>
    Strata Copilot
    Scan Event CEF Fields
    Focus
    Download PDF
    Focus
    1. Home
    2. Strata Logging Service
    3. Strata Logging Service Log Reference
    4. AI Supply Chain Logs
    5. Scan Event
    6. Scan Event CEF Fields
    Download PDF
    Strata Logging Service

    Scan Event CEF Fields

    Table of Contents

    Scan Event CEF Fields

    The following table identifies the Scan Event field names that the Log Forwarding app uses when you forward logs using the CEF log format.
    CEF Name
    Field Details
    PanOSCreatedBy
    Query Name: created_by
    Header Type: Custom
    PanOSCortexDataLakeTenantID
    Query Name: customer_id
    Header Type: Custom
    PanOSEnabledRuleCount
    Query Name: enabled_rule_count
    Header Type: Custom
    PanOSErrorCode
    Query Name: error_code.​value
    Header Type: Custom
    PanOSErrorMessage
    Query Name: error_message
    Header Type: Custom
    PanOSEvalOutcome
    Query Name: eval_outcome.​value
    Header Type: Custom
    PanOSLabels
    Query Name: labels
    Header Type: Custom
    PanOSLogSource
    Query Name: log_source
    Header Type: Custom
    logSourceGroupID
    Query Name: log_source_group_id
    Header Type: Predefined
    deviceExternalID
    Query Name: log_source_id
    Header Type: Predefined
    dvchost
    Query Name: log_source_name
    Header Type: Predefined
    PanOSLogSourceTimeZoneOffset
    Query Name: log_source_tz_offset
    Header Type: Custom
    rt
    Query Name: log_time
    Header Type: Predefined
    DeviceEventClassID
    Query Name: log_type.​value
    Header Type: Custom
    PanOSModelAuthor
    Query Name: model_author
    Header Type: Custom
    PanOSModelFormats
    Query Name: model_formats
    Header Type: Custom
    PanOSModelName
    Query Name: model_name
    Header Type: Custom
    PanOSModelURI
    Query Name: model_uri
    Header Type: Custom
    PanOSModelVersion
    Query Name: model_version
    Header Type: Custom
    PanOSPlatformType
    Query Name: platform_type
    Header Type: Custom
    PanOSRuleFailedCount
    Query Name: rule_failed_count
    Header Type: Custom
    PanOSRulePassedCount
    Query Name: rule_passed_count
    Header Type: Custom
    PanOSScanOrigin
    Query Name: scan_origin.​value
    Header Type: Custom
    PanOSScanUUID
    Query Name: scan_uuid
    Header Type: Custom
    PanOSScannerVersion
    Query Name: scanner_version
    Header Type: Custom
    PanOSSDKVersion
    Query Name: sdk_version
    Header Type: Custom
    PanOSSecurityGroupName
    Query Name: security_group_name
    Header Type: Custom
    PanOSSecurityGroupUUID
    Query Name: security_group_uuid
    Header Type: Custom
    PanOSSourceType
    Query Name: source_type.​value
    Header Type: Custom
    Name
    Query Name: sub_type.​value
    Header Type: Custom
    start
    Query Name: time_generated
    Header Type: Predefined
    PanOSTimeGeneratedHighResolution
    Query Name: time_generated_high_res
    Header Type: Custom
    PanOSTimeStarted
    Query Name: time_started
    Header Type: Custom
    PanOSTotalFilesScanned
    Query Name: total_files_scanned
    Header Type: Custom
    PanOSTotalFilesSkipped
    Query Name: total_files_skipped
    Header Type: Custom
    PanOSTSGID
    Query Name: tsg_id
    Header Type: Custom
    Device Vendor
    Query Name: vendor_name
    Header Type: Custom
    PanOSViolationCount
    Query Name: violation_count
    Header Type: Custom
    PanOSViolations
    Query Name: violations
    Header Type: Custom

    © 2026 Palo Alto Networks, Inc. All rights reserved.