GlobalProtect Status Messages
Vendor Documentation
Classification
| Rule Name | Rule Type | Classification | Common Event |
|---|---|---|---|
| GlobalProtect Status Messages | Base Rule | Other Audit | General Authentication Event |
| Remote Authentication Failure | Sub Rule | Authentication Failure | User Logon Failure |
| Remote Authentication Success | Sub Rule | Authentication Success | User Logon |
| Remote Session Logoff | Sub Rule | Authentication Success | User Logoff |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
|---|---|---|---|
| N/A | N/A | N/A | deviceVendor |
| N/A | N/A | N/A | deviceProduct |
| N/A | N/A | N/A | Version |
| N/A | <vmid> | Text/String | LogType |
| N/A | N/A | N/A | SubType |
| N/A | <severity> | Number | deviceSeverity |
| ProfileToken | N/A | N/A | N/A |
| dtz | N/A | N/A | N/A |
| rt | N/A | N/A | Time the log was received in Cortex Data Lake. This string contains a timestamp value that is the number of microseconds since the Unix epoch. |
| PanOSDeviceSN | N/A | N/A | ID that uniquely identifies the source of the log. That is, the serial number of the firewall that generated the log. |
| PanOSConfigVersion | N/A | N/A | Version number of the firewall operating system that wrote this log record. |
| start | N/A | N/A | Time when the log was generated on the firewall's data plane. This string contains a timestamp value that is the number of microseconds since the Unix epoch. |
| PanOSVirtualSystem | N/A | N/A | String representation of the unique identifier for a virtual system on a Palo Alto Networks firewall. |
| PanOSEventIDValue | N/A | N/A | The name of the event. |
| PanOSStage | <status> <tag1> | Text/String | Name of the stage in the GlobalProtect connection workflow. |
| PanOSAuthMethod | N/A | N/A | Authentication method used for the GlobalProtect connection. |
| PanOSTunnelType | N/A | N/A | Tunnel Type i.e. SSL or VPN. |
| PanOSSourceUserName | <login> | Text/String | The username that connected. |
| PanOSSourceRegion | N/A | N/A | Region of the Gateway (or User) that connected. |
| PanOSEndpointDeviceName | <sname> | Text/String | Name of the device that the user used for the connection. |
| PanOSPublicIPv4 | <sip> | IP Address | Public IP address (v4) of the user that connected. |
| PanOSPublicIPv6 | <sip> | IP Address | Public IP address (v6) of the user that connected. |
| PanOSPrivateIPv4 | <snatip> | IP Address | Private IP address (v4) of the user that connected. |
| PanOSPrivateIPv6 | <snatip> | IP Address | Private IP address (v6) of the user that connected. |
| PanOSHostID | N/A | N/A | Unique identifier GlobalProtect has assigned to the host. |
| PanOSEndpointSN | N/A | N/A | ID that uniquely identifies the endpoint on which the GlobalProtect client is deployed. |
| PanOSGlobalProtectClientVersion | N/A | N/A | GlobalProtect client version number. |
| PanOSEndpointOSType | N/A | N/A | OS type of the endpoint on which the GlobalProtect client is deployed. |
| PanOSEndpointOSVersion | N/A | N/A | OS version of the endpoint on which the GlobalProtect client is deployed. |
| PanOSRepeatCount | N/A | N/A | Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval. |
| PanOSQuarantineReason | <reason> | Text/String | Quarantine reason. |
| PanOSConnectionError | N/A | N/A | Error information for unsuccessful connection. |
| PanOSDescription | <vendorinfo> | Text/String | Additional information regarding the event. |
| PanOSEventStatus | <result> <tag2> | Text/String | The status (success or failure) of the event. |
| PanOSGlobalProtectGatewayLocation | N/A | N/A | Location of the Global Protect Gateway. |
| PanOSLoginDuration | <seconds> | Number | Duration for which the connected user was logged on. |
| PanOSConnectionMethod | N/A | N/A | Identifies how the GlobalProtect app connected to the the Gateway. For example, on-demand or user-logon. |
| PanOSConnectionErrorID | N/A | N/A | Enumeration integer assigned to the connection_error field value. |
| PanOSPortal | N/A | N/A | Global Protect Portal or Gateway that the user connected to. |
| PanOSSequenceNo | <serialnumber> | Number | The log entry identifier, which is incremented sequentially. Each log type has a unique number space. |
| PanOSTimeGeneratedHighResolution | N/A | N/A | Time the log was generated in data plane with millisec granularity in format YYYY-MM-DDTHH |
| PanOSGatewaySelectionType | N/A | N/A | Gateway Selection Method i.e automatic, preferred or manual. |
| PanOSSSLResponseTime | N/A | N/A | SSL Response Time in milliseconds. |
| PanOSGatewayPriority | N/A | N/A | Priority of gateway, retrieved from portal configuration. |
| PanOSAttemptedGateways | N/A | N/A | String of all gateways that were available and attempted for the client location. Contains gateway name, ssl response time, and priority, separated by a semicolon. |
| PanOSGateway | N/A | N/A | Selected Gateway for the connection. |
| PanOSDGHierarchyLevel1 | N/A | N/A | A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. |
| PanOSDGHierarchyLevel2 | N/A | N/A | A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. |
| PanOSDGHierarchyLevel3 | N/A | N/A | A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. |
| PanOSDGHierarchyLevel4 | N/A | N/A | A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. |
| PanOSVirtualSystemName | N/A | N/A | The name of the virtual system associated with the network traffic. |
| PanOSDeviceName | N/A | N/A | Name of the source of the log. That is, the hostname of the firewall that logged the network traffic. |
| PanOSVirtualSystemID | N/A | N/A | A unique identifier for a virtual system on a Palo Alto Networks firewall. |
| PanOSCortexDataLakeTenantID | N/A | N/A | The ID that uniquely identifies the Cortex Data Lake instance which received this log record. |
| PanOSIsDuplicateLog | N/A | N/A | Indicates whether this log data is available in multiple locations, such as from Cortex Data Lake as well as from an on-premise log collector. |
| PanOSLogExported | N/A | N/A | Indicates if this log was exported from the firewall using the firewall's log export function. |
| PanOSLogForwarded | N/A | N/A | Internal-use field that indicates if the log is being forwarded. |
| PanOSIsPrismaNetworks | N/A | N/A | Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise. |
| PanOSIsPrismaUsers | N/A | N/A | Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise. |
| PanOSLogSource | N/A | N/A | Identifies the origin of the data. That is, the system that produced the data. |
| PanOSLogSourceTimeZoneOffset | N/A | N/A | Time Zone offset from GMT of the source of the log. |
| sntdom | <domainorigin> | Text/String | Domain to which the Source User belongs. |
| suser/susername | <login> | Text/String | The Source User. That is, the username that initiated the network traffic. |
| suid, duid | N/A | N/A | Unique identifier assigned to the Source User. |
| dntdom | <domainimpacted> | Text/String | Domain to which the destination User belongs. |
| dusername | <account> | Text/String | The Destination User. That is, the username to which the network traffic was destined. |
| shost | <sname> | Text/String | Name of the device that the user used for the connection. |