Configuration Messages

Configuration Messages

Base Rule

Configuration

Configuration Modified : System

N/A

N/A

N/A

deviceVendor

N/A

N/A

N/A

deviceProduct

N/A

N/A

N/A

Version

N/A

<vmid>

Text/String

LogType

N/A

N/A

N/A

SubType

N/A

<severity>

Number

deviceSeverity

ProfileToken

N/A

N/A

N/A

dtz

N/A

N/A

N/A

rt

N/A

N/A

Time the log was received in Cortex Data Lake. This is populated by the platform.

deviceExternalId

<serialnumber>

Text/String/Number

ID that uniquely identifies the source of the log. If the source is a firewall, this is its serial number. If the source is TMS, this is the trapsID.

PanOSEventTime

N/A

N/A

Time when the log was generated on the firewall's data plane. This string contains a timestamp value that is the number of microseconds since the Unix epoch.

dusername

N/A

N/A

Username of the administrator performing the configuration.

dntdom

<domainorigin>

Text/String

Domain to which the admin user belongs.

duid

<login>

Text/String

The admin user's unique ID.

PanOSEventDetails

N/A

N/A

Identifies the firewall's configuration prior to and immediately after the configuration change.

PanOSIsDuplicateLog

N/A

N/A

Indicates whether this log data is available in multiple locations, such as from Cortex Data Lake as well as from an on-premise log collector.

PanOSIsPrismaNetwork

N/A

N/A

If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.

PanOSIsPrismaUsers

N/A

N/A

If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise.

cat

<vendorinfo>

Text/String

The log category.

PanOSLogExported

N/A

N/A

Indicates if this log was exported from the firewall using the firewall's log export function.

PanOSLogSource

N/A

N/A

Identifies the origin of the data. That is, the system that produced the data.

PanOSLogSourceTimeZoneOffset

N/A

N/A

Time Zone offset from GMT of the source of the log.

PanOSSeverity

N/A

N/A

Severity as defined by the platform.

PanOSTenantID

N/A

N/A

The ID that uniquely identifies the Cortex Data Lake instance which received this log record.

PanOSVirtualSystemID

N/A

N/A

A unique identifier for a virtual system on a Palo Alto Networks firewall.

src

<sip>

IP Address

Hostname or IP address of the client.

cs3

N/A

N/A

String representation of the unique identifier for a virtual system on a Palo Alto Networks firewall.

cs3Label

N/A

N/A

N/A

act

<command>

Text/String

Name of the system event.

duser0 or dusername0

<account>

Text/String

Name of the user who created the configuration change.

destinationServiceName

<process>

Text/String

Client used by the administrator who is performing the configuration.

PanOSEventResult

<result>

Text/String

Result of the configuration action.

msg

<object>

Text/String

The path of the configuration command issued.

externalId

N/A

N/A

The log entry identifier, which is incremented sequentially. Each log type has a unique number space.

PanOSDGHierarchyLevel1

N/A

N/A

A sequence of identification numbers that indicate the device group’s location within a device group hierarchy.

PanOSDGHierarchyLevel2

N/A

N/A

A sequence of identification numbers that indicate the device group’s location within a device group hierarchy.

PanOSDGHierarchyLevel3

N/A

N/A

A sequence of identification numbers that indicate the device group’s location within a device group hierarchy.

PanOSDGHierarchyLevel4

N/A

N/A

A sequence of identification numbers that indicate the device group’s location within a device group hierarchy.

PanOSVirtualSystemName

N/A

N/A

The name of the virtual system associated with the network traffic.

dvchost

N/A

N/A

Name of the source of the log. If the source is a firewall, this is the device_name value. If the source is TMS, this is either the customer or tenant name.

PanOSEventDescription

N/A

N/A

Description of the system event. If the source is a firewall, this is opaque. If the source is TMS, this is the msgTextEn field.

PanOSTimeGeneratedHighResolution

N/A

N/A

Time the log was generated in data plane with millisec granularity in format YYYY-MM-DDTHH.

PanOSVendorSeverity

N/A

N/A

Severity associated with the event.

PanOSTemplate

N/A

N/A

The ID and name of the template/template stack to which the firewall belonged where the log was generated.

PanOSConfigVersion

N/A

N/A

Config version converted to string represented as major.minor.patch.build in value and as hex in ID.

PanOSDeviceGroup

N/A

N/A

The ID and the name of the device group the firewall is in.