Decryption

By default, decryption logs display entries for unsuccessful TLS handshakes. In addition, they can display entries for successful TLS handshakes, but the firewall administrator must first enable successful TLS handshake logging in a Decryption policy.
See the following for information related to supported log formats:
DECRYPTION Field
(Display Name)
Description
action.​value
(ACTION)
Identifies the action that the firewall took for the network traffic.
Syslog field name: Syslog Field Order
CEF field name: act
EMAIL field name: Action
HTTPS field name: Action
LEEF field name: Action
app
(APPLICATION)
Application associated with the network traffic.
Syslog field name: Syslog Field Order
CEF field name: app
EMAIL field name: Application
HTTPS field name: Application
LEEF field name: Application
app_category
(APPLICATION CATEGORY)
Identifies the high-level family of the application.
CEF field name: PanOSApplicationCategory
EMAIL field name: ApplicationCategory
HTTPS field name: ApplicationCategory
LEEF field name: ApplicationCategory
app_sub_category
(APPLICATION SUBCATEGORY)
Identifies the application's subcategory. The subcategory is related to the application's category, which is identified in category_of_app.
EMAIL field name: ApplicationSubcategory
HTTPS field name: ApplicationSubcategory
LEEF field name: ApplicationSubcategory
cert_flags
(CERTIFICATE FLAGS)
Internal use only bit field containing raw decryption information as generated at the firewall. The information in this bit field is reflected in other decryption log fields.
Syslog field name: Syslog Field Order
CEF field name: PanOSCertificateFlags
EMAIL field name: CertificateFlags
HTTPS field name: CertificateFlags
LEEF field name: CertificateFlags
cert_serial
(CERTIFICATE SERIAL)
The certificate's serial number.
Syslog field name: Syslog Field Order
CEF field name: PanOSCertificateSerial
EMAIL field name: CertificateSerial
HTTPS field name: CertificateSerial
LEEF field name: CertificateSerial
certificate_size
(CERTIFICATE SIZE)
The size of the certificate.
Syslog field name: Syslog Field Order
CEF field name: PanOSCertificateSize
EMAIL field name: CertificateSize
HTTPS field name: CertificateSize
LEEF field name: CertificateSize
certificate_version.​value
(CERTIFICATE VERSION)
The certificate's version number.
Syslog field name: Syslog Field Order
CEF field name: PanOSCertificateVersion
EMAIL field name: CertificateVersion
HTTPS field name: CertificateVersion
LEEF field name: CertificateVersion
chain_status.​value
(CHAIN STATUS)
The certificate chain verification status. Possible values are:
  • Uninspected.
  • Untrusted.
  • Trusted.
  • Incomplete.
Syslog field name: Syslog Field Order
CEF field name: PanOSChainStatus
EMAIL field name: ChainStatus
HTTPS field name: ChainStatus
LEEF field name: ChainStatus
characteristics_of_app
(APPLICATION CHARACTERISTICS)
Identifies the behaviorial characteristic of the application associated with the network traffic.
EMAIL field name: ApplicationCharacteristics
HTTPS field name: ApplicationCharacteristics
client_to_firewall.​value
(CLIENT TO FIREWALL)
The direction of the SSL/TLS connection is from the client to the firewall.
Syslog field name: Syslog Field Order
CEF field name: PanOSClientToFirewall
EMAIL field name: ClientToFirewall
HTTPS field name: ClientToFirewall
LEEF field name: ClientToFirewall
cn
(COMMON NAME)
The common name found on the certificate's domain name.
Syslog field name: Syslog Field Order
CEF field name: PanOSCommonName
EMAIL field name: CommonName
HTTPS field name: CommonName
LEEF field name: CommonName
cn_len
(COMMON NAME LENGTH)
The length of the common name found on the certificate's domain name before truncation (if any).
Syslog field name: Syslog Field Order
CEF field name: PanOSCommonNameLength
EMAIL field name: CommonNameLength
HTTPS field name: CommonNameLength
LEEF field name: CommonNameLength
config_version.​value
(CONFIG VERSION)
Version number of the firewall operating system that wrote this log record, in
major.minor
format.
Syslog field name: Syslog Field Order
CEF field name: PanOSConfigVersion
EMAIL field name: ConfigVersion
HTTPS field name: ConfigVersion
LEEF field name: ConfigVersion
container_id
(CONTAINER ID)
Unknown field. No information is available at this time.
Syslog field name: Syslog Field Order
CEF field name: PanOSContainerID
EMAIL field name: ContainerID
HTTPS field name: ContainerID
LEEF field name: ContainerID
container_of_app
(APPLICATION CONTAINER)
Identifies the managing application or parent of the application associated with this network traffic.
EMAIL field name: ApplicationContainer
HTTPS field name: ApplicationContainer
LEEF field name: ApplicationContainer
count_of_repeats
(COUNT OF REPEAT)
Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.
Syslog field name: Syslog Field Order
CEF field name: cnt
EMAIL field name: CountOfRepeat
HTTPS field name: CountOfRepeat
LEEF field name: CountOfRepeat
cpadding
(CPADDING)
For internal use only.
CEF field name: PanOSCpadding
EMAIL field name: Cpadding
HTTPS field name: Cpadding
LEEF field name: Cpadding
customer_id
(CORTEX DATA LAKE TENANT ID)
The ID that uniquely identifies the Cortex Data Lake instance which received this log record.
EMAIL field name: CortexDataLakeTenantID
HTTPS field name: CortexDataLakeTenantID
LEEF field name: CortexDataLakeTenantID
dest_device_category
(DESTINATION DEVICE CATEGORY)
Category of the device to which the session was directed.
Syslog field name: Syslog Field Order
EMAIL field name: DestinationDeviceCategory
HTTPS field name: DestinationDeviceCategory
LEEF field name: DestinationDeviceCategory
dest_device_class
(DESTINATION DEVICE CLASS)
Destination device class.
EMAIL field name: DestinationDeviceClass
HTTPS field name: DestinationDeviceClass
LEEF field name: DestinationDeviceClass
dest_device_host
(DESTINATION DEVICE HOST)
Hostname of the device to which the session was directed.
Syslog field name: Syslog Field Order
EMAIL field name: DestinationDeviceHost
HTTPS field name: DestinationDeviceHost
LEEF field name: DestinationDeviceHost
dest_device_mac
(DESTINATION DEVICE MAC)
MAC Address of the device to which the session was directed.
Syslog field name: Syslog Field Order
EMAIL field name: DestinationDeviceMac
HTTPS field name: DestinationDeviceMac
LEEF field name: DestinationDeviceMac
dest_device_model
(DESTINATION DEVICE MODEL)
Model of the device to which the session was directed.
Syslog field name: Syslog Field Order
EMAIL field name: DestinationDeviceModel
HTTPS field name: DestinationDeviceModel
LEEF field name: DestinationDeviceModel
dest_device_os
(DESTINATION DEVICE OS)
Destination device OS type.
CEF field name: PanOSDestinationDeviceOS
EMAIL field name: DestinationDeviceOS
HTTPS field name: DestinationDeviceOS
LEEF field name: DestinationDeviceOS
dest_device_osfamily
(DESTINATION DEVICE OS FAMILY)
OS family of the device to which the session was directed.
Syslog field name: Syslog Field Order
EMAIL field name: DestinationDeviceOSFamily
HTTPS field name: DestinationDeviceOSFamily
LEEF field name: DestinationDeviceOSFamily
dest_device_osversion
(DESTINATION DEVICE OS VERSION)
OS version of the device to which the session was directed.
Syslog field name: Syslog Field Order
EMAIL field name: DestinationDeviceOSVersion
HTTPS field name: DestinationDeviceOSVersion
dest_device_profile
(DESTINATION DEVICE PROFILE)
Profile of the device to which the session was directed.
Syslog field name: Syslog Field Order
EMAIL field name: DestinationDeviceProfile
HTTPS field name: DestinationDeviceProfile
LEEF field name: DestinationDeviceProfile
dest_device_vendor
(DESTINATION DEVICE VENDOR)
Vendor of the device to which the session was directed.
Syslog field name: Syslog Field Order
EMAIL field name: DestinationDeviceVendor
HTTPS field name: DestinationDeviceVendor
LEEF field name: DestinationDeviceVendor
dest_dynamic_address_group
(DESTINATION DYNAMIC ADDRESS GROUP)
The dynamic address group that Device-ID identifies as the destination for the traffic.
Syslog field name: Syslog Field Order
dest_edl
(DESTINATION EDL)
The name of the external dynamic list that contains the destination IP address of the traffic.
Syslog field name: Syslog Field Order
CEF field name: PanOSDestinationEDL
EMAIL field name: DestinationEDL
HTTPS field name: DestinationEDL
LEEF field name: DestinationEDL
dest_ip.​value
(DESTINATION ADDRESS)
Original destination IP address.
Syslog field name: Syslog Field Order
CEF fields: dst or c6a3
EMAIL field name: DestinationAddress
HTTPS field name: DestinationAddress
LEEF field name: dst
dest_location
(DESTINATION LOCATION)
Destination country or internal region for private addresses.
CEF field name: PanOSDestinationLocation
EMAIL field name: DestinationLocation
HTTPS field name: DestinationLocation
LEEF field name: DestinationLocation
dest_port
(DESTINATION PORT)
Network traffic's destination port. If this value is 0, then the app is using its standard port.
Syslog field name: Syslog Field Order
CEF field name: dpt
EMAIL field name: DestinationPort
HTTPS field name: DestinationPort
LEEF field name: dstPort
dest_user
(DESTINATION USER)
The username to which the network traffic was destined.
Syslog field name: Syslog Field Order
CEF field name: duser
EMAIL field name: DestinationUser
HTTPS field name: DestinationUser
LEEF field name: DestinationUser
dest_user_info.​domain
(DESTINATION USER DOMAIN)
Domain to which the Destination User belongs.
CEF field name: dntdom
EMAIL field name: DestinationUserDomain
HTTPS field name: DestinationUserDomain
LEEF field name: DestinationUserDomain
dest_user_info.​name
(DESTINATION USER NAME)
The Destination User. That is, the username to which the network traffic was destined.
CEF field name: duser
EMAIL field name: DestinationUserName
HTTPS field name: DestinationUserName
LEEF field name: DestinationUserName
dest_user_info.​uuid
(DESTINATION USER UUID)
Unique identifier assigned to the Destination User.
CEF field name: duid
EMAIL field name: DestinationUserUUID
HTTPS field name: DestinationUserUUID
LEEF field name: DestinationUserUUID
dest_uuid
(DESTINATION UUID)
Identifies the destination universal unique identifier for a guest virtual machine in the VMware NSX environment.
Syslog field name: Syslog Field Order
CEF field name: PanOSDestinationUUID
EMAIL field name: DestinationUUID
HTTPS field name: DestinationUUID
LEEF field name: DestinationUUID
dg_hier_level_1
(DG HIERARCHY LEVEL 1)
A sequence of identification numbers that indicate the device group’s location within a device group hierarchy.
CEF field name: PanOSDGHierarchyLevel1
EMAIL field name: DGHierarchyLevel1
HTTPS field name: DGHierarchyLevel1
LEEF field name: DGHierarchyLevel1
dg_hier_level_2
(DG HIERARCHY LEVEL 2)
A sequence of identification numbers that indicate the device group’s location within a device group hierarchy.
CEF field name: PanOSDGHierarchyLevel2
EMAIL field name: DGHierarchyLevel2
HTTPS field name: DGHierarchyLevel2
LEEF field name: DGHierarchyLevel2
dg_hier_level_3
(DG HIERARCHY LEVEL 3)
A sequence of identification numbers that indicate the device group’s location within a device group hierarchy.
CEF field name: PanOSDGHierarchyLevel3
EMAIL field name: DGHierarchyLevel3
HTTPS field name: DGHierarchyLevel3
LEEF field name: DGHierarchyLevel3
dg_hier_level_4
(DG HIERARCHY LEVEL 4)
A sequence of identification numbers that indicate the device group’s location within a device group hierarchy.
CEF field name: PanOSDGHierarchyLevel4
EMAIL field name: DGHierarchyLevel4
HTTPS field name: DGHierarchyLevel4
LEEF field name: DGHierarchyLevel4
domain
(DOMAIN)
The subject common name; that is, the name of the server that the certificate protects.
CEF field name: PanOSDomain
EMAIL field name: Domain
HTTPS field name: Domain
LEEF field name: Domain
elliptic_curve.​value
(ELLIPTIC CURVE)
The elliptic cryptography curve that the client and server negotiate and use for connections that use ECDHE cipher suites.
Syslog field name: Syslog Field Order
CEF field name: PanOSEllipticCurve
EMAIL field name: EllipticCurve
HTTPS field name: EllipticCurve
LEEF field name: EllipticCurve
error_index.​value
(ERROR INDEX)
The elliptic cryptography curve that the client and server negotiate and use for connections that use ECDHE cipher suites.
Syslog field name: Syslog Field Order
CEF field name: PanOSErrorIndex
EMAIL field name: ErrorIndex
HTTPS field name: ErrorIndex
LEEF field name: ErrorIndex
error_message
(ERROR MESSAGE)
The error message content.
Syslog field name: Syslog Field Order
CEF field name: PanOSErrorMessage
EMAIL field name: ErrorMessage
HTTPS field name: ErrorMessage
LEEF field name: ErrorMessage
fingerprint
(FINGERPRINT)
A hash of the certificate in x509 binary format.
Syslog field name: Syslog Field Order
CEF field name: PanOSFingerprint
EMAIL field name: Fingerprint
HTTPS field name: Fingerprint
LEEF field name: Fingerprint
firewall_to_client.​value
(FIREWALL TO CLIENT)
The direction of the SSL/TLS connection is from the firewall to the client.
Syslog field name: Syslog Field Order
CEF field name: PanOSFirewallToClient
EMAIL field name: FirewallToClient
HTTPS field name: FirewallToClient
LEEF field name: FirewallToClient
from_zone
(FROM ZONE)
The networking zone from which the traffic originated.
Syslog field name: Syslog Field Order
CEF field name: cs4
EMAIL field name: FromZone
HTTPS field name: FromZone
LEEF field name: FromZone
inbound_if.​value
(INBOUND INTERFACE)
Interface from which the network traffic was sourced.
Syslog field name: Syslog Field Order
CEF field name: deviceInboundInterface
EMAIL field name: InboundInterface
HTTPS field name: InboundInterface
LEEF field name: InboundInterface
inbound_if_details.​port
(INBOUND INTERFACE DETAILS PORT)
Hardware port or socket from which the network traffic was sourced.
EMAIL field name: InboundInterfaceDetailsPort
HTTPS field name: InboundInterfaceDetailsPort
inbound_if_details.​slot
(INBOUND INTERFACE DETAILS SLOT)
Interface slot from which the network traffic was sourced.
EMAIL field name: InboundInterfaceDetailsSlot
HTTPS field name: InboundInterfaceDetailsSlot
inbound_if_details.​type.​value
(INBOUND INTERFACE DETAILS TYPE)
The type of interface from which the network traffic was sourced.
EMAIL field name: InboundInterfaceDetailsType
HTTPS field name: InboundInterfaceDetailsType
inbound_if_details.​unit
(INBOUND INTERFACE DETAILS UNIT)
Internal use.
EMAIL field name: InboundInterfaceDetailsUnit
HTTPS field name: InboundInterfaceDetailsUnit
is_captive_portal
(CAPTIVE PORTAL)
Indicates if user information for the session was captured through Captive Portal.
CEF field name: PanOSCaptivePortal
EMAIL field name: CaptivePortal
HTTPS field name: CaptivePortal
LEEF field name: CaptivePortal
is_cert_ECDSA
(IS CERT ECDSA)
The certificate key exchange algorithm used for the session is ECDSA.
CEF field name: PanOSIsCertECDSA
EMAIL field name: IsCertECDSA
HTTPS field name: IsCertECDSA
LEEF field name: IsCertECDSA
is_cert_RSA
(IS CERT RSA)
The certificate key exchange algorithm used for the session is RSA.
CEF field name: PanOSIsCertRSA
EMAIL field name: IsCertRSA
HTTPS field name: IsCertRSA
LEEF field name: IsCertRSA
is_cert_cn_truncated
(IS CERT CN TRUNCATED)
Indicates whether the common name found on the certificate has been truncated due to buffer limits.
CEF field name: PanOSIsCertCNTruncated
EMAIL field name: IsCertCNTruncated
HTTPS field name: IsCertCNTruncated
LEEF field name: IsCertCNTruncated
is_client_to_server
(IS CLIENT TO SERVER)
Indicates if direction of traffic is from client to server.
CEF field name: PanOSIsClienttoServer
EMAIL field name: IsClienttoServer
HTTPS field name: IsClienttoServer
LEEF field name: IsClienttoServer
is_container
(IS CONTAINER)
Indicates if the session is a container page access (Container Page).
CEF field name: PanOSIsContainer
EMAIL field name: IsContainer
HTTPS field name: IsContainer
LEEF field name: IsContainer
is_decrypt_mirror
(IS DECRYPT MIRROR)
Indicates whether decrypted traffic was sent out in clear text through a mirror port.
CEF field name: PanOSIsDecryptMirror
EMAIL field name: IsDecryptMirror
HTTPS field name: IsDecryptMirror
LEEF field name: IsDecryptMirror
is_decrypted
(IS DECRYPTED)
Flag that indicates that the session is decrypted.
CEF field name: PanOSIsDecrypted
EMAIL field name: IsDecrypted
HTTPS field name: IsDecrypted
LEEF field name: IsDecrypted
is_dup_log
(IS DUPLICATE LOG)
Indicates whether this log data is available in multiple locations, such as from Cortex Data Lake as well as from an on-premise log collector.
CEF field name: PanOSIsDuplicateLog
EMAIL field name: IsDuplicateLog
HTTPS field name: IsDuplicateLog
LEEF field name: IsDuplicateLog
is_encrypted
(IS ENCRYPTED)
Flag that indicates that the session is encrypted.
CEF field name: PanOSIsEncrypted
EMAIL field name: IsEncrypted
HTTPS field name: IsEncrypted
LEEF field name: IsEncrypted
is_exported
(LOG EXPORTED)
Indicates if this log was exported from the firewall using the firewall's log export function.
CEF field name: PanOSLogExported
EMAIL field name: LogExported
HTTPS field name: LogExported
LEEF field name: LogExported
is_forwarded
(IS FORWARDED)
Internal-use field that indicates if the log is being forwarded.
CEF field name: PanOSIsForwarded
EMAIL field name: IsForwarded
HTTPS field name: IsForwarded
LEEF field name: IsForwarded
is_ipv6
(IS IPV6)
Indicates whether IPV6 was used for the session.
CEF field name: PanOSIsIPV6
EMAIL field name: IsIPV6
HTTPS field name: IsIPV6
LEEF field name: IsIPV6
is_issuer_cn_truncated
(IS ISSUER CN TRUNCATED)
Indicates whether the common name used by the certificate's issuer has been truncated due to buffer limits.
CEF field name: PanOSIsIssuerCNTruncated
EMAIL field name: IsIssuerCNTruncated
HTTPS field name: IsIssuerCNTruncated
LEEF field name: IsIssuerCNTruncated
is_mptcp_on
(IS MPTCP ON)
Indicates whether the option is enabled on the next-generation firewall that allows a client to use multiple paths to connect to a destination host.
CEF field name: PanOSIsMptcpOn
EMAIL field name: IsMptcpOn
HTTPS field name: IsMptcpOn
LEEF field name: IsMptcpOn
is_nat
(IS NAT)
Indicates if the firewall is performing network address translation (NAT) for the logged traffic.
CEF field name: PanOSIsNAT
EMAIL field name: IsNAT
HTTPS field name: IsNAT
LEEF field name: IsNAT
is_non_std_dest_port
(IS NON STANDARD DESTINATION PORT)
Indicates if the destination port is non-standard.
is_packet_capture
(PACKET CAPTURE)
Indicates whether the session has a packet capture (PCAP).
CEF field name: PanOSPacketCapture
EMAIL field name: PacketCapture
HTTPS field name: PacketCapture
LEEF field name: PacketCapture
is_phishing
(IS PHISHING)
Indicates whether enterprise credentials were submitted by an end user.
CEF field name: PanOSIsPhishing
EMAIL field name: IsPhishing
HTTPS field name: IsPhishing
LEEF field name: IsPhishing
is_prisma_branch
(IS PRISMA NETWORK)
Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.
CEF field name: PanOSIsPrismaNetwork
EMAIL field name: IsPrismaNetwork
HTTPS field name: IsPrismaNetwork
LEEF field name: IsPrismaNetwork
is_prisma_mobile
(IS PRISMA USERS)
Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise.
CEF field name: PanOSIsPrismaUsers
EMAIL field name: IsPrismaUsers
HTTPS field name: IsPrismaUsers
LEEF field name: IsPrismaUsers
is_proxy
(IS PROXY)
Indicates whether the SSL session is decrypted (SSL Proxy).
CEF field name: PanOSIsProxy
EMAIL field name: IsProxy
HTTPS field name: IsProxy
LEEF field name: IsProxy
is_recon_excluded
(IS RECON EXCLUDED)
Indicates whether source for the flow is on the firewall allow list and not subject to recon protection.
CEF field name: PanOSIsReconExcluded
EMAIL field name: IsReconExcluded
HTTPS field name: IsReconExcluded
LEEF field name: IsReconExcluded
is_resume_session
(IS RESUME SESSION)
Indicates that the decryption session was previously interrupted and is now resuming.
CEF field name: PanOSIsResumeSession
EMAIL field name: IsResumeSession
HTTPS field name: IsResumeSession
LEEF field name: IsResumeSession
is_root_cn_truncated
(IS ROOT CN TRUNCATED)
Indicates whether the common name used for the root CA has been truncated due to buffer limits.
CEF field name: PanOSIsRootCNTruncated
EMAIL field name: IsRootCNTruncated
HTTPS field name: IsRootCNTruncated
LEEF field name: IsRootCNTruncated
is_saas_app
(IS SAAS APPLICATION)
Internal use field. Indicates whether the application associated with this network traffic is a SAAS application.
CEF field name: PanOSIsSaaSApplication
EMAIL field name: IsSaaSApplication
HTTPS field name: IsSaaSApplication
LEEF field name: IsSaaSApplication
is_server_to_client
(IS SERVER TO CLIENT)
Indicates if direction of traffic is from server to client.
CEF field name: PanOSIsServertoClient
EMAIL field name: IsServertoClient
HTTPS field name: IsServertoClient
LEEF field name: IsServertoClient
is_sni_truncated
(IS SNI TRUNCATED)
Indicates whether the server name indication (SNI), which is the hostname of the server that the client is trying to reach, has been truncated due to buffer limits.
CEF field name: PanOSIsSNITruncated
EMAIL field name: IsSNITruncated
HTTPS field name: IsSNITruncated
LEEF field name: IsSNITruncated
is_source_x_fwded
(IS SOURCE X FORWARDED)
Indicates whether the X-Forwarded-For value from a proxy is in the source user field.
CEF field name: PanOSIsSourceXForwarded
EMAIL field name: IsSourceXForwarded
HTTPS field name: IsSourceXForwarded
LEEF field name: IsSourceXForwarded
is_sym_return
(IS SYSTEM RETURN)
Indicates whether symmetric return was used to forward traffic for this session.
CEF field name: PanOSIsSystemReturn
EMAIL field name: IsSystemReturn
HTTPS field name: IsSystemReturn
LEEF field name: IsSystemReturn
is_transaction
(IS TRANSACTION)
Indicates whether the log corresponds to a transaction within an HTTP proxy session (Proxy Transaction).
CEF field name: PanOSIsTransaction
EMAIL field name: IsTransaction
HTTPS field name: IsTransaction
LEEF field name: IsTransaction
is_tunnel_inspected
(IS TUNNEL INSPECTED)
Indicates whether the payload for the outer tunnel was inspected.
CEF field name: PanOSIsTunnelInspected
EMAIL field name: IsTunnelInspected
HTTPS field name: IsTunnelInspected
LEEF field name: IsTunnelInspected
is_url_denied
(IS URL DENIED)
Indicates whether the session was denied due to a URL filtering rule.
CEF field name: PanOSIsURLDenied
EMAIL field name: IsURLDenied
HTTPS field name: IsURLDenied
LEEF field name: IsURLDenied
issuer_cn
(ISSUER COMMON NAME)
The name of the organization that verified the certificate’s contents.
Syslog field name: Syslog Field Order
CEF field name: PanOSIssuerCommonName
EMAIL field name: IssuerCommonName
HTTPS field name: IssuerCommonName
LEEF field name: IssuerCommonName
issuer_len
(ISSUER NAME LENGTH)
The length of the issuer's common name before truncation (if any).
Syslog field name: Syslog Field Order
CEF field name: PanOSIssuerNameLength
EMAIL field name: IssuerNameLength
HTTPS field name: IssuerNameLength
LEEF field name: IssuerNameLength
log_set
(LOG SETTING)
Log forwarding profile name that was applied to the session. This name was defined by the firewall's administrator.
Syslog field name: Syslog Field Order
CEF field name: cs6
EMAIL field name: LogSetting
HTTPS field name: LogSetting
LEEF field name: LogSetting
log_source
(LOG SOURCE)
Identifies the origin of the data. That is, the system that produced the data.
CEF field name: PanOSLogSource
EMAIL field name: LogSource
HTTPS field name: LogSource
LEEF field name: LogSource
log_source_id
(DEVICE SN)
ID that uniquely identifies the source of the log. That is, the serial number of the firewall that generated the log.
Syslog field name: Syslog Field Order
CEF field name: PanOSDeviceSN
EMAIL field name: DeviceSN
HTTPS field name: DeviceSN
LEEF field name: DeviceSN
log_source_name
(DEVICE NAME)
Name of the source of the log. That is, the hostname of the firewall that logged the network traffic.
CEF field name: PanOSDeviceName
EMAIL field name: DeviceName
HTTPS field name: DeviceName
LEEF field name: DeviceName
log_source_tz_offset
(LOG SOURCE TIMEZONE OFFSET)
Time Zone offset from GMT of the source of the log.
EMAIL field name: LogSourceTimeZoneOffset
HTTPS field name: LogSourceTimeZoneOffset
LEEF field name: LogSourceTimeZoneOffset
log_time
(TIME RECEIVED)
Time the log was received in Cortex Data Lake. This string contains a timestamp value that is the number of microseconds since the Unix epoch.
Syslog field name: Syslog Field Order
CEF field name: rt
EMAIL field name: TimeReceived
HTTPS field name: TimeReceived
LEEF field name: TimeReceived
log_type.​value
(LOG TYPE)
Identifies the log type.
Syslog field name: Syslog Field Order
CEF field name: Device Event Class ID
EMAIL field name: LogType
HTTPS field name: LogType
LEEF field name: cat
nat_dest.​value
(NAT DESTINATION)
If destination NAT was performed, the post-NAT destination IP address.
Syslog field name: Syslog Field Order
EMAIL field name: NATDestination
HTTPS field name: NATDestination
LEEF field name: dstPostNAT
nat_dest_port
(NAT DESTINATION PORT)
Post-NAT destination port.
Syslog field name: Syslog Field Order
EMAIL field name: NATDestinationPort
HTTPS field name: NATDestinationPort
LEEF field name: dstPostNATPort
nat_source.​value
(NAT SOURCE)
If source NAT was performed, the post-NAT source IP address.
Syslog field name: Syslog Field Order
CEF field name: sourceTranslatedAddress
EMAIL field name: NATSource
HTTPS field name: NATSource
LEEF field name: srcPostNAT
nat_source_port
(NAT SOURCE PORT)
Post-NAT source port.
Syslog field name: Syslog Field Order
CEF field name: sourceTranslatedPort
EMAIL field name: NATSourcePort
HTTPS field name: NATSourcePort
LEEF field name: srcPostNATPort
not_after
(TIME NOT AFTER)
Timestamp date after which the certificate is no longer valid.
Syslog field name: Syslog Field Order
CEF field name: PanOSTimeNotAfter
EMAIL field name: TimeNotAfter
HTTPS field name: TimeNotAfter
LEEF field name: TimeNotAfter
not_before
(TIME NOT BEFORE)
Timestamp date before which the certificate is not yet valid.
Syslog field name: Syslog Field Order
CEF field name: PanOSTimeNotBefore
EMAIL field name: TimeNotBefore
HTTPS field name: TimeNotBefore
LEEF field name: TimeNotBefore
outbound_if.​value
(OUTBOUND INTERFACE)
Interface to which the network traffic was destined.
Syslog field name: Syslog Field Order
CEF field name: deviceOutboundInterface
EMAIL field name: OutboundInterface
HTTPS field name: OutboundInterface
LEEF field name: OutboundInterface
outbound_if_details.​port
(OUTBOUND INTERFACE DETAILS PORT)
Hardware port or socket to which the network traffic was sent.
outbound_if_details.​slot
(OUTBOUND INTERFACE DETAILS SLOT)
Interface slot to which the network traffic was sent.
outbound_if_details.​type.​value
(OUTBOUND INTERFACE DETAILS TYPE)
The type of interface to which the network traffic was sent.
outbound_if_details.​unit
(OUTBOUND INTERFACE DETAILS UNIT)
Internal use.
padding
(PADDING)
For internal use only.
CEF field name: PanOSPadding
EMAIL field name: Padding
HTTPS field name: Padding
LEEF field name: Padding
padding3
(PADDING3)
For internal use only.
CEF field name: PanOSPadding3
EMAIL field name: Padding3
HTTPS field name: Padding3
LEEF field name: Padding3
pod_name
(CONTAINER NAME)
Container name.
Syslog field name: Syslog Field Order
CEF field name: PanOSContainerName
EMAIL field name: ContainerName
HTTPS field name: ContainerName
LEEF field name: ContainerName
pod_namespace
(CONTAINER NAME SPACE)
Container namespace.
Syslog field name: Syslog Field Order
CEF field name: PanOSContainerNameSpace
EMAIL field name: ContainerNameSpace
HTTPS field name: ContainerNameSpace
LEEF field name: ContainerNameSpace
policy_name
(POLICY NAME)
The name of the Decryption policy associated with the session.
Syslog field name: Syslog Field Order
CEF field name: PanOSPolicyName
EMAIL field name: PolicyName
HTTPS field name: PolicyName
LEEF field name: PolicyName
protocol.​value
(PROTOCOL)
IP protocol associated with the session.
Syslog field name: Syslog Field Order
CEF field name: proto
EMAIL field name: Protocol
HTTPS field name: Protocol
LEEF field name: proto
proxy_type.​value
(PROXY TYPE)
The Decryption proxy type, such as Forward for Forward Proxy, Inbound for Inbound Inspection, No Decrypt for undecrypted traffic, Decryption Broker, GlobalProtect, and so forth.
Syslog field name: Syslog Field Order
CEF field name: PanOSProxyType
EMAIL field name: ProxyType
HTTPS field name: ProxyType
LEEF field name: EventID
risk_of_app
(APPLICATION RISK)
Indicates how risky the application is from a network security perspective.
CEF field name: PanOSApplicationRisk
EMAIL field name: ApplicationRisk
HTTPS field name: ApplicationRisk
LEEF field name: ApplicationRisk
root_cn
(ROOT COMMON NAME)
The name of the root certificate authority.
Syslog field name: Syslog Field Order
CEF field name: PanOSRootCommonName
EMAIL field name: RootCommonName
HTTPS field name: RootCommonName
LEEF field name: RootCommonName
root_cn_len
(ROOT CN LENGTH)
The length of the root CA's common name before truncation (if any).
Syslog field name: Syslog Field Order
CEF field name: PanOSRootCNLength
EMAIL field name: RootCNLength
HTTPS field name: RootCNLength
LEEF field name: RootCNLength
root_status.​value
(ROOT STATUS)
The status of the root certificate, for example, trusted, untrusted, or uninspected.
Syslog field name: Syslog Field Order
CEF field name: PanOSRootStatus
EMAIL field name: RootStatus
HTTPS field name: RootStatus
LEEF field name: RootStatus
rule_matched
(RULE)
Name of the security policy rule that the network traffic matched.
Syslog field name: Syslog Field Order
CEF field name: cs1
EMAIL field name: Rule
HTTPS field name: Rule
LEEF field name: Rule
rule_matched_uuid
(RULE UUID)
Unique identifier for the security policy rule that the network traffic matched.
Syslog field name: Syslog Field Order
CEF field name: PanOSRuleUUID
EMAIL field name: RuleUUID
HTTPS field name: RuleUUID
LEEF field name: RuleUUID
sanctioned_state_of_app
(SANCTIONED STATE OF APP)
Indicates whether the application has been flagged as sanctioned by the firewall administrator.
EMAIL field name: SanctionedStateOfApp
HTTPS field name: SanctionedStateOfApp
LEEF field name: SanctionedStateOfApp
sequence_no
(SEQUENCE NO)
The log entry identifier, which is incremented sequentially. Each log type has a unique number space.
Syslog field name: Syslog Field Order
CEF field name: externalId
EMAIL field name: SequenceNo
HTTPS field name: SequenceNo
LEEF field name: SequenceNo
session_id
(SESSION ID)
Identifies the firewall's internal identifier for a specific network session.
Syslog field name: Syslog Field Order
CEF field name: cn1
EMAIL field name: SessionID
HTTPS field name: SessionID
LEEF field name: SessionID
sni
(SERVER NAME INDICATION)
The hostname of the server that the client is trying to contact.
Syslog field name: Syslog Field Order
EMAIL field name: ServerNameIndication
HTTPS field name: ServerNameIndication
LEEF field name: ServerNameIndication
sni_len
(SNI LENGTH)
The length of the server name indication (SNI), which is the hostname of the server that the client is trying to reach. This is the full length of the SNI before any truncation might have occurred.
Syslog field name: Syslog Field Order
CEF field name: PanOSSNILength
EMAIL field name: SNILength
HTTPS field name: SNILength
LEEF field name: SNILength
source_device_category
(SOURCE DEVICE CATEGORY)
Category of the device from which the session originated.
Syslog field name: Syslog Field Order
EMAIL field name: SourceDeviceCategory
HTTPS field name: SourceDeviceCategory
LEEF field name: SourceDeviceCategory
source_device_class
(SOURCE DEVICE CLASS)
Source device class.
CEF field name: PanOSSourceDeviceClass
EMAIL field name: SourceDeviceClass
HTTPS field name: SourceDeviceClass
LEEF field name: SourceDeviceClass
source_device_host
(SOURCE DEVICE HOST)
Hostname of the device from which the session originated.
Syslog field name: Syslog Field Order
CEF field name: PanOSSourceDeviceHost
EMAIL field name: SourceDeviceHost
HTTPS field name: SourceDeviceHost
LEEF field name: SourceDeviceHost
source_device_mac
(SOURCE DEVICE MAC)
MAC Address of the device from which the session originated.
Syslog field name: Syslog Field Order
CEF field name: PanOSSourceDeviceMac
EMAIL field name: SourceDeviceMac
HTTPS field name: SourceDeviceMac
LEEF field name: SourceDeviceMac
source_device_model
(SOURCE DEVICE MODEL)
Model of the device from which the session originated.
Syslog field name: Syslog Field Order
CEF field name: PanOSSourceDeviceModel
EMAIL field name: SourceDeviceModel
HTTPS field name: SourceDeviceModel
LEEF field name: SourceDeviceModel
source_device_os
(SOURCE DEVICE OS)
Source device OS type.
CEF field name: PanOSSourceDeviceOS
EMAIL field name: SourceDeviceOS
HTTPS field name: SourceDeviceOS
LEEF field name: SourceDeviceOS
source_device_osfamily
(SOURCE DEVICE OS FAMILY)
OS family of the device from which the session originated.
Syslog field name: Syslog Field Order
EMAIL field name: SourceDeviceOSFamily
HTTPS field name: SourceDeviceOSFamily
LEEF field name: SourceDeviceOSFamily
source_device_osversion
(SOURCE DEVICE OS VERSION)
OS version of the device from which the session originated.
Syslog field name: Syslog Field Order
EMAIL field name: SourceDeviceOSVersion
HTTPS field name: SourceDeviceOSVersion
LEEF field name: SourceDeviceOSVersion
source_device_profile
(SOURCE DEVICE PROFILE)
Profile of the device from which the session originated.
Syslog field name: Syslog Field Order
CEF field name: PanOSSourceDeviceProfile
EMAIL field name: SourceDeviceProfile
HTTPS field name: SourceDeviceProfile
LEEF field name: SourceDeviceProfile
source_device_vendor
(SOURCE DEVICE VENDOR)
Vendor of the device from which the session originated.
Syslog field name: Syslog Field Order
CEF field name: PanOSSourceDeviceVendor
EMAIL field name: SourceDeviceVendor
HTTPS field name: SourceDeviceVendor
LEEF field name: SourceDeviceVendor
source_dynamic_address_group
(SOURCE DYNAMIC ADDRESS GROUP)
The dynamic address group that Device-ID identifies as the source of the traffic.
Syslog field name: Syslog Field Order
EMAIL field name: SourceDynamicAddressGroup
HTTPS field name: SourceDynamicAddressGroup
LEEF field name: SourceDynamicAddressGroup
source_edl
(SOURCE EDL)
The name of the external dynamic list that contains the source IP address of the traffic.
Syslog field name: Syslog Field Order
CEF field name: PanOSSourceEDL
EMAIL field name: SourceEDL
HTTPS field name: SourceEDL
LEEF field name: SourceEDL
source_ip.​value
(SOURCE ADDRESS)
Original source IP address.
Syslog field name: Syslog Field Order
CEF fields: src or c6a2
EMAIL field name: SourceAddress
HTTPS field name: SourceAddress
LEEF field name: src
source_location
(SOURCE LOCATION)
Source country or internal region for private addresses.
CEF field name: PanOSSourceLocation
EMAIL field name: SourceLocation
HTTPS field name: SourceLocation
LEEF field name: SourceLocation
source_port
(SOURCE PORT)
Source port utilized by the session.
Syslog field name: Syslog Field Order
CEF field name: spt
EMAIL field name: SourcePort
HTTPS field name: SourcePort
LEEF field name: srcPort
source_user
(SOURCE USER)
The username that initiated the network traffic.
Syslog field name: Syslog Field Order
CEF field name: suser
EMAIL field name: SourceUser
HTTPS field name: SourceUser
LEEF field name: usrName
source_user_info.​domain
(SOURCE USER DOMAIN)
Domain to which the Source User belongs.
CEF field name: sntdom
EMAIL field name: SourceUserDomain
HTTPS field name: SourceUserDomain
LEEF field name: SourceUserDomain
source_user_info.​name
(SOURCE USER NAME)
The Source User. That is, the username that initiated the network traffic.
CEF field name: suser
EMAIL field name: SourceUserName
HTTPS field name: SourceUserName
LEEF field name: SourceUserName
source_user_info.​uuid
(SOURCE USER UUID)
Unique identifier assigned to the Source User.
CEF field name: suid
EMAIL field name: SourceUserUUID
HTTPS field name: SourceUserUUID
LEEF field name: SourceUserUUID
source_uuid
(SOURCE UUID)
Identifies the source universal unique identifier for a guest virtual machine in the VMware NSX environment.
Syslog field name: Syslog Field Order
CEF field name: PanOSSourceUUID
EMAIL field name: SourceUUID
HTTPS field name: SourceUUID
LEEF field name: SourceUUID
sub_type.​value
(SUB TYPE)
Identifies the log subtype.
Syslog field name: Syslog Field Order
CEF field name: Name
EMAIL field name: SubType
HTTPS field name: SubType
LEEF field name: SubType
technology_of_app
(APPLICATION TECHNOLOGY)
The networking technology used by the identified application.
EMAIL field name: ApplicationTechnology
HTTPS field name: ApplicationTechnology
LEEF field name: ApplicationTechnology
time_generated
(TIME GENERATED)
Time when the log was generated on the firewall's data plane. This string contains a timestamp value that is the number of microseconds since the Unix epoch.
Syslog field name: Syslog Field Order
CEF field name: start
EMAIL field name: TimeGenerated
HTTPS field name: TimeGenerated
LEEF field name: devTime
time_generated_high_res
(TIME GENERATED HIGH RESOLUTION)
Time the log was generated in data plane with millisec granularity in format YYYY-MM-DDTHH:MM:SS[.DDDDDD]Z.
Syslog field name: Syslog Field Order
EMAIL field name: TimeGeneratedHighResolution
HTTPS field name: TimeGeneratedHighResolution
time_received_mp
(TIME RECEIVED MANAGEMENT PLANE)
Time the log was received in the management plane in format YYYY-MM-DDTHH:MM:SS[.DDDDDD]Z.
Syslog field name: Syslog Field Order
EMAIL field name: TimeReceivedManagementPlane
HTTPS field name: TimeReceivedManagementPlane
tls_auth.​value
(TLS AUTH)
TLS hash algorithm.
Syslog field name: Syslog Field Order
CEF field name: PanOSTLSAuth
EMAIL field name: TLSAuth
HTTPS field name: TLSAuth
LEEF field name: TLSAuth
tls_enc_algorithm.​value
(TLS ENCRYPTION ALGORITHM)
The algorithm used to encrypt the session data, such as AES-128-CBC, AES-256-GCM, and so forth.
Syslog field name: Syslog Field Order
EMAIL field name: TLSEncryptionAlgorithm
HTTPS field name: TLSEncryptionAlgorithm
LEEF field name: TLSEncryptionAlgorithm
tls_keyxchange.​value
(TLS KEY EXCHANGE)
Algorithm used to perform the key exchange. Possible values are:
  • RSA
  • DHE
  • ECDHE
  • TLS1.3
Syslog field name: Syslog Field Order
CEF field name: PanOSTLSKeyExchange
EMAIL field name: TLSKeyExchange
HTTPS field name: TLSKeyExchange
LEEF field name: TLSKeyExchange
tls_version.​value
(TLS VERSION)
Version of TLS used for the encrypted session represented as major.minor.patch.build.
Syslog field name: Syslog Field Order
CEF field name: PanOSTLSVersion
EMAIL field name: TLSVersion
HTTPS field name: TLSVersion
LEEF field name: TLSVersion
to_zone
(TO ZONE)
Networking zone to which the traffic was sent.
Syslog field name: Syslog Field Order
CEF field name: cs5
EMAIL field name: ToZone
HTTPS field name: ToZone
LEEF field name: ToZone
tpadding
(TPADDING)
For internal use only.
CEF field name: PanOSTpadding
EMAIL field name: Tpadding
HTTPS field name: Tpadding
LEEF field name: Tpadding
tunnel.​value
(TUNNEL)
Type of tunnel.
Syslog field name: Syslog Field Order
CEF field name: PanOSTunnel
EMAIL field name: Tunnel
HTTPS field name: Tunnel
LEEF field name: Tunnel
tunneled_app
(TUNNELED APPLICATION)
For internal use only.
CEF field name: PanOSTunneledApplication
EMAIL field name: TunneledApplication
HTTPS field name: TunneledApplication
LEEF field name: TunneledApplication
vendor_name
(VENDOR NAME)
Identifies the vendor that produced the data.
CEF field name: Device Vendor
EMAIL field name: VendorName
HTTPS field name: VendorName
LEEF field name: Vendor
vpadding
(VPADDING)
For internal use only.
CEF field name: PanOSVpadding
EMAIL field name: Vpadding
HTTPS field name: Vpadding
LEEF field name: Vpadding
vsys
(VIRTUAL LOCATION)
String representation of the unique identifier for a virtual system on a Palo Alto Networks firewall.
Syslog field name: Syslog Field Order
CEF field name: cs3
EMAIL field name: VirtualLocation
HTTPS field name: VirtualLocation
LEEF field name: VirtualLocation
vsys_id
(VIRTUAL SYSTEM ID)
A unique identifier for a virtual system on a Palo Alto Networks firewall.
CEF field name: PanOSVirtualSystemID
EMAIL field name: VirtualSystemID
HTTPS field name: VirtualSystemID
LEEF field name: VirtualSystemID
vsys_name
(VIRTUAL SYSTEM NAME)
The name of the virtual system associated with the network traffic.
CEF field name: PanOSVirtualSystemName
EMAIL field name: VirtualSystemName
HTTPS field name: VirtualSystemName
LEEF field name: VirtualSystemName

Recommended For You