System EMAIL Fields

Table of Contents

System EMAIL Fields

Example System log in EMAIL:

LogTime=2021-02-22T06:00:54.000000Z
LogSourceID=xxxxxxxxxxxxxx
LogType=SYSTEM
Subtype=general
ConfigVersion=0.0
VirtualSystemID=0
AgentTimeZoneOffset=
AgentVersion=
EndpointCPUArchitecture=
EndpointDeviceDomain=
EndpointDeviceName=
EndpointIPaddress=
EndpointOSType=
EndpointOSVersion=
EndpointUserDomain=
EndpointUserName=xxxxx
EndpointUserUUID=
IsDuplicateLog=false
IsPrismaNetwork=false
IsPrismaUsers=false
LogCategory=
LogExported=false
LogForwarded=true
LogSource=firewall
LogSourceTimeZoneOffset=
Severity=Informational
TenantID=xxxxxxxxxxxxx
TimeGeneratedHighResolution=2021-02-22T06:00:46.000000Z
VDIEndpoint=
VendorName=Palo Alto Networks
AgentStatus=
AgentDataCollectionStatus=
AgentID=
AgentIsolationStatus=
AgentContentVersion=
EventTime=2021-02-22T06:00:46.000000Z
VirtualLocation=
EventName=general
EventComponent=
VendorSeverity=Informational
EventDescription=WildFire version 559357-566509 downloaded by Auto update agent
SequenceNo=30904438
DGHierarchyLevel1=0
DGHierarchyLevel2=0
DGHierarchyLevel3=0
DGHierarchyLevel4=0
VirtualSystemName=
LogSourceName=xxxxx
DeviceGroup=
Template=

The following table identifies the System field names that the Log Forwarding app uses when you forward logs using the EMAIL log format.

EMAIL Name	Query Name
AgentContentVersion	agent_content_version
AgentDataCollectionStatus	agent_data_collection_status.value
AgentID	agent_id
AgentIsolationStatus	agent_isolation_status
AgentStatus	agent_protection_status
AgentVersion	agent_version
ConfigVersion	config_version.value
TenantID	customer_id
DeviceGroup	device_group.value
DGHierarchyLevel1	dg_hier_level_1
DGHierarchyLevel2	dg_hier_level_2
DGHierarchyLevel3	dg_hier_level_3
DGHierarchyLevel4	dg_hier_level_4
EndpointCPUArchitecture	endpoint_cpu_architecture.value
EndpointDeviceDomain	endpoint_device_domain
EndpointDeviceName	endpoint_device_name
EndpointIPaddress	endpoint_ip.value
VDIEndpoint	endpoint_is_vdi
EndpointOSType	endpoint_os_type.value
EndpointOSVersion	endpoint_os_version
AgentTimeZoneOffset	endpoint_tz_offset
EndpointUserDomain	endpoint_user.domain
EndpointUserName	endpoint_user.name
EndpointUserUUID	endpoint_user.uuid
EventComponent	event_component
EventDescription	event_description
EventName	event_name.value
EventTime	event_time
IsDuplicateLog	is_dup_log
LogExported	is_exported
LogForwarded	is_forwarded
IsPrismaNetwork	is_prisma_branch
IsPrismaUsers	is_prisma_mobile
LogCategory	log_category.value
LogSource	log_source
LogSourceGroupID	log_source_group_id
LogSourceID	log_source_id
LogSourceName	log_source_name
LogSourceTimeZoneOffset	log_source_tz_offset
LogTime	log_time
LogType	log_type.value
PanoramaSN	panorama_serial
PlatformType	platform_type
SequenceNo	sequence_no
Severity	severity
Subtype	sub_type.value
Template	template.value
TimeGeneratedHighResolution	time_generated_high_res
VendorName	vendor_name
VendorSeverity	vendor_severity.value
VirtualLocation	vsys
VirtualSystemID	vsys_id
VirtualSystemName	vsys_name

System CEF Fields

System HTTPS Fields

Strata Logging Service Docs

System EMAIL Fields

Strata Logging Service Docs

System EMAIL Fields

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Endpoints

Visibility & Monitoring

Best Practices

Experts Corner