Events EMAIL Fields

Table of Contents

Events EMAIL Fields

The following table identifies the Events field names that the Log Forwarding app uses when you forward logs using the EMAIL log format.

EMAIL Name	Query Name
ApplicationAccountInventoryId	application.account_inventory_id
ApplicationAppCategory	application.app_category
ApplicationAppSubcategory	application.app_sub_category
ApplicationAccountChannelId	application.application_account.channel_id
ApplicationAccountDisplayValue	application.application_account.displayed_value
ApplicationAccountDomain	application.application_account.domain
ApplicationAccountRegion	application.application_account.region
ApplicationAccountTenantId	application.application_account.tenant_id
ApplicationAccountWorkspaceName	application.application_account.workspace_name
ApplicationAccountId	application.application_account_identifier
ApplicationClassification	application.classification
ApplicationCredentialType	application.credential_type
ApplicationExternalID	application.external_id
ApplicationExternalName	application.external_name
ApplicationID	application.id
ApplicationIdentityProviderUrl	application.identity_provider_url
IsGenAi	application.is_gen_ai
ApplicationLocalDesktopFileDescription	application.local_desktop.file_description
ApplicationLocalDesktopIconId	application.local_desktop.icon_id
ApplicationLocalDesktopOriginalFileName	application.local_desktop.original_file_name
ApplicationLocalDesktopParentProcessPath	application.local_desktop.parent_process_path
ApplicationLocalDesktopProcessPath	application.local_desktop.process_path
ApplicationLocalDesktopProductName	application.local_desktop.product_name
ApplicationLocalDesktopThumbprint	application.local_desktop.thumbprint
ApplicationLocalDesktopWindowTitle	application.local_desktop.window_title
ApplicationLoginId	application.login_id
ApplicationLoginMethod	application.login_method
ApplicationName	application.name
ApplicationProtectedAccount	application.protected_account
ApplicationReputation	application.reputation
ApplicationReputationRisk	application.reputation_risk
ApplicationRiskOfApp	application.risk_of_app
ApplicationServiceProviderUrl	application.service_provider_url
ApplicationSource	application.source
ApplicationTags	application.tags
ApplicationUsecases	application.use_cases
ApplicationUsername	application.username
ApplicationWebauthnAuthenticator	application.webauthn.authenticator
ApplicationWebauthnAuthenticatorAttachment	application.webauthn.authenticator_attachment
ApplicationWebauthnCredentialId	application.webauthn.credential_id
ApplicationWebauthnErrorMessage	application.webauthn.error.message
ApplicationWebauthnErrorName	application.webauthn.error.name
ApplicationWebauthnRelyingPartyId	application.webauthn.relying_party_id
ApplicationWebauthnUserHandle	application.webauthn.user_handle
AuthSsoProvider	auth.sso_provider
BatchID	batch_id
BrowserExtensionAppLaunchURL	browser_extension.app_launch_url
BrowserExtensionAvailableLaunchTypes	browser_extension.available_launch_types
BrowserExtensionDescription	browser_extension.description
BrowserExtensionDisabledReason	browser_extension.disabled_reason
BrowserExtensionEnabled	browser_extension.enabled
BrowserExtensionHomepageURL	browser_extension.homepage_url
BrowserExtensionHostPermissions	browser_extension.host_permissions
BrowserExtensionID	browser_extension.id
BrowserExtensionInstallType	browser_extension.install_type
BrowserExtensionIsApp	browser_extension.is_app
BrowserExtensionLaunchType	browser_extension.launch_type
BrowserExtensionMayDisable	browser_extension.may_disable
BrowserExtensionName	browser_extension.name
BrowserExtensionOfflineEnabled	browser_extension.offline_enabled
BrowserExtensionOptionsURL	browser_extension.options_url
BrowserExtensionPermissions	browser_extension.permissions
BrowserExtensionShortName	browser_extension.short_name
BrowserExtensionType	browser_extension.type
BrowserExtensionUpdateURL	browser_extension.update_url
BrowserExtensionVersion	browser_extension.version
CertificateCreatedTime	certificate.created_time
CertificateExpirationTime	certificate.expiration_time
CertificateFingerprints	certificate.fingerprints
CertificateIssuer	certificate.issuer
CertificateSerialNumber	certificate.serial_number
CertificateSubject	certificate.subject
ClassificationCategory	classification.category
ClassificationMaliciousCategories	classification.malicious_categories
ClassificationMITRE	classification.mitre
ClassificationReputation	classification.reputation
ClassificationSecurityCompliance	classification.security_compliance
ClassificationSeverity	classification.severity
ClipboardFromLocalDesktopAppFileDescription	clipboard.from_local_desktop_app.file_description
ClipboardFromLocalDesktopAppIconId	clipboard.from_local_desktop_app.icon_id
ClipboardFromLocalDesktopAppOriginalFileName	clipboard.from_local_desktop_app.original_file_name
ClipboardFromLocalDesktopAppParentProcessPath	clipboard.from_local_desktop_app.parent_process_path
ClipboardFromLocalDesktopAppProcessPath	clipboard.from_local_desktop_app.process_path
ClipboardFromLocalDesktopAppProductName	clipboard.from_local_desktop_app.product_name
ClipboardFromLocalDesktopAppThumbprint	clipboard.from_local_desktop_app.thumbprint
ClipboardFromLocalDesktopAppWindowTitle	clipboard.from_local_desktop_app.window_title
ClipboardFromURL	clipboard.from_url
ClipboardSearchEngine	clipboard.search_engine
ClipboardSelectedElement	clipboard.selected_element
ContentCategories	content.categories
ContentLengthBytes	content.length_bytes
ContentLiveScanningDetectionId	content.live_scanning.detection_id
ContentLiveScanningMaliciousUrl	content.live_scanning.malicious_content_url
ContentLiveScanningMaliciousObject	content.live_scanning.malicious_object
ContentLiveScanningMethod	content.live_scanning.scan_method
ContentLiveScanningTriggeredBy	content.live_scanning.triggered_by
ContentMIPMatchedLabel	content.mip_matched_label
ContentScanEngine	content.scan_engine
ContentSensitiveDataCategories	content.sensitive_data_categories
ContentSourceElementSelector	content.source_element_selector
ContentSourceURL	content.source_url
ContentTraceId	content.trace_id
CortexDataLakeTenantID	customer_id
DeviceAgentID	device.agent_id
DeviceBrowserBrand	device.browser_brand
DeviceBrowserProcessID	device.browser_process_id
DeviceBrowserType	device.browser_type
DeviceBrowserVersion	device.browser_version
DeviceCortexAgentID	device.cortex_agent_id
DeviceCountry	device.country
DeviceUUID	device.device_uuid
DeviceDiskEncryptionStatus	device.disk_encryption_status
DeviceEPPStatus	device.epp_status
DeviceExtensionVersion	device.extension_version
DeviceFirewallStatus	device.firewall_status
DeviceGeoIPFromCityName	device.geoip_from_city_name
DeviceGeoIPFromCountryName	device.geoip_from_country_name
DeviceGeoIPFromLocationLatitude	device.geoip_from_location_latitude
DeviceGeoIPFromLocationLongitude	device.geoip_from_location_longitude
DeviceGroupsIDs	device.groups.ids
DeviceGroupsNames	device.groups.names
DeviceHostname	device.hostname
DeviceIPAddress	device.ip_address
DeviceIsProcessPrivilegedElevated	device.is_process_privileged_elevated
DeviceIsRunningInVm	device.is_running_in_vm
DeviceIsSystemInstall	device.is_system_install
DeviceIsUserAdmin	device.is_user_admin
DeviceLocalIps	device.local_ips
DeviceMACAddresses	device.mac_addresses
DeviceModel	device.model
DeviceOSAndroidBuild	device.os.android.build
DeviceOSAndroidPatch	device.os.android.patch
DeviceOSAndroidRelease	device.os.android.release
DeviceOSAndroidSDK	device.os.android.sdk
DeviceOsChromeOsBuild	device.os.chrome_os.build
DeviceOsChromeOsMajor	device.os.chrome_os.major
DeviceOsChromeOsMinor	device.os.chrome_os.minor
DeviceOSiOSMajor	device.os.ios.major
DeviceOSiOSMinor	device.os.ios.minor
DeviceOSiOSPatch	device.os.ios.patch
DeviceOsLinuxId	device.os.linux.id
DeviceOsLinuxIdLike	device.os.linux.id_like
DeviceOsLinuxName	device.os.linux.name
DeviceOsLinuxPrettyName	device.os.linux.pretty_name
DeviceOsLinuxVersion	device.os.linux.version
DeviceOsLinuxVersionId	device.os.linux.version_id
DeviceOSmacOSBugfix	device.os.macos.bugfix
DeviceOSmacOSBuild	device.os.macos.build
DeviceOsMacosIntegrityInfoGatekeeperEnabled	device.os.macos.integrity_info.gatekeeper_enabled
DeviceOsMacosIntegrityInfoSipEnabled	device.os.macos.integrity_info.sip_enabled
DeviceOSmacOSMajor	device.os.macos.major
DeviceOSmacOSMinor	device.os.macos.minor
DeviceOSmacOSServer	device.os.macos.server
DeviceOSType	device.os.type
DeviceOSWindowsBuild	device.os.windows.build
DeviceOsWindowsIntegrityInfoDriversSigningEnforced	device.os.windows.integrity_info.drivers_signing_enforced
DeviceOsWindowsIntegrityInfoKernelDebuggerNotPresent	device.os.windows.integrity_info.kernel_debugger_not_present
DeviceOsWindowsIntegrityInfoSecureBootEnabled	device.os.windows.integrity_info.secure_boot_enabled
DeviceOSWindowsMajor	device.os.windows.major
DeviceOSWindowsMinor	device.os.windows.minor
DeviceOSWindowsPatch	device.os.windows.patch
DeviceOSWindowsProduct	device.os.windows.product
DeviceOSDisplayName	device.os_display_name
DevicePablVersion	device.pabl_version
DevicePublicIp	device.public_ip
DeviceRawUniversalID	device.raw_universal_id
DeviceScreenLockStatus	device.screen_lock_status
DeviceSerialNumber	device.serial_number
DeviceType	device.type
DeviceUserAgent	device.user_agent
DlpDetectedClassifiers	dlp.detected_classifiers
DlpDetectedClassifiersConfidence	dlp.detected_classifiers_confidence
DlpDetectedClassifiersOccurrences	dlp.detected_classifiers_occurrences
DlpMatchedClassifiers	dlp.matched_classifiers
DlpMatchedClassifiersConfidence	dlp.matched_classifiers_confidence
DlpMatchedClassifiersOccurrences	dlp.matched_classifiers_occurrences
DlpMatchedDataProfiles	dlp.matched_data_profiles
DlpParentDataProfile	dlp.parent_data_profile
ExtensionRiskInitiator	extension_risk.initiator
ExtensionRiskRisk	extension_risk.risk
ExtensionRiskTrigger	extension_risk.trigger
FileExtension	file.extension
FileIsEncrypted	file.is_encrypted
FileLocalPath	file.local_path
FileMimeType	file.mime_type
FileName	file.name
FileOperation	file.operation
FileOriginDownloadURL	file.origin_download_url
FileSHA256	file.sha256
FileURL	file.url
GenAiPromptEmbeddedGenAi	gen_ai_prompt.embedded_gen_ai
GenAiPromptIncludedFiles	gen_ai_prompt.included_files
GenAiPromptIsPromptCollected	gen_ai_prompt.is_prompt_collected
GenAiPromptPrompt	gen_ai_prompt.prompt
ID	id
LogSource	log_source
LogSourceGroupID	log_source_group_id
DeviceSN	log_source_id
DeviceName	log_source_name
TimeReceived	log_time
LogType	log_type.value
Miscellaneous	misc
NetworkClassifications	network.classifications
NetworkFrameURL	network.frame_url
NetworkHTTPMethod	network.http.method
NetworkHTTPStatus	network.http.status
NetworkProtocol	network.protocol
NetworkQueryParams	network.query_params
NetworkRedirectDestinationUrl	network.redirect_destination_url
NetworkRemoteConnectionProtocol	network.remote_connection_protocol
NetworkTabURL	network.tab_url
NetworkTunneledThroughPa	network.tunneled_through_pa
NetworkURL	network.url
NetworkWebRiskLevel	network.web_risk_level
NetworkWebScanEngine	network.web_scan_engine
NetworkWebScanEngines	network.web_scan_engines
PageCaptureIsSecureScreenshot	page.capture.is_secure_screenshot
PageCaptureTriggeredByURL	page.capture.triggered_by_url
PageDevtoolsBlockReason	page.devtools.block_reason
PageTitle	page.title
PasswordManagerImportCount	password_manager.import.count
PasswordManagerImportSource	password_manager.import.source
PasswordManagerLoginChanges	password_manager.login.changes
PasswordManagerLoginIsManaged	password_manager.login.is_managed
PasswordManagerLoginMethod	password_manager.login.method
PasswordManagerLoginName	password_manager.login.name
PasswordManagerLoginRetrievedMethod	password_manager.login.retrieved_method
PasswordManagerLoginRisks	password_manager.login.risks
PasswordManagerLoginSharingTargetGroups	password_manager.login.sharing.target.groups
PasswordManagerLoginSharingTargetUsers	password_manager.login.sharing.target.users
PasswordManagerLoginUrls	password_manager.login.urls
PasswordManagerLoginUser	password_manager.login.user
PincodeFailedAttempts	pincode.failed_attempts
PincodeRegistrationTime	pincode.registration_time
PlatformType	platform_type
PolicyAction	policy.action
PolicyBlockReason	policy.block_reason
PolicyBypassAllowed	policy.bypass_allowed
PolicyBypassReason	policy.bypass_reason
PolicyBypassRequestId	policy.bypass_request_id
PolicyDefinedAction	policy.defined_action
PolicyEvidenceFullSessionRecording	policy.evidence.full_session_recording
PolicyEvidenceFullSessionRecordingId	policy.evidence.full_session_recording_id
PolicyEvidenceFullSessionRecordingStatus	policy.evidence.full_session_recording_status
PolicyEvidenceScreenshot	policy.evidence.screenshot
PolicyEvidenceTypes	policy.evidence.types
PolicyFailureReason	policy.failure_reason
PolicyIsHistorical	policy.is_historical
PolicyIsMonitor	policy.is_monitor
PolicyIsRecordingExist	policy.is_recording_exist
PolicyIsSessionRecorded	policy.is_session_recorded
PolicyIsWecEnabled	policy.is_wec_enabled
PolicyRuleDescription	policy.rule_description
PolicyRuleID	policy.rule_id
PolicyRuleLogLevel	policy.rule_log_level
PolicyShouldLogQueryParams	policy.should_log_query_params
PostureBlockReason	posture.block_reason
PostureBlockType	posture.block_type
PostureError	posture.error
PostureSuspensionType	posture.suspension_type
PrintPrinterLocation	print.printer_location
PrintPrinterName	print.printer_name
ProcessCLIArgs	process.cli_args
ProcessImagePath	process.image_path
ProcessParentProcess	process.parent_process
ProcessPID	process.pid
RceExploitSensor	rce_exploit.sensor
RceExploitUrl	rce_exploit.url
StateDeviceGroupEvaluation	state.device_group_evaluation
StateSignInRules	state.sign_in_rules
SubtenantID	sub_tenant_id
Subtype	sub_type.value
TamperingType	tampering.type
TenantID	tenant_id
TimeGenerated	time_generated
TimeGeneratedHighResolution	time_generated_high_res
Timestamp	timestamp
TSGID	tsg_id
Type	type
UserEmail	user.email
UserExternalID	user.external_id
UserGroupsIDs	user.groups.ids
UserGroupsNames	user.groups.names
UserID	user.id
UserName	user.name
UserShortUsername	user.short_username
UserTenantExternalID	user.tenant_external_id
UserTenantID	user.tenant_id
UserTenantName	user.tenant_name
UserTSGID	user.tsg_id
VendorName	vendor_name

Events CEF Fields

Events HTTPS Fields

Strata Logging Service Docs

Events EMAIL Fields

Strata Logging Service Docs

Events EMAIL Fields

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Endpoints

Visibility & Monitoring

Best Practices

Experts Corner