End-of-Life (EoL)

Correlated Events Log Fields

Format:
FUTURE_USE, Receive Time, Serial Number, Type, Threat/Content Type, FUTURE_USE, Generated Time, Source Address, Source User, Virtual System, Category, Severity, Group Hierarchy Level 1, Device Group Hierarchy Level 2, Device Group Hierarchy Level 3, Device Group Hierarchy Level 4, Virtual System Name, Device Name, Virtual System ID, Object Name, Object ID, Evidence
Field Name
Description
Receive Time
Time the log was received at the management plane.
Serial Number (Serial #)
Serial number of the device that generated the log.
Type
Specifies the type of log; value is CORRELATION.
Threat/Content Type
Subtype of the system log; refers to the system daemon generating the log; values are crypto, dhcp, dnsproxy, dos, general, global-protect, ha, hw, nat, ntpd, pbf, port, pppoe, ras, routing, satd, sslmgr, sslvpn, userid, url-filtering, vpn.
Generated Time (Generate Time)
Time the log was generated on the dataplane.
Source Address
IP address of the user who initiated the event.
Source User
Username of the user who initiated the event.
Virtual System
Virtual System associated with the configuration log.
Category
For URL Subtype, it is the URL Category; For WildFire subtype, it is the verdict on the file and is either ‘malicious’, ‘grayware’, or ‘benign’; For other subtypes, the value is ‘any’.
Severity
Severity associated with the event; values are informational, low, medium, high, critical.
Device Group Hierarchy (dg_hier_level_1 to dg_hier_level_4)
A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. The firewall (or virtual system) generating the log includes the identification number of each ancestor in its device group hierarchy. The shared device group (level 0) is not included in this structure.
If the log values are 12, 34, 45, 0, it means that the log was generated by a firewall (or virtual system) that belongs to device group 45, and its ancestors are 34, and 12. To view the device group names that correspond to the value 12, 34 or 45, use one of the following methods:
API query:
/api/?type=op&cmd=<show><dg-hierarchy></dg-hierarchy></show>
Virtual System Name
The name of the virtual system associated with the sessions; only valid on firewalls enabled with multiple virtual systems.
Device Name
The hostname of the firewall on which the session was logged.
Virtual System ID
A unique identifier for a virtual system on a Palo Alto Networks firewall.
Object Name
Name of the correlation object that was matched on.
Object ID
Name of the object associated with the system event.
Evidence
A summary statement that indicates how many times the host has matched against the conditions defined in the correlation object. For example, Host visited known malware URl (19 times).

Recommended For You