Events HTTPS Fields

Table of Contents

Events HTTPS Fields

The following table identifies the Events field names that the Log Forwarding app uses when you forward logs using the HTTPS log format.

HTTPS Name	Query Name	Field Type
ApplicationAccountInventoryId	application.account_inventory_id	string
ApplicationAppCategory	application.app_category	string
ApplicationAppSubcategory	application.app_sub_category	string
ApplicationAccountChannelId	application.application_account.channel_id	string
ApplicationAccountDisplayValue	application.application_account.displayed_value	string
ApplicationAccountDomain	application.application_account.domain	string
ApplicationAccountRegion	application.application_account.region	string
ApplicationAccountTenantId	application.application_account.tenant_id	string
ApplicationAccountWorkspaceName	application.application_account.workspace_name	string
ApplicationAccountId	application.application_account_identifier	string
ApplicationClassification	application.classification	string
ApplicationCredentialType	application.credential_type	string
ApplicationExternalID	application.external_id	string
ApplicationExternalName	application.external_name	string
ApplicationID	application.id	string
ApplicationIdentityProviderUrl	application.identity_provider_url	string
IsGenAi	application.is_gen_ai	boolean
ApplicationLocalDesktopFileDescription	application.local_desktop.file_description	string
ApplicationLocalDesktopIconId	application.local_desktop.icon_id	string
ApplicationLocalDesktopOriginalFileName	application.local_desktop.original_file_name	string
ApplicationLocalDesktopParentProcessPath	application.local_desktop.parent_process_path	string
ApplicationLocalDesktopProcessPath	application.local_desktop.process_path	string
ApplicationLocalDesktopProductName	application.local_desktop.product_name	string
ApplicationLocalDesktopThumbprint	application.local_desktop.thumbprint	string
ApplicationLocalDesktopWindowTitle	application.local_desktop.window_title	string
ApplicationLoginId	application.login_id	string
ApplicationLoginMethod	application.login_method	string
ApplicationName	application.name	string
ApplicationProtectedAccount	application.protected_account	boolean
ApplicationReputation	application.reputation	int
ApplicationReputationRisk	application.reputation_risk	string
ApplicationRiskOfApp	application.risk_of_app	int
ApplicationServiceProviderUrl	application.service_provider_url	string
ApplicationSource	application.source	string
ApplicationTags	application.tags	array
ApplicationUsecases	application.use_cases	array
ApplicationUsername	application.username	string
ApplicationWebauthnAuthenticator	application.webauthn.authenticator	string
ApplicationWebauthnAuthenticatorAttachment	application.webauthn.authenticator_attachment	string
ApplicationWebauthnCredentialId	application.webauthn.credential_id	string
ApplicationWebauthnErrorMessage	application.webauthn.error.message	string
ApplicationWebauthnErrorName	application.webauthn.error.name	string
ApplicationWebauthnRelyingPartyId	application.webauthn.relying_party_id	string
ApplicationWebauthnUserHandle	application.webauthn.user_handle	string
AuthSsoProvider	auth.sso_provider	string
BatchID	batch_id	string
BrowserExtensionAppLaunchURL	browser_extension.app_launch_url	string
BrowserExtensionAvailableLaunchTypes	browser_extension.available_launch_types	array
BrowserExtensionDescription	browser_extension.description	string
BrowserExtensionDisabledReason	browser_extension.disabled_reason	string
BrowserExtensionEnabled	browser_extension.enabled	boolean
BrowserExtensionHomepageURL	browser_extension.homepage_url	string
BrowserExtensionHostPermissions	browser_extension.host_permissions	array
BrowserExtensionID	browser_extension.id	string
BrowserExtensionInstallType	browser_extension.install_type	string
BrowserExtensionIsApp	browser_extension.is_app	boolean
BrowserExtensionLaunchType	browser_extension.launch_type	string
BrowserExtensionMayDisable	browser_extension.may_disable	boolean
BrowserExtensionName	browser_extension.name	string
BrowserExtensionOfflineEnabled	browser_extension.offline_enabled	boolean
BrowserExtensionOptionsURL	browser_extension.options_url	string
BrowserExtensionPermissions	browser_extension.permissions	array
BrowserExtensionShortName	browser_extension.short_name	string
BrowserExtensionType	browser_extension.type	string
BrowserExtensionUpdateURL	browser_extension.update_url	string
BrowserExtensionVersion	browser_extension.version	string
CertificateCreatedTime	certificate.created_time	timestamp
CertificateExpirationTime	certificate.expiration_time	timestamp
CertificateFingerprints	certificate.fingerprints	array
CertificateIssuer	certificate.issuer	string
CertificateSerialNumber	certificate.serial_number	string
CertificateSubject	certificate.subject	string
ClassificationCategory	classification.category	string
ClassificationMaliciousCategories	classification.malicious_categories	array
ClassificationMITRE	classification.mitre	array
ClassificationReputation	classification.reputation	long
ClassificationSecurityCompliance	classification.security_compliance	array
ClassificationSeverity	classification.severity	string
ClipboardFromLocalDesktopAppFileDescription	clipboard.from_local_desktop_app.file_description	string
ClipboardFromLocalDesktopAppIconId	clipboard.from_local_desktop_app.icon_id	string
ClipboardFromLocalDesktopAppOriginalFileName	clipboard.from_local_desktop_app.original_file_name	string
ClipboardFromLocalDesktopAppParentProcessPath	clipboard.from_local_desktop_app.parent_process_path	string
ClipboardFromLocalDesktopAppProcessPath	clipboard.from_local_desktop_app.process_path	string
ClipboardFromLocalDesktopAppProductName	clipboard.from_local_desktop_app.product_name	string
ClipboardFromLocalDesktopAppThumbprint	clipboard.from_local_desktop_app.thumbprint	string
ClipboardFromLocalDesktopAppWindowTitle	clipboard.from_local_desktop_app.window_title	string
ClipboardFromURL	clipboard.from_url	string
ClipboardSearchEngine	clipboard.search_engine	string
ClipboardSelectedElement	clipboard.selected_element	string
ContentCategories	content.categories	array
ContentLengthBytes	content.length_bytes	long
ContentLiveScanningDetectionId	content.live_scanning.detection_id	string
ContentLiveScanningMaliciousUrl	content.live_scanning.malicious_content_url	string
ContentLiveScanningMaliciousObject	content.live_scanning.malicious_object	string
ContentLiveScanningMethod	content.live_scanning.scan_method	string
ContentLiveScanningTriggeredBy	content.live_scanning.triggered_by	string
ContentMIPMatchedLabel	content.mip_matched_label	string
ContentScanEngine	content.scan_engine	string
ContentSensitiveDataCategories	content.sensitive_data_categories	array
ContentSourceElementSelector	content.source_element_selector	string
ContentSourceURL	content.source_url	string
ContentTraceId	content.trace_id	string
CortexDataLakeTenantID	customer_id	string
DeviceAgentID	device.agent_id	string
DeviceBrowserBrand	device.browser_brand	string
DeviceBrowserProcessID	device.browser_process_id	string
DeviceBrowserType	device.browser_type	string
DeviceBrowserVersion	device.browser_version	string
DeviceCortexAgentID	device.cortex_agent_id	string
DeviceCountry	device.country	string
DeviceUUID	device.device_uuid	string
DeviceDiskEncryptionStatus	device.disk_encryption_status	string
DeviceEPPStatus	device.epp_status	string
DeviceExtensionVersion	device.extension_version	string
DeviceFirewallStatus	device.firewall_status	string
DeviceGeoIPFromCityName	device.geoip_from_city_name	string
DeviceGeoIPFromCountryName	device.geoip_from_country_name	string
DeviceGeoIPFromLocationLatitude	device.geoip_from_location_latitude	float
DeviceGeoIPFromLocationLongitude	device.geoip_from_location_longitude	float
DeviceGroupsIDs	device.groups.ids	array
DeviceGroupsNames	device.groups.names	array
DeviceHostname	device.hostname	string
DeviceIPAddress	device.ip_address	string
DeviceIsProcessPrivilegedElevated	device.is_process_privileged_elevated	boolean
DeviceIsRunningInVm	device.is_running_in_vm	boolean
DeviceIsSystemInstall	device.is_system_install	boolean
DeviceIsUserAdmin	device.is_user_admin	boolean
DeviceLocalIps	device.local_ips	array
DeviceMACAddresses	device.mac_addresses	array
DeviceModel	device.model	string
DeviceOSAndroidBuild	device.os.android.build	string
DeviceOSAndroidPatch	device.os.android.patch	string
DeviceOSAndroidRelease	device.os.android.release	string
DeviceOSAndroidSDK	device.os.android.sdk	string
DeviceOsChromeOsBuild	device.os.chrome_os.build	string
DeviceOsChromeOsMajor	device.os.chrome_os.major	string
DeviceOsChromeOsMinor	device.os.chrome_os.minor	string
DeviceOSiOSMajor	device.os.ios.major	string
DeviceOSiOSMinor	device.os.ios.minor	string
DeviceOSiOSPatch	device.os.ios.patch	string
DeviceOsLinuxId	device.os.linux.id	string
DeviceOsLinuxIdLike	device.os.linux.id_like	string
DeviceOsLinuxName	device.os.linux.name	string
DeviceOsLinuxPrettyName	device.os.linux.pretty_name	string
DeviceOsLinuxVersion	device.os.linux.version	string
DeviceOsLinuxVersionId	device.os.linux.version_id	string
DeviceOSmacOSBugfix	device.os.macos.bugfix	string
DeviceOSmacOSBuild	device.os.macos.build	string
DeviceOsMacosIntegrityInfoGatekeeperEnabled	device.os.macos.integrity_info.gatekeeper_enabled	boolean
DeviceOsMacosIntegrityInfoSipEnabled	device.os.macos.integrity_info.sip_enabled	boolean
DeviceOSmacOSMajor	device.os.macos.major	string
DeviceOSmacOSMinor	device.os.macos.minor	string
DeviceOSmacOSServer	device.os.macos.server	boolean
DeviceOSType	device.os.type	string
DeviceOSWindowsBuild	device.os.windows.build	string
DeviceOsWindowsIntegrityInfoDriversSigningEnforced	device.os.windows.integrity_info.drivers_signing_enforced	boolean
DeviceOsWindowsIntegrityInfoKernelDebuggerNotPresent	device.os.windows.integrity_info.kernel_debugger_not_present	boolean
DeviceOsWindowsIntegrityInfoSecureBootEnabled	device.os.windows.integrity_info.secure_boot_enabled	boolean
DeviceOSWindowsMajor	device.os.windows.major	string
DeviceOSWindowsMinor	device.os.windows.minor	string
DeviceOSWindowsPatch	device.os.windows.patch	string
DeviceOSWindowsProduct	device.os.windows.product	string
DeviceOSDisplayName	device.os_display_name	string
DevicePablVersion	device.pabl_version	string
DevicePublicIp	device.public_ip	string
DeviceRawUniversalID	device.raw_universal_id	string
DeviceScreenLockStatus	device.screen_lock_status	string
DeviceSerialNumber	device.serial_number	string
DeviceType	device.type	string
DeviceUserAgent	device.user_agent	string
DlpDetectedClassifiers	dlp.detected_classifiers	array
DlpDetectedClassifiersConfidence	dlp.detected_classifiers_confidence	array
DlpDetectedClassifiersOccurrences	dlp.detected_classifiers_occurrences	array
DlpMatchedClassifiers	dlp.matched_classifiers	array
DlpMatchedClassifiersConfidence	dlp.matched_classifiers_confidence	array
DlpMatchedClassifiersOccurrences	dlp.matched_classifiers_occurrences	array
DlpMatchedDataProfiles	dlp.matched_data_profiles	array
DlpParentDataProfile	dlp.parent_data_profile	string
ExtensionRiskInitiator	extension_risk.initiator	string
ExtensionRiskRisk	extension_risk.risk	string
ExtensionRiskTrigger	extension_risk.trigger	string
FileExtension	file.extension	string
FileIsEncrypted	file.is_encrypted	boolean
FileLocalPath	file.local_path	string
FileMimeType	file.mime_type	string
FileName	file.name	string
FileOperation	file.operation	string
FileOriginDownloadURL	file.origin_download_url	string
FileSHA256	file.sha256	string
FileURL	file.url	string
GenAiPromptEmbeddedGenAi	gen_ai_prompt.embedded_gen_ai	string
GenAiPromptIncludedFiles	gen_ai_prompt.included_files	array
GenAiPromptIsPromptCollected	gen_ai_prompt.is_prompt_collected	boolean
GenAiPromptPrompt	gen_ai_prompt.prompt	string
ID	id	string
LogSource	log_source	string
LogSourceGroupID	log_source_group_id	string
DeviceSN	log_source_id	string
DeviceName	log_source_name	string
TimeReceived	log_time	timestamp
LogType	log_type.value	string
Miscellaneous	misc	string
NetworkClassifications	network.classifications	array
NetworkFrameURL	network.frame_url	string
NetworkHTTPMethod	network.http.method	string
NetworkHTTPStatus	network.http.status	int
NetworkProtocol	network.protocol	string
NetworkQueryParams	network.query_params	string
NetworkRedirectDestinationUrl	network.redirect_destination_url	string
NetworkRemoteConnectionProtocol	network.remote_connection_protocol	string
NetworkTabURL	network.tab_url	string
NetworkTunneledThroughPa	network.tunneled_through_pa	boolean
NetworkURL	network.url	string
NetworkWebRiskLevel	network.web_risk_level	string
NetworkWebScanEngine	network.web_scan_engine	string
NetworkWebScanEngines	network.web_scan_engines	array
PageCaptureIsSecureScreenshot	page.capture.is_secure_screenshot	boolean
PageCaptureTriggeredByURL	page.capture.triggered_by_url	string
PageDevtoolsBlockReason	page.devtools.block_reason	string
PageTitle	page.title	string
PasswordManagerImportCount	password_manager.import.count	int
PasswordManagerImportSource	password_manager.import.source	string
PasswordManagerLoginChanges	password_manager.login.changes	array
PasswordManagerLoginIsManaged	password_manager.login.is_managed	boolean
PasswordManagerLoginMethod	password_manager.login.method	string
PasswordManagerLoginName	password_manager.login.name	string
PasswordManagerLoginRetrievedMethod	password_manager.login.retrieved_method	string
PasswordManagerLoginRisks	password_manager.login.risks	array
PasswordManagerLoginSharingTargetGroups	password_manager.login.sharing.target.groups	array
PasswordManagerLoginSharingTargetUsers	password_manager.login.sharing.target.users	array
PasswordManagerLoginUrls	password_manager.login.urls	array
PasswordManagerLoginUser	password_manager.login.user	string
PincodeFailedAttempts	pincode.failed_attempts	long
PincodeRegistrationTime	pincode.registration_time	timestamp
PlatformType	platform_type	string
PolicyAction	policy.action	string
PolicyBlockReason	policy.block_reason	string
PolicyBypassAllowed	policy.bypass_allowed	boolean
PolicyBypassReason	policy.bypass_reason	string
PolicyBypassRequestId	policy.bypass_request_id	string
PolicyDefinedAction	policy.defined_action	string
PolicyEvidenceFullSessionRecording	policy.evidence.full_session_recording	boolean
PolicyEvidenceFullSessionRecordingId	policy.evidence.full_session_recording_id	string
PolicyEvidenceFullSessionRecordingStatus	policy.evidence.full_session_recording_status	string
PolicyEvidenceScreenshot	policy.evidence.screenshot	boolean
PolicyEvidenceTypes	policy.evidence.types	array
PolicyFailureReason	policy.failure_reason	string
PolicyIsHistorical	policy.is_historical	boolean
PolicyIsMonitor	policy.is_monitor	boolean
PolicyIsRecordingExist	policy.is_recording_exist	boolean
PolicyIsSessionRecorded	policy.is_session_recorded	boolean
PolicyIsWecEnabled	policy.is_wec_enabled	boolean
PolicyRuleDescription	policy.rule_description	string
PolicyRuleID	policy.rule_id	string
PolicyRuleLogLevel	policy.rule_log_level	string
PolicyShouldLogQueryParams	policy.should_log_query_params	boolean
PostureBlockReason	posture.block_reason	string
PostureBlockType	posture.block_type	string
PostureError	posture.error	string
PostureSuspensionType	posture.suspension_type	string
PrintPrinterLocation	print.printer_location	string
PrintPrinterName	print.printer_name	string
ProcessCLIArgs	process.cli_args	string
ProcessImagePath	process.image_path	string
ProcessParentProcess	process.parent_process	string
ProcessPID	process.pid	long
RceExploitSensor	rce_exploit.sensor	string
RceExploitUrl	rce_exploit.url	string
StateDeviceGroupEvaluation	state.device_group_evaluation	array
StateSignInRules	state.sign_in_rules	array
SubtenantID	sub_tenant_id	string
Subtype	sub_type.value	string
TamperingType	tampering.type	string
TenantID	tenant_id	string
TimeGenerated	time_generated	timestamp
TimeGeneratedHighResolution	time_generated_high_res	timestamp
Timestamp	timestamp	timestamp
TSGID	tsg_id	string
Type	type	string
UserEmail	user.email	string
UserExternalID	user.external_id	string
UserGroupsIDs	user.groups.ids	array
UserGroupsNames	user.groups.names	array
UserID	user.id	string
UserName	user.name	string
UserShortUsername	user.short_username	string
UserTenantExternalID	user.tenant_external_id	string
UserTenantID	user.tenant_id	string
UserTenantName	user.tenant_name	string
UserTSGID	user.tsg_id	string
VendorName	vendor_name	string

Events EMAIL Fields

Events LEEF Fields

Strata Logging Service Docs

Events HTTPS Fields

Strata Logging Service Docs

Events HTTPS Fields

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Endpoints

Visibility & Monitoring

Best Practices

Experts Corner