>
    Syslog Integration on Data Security
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. Syslog and API Client Integration on Data Security
    4. Syslog Integration on Data Security
    Download PDF
    SaaS Security

    Syslog Integration on Data Security

    Table of Contents

    Syslog Integration on Data Security

    Configure syslog monitoring on Data Security and discover the supported log types and fields available.
    Where Can I Use This?What Do I Need?
    • Strata Cloud Manager
    • Data Security license
    Or any of the following licenses that include the Data Security license:
    • CASB-X
    • CASB-PA
    Syslog is a standard log transport mechanism that enables the aggregation of log data from different sources into a central repository for archiving. Data Security can forward every type of log it generates to an external syslog server. This syslog feature requires TLS 1.0 (and above) communications protocol for connections between Data Security and the external syslog server. This topic describes how to configure syslog monitoring and includes a description of supported log types and log fields (LF).
    LF denotes Log Fields.

    Syslog Field Descriptions

    Learn about the different log fields available for each log type on Data Security.
    The following topics list the standard fields of each log type Data Security can forward to an external server, as well as the security levels, custom formats, and escape sequences. To help parsing, the delimiter is a comma and each field is a comma-separated value (CSV) string.
    • Incidents Log Fields
    • Remediation Activity Log Fields
    • Policy Violation Log Fields
    • Activity Monitoring Log Fields
    • Admin Audit Log Fields
    • Behavior Threats Log Fields

    Incidents Log Fields

    The descriptions and names of available log fields in a Data Security incident log.
    The incident log is generated when an incident is detected. The log includes the following fields, which are available for ingestion by your Security information and event management (SIEM) system.
    Fields are listed in the order that they are needed for push mode.
    Field Name
    Description
    timestamp
    Time the incident was discovered in YYYY-MM-DD HH:MM:SS format with Augmented Backus-Naur Form (ABNF) to indicate the timezone.
    serial
    Serial number of the organization using the service (tenant).
    log_type
    Type of log. In this case, incident.
    cloud_app_instance
    Instance name of the cloud application (not the type of cloud application).
    severity
    Severity of the incident valued between 0 and 5.
    incident_id
    Unique ID number for the policy rule that created the incident.
    asset_id
    Unique ID number for the asset associated with the incident.
    item_name
    Name of the file, folder, email subject, or user associated with the incident.
    item_type
    Values are File, Folder, or User
    item_owner
    User who owns the asset identified in the incident.
    container_name
    Value of bucketname for AWS S3, Google Cloud Platform, and Microsoft Azure assets. The value is null for the remaining apps.
    item_creator
    User who created the asset identified in the incident.
    policy_rule_name
    Names of one or more policy rules (not policy type) that were matched.
    exposure
    The type of exposure associated with the incident. Values are Public, External, Company, or Internal.
    occurrences_by_rule
    Value is null.
    future_use
    Not currently implemented
    future_use2
    Not currently implemented
    additional_notes
    Any notes added by the administrator (first 20 bytes).
    collaborators
    Any external or internal collaborators with access to view, edit, or download an asset.
    datetime_edited
    Last time the asset associated with the incident was updated on the cloud app.
    incident_category
    Category of the incident. For example, Personal or Business Justified.
    incident_owner
    Administrator assigned to the incident.
    item_creator_email
    Email address of the item creator.
    item_owner_email
    Email address of the item owner or sender of email.
    item_cloud_url
    File URL associated with the incident and used to download or view the asset.
    item_owner_group
    AD groups to which the asset owner belongs.
    item_sha256
    sha256 hash as reported by WildFire cloud service.
    item_size
    Size of the file as reported by WildFire cloud service .
    item_verdict
    Verdict as reported by WildFire cloud service: either malware, benign, or not available.
    asset_create_time
    Time the asset associated with the incident was created on the cloud app or initially uploaded from local drive to the cloud app.

    Remediation Activity Log Fields

    The descriptions and names of available log fields in a Data Security remediation log.
    A remediation log is generated when an incident is manually remediated or if automatic remediation has been applied. The log includes the following fields, which are available for ingestion by your Security information and event management (SIEM) system.
    Fields are listed in the order that they are needed for push mode.
    Field Name
    Description
    timestamp
    Time the remediation action occurred. Values are in YYYY-MM-DD HH:MM:SS format.
    serial
    Serial number of the organization using the service (tenant).
    log_type
    Type of log. In this case, remediation.
    cloud_app_instance
    Instance name of the cloud application (not the type of cloud application) associated with the remediation of the incident.
    severity
    Policy violation or incident severity valued between 0 and 5.
    incident_id
    Unique ID number for the incident. Can be null (no value).
    asset_id
    Unique ID number for the asset associated with the remediation of the incident.
    item_name
    Name of the file, folder, or user associated with the remediation of the incident.
    item_type
    Values are File, Folder, or User.
    item_owner
    User who owns the asset associated with the remediation.
    container_name
    Value is the bucketname for AWS S3, Google Cloud Platform, and Microsoft Azure assets. The value is null for the remaining applications.
    item_creator
    User who created the asset associated with the remediation.
    policy_rule_name
    Names of one or more policy rules (not policy type) that were matched.
    future_use
    Not currently implemented.
    action_taken
    Remediation action taken on Data Security. (Admin Quarantine, User Quarantine, or Remove Public Links).
    action_taken_by
    User who performed the remediation. For automated remediation, the value is Aperture.
    item_creator_email
    Email address of the item creator.
    item_owner_email
    Email address of the item owner.

    Policy Violation Log Fields

    The descriptions and names of available log fields in a Data Security policy violation log.
    The policy violation log is generated when an asset matches a policy rule. The log includes the following fields, which are available for ingestion by your Security information and event management (SIEM) system.
    Fields are listed in the order that they are needed for push mode.
    Field Name
    Description
    timestamp
    Time the policy violation occurred. Values are in YYYY-MM-DD HH:MM:SS format.
    serial
    Serial number of the organization using the service (tenant).
    log_type
    Type of log. In this case, policy_violation.
    cloud_app_instance
    Instance name of the cloud application (not the type of cloud application) associated with the policy violation.
    severity
    Policy violation severity valued between 0 and 5.
    incident_id
    Unique ID number for the incident. Can be null (no value).
    asset_id
    Unique ID number for the asset associated with the policy violation.
    item_name
    Name of the file, folder, or user associated with the policy violation.
    item_type
    Values are File, Folder, or User.
    item_owner
    User who owns the asset associated with the policy violation.
    item_creator
    User who created the asset identified in the policy violation.
    policy_rule_name
    Name of the policy rule that triggered the violation.
    future_use
    Not currently implemented.
    action_taken
    Action taken to remedy the policy violation. For example, Log only, or Send Administrator Alert.
    action_taken_by
    Cloud app user who took action to remediate the policy violation. For automated remediation, the value is Aperture.

    Activity Monitoring Log Fields

    The descriptions and names of available log fields in a Data Security activity monitoring log.
    The activity monitoring log is generated when a user activity policy is matched.
    Field Name
    Description
    timestamp
    Time the activity occurred. Values are in YYYY-MM-DD HH:MM:SS format.
    serial
    Serial number of the organization using the service (tenant).
    log_type
    Type of log. In this case, activity_monitoring.
    cloud_app_instance
    Instance name of the cloud application (not the type of cloud application) associated with the activity.
    severity
    Policy violation or incident severity valued between 0 and 5.
    item_name
    Name of the file, folder, or user associated with the activity.
    item_type
    Values are File, Folder, or User.
    user
    Cloud app user who performed the activity.
    source_ip
    Source IP address where the activity was performed.
    location
    Location where the activity was performed.
    action
    Activity that occurred. For example, Login or Upload.
    target_name
    Field name updated or target of the activity.
    target_type
    Target type. For example, FieldName, Report, or File.
    item_unique_id
    Unique ID number for an asset’s related asset.

    Admin Audit Log Fields

    The descriptions and names of available log fields in a Data Security administration activity log.
    The admin audit log is generated when a Data Security administrator performs an action such as the remediation of an incident, creating a new policy rule, or adding internal or external collaborators. The log includes the following fields, which are available for ingestion by your Security information and event management (SIEM) system.
    Fields are listed in the order that they are needed for push mode.
    Field Name
    Description
    timestamp
    Time the incident was discovered in YYYY-MM-DD HH:MM:SS format with Augmented Backus-Naur Form (ABNF) to indicate the timezone.
    serial
    Serial number of the organization using the service (tenant).
    log_type
    Type of log. In this case, admin_audit.
    admin_id
    Email account associated with the Data Security administrator.
    admin_role
    Role assigned to the administrator: super_admin, admin, limited_admin, or read_only
    ip
    IP address of the administrator who performed the action.
    event_type
    Type of configuration change: settings, policy, remediation, or login.
    item_name
    Name of the item that changed in the configuration.
    item_type
    Type of item in the configuration that changed: user, apps, settings, content_policy, file, risk, or general_settings.
    field
    Name of the field associated with the configuration change.
    action
    Configuration change activity that occurred: create, edit, delete, login, or logout.
    resource_value_old
    Value before the configuration change occurred.
    resource_value_new
    Value after the configuration change occurred.
    future_use
    Not currently implemented.
    future_use2
    Not currently implemented.

    Behavior Threats Log Fields

    This topic describes the names of available log fields in a Data Security Behavior Threats log.
    SaaS Security generates a Behavior Threats Log when it detects a Behavior Threats incident. The log includes the following fields, which are available for ingestion by your security information and event management (SIEM) system.
    Fields are listed in the order that they are needed for push mode.
    Field Name
    Description
    log_type
    Type of log. In this case, ba_incident_event.
    description
    Detailed description about the incident.
    date
    The date and time when the incident occurred.
    severity
    Severity of the incident valued between 0 and 5.
    policy_id
    Policy rule ID for which this incident occurred.
    user_email
    Email of the user who caused this incident.
    timestamp
    The time when this incident is published to the user's syslog.

    © 2025 Palo Alto Networks, Inc. All rights reserved.