GlobalProtect Status Messages

GlobalProtect Status Messages

Base Rule

Other Audit

General Authentication Event

Remote Authentication Failure

Sub Rule

Authentication Failure

User Logon Failure

Remote Authentication Success

Sub Rule

Authentication Success

User Logon

Remote Session Logoff

Sub Rule

Authentication Success

User Logoff

N/A

 N/A

N/A

deviceVendor

N/A

N/A 

N/A

deviceProduct

N/A

N/A 

N/A

Version

N/A

<vmid>

Text/String

LogType

N/A

N/A 

N/A

SubType

N/A

<severity>

Number

deviceSeverity

ProfileToken

N/A

N/A

 N/A

dtz

N/A

N/A

 N/A

rt

N/A

N/A

Time the log was received in Cortex Data Lake. This string contains a timestamp value that is the number of microseconds since the Unix epoch.

PanOSDeviceSN

N/A

N/A

ID that uniquely identifies the source of the log. That is, the serial number of the firewall that generated the log.

PanOSConfigVersion

N/A

N/A

Version number of the firewall operating system that wrote this log record.

start

N/A

N/A

Time when the log was generated on the firewall's data plane. This string contains a timestamp value that is the number of microseconds since the Unix epoch.

PanOSVirtualSystem

N/A

N/A

String representation of the unique identifier for a virtual system on a Palo Alto Networks firewall.

PanOSEventIDValue

N/A

N/A

The name of the event.

PanOSStage

<status>
<tag1>

Text/String

Name of the stage in the GlobalProtect connection workflow.

PanOSAuthMethod

 N/A

N/A

Authentication method used for the GlobalProtect connection.

PanOSTunnelType

 N/A

N/A

Tunnel Type i.e. SSL or VPN.

PanOSSourceUserName

<login>

Text/String

The username that connected.

PanOSSourceRegion

N/A

N/A

Region of the Gateway (or User) that connected.

PanOSEndpointDeviceName

<sname>

Text/String

Name of the device that the user used for the connection.

PanOSPublicIPv4

<sip>

IP Address

Public IP address (v4) of the user that connected.

PanOSPublicIPv6

<sip>

IP Address

Public IP address (v6) of the user that connected.

PanOSPrivateIPv4

<snatip>

IP Address

Private IP address (v4) of the user that connected.

PanOSPrivateIPv6

<snatip>

IP Address

Private IP address (v6) of the user that connected.

PanOSHostID

N/A

N/A

Unique identifier GlobalProtect has assigned to the host.

PanOSEndpointSN

N/A

N/A

ID that uniquely identifies the endpoint on which the GlobalProtect client is deployed.

PanOSGlobalProtectClientVersion

<version>

Text/String

GlobalProtect client version number.

PanOSEndpointOSType

N/A

N/A

OS type of the endpoint on which the GlobalProtect client is deployed.

PanOSEndpointOSVersion

N/A

N/A

OS version of the endpoint on which the GlobalProtect client is deployed.

PanOSRepeatCount

N/A

N/A

Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.

PanOSQuarantineReason

<reason>

Text/String

Quarantine reason.

PanOSConnectionError

 N/A

N/A

Error information for unsuccessful connection.

PanOSDescription

<vendorinfo>

Text/String

Additional information regarding the event.

PanOSEventStatus

<result>
<tag2>

Text/String

The status (success or failure) of the event.

PanOSGlobalProtectGatewayLocation

 N/A

N/A

Location of the Global Protect Gateway.

PanOSLoginDuration

<seconds>

Number

Duration for which the connected user was logged on.

PanOSConnectionMethod

 N/A

N/A

Identifies how the GlobalProtect app connected to the the Gateway. For example, on-demand or user-logon.

PanOSConnectionErrorID

 N/A

N/A

Enumeration integer assigned to the connection_error field value.

PanOSPortal

 N/A

N/A

Global Protect Portal or Gateway that the user connected to.

PanOSSequenceNo

<serialnumber>

Number

The log entry identifier, which is incremented sequentially. Each log type has a unique number space.

PanOSTimeGeneratedHighResolution

N/A

N/A

Time the log was generated in data plane with millisec granularity in format YYYY-MM-DDTHH

PanOSGatewaySelectionType

N/A

N/A

Gateway Selection Method i.e automatic, preferred or manual.

PanOSSSLResponseTime

N/A

N/A

SSL Response Time in milliseconds.

PanOSGatewayPriority

N/A

N/A

Priority of gateway, retrieved from portal configuration.

PanOSAttemptedGateways

N/A

N/A

String of all gateways that were available and attempted for the client location. Contains gateway name, ssl response time, and priority, separated by a semicolon.

PanOSGateway

N/A

N/A

Selected Gateway for the connection.

PanOSDGHierarchyLevel1

N/A

N/A

A sequence of identification numbers that indicate the device group’s location within a device group hierarchy.

PanOSDGHierarchyLevel2

N/A

N/A

A sequence of identification numbers that indicate the device group’s location within a device group hierarchy.

PanOSDGHierarchyLevel3

N/A

N/A

A sequence of identification numbers that indicate the device group’s location within a device group hierarchy.

PanOSDGHierarchyLevel4

N/A

N/A

A sequence of identification numbers that indicate the device group’s location within a device group hierarchy.

PanOSVirtualSystemName

N/A

N/A

The name of the virtual system associated with the network traffic.

PanOSDeviceName

N/A

N/A

Name of the source of the log. That is, the hostname of the firewall that logged the network traffic.

PanOSVirtualSystemID

N/A

N/A

A unique identifier for a virtual system on a Palo Alto Networks firewall.

PanOSCortexDataLakeTenantID

N/A

N/A

The ID that uniquely identifies the Cortex Data Lake instance which received this log record.

PanOSIsDuplicateLog

N/A

N/A

Indicates whether this log data is available in multiple locations, such as from Cortex Data Lake as well as from an on-premise log collector.

PanOSLogExported

N/A

N/A

Indicates if this log was exported from the firewall using the firewall's log export function.

PanOSLogForwarded

N/A

N/A

Internal-use field that indicates if the log is being forwarded.

PanOSIsPrismaNetworks

N/A

N/A

Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.

PanOSIsPrismaUsers

N/A

N/A

Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise.

PanOSLogSource

N/A

N/A

Identifies the origin of the data. That is, the system that produced the data.

PanOSLogSourceTimeZoneOffset

N/A

N/A

Time Zone offset from GMT of the source of the log.

sntdom

<domainorigin>

Text/String

Domain to which the Source User belongs.

suser/susername

<login>

Text/String

The Source User. That is, the username that initiated the network traffic.

suid, duid

 N/A

N/A

Unique identifier assigned to the Source User.

dntdom

<domainimpacted>

Text/String

Domain to which the destination User belongs.

dusername

<account>

Text/String

The Destination User. That is, the username to which the network traffic was destined.

shost

<sname>

Text/String

Name of the device that the user used for the connection.