HIP Match Log Fields
Format:
FUTURE_USE, Receive Time, Serial Number,
Type, Threat/Content Type, FUTURE_USE, Generated Time, Source User,
Virtual System, Machine name, OS, Source Address, HIP, Repeat Count,
HIP Type, FUTURE_USE, FUTURE_USE, Sequence Number, Action Flags,
Device Group Hierarchy Level 1, Device Group Hierarchy
Level 2, Device Group Hierarchy Level 3, Device Group Hierarchy
Level 4, Virtual System Name, Device Name, Virtual System
ID, IPv6 Source Address, Host IDField Name | Description |
|---|---|
Receive Time (receive_time or cef-formatted-receive_time) | Time the log was received at the management
plane. |
Serial Number (serial) | Serial number of the firewall that generated
the log. |
Type (type) | Type of log; values are traffic, threat,
config, system and hip-match. |
Threat/Content Type (subtype) | Subtype of HIP match log; unused. |
Generated Time (time_generated or cef-formatted-time_generated) | Time the log was generated on the dataplane. |
Source User (srcuser) | Username of the user who initiated the session. |
Virtual System (vsys) | Virtual System associated with the HIP match
log. |
Machine Name (machinename) | Name of the user’s machine. |
OS (os) | The operating system installed on the user’s
machine or device (or on the client system). |
Source Address (src) | IP address of the source user. |
HIP (matchname) | Name of the HIP object or profile. |
Repeat Count (repeatcnt) | Number of times the HIP profile matched. |
HIP Type (matchtype) | Whether the hip field represents a HIP object
or a HIP profile. |
Sequence Number (seqno) | A 64-bit log entry identifier incremented
sequentially; each log type has a unique number space. |
Action Flags (actionflags) | A bit field indicating if the log was forwarded
to Panorama. |
Device Group Hierarchy (dg_hier_level_1
to dg_hier_level_4) | A sequence of identification numbers that
indicate the device group’s location within a device group hierarchy.
The firewall (or virtual system) generating the log includes the
identification number of each ancestor in its device group hierarchy.
The shared device group (level 0) is not included in this structure. If
the log values are 12, 34, 45, 0, it means that the log was generated
by a firewall (or virtual system) that belongs to device group 45,
and its ancestors are 34, and 12. To view the device group names
that correspond to the value 12, 34 or 45, use one of the following
methods: CLI command in configure mode: show readonlydg-meta-data API query:
|
Virtual System Name (vsys_name) | The name of the virtual system associated
with the session; only valid on firewalls enabled for multiple virtual
systems. |
Device Name (device_name) | The hostname of the firewall on which the
session was logged. |
Virtual System ID (vsys_id) | A unique identifier for a virtual system
on a Palo Alto Networks firewall. |
IPv6 System Address (srcipv6) | IPv6 address of the user’s
machine or device. |
Host ID (hostid) | Unique ID GlobalProtect assigns to identify
the host. |