Palo Alto Fields

Palo Alto Fields
Field Name Example Values Field Type Notes
pan_alert_direction   Keyword Indicates the direction of the attack, client-to-server or server-to-client: 0—direction of the threat is client to server. 1—direction of the threat is server to client
pan_after_change_detail   Keyword This field is in custom logs only; it is not in the default format. - It contains the full xpath after the configuration change.
pan_assoc_id   Keyword Number to idetify all connections for an association between to SCTP endpoints
pan_auth_method   Keyword A string showing the authentication type, such as LDAP, RADIUS or SAML
pan_before_change_detail   Keyword This field is in custom logs only; it is not in the default format. - It contains the full xpath after the configuration change.
pan_cloud_hostname   Keyword FQDN of WildFire appliance or Cloud where file was uploaded
pan_dev_group_level_[1-4]   Keyword ID Numbers that indicate the device groups location within DG Hierarchy
pan_dynusergroup_name   Keyword Name of the dynamic user group that contains the user who initiated the session.
pan_event_name   Keyword String showing the name of the event.
pan_event_object   Keyword Name of the object associated with the system event.
pan_evidence   Keyword A summary statement that indicates how many times the host has matched against the conditions defined in the correlation object. For example, Host visited known malware URl (19 times).
pan_flags   Keyword 32-bit field that provides details on session
pan_gp_client_version   Keyword The client’s GlobalProtect app version.
pan_gp_connect_method   Keyword A string showing the how the GlobalProtect app connects to Gateway, (for example, on-demand or user-login)
pan_gp_error   Keyword A string showing that error that has occurred in any event.
pan_gp_error_code   Keyword An integer associated with any errors that occurred
pan_gp_error_extended   Keyword Additional information for any event that has occurred.
pan_gp_hostname   Keyword The name of the GlobalProtect portal or gateway.
pan_gp_hostid   Keyword Unique ID GlobalProtect assigns to identify the host.
pan_gp_location_name   Keyword A string showing the administrator-defined location of the GlobalProtect portal or gateway.
pan_gp_reason   Keyword A string that shows the reason for the quarantine
pan_hip   Keyword Name of the HIP object or profile.
pan_hip_type   Keyword Whether the hip field represents a HIP object or a HIP profile.
pan_http2   Byte Identifies if traffic used an HTTP/2 Connection by displaying one of the following values: Parent session ID—HTTP/2 connection. OR. 0—SSL session
pan_link_changes   Keyword Number of link flaps during session
pan_link_switches   Keyword Contains up to four link flap entries, with each entry containing the link name, link tag, link type, physical interface, timestamp, bytes read, bytes written, link health, and link flap cause.
pan_log_action   Keyword Log Forwarding Profile Applied to Session
pan_log_panorama   Byte A bit field indicating if the log was forwarded to Panorama
pan_log_subtype   Keyword Subtype of Given Log
pan_module   Keyword It provides additional information about the sub-system generating the log
pan_monitor_tag   Keyword IMEI 15/16 Digit number
pan_object_id   Keyword Name of the object associated with the system event.
pan_objectname   Keyword Name of the correlation object that was matched on.
pan_parent_session_id   Keyword ID of the session in which this session is tunneled
pan_parent_start_time   Keyword Time the Tunnel Session began
pan_pcap_id   Keyword Packet Capture ID
pan_ppid   Keyword ID of the protocol for the payload of the data chunk
pan_sctp_chunks_sum   Keyword Sum of SCTP chunks sent and received for an association.
pan_sctp_chunks_tx   Keyword Number of SCTP chunks sent for an association.
pan_sctp_chunks_rx   Keyword Number of SCTP chunks received for an association.
pan_sdwan_cluster   Keyword Name of the SD-WAN cluster.
pan_sdwan_cluster_type   Keyword Type of cluster (mesh or hub-spoke)
pan_sdwan_device_type   Keyword Type of device (hub or branch)
pan_sdwan_policy_id   Keyword Name of the SD-WAN policy.
pan_sdwan_site_name   Keyword Name of the SD-WAN site
pan_session_end_reason     The reason the session was terminated
pan_source_region   Keyword The region for the user who initiated the session.
pan_tunnel_id   Keyword International Mobile Subscriber Identity Number
pan_tunnel_stage   Keyword A string showing the stage of the connection (for example, before-login, login, or tunnel)
pan_url_index   Keyword Counter allowing you to correlate order of log entries in URL Filtering/WildFire
pan_wildfire_hash   Keyword Binary Hash of file sent to WildFire
pan_wildfire_report_id   Keyword Identifies the analysis request on Wildfire Cloud/Appliance