>
    Strata Copilot
    Scan Event
    Focus
    Download PDF
    Focus
    1. Home
    2. Strata Logging Service
    3. Strata Logging Service Log Reference
    4. AI Supply Chain Logs
    5. Scan Event
    Download PDF
    Strata Logging Service

    Scan Event

    Table of Contents

    Scan Event

    AI Supply Chain logs record security scan events for AI models retrieved from model registries and storage systems.
    See the following for information related to supported log formats:
    SCAN EVENT Field
    (Display Name)
    Description
    created_by
    (CREATED BY)
    Identifier of the user that created the scan.
    CEF field name: PanOSCreatedBy
    EMAIL field name: CreatedBy
    HTTPS field name: CreatedBy
    LEEF field name: CreatedBy
    customer_id
    (CORTEX DATA LAKE TENANT ID)
    The ID that uniquely identifies the Cortex Data Lake instance which received this log record.
    CEF field name: PanOSCortexDataLakeTenantID
    EMAIL field name: CortexDataLakeTenantId
    HTTPS field name: CortexDataLakeTenantId
    LEEF field name: CortexDataLakeTenantID
    enabled_rule_count
    (ENABLED RULE COUNT)
    Number of rules enabled for the scan.
    CEF field name: PanOSEnabledRuleCount
    EMAIL field name: EnabledRuleCount
    HTTPS field name: EnabledRuleCount
    LEEF field name: EnabledRuleCount
    error_code.​value
    (ERROR CODE)
    Error code if the scan encountered an error. Values are RESOURCE_NOT_FOUND, INTERNAL_ERROR, SCAN_DATA_PENDING.
    CEF field name: PanOSErrorCode
    EMAIL field name: ErrorCode
    HTTPS field name: ErrorCode
    LEEF field name: ErrorCode
    error_message
    (ERROR MESSAGE)
    Error message if the scan encountered an error, null if no error.
    CEF field name: PanOSErrorMessage
    EMAIL field name: ErrorMessage
    HTTPS field name: ErrorMessage
    LEEF field name: ErrorMessage
    eval_outcome.​value
    (EVALUATION OUTCOME)
    Overall evaluation outcome of the scan. Values are ALLOWED, BLOCKED, ERROR.
    CEF field name: PanOSEvalOutcome
    EMAIL field name: EvalOutcome
    HTTPS field name: EvalOutcome
    LEEF field name: EvalOutcome
    labels
    (LABELS)
    Key-value pairs of user-defined labels encoded as a JSON string (e.g., {"team": "ml-platform", "env": "prod"}).
    CEF field name: PanOSLabels
    EMAIL field name: Labels
    HTTPS field name: Labels
    LEEF field name: Labels
    log_source
    (LOG SOURCE)
    Identifies the origin of the data - the system that produced the data.
    CEF field name: PanOSLogSource
    EMAIL field name: LogSource
    HTTPS field name: LogSource
    LEEF field name: LogSource
    log_source_group_id
    (LOG SOURCE GROUP ID)
    ID that uniquely identifies the logSourceGroupId of the log. That is, the log_source_id of the group.
    CEF field name: logSourceGroupID
    EMAIL field name: LogSourceGroupID
    HTTPS field name: LogSourceGroupID
    LEEF field name: LogSourceGroupID
    log_source_id
    (DEVICE SN)
    ID that uniquely identifies the source of the log - serial number of the firewall that generated the log.
    CEF field name: deviceExternalID
    EMAIL field name: DeviceSN
    HTTPS field name: DeviceSN
    LEEF field name: DeviceSN
    log_source_name
    (DEVICE NAME)
    Name of the source of the log - hostname of the firewall that logged the network traffic.
    CEF field name: dvchost
    EMAIL field name: DeviceName
    HTTPS field name: DeviceName
    LEEF field name: DeviceName
    log_source_tz_offset
    (LOG SOURCE TIMEZONE OFFSET)
    Time Zone offset from GMT of the source of the log.
    CEF field name: PanOSLogSourceTimeZoneOffset
    EMAIL field name: LogSourceTimeZoneOffset
    HTTPS field name: LogSourceTimeZoneOffset
    LEEF field name: LogSourceTimeZoneOffset
    log_time
    (TIME RECEIVED)
    Time the log was received in Cortex Data Lake. This is populated by the platform.
    CEF field name: rt
    EMAIL field name: TimeReceived
    HTTPS field name: TimeReceived
    LEEF field name: TimeReceived
    log_type.​value
    (LOG TYPE)
    Identifies the log type.
    CEF field name: DeviceEventClassID
    EMAIL field name: LogType
    HTTPS field name: LogType
    LEEF field name: cat
    model_author
    (MODEL AUTHOR)
    Author of the scanned model (e.g., "meta-llama").
    CEF field name: PanOSModelAuthor
    EMAIL field name: ModelAuthor
    HTTPS field name: ModelAuthor
    LEEF field name: ModelAuthor
    model_formats
    (MODEL FORMATS)
    Model formats detected during the scan (e.g., ["pickle", "safetensors", "onnx"]).
    CEF field name: PanOSModelFormats
    EMAIL field name: ModelFormats
    HTTPS field name: ModelFormats
    LEEF field name: ModelFormats
    model_name
    (MODEL NAME)
    Name of the scanned model (e.g., "meta-llama/Llama-2-7b").
    CEF field name: PanOSModelName
    EMAIL field name: ModelName
    HTTPS field name: ModelName
    LEEF field name: ModelName
    model_uri
    (MODEL URI)
    URI of the scanned model (e.g., "hf://meta-llama/Llama-2-7b").
    CEF field name: PanOSModelURI
    EMAIL field name: ModelURI
    HTTPS field name: ModelURI
    LEEF field name: ModelURI
    model_version
    (MODEL VERSION)
    Version or revision of the scanned model -- may be a semver, branch name, or git SHA (e.g., "main", "v1.0", "abc123def").
    CEF field name: PanOSModelVersion
    EMAIL field name: ModelVersion
    HTTPS field name: ModelVersion
    LEEF field name: ModelVersion
    platform_type
    (PLATFORM TYPE)
    Identifies the platform that generated the log.
    CEF field name: PanOSPlatformType
    EMAIL field name: PlatformType
    HTTPS field name: PlatformType
    LEEF field name: PlatformType
    rule_failed_count
    (RULE FAILED COUNT)
    Number of rules that failed.
    CEF field name: PanOSRuleFailedCount
    EMAIL field name: RuleFailedCount
    HTTPS field name: RuleFailedCount
    LEEF field name: RuleFailedCount
    rule_passed_count
    (RULE PASSED COUNT)
    Number of rules that passed.
    CEF field name: PanOSRulePassedCount
    EMAIL field name: RulePassedCount
    HTTPS field name: RulePassedCount
    LEEF field name: RulePassedCount
    scan_origin.​value
    (SCAN ORIGIN)
    Origin from which the scan was initiated. Values are MODEL_SECURITY_SDK, MODEL_SECURITY_API, MODEL_SECURITY_FRONTEND.
    CEF field name: PanOSScanOrigin
    EMAIL field name: ScanOrigin
    HTTPS field name: ScanOrigin
    LEEF field name: ScanOrigin
    scan_uuid
    (SCAN UUID)
    Unique identifier of the scan (e.g., "57d86937-1ba6-4637-b303-87798f555d09").
    CEF field name: PanOSScanUUID
    EMAIL field name: ScanUUID
    HTTPS field name: ScanUUID
    LEEF field name: ScanUUID
    scanner_version
    (SCANNER VERSION)
    Version of the scanner (e.g., "1.0.0").
    CEF field name: PanOSScannerVersion
    EMAIL field name: ScannerVersion
    HTTPS field name: ScannerVersion
    LEEF field name: ScannerVersion
    sdk_version
    (SDK VERSION)
    Version of the SDK used to initiate the scan.
    CEF field name: PanOSSDKVersion
    EMAIL field name: SDKVersion
    HTTPS field name: SDKVersion
    LEEF field name: SDKVersion
    security_group_name
    (SECURITY GROUP NAME)
    Name of the security group applied to the scan (e.g., "production-models-sg").
    CEF field name: PanOSSecurityGroupName
    EMAIL field name: SecurityGroupName
    HTTPS field name: SecurityGroupName
    LEEF field name: SecurityGroupName
    security_group_uuid
    (SECURITY GROUP UUID)
    Unique identifier of the security group applied to the scan (e.g., "a1b2c3d4-5678-90ab-cdef-1234567890ab").
    CEF field name: PanOSSecurityGroupUUID
    EMAIL field name: SecurityGroupUUID
    HTTPS field name: SecurityGroupUUID
    LEEF field name: SecurityGroupUUID
    source_type.​value
    (SOURCE TYPE)
    Source type of the scanned model. Values are HUGGING_FACE, S3, GCS, AZURE, LOCAL, ARTIFACTORY, GITLAB.
    CEF field name: PanOSSourceType
    EMAIL field name: SourceType
    HTTPS field name: SourceType
    LEEF field name: SourceType
    sub_type.​value
    (SUB TYPE)
    Identifies the log subtype.
    CEF field name: Name
    EMAIL field name: SubType
    HTTPS field name: SubType
    LEEF field name: SubType
    time_generated
    (TIME GENERATED)
    Time the log was generated on the data plane in format YYYY-MM-DDTHH:MM:SS[.DDDDDD]Z.
    CEF field name: start
    EMAIL field name: TimeGenerated
    HTTPS field name: TimeGenerated
    LEEF field name: devTime
    time_generated_high_res
    (TIME GENERATED HIGH RESOLUTION)
    Time the log was generated in data plane with millisec granularity in format YYYY-MM-DDTHH:MM:SS[.DDDDDD]Z.
    CEF field name: PanOSTimeGeneratedHighResolution
    EMAIL field name: TimeGeneratedHighResolution
    HTTPS field name: TimeGeneratedHighResolution
    LEEF field name: TimeGeneratedHighResolution
    time_started
    (TIME STARTED)
    Timestamp when the scan started in UTC (e.g., "2026-05-07T14:29:58.000Z").
    CEF field name: PanOSTimeStarted
    EMAIL field name: TimeStarted
    HTTPS field name: TimeStarted
    LEEF field name: TimeStarted
    total_files_scanned
    (TOTAL FILES SCANNED)
    Total number of files scanned.
    CEF field name: PanOSTotalFilesScanned
    EMAIL field name: TotalFilesScanned
    HTTPS field name: TotalFilesScanned
    LEEF field name: TotalFilesScanned
    total_files_skipped
    (TOTAL FILES SKIPPED)
    Total number of files skipped.
    CEF field name: PanOSTotalFilesSkipped
    EMAIL field name: TotalFilesSkipped
    HTTPS field name: TotalFilesSkipped
    LEEF field name: TotalFilesSkipped
    tsg_id
    (TSG ID)
    The ID that uniquely identifiers a Tenant Sevice Group (TSG) that this log record should be associated with.
    CEF field name: PanOSTSGID
    EMAIL field name: TSGID
    HTTPS field name: TSGID
    LEEF field name: TSGID
    vendor_name
    (VENDOR NAME)
    Identifies the vendor that produced the data.
    CEF field name: Device Vendor
    EMAIL field name: VendorName
    HTTPS field name: VendorName
    LEEF field name: Vendor
    violation_count
    (VIOLATION COUNT)
    Number of violations found in the scan.
    CEF field name: PanOSViolationCount
    EMAIL field name: ViolationCount
    HTTPS field name: ViolationCount
    LEEF field name: ViolationCount
    violations
    (VIOLATIONS)
    List of violations found during the scan.
    CEF field name: PanOSViolations
    EMAIL field name: Violations
    HTTPS field name: Violations
    LEEF field name: Violations

    © 2026 Palo Alto Networks, Inc. All rights reserved.