URL Threat Messages
Vendor Documentation
Classification
Rule Name | Rule Type | Classification | Common Event |
---|---|---|---|
URL Threat Messages | Base Rule | Activity | General Threat Message |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
---|---|---|---|
N/A | N/A | N/A | deviceVendor |
N/A | N/A | N/A | deviceProduct |
N/A | N/A | N/A | Version |
N/A | N/A | N/A | LogType |
N/A | <vmid> | Text/String | SubType |
N/A | <severity> | Number | deviceSeverity |
ProfileToken | N/A | N/A | N/A |
dtz | N/A | N/A | N/A |
rt | N/A | N/A | Time the log was received in Cortex Data Lake. This string contains a timestamp value that is the number of microseconds since the Unix epoch. |
deviceExternalId | <serialnumber> | Text/String/Number | ID that uniquely identifies the source of the log. That is, the serial number of the firewall that generated the log. |
PanOSApplicationCategory | N/A | N/A | Identifies the high-level family of the application. |
PanOSApplicationContainer | N/A | N/A | Identifies the managing application or parent of the application associated with this network traffic. |
PanOSApplicationRisk | N/A | N/A | Indicates how risky the application is from a network security perspective. |
PanOSApplicationSubcategory | N/A | N/A | Identifies the application's subcategory. The subcategory is related to the application's category, which is identified in app_category. |
PanOSApplicationTechnology | N/A | N/A | The networking technology used by the identified application. |
PanOSCaptivePortal | N/A | N/A | Indicates if user information for the session was captured through Captive Portal. |
PanOSCloudHostname | N/A | N/A | The hostname in which the VM-series firewall is running. |
PanOSCortexDataLakeTenantID | N/A | N/A | The ID that uniquely identifies the Cortex Data Lake instance which received this log record. |
PanOSDestinationDeviceClass | N/A | N/A | Destination device class. |
PanOSDestinationDeviceOS | N/A | N/A | Destination device OS type. |
dntdom | <domainimpacted> | Text/String | Domain to which the Destination User belongs. |
dusername | <account> | Text/String | The username to which the network traffic was destined. |
duid | N/A | N/A | Unique identifier assigned to the Destination User. |
PanOSHTTPRefererFQDN | N/A | N/A | The fully qualified domain name used in the HTTP REFERER header field. |
PanOSHTTPRefererPort | N/A | N/A | The port used in the HTTP REFERER header field. |
PanOSHTTPRefererProtocol | N/A | N/A | The protocol used in the HTTP REFERER header field. |
PanOSHTTPRefererURLPath | N/A | N/A | The URL path used in the HTTP REFERER header field. |
PanOSInboundInterfaceDetailsPort | N/A | N/A | Hardware port or socket from which the network traffic was sourced. |
PanOSInboundInterfaceDetailsSlot | N/A | N/A | Interface slot from which the network traffic was sourced. |
PanOSInboundInterfaceDetailsType | N/A | N/A | The type of interface from which the network traffic was sourced. |
PanOSInboundInterfaceDetailsUnit | N/A | N/A | Internal use. |
PanOSIsClienttoServer | N/A | N/A | Indicates if direction of traffic is from client to server. |
PanOSIsContainer | N/A | N/A | Indicates if the session is a container page access (Container Page). |
PanOSIsDecryptMirror | N/A | N/A | Indicates whether decrypted traffic was sent out in clear text through a mirror port. |
PanOSIsDecrypted | N/A | N/A | Flag that indicates that the session is decrypted. |
PanOSIsDuplicateLog | N/A | N/A | Indicates whether this log data is available in multiple locations, such as from Cortex Data Lake as well as from an on-premise log collector. |
PanOSIsEncrypted | N/A | N/A | Flag that indicates that the session is encrypted. |
PanOSIsIPV6 | N/A | N/A | Indicates whether IPV6 was used for the session. |
PanOSIsMptcpOn | N/A | N/A | Indicates whether the option is enabled on the next-generation firewall that allows a client to use multiple paths to connect to a destination host. |
PanOSIsNonStandardDestinationPort | N/A | N/A | Indicates if the destination port is non-standard. |
PanOSIsPacketCapture | N/A | N/A | Indicates whether the session has a packet capture (PCAP). |
PanOSIsPhishing | N/A | N/A | Indicates whether enterprise credentials were submitted by an end user. |
PanOSIsPrismaNetwork | N/A | N/A | Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise. |
PanOSIsPrismaUsers | N/A | N/A | Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise. |
PanOSIsProxy | N/A | N/A | Indicates whether the SSL session is decrypted (SSL Proxy). |
PanOSIsReconExcluded | N/A | N/A | Indicates whether source for the flow is on the firewall allow list and not subject to recon protection. |
PanOSIsSaaSApplication | N/A | N/A | Internal use field. Indicates whether the application associated with this network traffic is a SAAS application. |
PanOSIsServertoClient | N/A | N/A | Indicates if direction of traffic is from server to client. |
PanOSIsSourceXForwarded | N/A | N/A | Indicates whether the X-Forwarded-For value from a proxy is in the source user field. |
PanOSIsSystemReturn | N/A | N/A | Indicates whether symmetric return was used to forward traffic for this session. |
PanOSIsTransaction | N/A | N/A | Indicates whether the log corresponds to a transaction within an HTTP proxy session (Proxy Transaction). |
PanOSIsTunnelInspected | N/A | N/A | Indicates whether the payload for the outer tunnel was inspected. |
PanOSIsURLDenied | N/A | N/A | Indicates whether the session was denied due to a URL filtering rule. |
PanOSLogExported | N/A | N/A | Indicates if this log was exported from the firewall using the firewall's log export function. |
PanOSLogForwarded | N/A | N/A | Internal-use field that indicates if the log is being forwarded. |
PanOSLogSource | N/A | N/A | Identifies the origin of the data. That is, the system that produced the data. |
PanOSLogSourceTimeZoneOffset | N/A | N/A | Time Zone offset from GMT of the source of the log. |
PanOSNAT | N/A | N/A | Indicates if the firewall is performing network address translation (NAT) for the logged traffic. |
PanOSNonStandardDestinationPort | N/A | N/A | Identifies the non-standard or unexpected port used by the application associated with this session. |
PanOSOutboundInterfaceDetailsPort | N/A | N/A | Hardware port or socket to which the network traffic was sent. |
PanOSOutboundInterfaceDetailsSlot | N/A | N/A | Interface slot to which the network traffic was sent. |
PanOSOutboundInterfaceDetailsType | N/A | N/A | The type of interface to which the network traffic was sent. |
PanOSOutboundInterfaceDetailsUnit | N/A | N/A | Internal use. |
PanOSPacket | N/A | N/A | Packet that triggered the firewall to generate this URL log record. |
PanOSSanctionedStateofApp | N/A | N/A | Indicates whether the application has been flagged as sanctioned by the firewall administrator. |
PanOSSeverity | N/A | N/A | Severity as defined by the platform. |
PanOSSourceDeviceClass | N/A | N/A | Source device class. |
PanOSSourceDeviceOS | N/A | N/A | Source device OS type. |
sntdom | <domainorigin> | Text/String | Domain to which the Source User belongs. |
susername | <domainorigin>\<login> | Text/String | The username that initiated the network traffic. |
suid | N/A | N/A | Unique identifier assigned to the Source User. |
PanOSTunneledApplication | N/A | N/A | For internal use only. |
PanOSURLDomain | N/A | N/A | The name of the internet domain that was visited in this session. |
PanOSUsers | N/A | N/A | Source/Destination user. If neither is available, source. |
PanOSVirtualSystemID | N/A | N/A | A unique identifier for a virtual system on a Palo Alto Networks firewall. |
PanOSConfigVersion | N/A | N/A | Version number of the firewall operating system that wrote this log record. |
start | N/A | N/A | Time when the log was generated on the firewall's data plane. This string contains a timestamp value that is the number of microseconds since the Unix epoch. |
src | <sip> | IP Address | Original source IP address. |
dst | <dip> | IP Address | Original destination IP address. |
sourceTranslatedAddress | <snatip> | IP Address | If source NAT was performed, the post-NAT source IP address. |
destinationTranslatedAddress | <dnatip> | IP Address | If destination NAT performed, the post-NAT destination IP address. |
cs1 | <policy> | Text/String | Name of the security policy rule that the network traffic matched. |
cs1Label | N/A | N/A | N/A |
susername0 | N/A | N/A | The Source User. That is, the username that initiated the network traffic. |
dusername0 | N/A | N/A | The Destination User. That is, the username to which the network traffic was destined. |
app | N/A | N/A | Application associated with the network traffic. |
cs3 | N/A | N/A | String representation of the unique identifier for a virtual system on a Palo Alto Networks firewall. |
cs3Label | N/A | N/A | N/A |
cs4 | N/A | N/A | The networking zone from which the traffic originated. |
cs4Label | N/A | N/A | N/A |
cs5 | N/A | N/A | Networking zone to which the traffic was sent. |
cs5Label | N/A | N/A | N/A |
deviceInboundInterface | <sinterface> | Text/String | Interface from which the network traffic was sourced. |
deviceOutboundInterface | <dinterface> | Text/String | Interface to which the network traffic was destined. |
cs6 | N/A | N/A | Log forwarding profile name that was applied to the session. This name was defined by the firewall's administrator. |
cs6Label | N/A | N/A | N/A |
cn1 | <session> | Number | Identifies the firewall's internal identifier for a specific network session. |
cn1Label | N/A | N/A | N/A |
cnt | N/A | N/A | Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval. |
spt | <sport> | Number | Source port utilized by the session. |
dpt | <dport> | Number | Network traffic's destination port. If this value is 0, then the app is using its standard port. |
sourceTranslatedPort | <snatport> | Number | Post-NAT source port. |
destinationTranslatedPort | <dnatport> | Number | Post-NAT destination port. |
proto | <protname> | Text/String | IP protocol associated with the session. |
act | <action> <tag1> | Text/String | Identifies the action that the firewall took for the network traffic. |
request | <url> | Text/String | The Uniform Resource Identifier (URI) used in the web request. |
cs2 | <subject> | Text/String | The URL category. |
cs2Label | N/A | N/A | N/A |
flexString2 | N/A | N/A | Indicates the direction of the attack. |
flexString2Label | N/A | N/A | N/A |
externalId | N/A | N/A | The log entry identifier, which is incremented sequentially. Each log type has a unique number space. |
PanOSSourceLocation | N/A | N/A | Source country or internal region for private addresses. |
PanOSDestinationLocation | N/A | N/A | Destination country or internal region for private addresses. |
requestContext | N/A | N/A | Content type of the HTTP response data. |
fileId | N/A | N/A | Packet capture ID. Used to correlate threat pcap files with extended pcaps taken as a part of the session flow. |
PanOSURLCounter | N/A | N/A | The column that correlates the traffic, url, and sandbox logs. |
requestClientApplication | <useragent> | Text/String | The User Agent field specifies the web browser that the user used to access the URL. |
PanOSX-Forwarded-For | N/A | N/A | The IP address of the user who requested the web page. |
PanOSReferer | N/A | N/A | The web page URL identified in the HTTP REFERER header field. |
PanOSDGHierarchyLevel1 | N/A | N/A | A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. |
PanOSDGHierarchyLevel2 | N/A | N/A | A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. |
PanOSDGHierarchyLevel3 | N/A | N/A | A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. |
PanOSDGHierarchyLevel4 | N/A | N/A | A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. |
PanOSVirtualSystemName | N/A | N/A | The name of the virtual system associated with the network traffic. |
dvchost | N/A | N/A | Name of the source of the log. That is, the hostname of the firewall that logged the network traffic. |
PanOSSourceUUID | N/A | N/A | Identifies the source universal unique identifier for a guest virtual machine in the VMware NSX environment. |
PanOSDestinationUUID | N/A | N/A | Identifies the destination universal unique identifier for a guest virtual machine in the VMware NSX environment. |
requestMethod | <command> | Text/String | The HTTP Method used in the web request. |
PanOSIMSI | N/A | N/A | ID of the tunnel being inspected or the International Mobile Subscriber Identity (IMSI) ID of the mobile user. |
PanOSIMEI | N/A | N/A | A string used to group similar traffic together for logging and reporting. This value is globally defined on the firewall by the administrator. |
PanOSParentSessionID | N/A | N/A | ID of the session in which this network traffic was tunneled. |
PanOSParentStarttime | N/A | N/A | Time that the parent session began. This string contains a timestamp value that is the number of microseconds since the Unix epoch. |
PanOSTunnel | N/A | N/A | Type of tunnel. |
PanOSInlineMLVerdict | N/A | N/A | A verdict that identifies the nature of the threat based on the Inline ML model used to analyze the webpage. |
PanOSContentVersion | N/A | N/A | Applications and Threats version installed on the firewall when the log was generated. |
PanOSSigFlags | N/A | N/A | Internal use only. |
PanOSHTTPHeaders | N/A | N/A | The HTTP headers used in the web request. |
PanOSURLCategoryList | N/A | N/A | The list of associated URL categories. |
PanOSRuleUUID | N/A | N/A | Unique identifier for the security policy rule that the network traffic matched. |
PanOSHTTP2Connection | N/A | N/A | Parent session ID for an HTTP/2 connection. If the traffic is not using HTTP/2, this field is set to 0. |
PanOSDynamicUserGroupName | N/A | N/A | Dynamic user group of the user who initiated the network connection. |
PanOSX-Forwarded-ForIP | N/A | N/A | X-Forwarded-For IP. |
PanOSSourceDeviceCategory | N/A | N/A | Category of the device from which the session originated. |
PanOSSourceDeviceProfile | N/A | N/A | Profile of the device from which the session originated. |
PanOSSourceDeviceModel | N/A | N/A | Model of the device from which the session originated. |
PanOSSourceDeviceVendor | N/A | N/A | Vendor of the device from which the session originated. |
PanOSSourceDeviceOSFamily | N/A | N/A | OS family of the device from which the session originated. |
PanOSSourceDeviceOSVersion | N/A | N/A | OS version of the device from which the session originated. |
PanOSSourceDeviceHost | <sname> | Text/String | Hostname of the device from which the session originated. |
PanOSSourceDeviceMac | <smac> | Text/String | MAC Address of the device from which the session originated. |
PanOSDestinationDeviceCategory | N/A | N/A | Category of the device to which the session was directed. |
PanOSDestinationDeviceProfile | N/A | N/A | Profile of the device to which the session was directed. |
PanOSDestinationDeviceModel | N/A | N/A | Model of the device to which the session was directed. |
PanOSDestinationDeviceVendor | N/A | N/A | Vendor of the device to which the session was directed. |
PanOSDestinationDeviceOSFamily | N/A | N/A | OS family of the device to which the session was directed. |
PanOSDestinationDeviceOSVersion | N/A | N/A | OS version of the device to which the session was directed. |
PanOSDestinationDeviceHost | <dname> | Text/String | Hostname of the device to which the session was directed. |
PanOSDestinationDeviceMac | <dmac> | Text/String | MAC Address of the device to which the session was directed. |
PanOSContainerID | N/A | N/A | Unknown field. No information is available at this time. |
PanOSContainerNameSpace | N/A | N/A | Container namespace. |
PanOSContainerName | N/A | N/A | Container name. |
PanOSSourceEDL | N/A | N/A | The name of the external dynamic list that contains the source IP address of the traffic. |
PanOSDestinationEDL | N/A | N/A | The name of the external dynamic list that contains the destination IP address of the traffic. |
PanOSHostID | N/A | N/A | A unique ID that GlobalProtect assigns to identify the host. |
PanOSEndpointSerialNumber | N/A | N/A | Serial number of the host on which GlobalProtect is installed. |
PanOSSourceDynamicAddressGroup | N/A | N/A | The dynamic address group that Device-ID identifies as the source of the traffic. |
PanOSDestinationDynamicAddressGroup | N/A | N/A | The dynamic address group that Device-ID identifies as the destination for the traffic. |
PanOSTimeGeneratedHighResolution | N/A | N/A | Time the log was generated in data plane with millisec granularity in format YYYY-MM-DDTHH:MM:SS[.DDDDDD]Z. |
PanOSNSSAINetworkSliceType | N/A | N/A | Network Slice Type (SST part of SNSSAI). |
PanOSFileURL | N/A | N/A | File URL. |
PanOSLocation | N/A | N/A | Prisma Access Region/Location. |
PanOSVendorSeverity | N/A | N/A | Severity associated with the event. |