>
    Strata Copilot
    AI Conversation Log CEF Fields
    Focus
    Download PDF
    Focus
    1. Home
    2. Strata Logging Service
    3. Strata Logging Service Log Reference
    4. AI Access Logs
    5. AI Conversation Log
    6. AI Conversation Log CEF Fields
    Download PDF
    Strata Logging Service

    AI Conversation Log CEF Fields

    Table of Contents

    AI Conversation Log CEF Fields

    The following table identifies the AI Conversation Log field names that the Log Forwarding app uses when you forward logs using the CEF log format.
    CEF Name
    Field Details
    PanOSAction
    Query Name: action.​value
    Header Type: Custom
    PanOSAppClassification
    Query Name: app_classification.​value
    Header Type: Custom
    PanOSAppID
    Query Name: app_id
    Header Type: Custom
    PanOSAppName
    Query Name: app_name
    Header Type: Custom
    PanOSChannel
    Query Name: channel.​value
    Header Type: Custom
    PanOSContent
    Query Name: content
    Header Type: Custom
    PanOSContentExtracted
    Query Name: content_extracted
    Header Type: Custom
    PanOSConversationID
    Query Name: conversation_id
    Header Type: Custom
    PanOSCortexDataLakeTenantID
    Query Name: customer_id
    Header Type: Custom
    PanOSDataSize
    Query Name: data_size
    Header Type: Custom
    PanOSDLPDataProfiles
    Query Name: dlp_data_profiles
    Header Type: Custom
    PanOSDLPIncidentID
    Query Name: dlp_incident_id
    Header Type: Custom
    PanOSDLPTenantID
    Query Name: dlp_tenant_id
    Header Type: Custom
    PanOSFileName
    Query Name: file_name
    Header Type: Custom
    PanOSFileType
    Query Name: file_type
    Header Type: Custom
    PanOSIsFileBased
    Query Name: is_file_based
    Header Type: Custom
    PanOSIsPrompt
    Query Name: is_prompt
    Header Type: Custom
    PanOSIsResponse
    Query Name: is_response
    Header Type: Custom
    PanOSLogSource
    Query Name: log_source
    Header Type: Custom
    logSourceGroupID
    Query Name: log_source_group_id
    Header Type: Predefined
    deviceExternalID
    Query Name: log_source_id
    Header Type: Predefined
    dvchost
    Query Name: log_source_name
    Header Type: Predefined
    PanOSLogSourceTimeZoneOffset
    Query Name: log_source_tz_offset
    Header Type: Custom
    rt
    Query Name: log_time
    Header Type: Predefined
    DeviceEventClassID
    Query Name: log_type.​value
    Header Type: Custom
    PanOSPlatformType
    Query Name: platform_type
    Header Type: Custom
    PanOSPromptIntents
    Query Name: prompt_intents
    Header Type: Custom
    PanOSPromptTopics
    Query Name: prompt_topics
    Header Type: Custom
    PanOSReportID
    Query Name: report_id
    Header Type: Custom
    PanOSScanRegion
    Query Name: scan_region
    Header Type: Custom
    PanOSSessionKey
    Query Name: session_key
    Header Type: Custom
    PanOSSnippets
    Query Name: snippets
    Header Type: Custom
    PanOSSource
    Query Name: source.​value
    Header Type: Custom
    Name
    Query Name: sub_type.​value
    Header Type: Custom
    start
    Query Name: time_generated
    Header Type: Predefined
    PanOSTimeGeneratedHighResolution
    Query Name: time_generated_high_res
    Header Type: Custom
    PanOSTSGID
    Query Name: tsg_id
    Header Type: Custom
    PanOSURL
    Query Name: url
    Header Type: Custom
    PanOSUserID
    Query Name: user_id
    Header Type: Custom
    Device Vendor
    Query Name: vendor_name
    Header Type: Custom
    PanOSDLPVerdict
    Query Name: verdict.​value
    Header Type: Custom

    © 2026 Palo Alto Networks, Inc. All rights reserved.