| Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
|---|
| N/A | N/A | N/A | deviceVendor |
| N/A | N/A | N/A | deviceProduct |
| N/A | N/A | N/A | Version |
| N/A | <vmid> | Text/String | LogType |
| N/A | <command>
<tag1> | Text/String | SubType |
| N/A | <severity> | Number | deviceSeverity |
| ProfileToken | N/A | N/A | N/A |
| dtz | N/A | N/A | N/A |
| rt | N/A | N/A | Time the log was received in Cortex Data Lake. This string contains a timestamp value that is the number of microseconds since the Unix epoch. |
| deviceExternalId | <serialnumber> | Text/String/Number | ID that uniquely identifies the source of the log. That is, the serial number of the firewall that generated the log. |
| PanOSApplicationContainer | N/A | N/A | Identifies the managing application or parent of the application associated with this network traffic. |
| PanOSApplicationRisk | N/A | N/A | Indicates how risky the application is from a network security perspective. |
| PanOSApplicationSubcategory | N/A | N/A | Identifies the application's subcategory. The subcategory is related to the application's category, which is identified in category_of_app. |
| PanOSApplicationTechnology | N/A | N/A | The networking technology used by the identified application. |
| PanOSCaptivePortal | N/A | N/A | Indicates if user information for the session was captured through Captive Portal. |
| PanOSCortexDataLakeTenantID | N/A | N/A | The ID that uniquely identifies the Cortex Data Lake instance which received this log record. |
| PanOSDestinationDeviceClass | N/A | N/A | Destination device class. |
| PanOSDestinationDeviceOS | N/A | N/A | Destination device OS type. |
| dntdom | <domainimpacted> | Text/String | Domain to which the Destination User belongs. |
| dusername | <account> | Text/String | The username to which the network traffic was destined. |
| duid | N/A | N/A | Unique identifier assigned to the Destination User. |
| PanOSInboundInterfaceDetailsPort | N/A | N/A | Hardware port or socket from which the network traffic was sourced. |
| PanOSInboundInterfaceDetailsSlot | N/A | N/A | Interface slot from which the network traffic was sourced. |
| PanOSInboundInterfaceDetailsType | N/A | N/A | The type of interface from which the network traffic was sourced. |
| PanOSInboundInterfaceDetailsUnit | N/A | N/A | Internal use. |
| PanOSIsClienttoServer | N/A | N/A | Indicates if direction of traffic is from client to server. |
| PanOSIsContainer | N/A | N/A | Indicates if the session is a container page access (Container Page). |
| PanOSIsDecryptMirror | N/A | N/A | Indicates whether decrypted traffic was sent out in clear text through a mirror port. |
| PanOSIsDecrypted | N/A | N/A | Flag that indicates that the session is decrypted. |
| PanOSIsDecryptedLog | N/A | N/A | Unknown field. No information is available at this time. |
| PanOSIsDecryptedPayloadForward | N/A | N/A | Unknown field. No information is available at this time. |
| PanOSIsDuplicateLog | N/A | N/A | Indicates whether this log data is available in multiple locations, such as from Cortex Data Lake as well as from an on-premise log collector. |
| PanOSIsEncrypted | N/A | N/A | Flag that indicates that the session is encrypted. |
| PanOSIsIPV6 | N/A | N/A | Indicates whether IPV6 was used for the session. |
| PanOSIsInspectionBeforeSession | N/A | N/A | Unknown field. No information is available at this time. |
| PanOSIsMptcpOn | N/A | N/A | Indicates whether the option is enabled on the next-generation firewall that allows a client to use multiple paths to connect to a destination host. |
| PanOSIsNonStandardDestinationPort | N/A | N/A | Indicates if the destination port is non-standard. |
| PanOSIsPacketCapture | N/A | N/A | Indicates whether the session has a packet capture (PCAP). |
| PanOSIsPhishing | N/A | N/A | Indicates whether enterprise credentials were submitted by an end user. |
| PanOSIsPrismaNetwork | N/A | N/A | Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise. |
| PanOSIsPrismaUsers | N/A | N/A | Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise. |
| PanOSIsProxy | N/A | N/A | Indicates whether the SSL session is decrypted (SSL Proxy). |
| PanOSIsReconExcluded | N/A | N/A | Indicates whether source for the flow is on the firewall allow list and not subject to recon protection. |
| PanOSIsSaaSApplication | N/A | N/A | Internal use field. Indicates whether the application associated with this network traffic is a SAAS application. |
| PanOSIsServertoClient | N/A | N/A | Indicates if direction of traffic is from server to client. |
| PanOSIsSourceXForwarded | N/A | N/A | Indicates whether the X-Forwarded-For value from a proxy is in the source user field. |
| PanOSIsSystemReturn | N/A | N/A | Indicates whether symmetric return was used to forward traffic for this session. |
| PanOSIsTransaction | N/A | N/A | Indicates whether the log corresponds to a transaction within an HTTP proxy session (Proxy Transaction). |
| PanOSIsTunnelInspected | N/A | N/A | Indicates whether the payload for the outer tunnel was inspected. |
| PanOSIsURLDenied | N/A | N/A | Indicates whether the session was denied due to a URL filtering rule. |
| PanOSLogExported | N/A | N/A | Indicates if this log was exported from the firewall using the firewall's log export function. |
| PanOSLogForwarded | N/A | N/A | Internal-use field that indicates if the log is being forwarded. |
| PanOSLogSource | N/A | N/A | Identifies the origin of the data. That is, the system that produced the data. |
| PanOSLogSourceTimeZoneOffset | N/A | N/A | Time Zone offset from GMT of the source of the log. |
| PanOSNAT | N/A | N/A | Indicates if the firewall is performing network address translation (NAT) for the logged traffic. |
| PanOSNonStandardDestinationPort | N/A | N/A | Identifies the non-standard or unexpected port used by the application associated with this session. |
| PanOSOutboundInterfaceDetailsPort | N/A | N/A | Hardware port or socket to which the network traffic was sent. |
| PanOSOutboundInterfaceDetailsSlot | N/A | N/A | Interface slot to which the network traffic was sent. |
| PanOSOutboundInterfaceDetailsType | N/A | N/A | The type of interface to which the network traffic was sent. |
| PanOSOutboundInterfaceDetailsUnit | N/A | N/A | Internal use. |
| PanOSSDWANFECRatio | N/A | N/A | SDWAN forward error correction (FEC) ratio. |
| PanOSSanctionedStateOfApp | N/A | N/A | Indicates whether the application has been flagged as sanctioned by the firewall administrator. |
| PanOSSessionOwnerMidx | N/A | N/A | Unknown field. No information is available at this time. |
| PanOSSessionTracker | N/A | N/A | Unknown field. No information is available at this time. |
| PanOSSourceDeviceClass | N/A | N/A | Source device class. |
| PanOSSourceDeviceOS | N/A | N/A | Source device OS type. |
| sntdom | <domainorigin> | Text/String | Domain to which the Source User belongs. |
| susername | <domainorigin>\<login> | Text/String | The username that initiated the network traffic. |
| suid | N/A | N/A | Unique identifier assigned to the Source User. |
| PanOSTunneledApplication | N/A | N/A | For internal use only. |
| PanOSUsers | N/A | N/A | Source/Destination user. If neither is available, source_ip is used. |
| PanOSVirtualSystemID | N/A | N/A | A unique identifier for a virtual system on a Palo Alto Networks firewall. |
| PanOSApplicationCategory | N/A | N/A | Identifies the high-level family of the application. |
| PanOSConfigVersion | N/A | N/A | Version number of the firewall operating system that wrote this log record. |
| start | N/A | N/A | Time when the log was generated on the firewall's data plane. This string contains a timestamp value that is the number of microseconds since the Unix epoch. |
| src | <sip> | IP Address | Original source IP address. |
| dst | <dip> | IP Address | Original destination IP address. |
| sourceTranslatedAddress | <snatip> | IP Address | If source NAT was performed, the post-NAT source IP address. |
| destinationTranslatedAddress | <dnatip> | IP Address | If destination NAT was performed, the post-NAT destination IP address. |
| cs1 | <policy> | Text/String | Name of the security policy rule that the network traffic matched. |
| cs1Label | N/A | N/A |
|
| susername0 | N/A | N/A | The Source User. That is, the username that initiated the network traffic. |
| dusername0 | N/A | N/A | The Destination User. That is, the username to which the network traffic was destined. |
| app | <object> | Text/String | Application associated with the network traffic. |
| cs3 | N/A | N/A | String representation of the unique identifier for a virtual system on a Palo Alto Networks firewall. |
| cs3Label | N/A | N/A | N/A |
| cs4 | N/A | N/A | The networking zone from which the traffic originated. |
| cs4Label | N/A | N/A | N/A |
| cs5 | N/A | N/A | Networking zone to which the traffic was sent. |
| cs5Label | N/A | N/A | N/A |
| deviceInboundInterface | <sinterface> | Text/String | Interface from which the network traffic was sourced. |
| deviceOutboundInterface | <dinterface> | Text/String | Interface to which the network traffic was destined. |
| cs6 | N/A | N/A | Log forwarding profile name that was applied to the session. This name was defined by the firewall's administrator. |
| cs6Label | N/A | N/A | N/A |
| cn1 | <session> | Number | Identifies the firewall's internal identifier for a specific network session. |
| cn1Label | N/A | N/A | N/A |
| cnt | N/A | N/A | Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval. |
| spt | <sport> | Number | Source port utilized by the session. |
| dpt | <dport> | Number | Network traffic's destination port. If this value is 0, then the app is using its standard port. |
| sourceTranslatedPort | <snatport> | Number | Post-NAT source port. |
| destinationTranslatedPort | <dnatport> | Number | Post-NAT destination port. |
| proto | <protname> | Text/String | IP protocol associated with the session. |
| act | <action> | Text/String | Identifies the action that the firewall took for the network traffic. |
| PanOSBytes | N/A | N/A | Number of total bytes (transmit and receive). |
| out | <bytesin> | Number | Number of bytes in the client-to-server network traffic. |
| in | <bytesout> | Number | Number of bytes in the server-to-client network traffic. |
| cn2 | N/A | N/A | Number of total packets (transmit and receive) seen for the session. |
| cn2Label | N/A | N/A | N/A |
| PanOSSessionStartTime | N/A | N/A | Time when the session was established. This string contains a timestamp value that is the number of microseconds since the Unix epoch. |
| cn3 | <seconds> | Number | Total time taken for the network session to complete. |
| cn3Label | N/A | N/A | N/A |
| cs2 | N/A | N/A | URL category associated with the session. |
| cs2Label | N/A | N/A | N/A |
| externalId | N/A | N/A | The log entry identifier, which is incremented sequentially. Each log type has a unique number space. |
| PanOSSourceLocation | N/A | N/A | Source country or internal region for private addresses. |
| PanOSDestinationLocation | N/A | N/A | Destination country or internal region for private addresses. |
| PanOSPacketsSent | <packetsin> | Number | Number of client-to-server packets for the session. |
| PanOSPacketsReceived | <packetsout> | Number | Number of server-to-client packets for the session. |
| reason | <reason> | Text/String | The reason a session terminated. |
| PanOSDGHierarchyLevel1 | N/A | N/A | A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. |
| PanOSDGHierarchyLevel2 | N/A | N/A | A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. |
| PanOSDGHierarchyLevel3 | N/A | N/A | A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. |
| PanOSDGHierarchyLevel4 | N/A | N/A | A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. |
| PanOSVirtualSystemName | N/A | N/A | The name of the virtual system associated with the network traffic. |
| dvchost | N/A | N/A | Name of the source of the log. That is, the hostname of the firewall that logged the network traffic. |
| cat | <subject> | Text/String | Specifies whether the action taken to allow or block an application was defined in the application or in policy. |
| PanOSSourceUUID | N/A | N/A | Identifies the source universal unique identifier for a guest virtual machine in the VMware NSX environment. |
| PanOSDestinationUUID | N/A | N/A | Identifies the destination universal unique identifier for a guest virtual machine in the VMware NSX environment. |
| PanOSIMSI | N/A | N/A | ID of the tunnel being inspected or the International Mobile Subscriber Identity (IMSI) ID of the mobile user. |
| PanOSIMEI | N/A | N/A | A string used to group similar traffic together for logging and reporting. This value is globally defined on the firewall by the administrator. |
| PanOSParentSessionID | N/A | N/A | ID of the session in which this network traffic was tunneled. |
| PanOSParentStarttime | N/A | N/A | Time that the parent session began. This string contains a timestamp value that is the number of microseconds since the Unix epoch. |
| PanOSTunnel | N/A | N/A | Type of tunnel. |
| PanOSEndpointAssociationID | N/A | N/A | The ID assigned to the endpoint association used for the SCTP network traffic. |
| PanOSChunksTotal | N/A | N/A | The total number of SCTP data chunks in the network traffic. |
| PanOSChunksSent | N/A | N/A | The total number of SCTP data chunks in the client-to-server network traffic. |
| PanOSChunksReceived | N/A | N/A | The total number of SCTP data chunks in the server-to-client network traffic. |
| PanOSRuleUUID | N/A | N/A | Unique identifier for the security policy rule that the network traffic matched. |
| PanOSHTTP2Connection | N/A | N/A | Parent session ID for an HTTP/2 connection. If the traffic is not using HTTP/2, this field is set to 0. |
| PanOSLinkChangeCount | N/A | N/A | Number of times the app flapped in that session. |
| PanOSSDWANPolicyName | N/A | N/A | Name of the SD-WAN policy. |
| PanOSLinkSwitches | N/A | N/A | Details of the links switches (up-to 4). |
| PanOSSDWANCluster | N/A | N/A | Name of the SD-WAN cluster. |
| PanOSSDWANDeviceType | N/A | N/A | Type of SD-WAN device. Either hub or branch. |
| PanOSSDWANClusterType | N/A | N/A | Type of SD-WAN cluster. Either mesh or hub-spoke. |
| PanOSSDWANSite | N/A | N/A | Name of the SD-WAN site. |
| PanOSDynamicUserGroupName | N/A | N/A | Dynamic user group of the user who initiated the network connection. |
| PanOSX-Forwarded-ForIP | N/A | N/A | X-Forwarded-For IP. |
| PanOSSourceDeviceCategory | N/A | N/A | Category of the device from which the session originated. |
| PanOSSourceDeviceProfile | N/A | N/A | Profile of the device from which the session originated. |
| PanOSSourceDeviceModel | N/A | N/A | Model of the device from which the session originated. |
| PanOSSourceDeviceVendor | N/A | N/A | Vendor of the device from which the session originated. |
| PanOSSourceDeviceOSFamily | N/A | N/A | OS family of the device from which the session originated. |
| PanOSSourceDeviceOSVersion | N/A | N/A | OS version of the device from which the session originated. |
| PanOSSourceDeviceHost | <sname> | Text/String | Hostname of the device from which the session originated. |
| PanOSSourceDeviceMac | <smac> | Text/String/Number | MAC Address of the device from which the session originated. |
| PanOSDestinationDeviceCategory | N/A | N/A | Category of the device to which the session was directed. |
| PanOSDestinationDeviceProfile | N/A | N/A | Profile of the device to which the session was directed. |
| PanOSDestinationDeviceModel | N/A | N/A | Model of the device to which the session was directed. |
| PanOSDestinationDeviceVendor | N/A | N/A | Vendor of the device to which the session was directed. |
| PanOSDestinationDeviceOSFamily | N/A | N/A | OS family of the device to which the session was directed. |
| PanOSDestinationDeviceOSVersion | N/A | N/A | OS version of the device to which the session was directed. |
| PanOSDestinationDeviceHost | <dname> | Text/String | Hostname of the device to which the session was directed. |
| PanOSDestinationDeviceMac | <dmac> | Text/String/Number | MAC Address of the device to which the session was directed. |
| PanOSContainerID | N/A | N/A | Unknown field. No information is available at this time. |
| PanOSContainerNameSpace | N/A | N/A | Container namespace. |
| PanOSContainerName | N/A | N/A | Container name. |
| PanOSSourceEDL | N/A | N/A | The name of the external dynamic list that contains the source IP address of the traffic. |
| PanOSDestinationEDL | N/A | N/A | The name of the external dynamic list that contains the destination IP address of the traffic. |
| PanOSGPHostID | N/A | N/A | A unique ID that GlobalProtect assigns to identify the host. |
| PanOSEndpointSerialNumber | N/A | N/A | Serial number of the host on which GlobalProtect is installed. |
| PanOSSourceDynamicAddressGroup | N/A | N/A | The dynamic address group that Device-ID identifies as the source of the traffic. |
| PanOSDestinationDynamicAddressGroup | N/A | N/A | The dynamic address group that Device-ID identifies as the destination for the traffic. |
| PanOSHASessionOwner | N/A | N/A | Name of cluster member in which session failed over from. |
| PanOSTimeGeneratedHighResolution | N/A | N/A | Time the log was generated in data plane with millisec granularity in format YYYY-MM-DDTHH:MM:SS[.DDDDDD]Z. |
| PanOSNSSAINetworkSliceType | N/A | N/A | Network Slice Type (SST part of SNSSAI). |
| PanOSNSSAINetworkSliceDifferentiator | N/A | N/A | Network Slice Differentiator (SD part of SNSSAI). |
| PanOSIsOffloaded | N/A | N/A | Indicates whether the traffic flow is offloaded to hardware before the packets enter Linux kernel on VM/CN series. |
| PanOSLocation | N/A | N/A | Prisma Access Region/Location. |
