Skip to main content
Skip table of contents

URL Threat Messages

Vendor Documentation

Classification

Rule NameRule TypeClassificationCommon Event
URL Threat MessagesBase RuleActivityGeneral Threat Message

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm SchemaData Type

Schema Description

 N/A N/AN/AdeviceVendor
N/A N/A N/AdeviceProduct
N/A N/A N/AVersion
N/A N/A N/ALogType
N/A <vmid>Text/StringSubType
N/A <severity>NumberdeviceSeverity
ProfileTokenN/A N/A N/A
dtzN/A N/AN/A 
rtN/A N/ATime the log was received in Cortex Data Lake. This string contains a timestamp value that is the number of microseconds since the Unix epoch.
deviceExternalId<serialnumber>Text/String/NumberID that uniquely identifies the source of the log. That is, the serial number of the firewall that generated the log.
PanOSApplicationCategory N/AN/AIdentifies the high-level family of the application.
PanOSApplicationContainerN/A N/AIdentifies the managing application or parent of the application associated with this network traffic.
PanOSApplicationRiskN/A N/AIndicates how risky the application is from a network security perspective.
PanOSApplicationSubcategoryN/A N/AIdentifies the application's subcategory. The subcategory is related to the application's category, which is identified in app_category.
PanOSApplicationTechnologyN/A N/AThe networking technology used by the identified application.
PanOSCaptivePortalN/A N/AIndicates if user information for the session was captured through Captive Portal.
PanOSCloudHostnameN/A N/AThe hostname in which the VM-series firewall is running.
PanOSCortexDataLakeTenantIDN/A N/AThe ID that uniquely identifies the Cortex Data Lake instance which received this log record.
PanOSDestinationDeviceClassN/A N/ADestination device class.
PanOSDestinationDeviceOSN/A N/ADestination device OS type.
dntdom<domainimpacted>Text/StringDomain to which the Destination User belongs.
dusername<account>Text/StringThe username to which the network traffic was destined.
duidN/A N/AUnique identifier assigned to the Destination User.
PanOSHTTPRefererFQDNN/A N/AThe fully qualified domain name used in the HTTP REFERER header field.
PanOSHTTPRefererPortN/A N/AThe port used in the HTTP REFERER header field.
PanOSHTTPRefererProtocolN/A N/AThe protocol used in the HTTP REFERER header field.
PanOSHTTPRefererURLPathN/A N/AThe URL path used in the HTTP REFERER header field.
PanOSInboundInterfaceDetailsPortN/A N/AHardware port or socket from which the network traffic was sourced.
PanOSInboundInterfaceDetailsSlotN/A N/AInterface slot from which the network traffic was sourced.
PanOSInboundInterfaceDetailsTypeN/A N/AThe type of interface from which the network traffic was sourced.
PanOSInboundInterfaceDetailsUnitN/A N/AInternal use.
PanOSIsClienttoServerN/A N/AIndicates if direction of traffic is from client to server.
PanOSIsContainerN/A N/AIndicates if the session is a container page access (Container Page).
PanOSIsDecryptMirrorN/A N/AIndicates whether decrypted traffic was sent out in clear text through a mirror port.
PanOSIsDecryptedN/A N/AFlag that indicates that the session is decrypted.
PanOSIsDuplicateLogN/A N/AIndicates whether this log data is available in multiple locations, such as from Cortex Data Lake as well as from an on-premise log collector.
PanOSIsEncryptedN/A N/AFlag that indicates that the session is encrypted.
PanOSIsIPV6N/A N/AIndicates whether IPV6 was used for the session.
PanOSIsMptcpOnN/A N/AIndicates whether the option is enabled on the next-generation firewall that allows a client to use multiple paths to connect to a destination host.
PanOSIsNonStandardDestinationPortN/A N/AIndicates if the destination port is non-standard.
PanOSIsPacketCaptureN/A N/AIndicates whether the session has a packet capture (PCAP).
PanOSIsPhishingN/A N/AIndicates whether enterprise credentials were submitted by an end user.
PanOSIsPrismaNetworkN/A N/AInternal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.
PanOSIsPrismaUsersN/A N/AInternal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise.
PanOSIsProxyN/A N/AIndicates whether the SSL session is decrypted (SSL Proxy).
PanOSIsReconExcludedN/A N/AIndicates whether source for the flow is on the firewall allow list and not subject to recon protection.
PanOSIsSaaSApplicationN/A N/AInternal use field. Indicates whether the application associated with this network traffic is a SAAS application.
PanOSIsServertoClientN/A N/AIndicates if direction of traffic is from server to client.
PanOSIsSourceXForwardedN/A N/AIndicates whether the X-Forwarded-For value from a proxy is in the source user field.
PanOSIsSystemReturnN/A N/AIndicates whether symmetric return was used to forward traffic for this session.
PanOSIsTransactionN/A N/AIndicates whether the log corresponds to a transaction within an HTTP proxy session (Proxy Transaction).
PanOSIsTunnelInspectedN/A N/AIndicates whether the payload for the outer tunnel was inspected.
PanOSIsURLDeniedN/A N/AIndicates whether the session was denied due to a URL filtering rule.
PanOSLogExportedN/A N/AIndicates if this log was exported from the firewall using the firewall's log export function.
PanOSLogForwardedN/A N/AInternal-use field that indicates if the log is being forwarded.
PanOSLogSourceN/A N/AIdentifies the origin of the data. That is, the system that produced the data.
PanOSLogSourceTimeZoneOffsetN/A N/ATime Zone offset from GMT of the source of the log.
PanOSNATN/A N/AIndicates if the firewall is performing network address translation (NAT) for the logged traffic.
PanOSNonStandardDestinationPortN/A N/AIdentifies the non-standard or unexpected port used by the application associated with this session.
PanOSOutboundInterfaceDetailsPortN/A N/AHardware port or socket to which the network traffic was sent.
PanOSOutboundInterfaceDetailsSlotN/A N/AInterface slot to which the network traffic was sent.
PanOSOutboundInterfaceDetailsTypeN/A N/AThe type of interface to which the network traffic was sent.
PanOSOutboundInterfaceDetailsUnitN/A N/AInternal use.
PanOSPacketN/A N/APacket that triggered the firewall to generate this URL log record.
PanOSSanctionedStateofAppN/A N/AIndicates whether the application has been flagged as sanctioned by the firewall administrator.
PanOSSeverityN/A N/ASeverity as defined by the platform.
PanOSSourceDeviceClassN/A N/ASource device class.
PanOSSourceDeviceOSN/A N/ASource device OS type.
sntdom<domainorigin>Text/StringDomain to which the Source User belongs.
susername<domainorigin>\<login>Text/StringThe username that initiated the network traffic.
suidN/A N/AUnique identifier assigned to the Source User.
PanOSTunneledApplicationN/A N/AFor internal use only.
PanOSURLDomainN/A N/AThe name of the internet domain that was visited in this session.
PanOSUsersN/A N/ASource/Destination user. If neither is available, source.
PanOSVirtualSystemIDN/A N/AA unique identifier for a virtual system on a Palo Alto Networks firewall.
PanOSConfigVersionN/A N/AVersion number of the firewall operating system that wrote this log record.
startN/A N/ATime when the log was generated on the firewall's data plane. This string contains a timestamp value that is the number of microseconds since the Unix epoch.
src<sip>IP AddressOriginal source IP address.
dst<dip>IP AddressOriginal destination IP address.
sourceTranslatedAddress<snatip>IP AddressIf source NAT was performed, the post-NAT source IP address.
destinationTranslatedAddress<dnatip>IP AddressIf destination NAT performed, the post-NAT destination IP address.
cs1<policy>Text/StringName of the security policy rule that the network traffic matched.
cs1LabelN/A N/A N/A
susername0N/A N/AThe Source User. That is, the username that initiated the network traffic.
dusername0N/A N/AThe Destination User. That is, the username to which the network traffic was destined.
appN/A N/AApplication associated with the network traffic.
cs3N/A N/AString representation of the unique identifier for a virtual system on a Palo Alto Networks firewall.
cs3LabelN/A N/A N/A
cs4N/A N/AThe networking zone from which the traffic originated.
cs4LabelN/A N/A N/A
cs5N/A N/ANetworking zone to which the traffic was sent.
cs5LabelN/A N/A N/A
deviceInboundInterface<sinterface>Text/StringInterface from which the network traffic was sourced.
deviceOutboundInterface<dinterface>Text/StringInterface to which the network traffic was destined.
cs6N/A N/ALog forwarding profile name that was applied to the session. This name was defined by the firewall's administrator.
cs6LabelN/A N/A N/A
cn1<session>NumberIdentifies the firewall's internal identifier for a specific network session.
cn1LabelN/A N/A N/A
cntN/A N/ANumber of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.
spt<sport>NumberSource port utilized by the session.
dpt<dport>NumberNetwork traffic's destination port. If this value is 0, then the app is using its standard port.
sourceTranslatedPort<snatport>NumberPost-NAT source port.
destinationTranslatedPort<dnatport>NumberPost-NAT destination port.
proto<protname>Text/StringIP protocol associated with the session.
act<action>
<tag1>
Text/StringIdentifies the action that the firewall took for the network traffic.
request<url>Text/StringThe Uniform Resource Identifier (URI) used in the web request.
cs2<subject>Text/StringThe URL category.
cs2LabelN/A N/A N/A
flexString2N/A N/AIndicates the direction of the attack.
flexString2LabelN/A N/A N/A
externalIdN/A N/AThe log entry identifier, which is incremented sequentially. Each log type has a unique number space.
PanOSSourceLocationN/A N/ASource country or internal region for private addresses.
PanOSDestinationLocationN/A N/ADestination country or internal region for private addresses.
requestContextN/A N/AContent type of the HTTP response data.
fileIdN/A N/APacket capture ID. Used to correlate threat pcap files with extended pcaps taken as a part of the session flow.
PanOSURLCounterN/A N/AThe column that correlates the traffic, url, and sandbox logs.
requestClientApplication<useragent>Text/StringThe User Agent field specifies the web browser that the user used to access the URL.
PanOSX-Forwarded-ForN/A N/AThe IP address of the user who requested the web page.
PanOSRefererN/A N/AThe web page URL identified in the HTTP REFERER header field.
PanOSDGHierarchyLevel1N/A N/AA sequence of identification numbers that indicate the device group’s location within a device group hierarchy.
PanOSDGHierarchyLevel2N/A N/AA sequence of identification numbers that indicate the device group’s location within a device group hierarchy.
PanOSDGHierarchyLevel3N/A N/AA sequence of identification numbers that indicate the device group’s location within a device group hierarchy.
PanOSDGHierarchyLevel4N/A N/AA sequence of identification numbers that indicate the device group’s location within a device group hierarchy.
PanOSVirtualSystemNameN/A N/AThe name of the virtual system associated with the network traffic.
dvchostN/A N/AName of the source of the log. That is, the hostname of the firewall that logged the network traffic.
PanOSSourceUUIDN/A N/AIdentifies the source universal unique identifier for a guest virtual machine in the VMware NSX environment.
PanOSDestinationUUIDN/A N/AIdentifies the destination universal unique identifier for a guest virtual machine in the VMware NSX environment.
requestMethod<command>Text/StringThe HTTP Method used in the web request.
PanOSIMSIN/A N/AID of the tunnel being inspected or the International Mobile Subscriber Identity (IMSI) ID of the mobile user.
PanOSIMEIN/A N/AA string used to group similar traffic together for logging and reporting. This value is globally defined on the firewall by the administrator.
PanOSParentSessionIDN/A N/AID of the session in which this network traffic was tunneled.
PanOSParentStarttimeN/A N/ATime that the parent session began. This string contains a timestamp value that is the number of microseconds since the Unix epoch.
PanOSTunnelN/A N/AType of tunnel.
PanOSInlineMLVerdictN/A N/AA verdict that identifies the nature of the threat based on the Inline ML model used to analyze the webpage.
PanOSContentVersionN/A N/AApplications and Threats version installed on the firewall when the log was generated.
PanOSSigFlagsN/A N/AInternal use only.
PanOSHTTPHeadersN/A N/AThe HTTP headers used in the web request.
PanOSURLCategoryListN/A N/AThe list of associated URL categories.
PanOSRuleUUIDN/A N/AUnique identifier for the security policy rule that the network traffic matched.
PanOSHTTP2ConnectionN/A N/AParent session ID for an HTTP/2 connection. If the traffic is not using HTTP/2, this field is set to 0.
PanOSDynamicUserGroupNameN/A N/ADynamic user group of the user who initiated the network connection.
PanOSX-Forwarded-ForIPN/A N/AX-Forwarded-For IP.
PanOSSourceDeviceCategoryN/A N/ACategory of the device from which the session originated.
PanOSSourceDeviceProfileN/A N/AProfile of the device from which the session originated.
PanOSSourceDeviceModelN/A N/AModel of the device from which the session originated.
PanOSSourceDeviceVendorN/A N/AVendor of the device from which the session originated.
PanOSSourceDeviceOSFamilyN/A N/AOS family of the device from which the session originated.
PanOSSourceDeviceOSVersion N/AN/AOS version of the device from which the session originated.
PanOSSourceDeviceHost<sname>Text/StringHostname of the device from which the session originated.
PanOSSourceDeviceMac<smac>Text/StringMAC Address of the device from which the session originated.
PanOSDestinationDeviceCategoryN/A N/ACategory of the device to which the session was directed.
PanOSDestinationDeviceProfileN/A N/AProfile of the device to which the session was directed.
PanOSDestinationDeviceModelN/A N/AModel of the device to which the session was directed.
PanOSDestinationDeviceVendorN/A N/AVendor of the device to which the session was directed.
PanOSDestinationDeviceOSFamilyN/A N/AOS family of the device to which the session was directed.
PanOSDestinationDeviceOSVersionN/A N/AOS version of the device to which the session was directed.
PanOSDestinationDeviceHost<dname>Text/StringHostname of the device to which the session was directed.
PanOSDestinationDeviceMac<dmac>Text/StringMAC Address of the device to which the session was directed.
PanOSContainerIDN/A N/AUnknown field. No information is available at this time.
PanOSContainerNameSpaceN/A N/AContainer namespace.
PanOSContainerNameN/A N/AContainer name.
PanOSSourceEDLN/A N/AThe name of the external dynamic list that contains the source IP address of the traffic.
PanOSDestinationEDLN/A N/AThe name of the external dynamic list that contains the destination IP address of the traffic.
PanOSHostIDN/A N/AA unique ID that GlobalProtect assigns to identify the host.
PanOSEndpointSerialNumberN/A N/ASerial number of the host on which GlobalProtect is installed.
PanOSSourceDynamicAddressGroupN/A N/AThe dynamic address group that Device-ID identifies as the source of the traffic.
PanOSDestinationDynamicAddressGroupN/A N/AThe dynamic address group that Device-ID identifies as the destination for the traffic.
PanOSTimeGeneratedHighResolutionN/A N/ATime the log was generated in data plane with millisec granularity in format YYYY-MM-DDTHH:MM:SS[.DDDDDD]Z.
PanOSNSSAINetworkSliceTypeN/A N/ANetwork Slice Type (SST part of SNSSAI).
PanOSFileURLN/A N/AFile URL.
PanOSLocationN/A N/APrisma Access Region/Location.
PanOSVendorSeverity N/AN/ASeverity associated with the event.
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.