Host Profile Messages

Host Profile Messages

Base Rule

Information

General Profile Detection

 N/A

 N/A

N/A

deviceVendor

 N/A

 N/A

N/A

deviceProduct

 N/A

 N/A

N/A

Version

 N/A

<vmid>

Text/String

LogType

 N/A

 N/A

N/A

SubType

 N/A

<severity>

Number

deviceSeverity

ProfileToken

 N/A

N/A

dtz

 N/A

N/A

rt

 N/A

N/A

Time the log was received in Cortex Data Lake. This string contains a timestamp value that is the number of microseconds since the Unix epoch.

deviceExternalId

<serialnumber>

Text/String/Number

ID that uniquely identifies the source of the log. That is, the serial number of the firewall that generated the log.

PanOSIsDuplicateLog

 N/A

N/A

Indicates whether this log data is available in multiple locations, such as from Cortex Data Lake as well as from an on-premise log collector.

PanOSIsPrismaNetworks

 N/A

N/A

Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.

PanOSIsPrismaUsers

 N/A

N/A

Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise.

PanOSLogExported

 N/A

N/A

Indicates if this log was exported from the firewall using the firewall's log export function.

PanOSLogForwarded

 N/A

N/A

Internal-use field that indicates if the log is being forwarded.

PanOSLogSource

 N/A

N/A

Identifies the origin of the data. That is, the system that produced the data.

PanOSLogSourceTimeZoneOffset

 N/A

N/A

Time Zone offset from GMT of the source of the log.

PanOSSourceDeviceClass

N/A 

N/A

Source device class.

PanOSSourceDeviceOS

N/A 

N/A

Source device OS type.

sntdom

<domainorigin>

Text/String

Domain to which the Source User belongs.

dntdom

<domainimpacted>

Text/String

Domain to which the Destination User belongs.

susername

<login>

Text/String

The Source User. That is, the username that initiated the network traffic.

dusername

<account>

Text/String

The Destination User. That is, the username that initiated the network traffic.

suid

N/A 

N/A

Unique identifier assigned to the Source User.

duid

 N/A

N/A

Unique identifier assigned to the Source User.

PanOSCortexDataLakeTenantID

 N/A

N/A

The ID that uniquely identifies the Cortex Data Lake instance which received this log record.

PanOSUUID

 N/A

N/A

UUID.

PanOSConfigVersion

 N/A

N/A

Version number of the firewall operating system that wrote this log record.

start

N/A 

N/A

Time when the log was generated on the firewall's data plane. This string contains a timestamp value that is the number of microseconds since the Unix epoch.

PanOSSourceUser

 N/A

N/A

The username that initiated the network traffic.

cs3

 N/A

N/A

String representation of the unique identifier for a virtual system on a Palo Alto Networks firewall.

cs3Label

 N/A

N/A

shost

<sname>

Text/String

Name of the user’s machine.

dhost

<dname>

Text/String

cs2

N/A 

N/A

The operating system installed on the user’s machine or device (or on the client system).

cs2Label

 N/A

N/A

src

<sip>

IP Address

Original source IP address.

dst

<dip>

IP Address

cat

<object>

Text/String

Name of the HIP object or profile.

cnt

<quantity>

Number

Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.

PanOSHipMatchType

<objecttype>

Text/String

Identifies whether the hip field represents a HIP object or a HIP profile.

externalId

 N/A

N/A

The log entry identifier, which is incremented sequentially. Each log type has a unique number space.

PanOSDGHierarchyLevel1

 N/A

N/A

A sequence of identification numbers that indicate the device group’s location within a device group hierarchy.

PanOSDGHierarchyLevel2

 N/A

N/A

A sequence of identification numbers that indicate the device group’s location within a device group hierarchy.

PanOSDGHierarchyLevel3

N/A 

N/A

A sequence of identification numbers that indicate the device group’s location within a device group hierarchy.

PanOSDGHierarchyLevel4

 N/A

N/A

A sequence of identification numbers that indicate the device group’s location within a device group hierarchy.

PanOSVirtualSystemName

 N/A

N/A

The name of the virtual system associated with the network traffic.

dvchost

 N/A

N/A

Name of the source of the log. That is, the hostname of the firewall that logged the network traffic.

cn2

 N/A

N/A

A unique identifier for a virtual system on a Palo Alto Networks firewall.

cn2Label

 N/A

N/A

c6a1

 N/A

N/A

Source from which mapping information is collected.

c6a1Label

 N/A

N/A

PanOSHostID

 N/A

N/A

Unique identifier GlobalProtect has assigned to the host.

PanOSEndpointSerialNumber

 N/A

N/A

Serial number of the host on which GlobalProtect is installed.

PanOSSourceDeviceCategory

 N/A

N/A

Category of the device from which the session originated.

PanOSSourceDeviceProfile

 N/A

N/A

Profile of the device from which the session originated.

PanOSSourceDeviceModel

 N/A

N/A

Model of the device from which the session originated.

PanOSSourceDeviceVendor

N/A 

N/A

Vendor of the device from which the session originated.

PanOSSourceDeviceOSFamily

 N/A

N/A

OS family of the device from which the session originated.

PanOSSourceDeviceOSVersion

N/A 

N/A

OS version of the device from which the session originated.

PanOSSourceDeviceMac

<smac>

Text/String

MAC Address of the device from which the session originated.

PanOSSourceDeviceHost

 N/A

N/A

Hostname of the device from which the session originated.

PanOSSource

 N/A

N/A

Source.

PanOSTimestampDeviceIdentification

 N/A

N/A

Time the device was identified in format YYYY-MM-DDTHH

PanOSTimeGeneratedHighResolution

 N/A

N/A

Time the log was generated in data plane with millisec granularity in format YYYY-MM-DDTHH