Remote Browser Isolation LEEF Fields

Table of Contents

Remote Browser Isolation LEEF Fields

The following table identifies the Remote Browser Isolation field names that the Log Forwarding app uses when you forward logs using the LEEF log format.

When you create a syslog forwarding profile , you can optionally create a profile token that the Log Forwarding app uses when it sends logs to the syslog server. If you configure a profile token, it appears in the log line immediately after the log type information (for example, TRAFFIC, THREAT, HIPMATCH, and so forth). The token will appear on a parameter called profileToken.

LEEF Name	Query Name	Field Type
Action	action.value	Custom
BHName	bh_name	Custom
BrowserType	browser_type	Custom
ClientId	client_id	Custom
ClientIP	client_ip.value	Custom
SessionDuration	connected_duration	Custom
CortexDataLakeTenantID	customer_id	Custom
DataSize	data_size	Custom
DisconnectReason	disconnect_reason.value	Custom
EdgeLocation	edge_location	Custom
EventSeverity	event_severity.value	Custom
EventSubType	event_sub_type.value	Custom
EventType	event_type.value	Custom
FileName	file_name	Custom
IssueDetails	issue_details	Custom
LogSource	log_source	Custom
LogSourceGroupID	log_source_group_id	Custom
DeviceSN	log_source_id	Custom
DeviceName	log_source_name	Custom
TimeReceived	log_time	Custom
LogType	log_type.value	Custom
OSType	os_type	Custom
PlatformType	platform_type	Custom
SubType	sub_type.value	Custom
TimeGenerated	time_generated	Custom
TimeGeneratedHighResolution	time_generated_high_res	Custom
URL	url	Custom
SourceUser	user_id	Custom
VendorName	vendor_name	Custom

Remote Browser Isolation HTTPS Fields

SCTP

Strata Logging Service Docs

Remote Browser Isolation LEEF Fields

Strata Logging Service Docs

Remote Browser Isolation LEEF Fields

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Endpoints

Visibility & Monitoring

Best Practices

Experts Corner