Palo Alto Next-Gen Firewall

Collect logs from Palo Alto next-gen firewalls with Elastic Agent.


Version	3.22.0 (View all)
Compatible Kibana version(s)	8.7.1 or higher
Supported Serverless project types What's this?	Security Observability
Subscription level What's this?	Basic
Level of support What's this?	Elastic

This integration is for Palo Alto Networks PAN-OS firewall monitoring logs received over Syslog or read from a file. It currently supports messages of GlobalProtect, HIP Match, Threat, Traffic, User-ID, Authentication, Config, Correlated Events, Decryption, GTP, IP-Tag, SCTP, System and Tunnel Inspection types.

Compatibility

This integration supports PAN-OS versions 8.1 to 11.0, but limited compatibility is expected for earlier versions.
This integration supports logs of GlobalProtect for PAN-OS version 9.1.3 or above.
This integration supports logs of User-ID for PAN-OS version 8.1 or above.
This integration supports logs of Tunnel Inspection for PAN-OS version 9.1 or above.
This module has been tested with logs generated by devices running PAN-OS versions 7.1 to 11.0.

Configurations

To configure syslog monitoring, please follow the steps mentioned in the Configure Syslog Monitoring.

Note

If events are getting truncated, then increase max_message_size option for TCP and UDP input type.
- It can be found under Advanced Options and can be configured as per requirements. The default value of max_message_size is set to 50KiB.
If the TCP input is used, it is recommended that PAN-OS is configured to send syslog messages using the IETF (RFC 5424) format. In addition, RFC 6587 framing (Octet Counting) will be enabled by default on the TCP input.

Logs

PAN-OS

This is the panos data stream.

An example event for panos looks as following:

{
    "@timestamp": "2012-04-10T04:39:56.000Z",
    "agent": {
        "ephemeral_id": "3a362c46-abee-4440-bd82-f0e41a651188",
        "id": "f25d13cd-18cc-4e73-822c-c4f849322623",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.10.1"
    },
    "data_stream": {
        "dataset": "panw.panos",
        "namespace": "ep",
        "type": "logs"
    },
    "destination": {
        "domain": "lorexx.cn",
        "geo": {
            "city_name": "Changchun",
            "continent_name": "Asia",
            "country_iso_code": "CN",
            "country_name": "China",
            "location": {
                "lat": 43.88,
                "lon": 125.3228
            },
            "name": "United States",
            "region_iso_code": "CN-22",
            "region_name": "Jilin Sheng"
        },
        "ip": "175.16.199.1",
        "port": 80
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "f25d13cd-18cc-4e73-822c-c4f849322623",
        "snapshot": false,
        "version": "8.10.1"
    },
    "event": {
        "action": "url_filtering",
        "agent_id_status": "verified",
        "category": [
            "intrusion_detection",
            "threat",
            "network"
        ],
        "created": "2012-10-30T09:46:12.000Z",
        "dataset": "panw.panos",
        "ingested": "2023-09-26T16:43:58Z",
        "kind": "alert",
        "original": "<14>Nov 30 16:09:08 PA-220 1,2012/10/30 09:46:12,01606001116,THREAT,url,1,2012/04/10 04:39:56,192.168.0.2,175.16.199.1,0.0.0.0,0.0.0.0,rule1,crusher,,web-browsing,vsys1,trust,untrust,ethernet1/2,ethernet1/1,forwardAll,2012/04/10 04:39:58,25149,1,59309,80,0,0,0x208000,tcp,alert,\"lorexx.cn/loader.exe\",(9999),not-resolved,informational,client-to-server,0,0x0,192.168.0.0-192.168.255.255,United States,0,text/html",
        "outcome": "success",
        "severity": 5,
        "timezone": "+00:00",
        "type": [
            "allowed"
        ]
    },
    "input": {
        "type": "tcp"
    },
    "labels": {
        "captive_portal": true,
        "container_page": true
    },
    "log": {
        "level": "informational",
        "source": {
            "address": "192.168.80.7:47488"
        },
        "syslog": {
            "facility": {
                "code": 1,
                "name": "user-level"
            },
            "hostname": "PA-220",
            "priority": 14,
            "severity": {
                "code": 6,
                "name": "Informational"
            }
        }
    },
    "message": "192.168.0.2,175.16.199.1,0.0.0.0,0.0.0.0,rule1,crusher,,web-browsing,vsys1,trust,untrust,ethernet1/2,ethernet1/1,forwardAll,2012/04/10 04:39:58,25149,1,59309,80,0,0,0x208000,tcp,alert,\"lorexx.cn/loader.exe\",(9999),not-resolved,informational,client-to-server,0,0x0,192.168.0.0-192.168.255.255,United States,0,text/html",
    "network": {
        "application": "web-browsing",
        "community_id": "1:CpnxxiYk2GolQXL1AiyOIq2jeIE=",
        "direction": "inbound",
        "transport": "tcp",
        "type": "ipv4"
    },
    "observer": {
        "egress": {
            "interface": {
                "name": "ethernet1/1"
            },
            "zone": "untrust"
        },
        "ingress": {
            "interface": {
                "name": "ethernet1/2"
            },
            "zone": "trust"
        },
        "product": "PAN-OS",
        "serial_number": "01606001116",
        "type": "firewall",
        "vendor": "Palo Alto Networks"
    },
    "panw": {
        "panos": {
            "action": "alert",
            "action_flags": "0x0",
            "flow_id": "25149",
            "http_content_type": "text/html",
            "log_profile": "forwardAll",
            "logged_time": "2012-04-10T04:39:58.000Z",
            "repeat_count": 1,
            "ruleset": "rule1",
            "sequence_number": "0",
            "sub_type": "url",
            "threat": {
                "id": "9999",
                "name": "URL-filtering"
            },
            "type": "THREAT",
            "url": {
                "category": "not-resolved"
            },
            "virtual_sys": "vsys1"
        }
    },
    "related": {
        "ip": [
            "192.168.0.2",
            "175.16.199.1",
            "0.0.0.0"
        ],
        "user": [
            "crusher"
        ]
    },
    "rule": {
        "name": "rule1"
    },
    "source": {
        "geo": {
            "name": "192.168.0.0-192.168.255.255"
        },
        "ip": "192.168.0.2",
        "port": 59309,
        "user": {
            "name": "crusher"
        }
    },
    "tags": [
        "preserve_original_event",
        "panw-panos",
        "forwarded"
    ],
    "url": {
        "domain": "lorexx.cn",
        "extension": "exe",
        "original": "lorexx.cn/loader.exe",
        "path": "/loader.exe"
    },
    "user": {
        "name": "crusher"
    }
}

Exported fields

Field	Description	Type
@timestamp	Event timestamp.	date
client.bytes	Bytes sent from the client to the server.	long
client.ip	IP address of the client (IPv4 or IPv6).	ip
client.nat.ip	Translated IP of source based NAT sessions (e.g. internal client to internet). Typically connections traversing load balancers, firewalls, or routers.	ip
client.nat.port	Translated port of source based NAT sessions (e.g. internal client to internet). Typically connections traversing load balancers, firewalls, or routers.	long
client.packets	Packets sent from the client to the server.	long
client.port	Port of the client.	long
client.user.name	Short name or login of the user.	keyword
client.user.name.text	Multi-field of `client.user.name`.	match_only_text
cloud.account.id	The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.	keyword
cloud.availability_zone	Availability zone in which this host is running.	keyword
cloud.image.id	Image ID for the cloud instance.	keyword
cloud.instance.id	Instance ID of the host machine.	keyword
cloud.instance.name	Instance name of the host machine.	keyword
cloud.machine.type	Machine type of the host machine.	keyword
cloud.project.id	Name of the project in Google Cloud.	keyword
cloud.provider	Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.	keyword
cloud.region	Region in which this host is running.	keyword
container.id	Unique container id.	keyword
container.image.name	Name of the image the container was built on.	keyword
container.labels	Image labels.	object
container.name	Container name.	keyword
data_stream.dataset	Data stream dataset.	constant_keyword
data_stream.namespace	Data stream namespace.	constant_keyword
data_stream.type	Data stream type.	constant_keyword
destination.address	Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.	keyword
destination.as.number	Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.	long
destination.as.organization.name	Organization name.	keyword
destination.as.organization.name.text	Multi-field of `destination.as.organization.name`.	match_only_text
destination.bytes	Bytes sent from the destination to the source.	long
destination.domain	The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.	keyword
destination.geo.city_name	City name.	keyword
destination.geo.continent_name	Name of the continent.	keyword
destination.geo.country_iso_code	Country ISO code.	keyword
destination.geo.country_name	Country name.	keyword
destination.geo.location	Longitude and latitude.	geo_point
destination.geo.name	User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation.	keyword
destination.geo.region_iso_code	Region ISO code.	keyword
destination.geo.region_name	Region name.	keyword
destination.ip	IP address of the destination (IPv4 or IPv6).	ip
destination.nat.ip	Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers.	ip
destination.nat.port	Port the source session is translated to by NAT Device. Typically used with load balancers, firewalls, or routers.	long
destination.packets	Packets sent from the destination to the source.	long
destination.port	Port of the destination.	long
destination.user.domain	Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name.	keyword
destination.user.email	User email address.	keyword
destination.user.name	Short name or login of the user.	keyword
destination.user.name.text	Multi-field of `destination.user.name`.	match_only_text
ecs.version	ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.	keyword
error.message	Error message.	match_only_text
event.action	The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.	keyword
event.category	This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories.	keyword
event.code	Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.	keyword
event.created	`event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used.	date
event.dataset	Event dataset.	constant_keyword
event.duration	Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time.	long
event.end	`event.end` contains the date when the event ended or when the activity was last observed.	date
event.kind	This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.	keyword
event.module	Event module.	constant_keyword
event.original	Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`.	keyword
event.outcome	This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.	keyword
event.reason	Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`).	keyword
event.severity	The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.	long
event.start	`event.start` contains the date when the event started or when the activity was first observed.	date
event.timezone	This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00").	keyword
event.type	This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types.	keyword
file.name	Name of the file including the extension, without the directory.	keyword
file.path	Full path to the file, including the file name. It should include the drive letter, when appropriate.	keyword
file.path.text	Multi-field of `file.path`.	match_only_text
file.type	File type (file, dir, or symlink).	keyword
host.architecture	Operating system architecture.	keyword
host.containerized	If the host is a container.	boolean
host.domain	Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.	keyword
host.hostname	Hostname of the host. It normally contains what the `hostname` command returns on the host machine.	keyword
host.id	Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`.	keyword
host.ip	Host ip addresses.	ip
host.mac	Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.	keyword
host.name	Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.	keyword
host.os.build	OS build information.	keyword
host.os.codename	OS codename, if any.	keyword
host.os.family	OS family (such as redhat, debian, freebsd, windows).	keyword
host.os.full	Operating system name, including the version or code name.	keyword
host.os.full.text	Multi-field of `host.os.full`.	match_only_text
host.os.kernel	Operating system kernel version as a raw string.	keyword
host.os.name	Operating system name, without the version.	keyword
host.os.name.text	Multi-field of `host.os.name`.	text
host.os.platform	Operating system platform (such centos, ubuntu, windows).	keyword
host.os.version	Operating system version as a raw string.	keyword
host.type	Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.	keyword
hostname	Name of host parsed from syslog message.	keyword
http.request.method	HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field.	keyword
http.request.referer	Referrer for this HTTP request.	keyword
http.request.referrer	Referrer for this HTTP request.	keyword
http.version	HTTP version.	keyword
input.type	Type of Filebeat input.	keyword
labels	Custom key/value pairs. Can be used to add meta information to events. Should not contain nested objects. All values are stored as keyword. Example: `docker` and `k8s` labels.	object
labels.captive_portal		boolean
labels.client_server_policy_based_forwarding		boolean
labels.connect_to_destination_host		boolean
labels.container_page		boolean
labels.decrypted_traffic		boolean
labels.enterprise_credential_submission		boolean
labels.file_submitted_to_WildFire		boolean
labels.http_proxy		boolean
labels.ipv6_session		boolean
labels.nat_translated		boolean
labels.non_standard_port_usage		boolean
labels.payload_outer_tunnel		boolean
labels.pcap_included		boolean
labels.server_client_policy_based_forwarding		boolean
labels.source_flow_allow_list		boolean
labels.ssl_decrypted		boolean
labels.symmetric_return		boolean
labels.temporary_match		boolean
labels.url_filter_denied		boolean
labels.x_forwarded_for		boolean
log.file.path	Path to the log file.	keyword
log.flags	Flags for the log file.	keyword
log.level	Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`.	keyword
log.offset	Offset of the entry in the log file.	long
log.source.address	Source address from which the log event was read / sent from.	keyword
log.syslog.facility.code	The Syslog numeric facility of the log event, if available. According to RFCs 5424 and 3164, this value should be an integer between 0 and 23.	long
log.syslog.facility.name	The Syslog text-based facility of the log event, if available.	keyword
log.syslog.hostname	The hostname, FQDN, or IP of the machine that originally sent the Syslog message. This is sourced from the hostname field of the syslog header. Depending on the environment, this value may be different from the host that handled the event, especially if the host handling the events is acting as a collector.	keyword
log.syslog.priority	Syslog numeric priority of the event, if available. According to RFCs 5424 and 3164, the priority is 8 * facility + severity. This number is therefore expected to contain a value between 0 and 191.	long
log.syslog.severity.code	The Syslog numeric severity of the log event, if available. If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`.	long
log.syslog.severity.name	The Syslog numeric severity of the log event, if available. If the event source publishing via Syslog provides a different severity value (e.g. firewall, IDS), your source's text severity should go to `log.level`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `log.level`.	keyword
log.syslog.version	The version of the Syslog protocol specification. Only applicable for RFC 5424 messages.	keyword
message	For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message.	match_only_text
network.application	When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. The field value must be normalized to lowercase for querying.	keyword
network.bytes	Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum.	long
network.community_id	A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec.	keyword
network.direction	Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.	keyword
network.forwarded_ip	Host IP address when the source IP address is the proxy.	ip
network.packets	Total packets transferred in both directions. If `source.packets` and `destination.packets` are known, `network.packets` is their sum.	long
network.transport	Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying.	keyword
network.type	In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying.	keyword
observer.egress.interface.name	Interface name as reported by the system.	keyword
observer.egress.zone	Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc.	keyword
observer.geo.name	User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation.	keyword
observer.hostname	Hostname of the observer.	keyword
observer.ingress.interface.name	Interface name as reported by the system.	keyword
observer.ingress.zone	Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc.	keyword
observer.product	The product name of the observer.	keyword
observer.serial_number	Observer serial number.	keyword
observer.type	The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`.	keyword
observer.vendor	Vendor name of the observer.	keyword
panw.panos.access_point.name	Reference to a Packet Data Network Data Gateway (PGW)/ Gateway GPRS Support Node in a mobile network. Composed of a mandatory APN Network Identifier and an optional APN Operator Identifier.	keyword
panw.panos.action	Action taken for the session; values are alert, allow, deny, drop, drop-all-packets, reset-client, reset-server, reset-both, block-url.	keyword
panw.panos.action_flags	A bit field indicating if the log was forwarded to Panorama.	keyword
panw.panos.action_source	Specifies whether the action taken to allow or block an application was defined in the application or in policy. The actions can be allow, deny, drop, reset- server, reset-client or reset-both for the session.	keyword
panw.panos.admin	Username of the Administrator performing the configuration.	keyword
panw.panos.after_change_detail	This field is in custom logs only; it is not in the default format.It contains the full xpath after the configuration change.	keyword
panw.panos.application.category	The application category specified in the application configuration properties. Values are: business-systems, collaboration, general-internet, media, networking, saas.	keyword
panw.panos.application.characteristics	Comma-separated list of applicable characteristic of the application.	keyword
panw.panos.application.container	The parent application for an application.	keyword
panw.panos.application.is_saas	Displays 1 if a SaaS application or 0 if not a SaaS application.	keyword
panw.panos.application.is_sanctioned	Displays 1 if application is sanctioned or 0 if application is not sanctioned.	keyword
panw.panos.application.risk_level	Risk level associated with the application (1=lowest to 5=highest).	long
panw.panos.application.sub_category	The application subcategory specified in the application configuration properties.	keyword
panw.panos.application.technology	The application technology specified in the application configuration properties. Values are: browser-based, client-server, network-protocol, peer-to-peer.	keyword
panw.panos.application.tunneled	Name of the tunneled application.	keyword
panw.panos.area_code	Area within a Public Land Mobile Network (PLMN).	keyword
panw.panos.attempted_gateways	The fields that are collected for each gateway connection attempt with the gateway name, SSL response time, and priority (Each field entry is separated by commas such as g82-gateway,12,3. Each gateway entry is separated by semicolons such as g83-gateway,10,2;g84-gateway,-1,1.	keyword
panw.panos.auth_method	A string showing the authentication type, such as LDAP, RADIUS, or SAML.	keyword
panw.panos.authentication.id	Unique ID given across primary authentication and additional (multi factor) authentication.	keyword
panw.panos.authentication.policy	Policy invoked for authentication before allowing access to a protected resource.	keyword
panw.panos.authentication.protocol	Indicates the authentication protocol used by the server. For example, PEAP with GTC.	keyword
panw.panos.before_change_detail	This field is in custom logs only; it is not in the default format. It contains the full xpath before the configuration change.	keyword
panw.panos.bytes_received	Number of bytes in the server-to-client direction of the session.	long
panw.panos.bytes_sent	Number of bytes in the client-to-server direction of the session.	long
panw.panos.category	A summary of the kind of threat or harm posed to the network, user, or host.	keyword
panw.panos.cause_code	GTP cause value in logs responses which contain an Information Element that provides information about acceptance or rejection of GTP requests by a network node.	keyword
panw.panos.cell.id	Base station within an area code.	keyword
panw.panos.certificate.fingerprint	A hash of the certificate in x509 binary format.	keyword
panw.panos.certificate.flags	The certificate flags can return seven values: b_resume_session, b_cert_cn_truncated, b_issuer_cn_truncated, b_root_cn_truncated, b_sni_truncated, b_cert_type, padding3.	keyword
panw.panos.certificate.not_after	The time the certificate expires (certificate becomes invalid after this time).	date
panw.panos.certificate.not_before	The time the certificate became valid (certificate in invalid before this time).	date
panw.panos.certificate.raw_size	The raw certificate key size.	keyword
panw.panos.certificate.serial_number	The unique identifier of the certificate (generated by the certificate issuer).	keyword
panw.panos.certificate.size	The certificate key size.	long
panw.panos.certificate.version	The certificate version (V1, V2, or V3).	keyword
panw.panos.chain_status	Whether the chain is trusted. Values are: Uninspected, Untrusted, Trusted, Incomplete	keyword
panw.panos.client.os	The client device’s OS type (for example, Windows or Linux).	keyword
panw.panos.client.os_version	The client device’s OS version.	keyword
panw.panos.client_type	Type of client to used by administrator or complete authentication.	keyword
panw.panos.client_ver	The client's GlobalProtect app version.	keyword
panw.panos.cloud_report.id	Unique 32 character ID for a file scanned by the DLP cloud service sent by a firewall.	keyword
panw.panos.cmd	Command performed by the Admin; values are add, clone, commit, delete, edit, move, rename, set.	keyword
panw.panos.comment	The audit comment entered in a policy rule configuration change.	keyword
panw.panos.config_version	The software version.	keyword
panw.panos.connect_method	A string showing the how the GlobalProtect app connects to Gateway, (for example, on-demand or user-logon.	keyword
panw.panos.container.id	The container ID of the PAN-NGFW pod on the Kubernetes node where the application POD is deployed.	keyword
panw.panos.content_version	Applications and Threats version on your firewall when the log was generated.	keyword
panw.panos.datasource	Source from which mapping information is collected.	keyword
panw.panos.datasource_subtype	The mechanism used to identify the IP address-to-username mappings within a data source.	keyword
panw.panos.datasource_type	The source from which mapping information is collected.	keyword
panw.panos.datasourcename	User-ID source that sends the IP (Port)-User Mapping.	keyword
panw.panos.datasourcetype	Mechanism used to identify the IP/User mappings within a data source.	keyword
panw.panos.description	Additional information for any event that has occurred.	text
panw.panos.destination.ip	Original session destination IP address.	ip
panw.panos.destination.location	Destination country or Internal region for private addresses. Maximum length is 32 bytes.	keyword
panw.panos.destination.nat.ip	If destination NAT performed, the post-NAT destination IP address.	ip
panw.panos.destination.nat.port	Post-NAT destination port.	long
panw.panos.destination.port	Destination port utilized by the session.	long
panw.panos.destination.user	Username of the user to which the session was destined.	keyword
panw.panos.destination.zone	Zone the session was destined to.	keyword
panw.panos.destination_vm_uuid	Identifies the destination universal unique identifier for a guest virtual machine in the VMware NSX environment.	keyword
panw.panos.device_group_hierarchy1	A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. The firewall (or virtual system) generating the log includes the identification number of each ancestor in its device group hierarchy. The shared device group (level 0) is not included in this structure.	keyword
panw.panos.device_group_hierarchy2	A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. The firewall (or virtual system) generating the log includes the identification number of each ancestor in its device group hierarchy. The shared device group (level 0) is not included in this structure.	keyword
panw.panos.device_group_hierarchy3	A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. The firewall (or virtual system) generating the log includes the identification number of each ancestor in its device group hierarchy. The shared device group (level 0) is not included in this structure.	keyword
panw.panos.device_group_hierarchy4	A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. The firewall (or virtual system) generating the log includes the identification number of each ancestor in its device group hierarchy. The shared device group (level 0) is not included in this structure.	keyword
panw.panos.device_group_id	The device group the firewall belongs to if managed by a Panorama™ management server.	keyword
panw.panos.device_name	The hostname of the firewall on which the session was logged.	keyword
panw.panos.diameter_app_id	The diameter application in the data chunk which triggered the event. Diameter Application ID is assigned by Internet Assigned Numbers Authority (IANA).	keyword
panw.panos.diameter_avp_code	The diameter AVP code in the data chunk which triggered the event.	keyword
panw.panos.diameter_cmd_code	The diameter command code in the data chunk which triggered the event. Diameter Command Code is assigned by Internet Assigned Numbers Authority (IANA).	keyword
panw.panos.domain_edl	The name of the external dynamic list that contains the domain name of the traffic.	keyword
panw.panos.dst.category	The category for the device that Device-ID identifies as the destination for the traffic.	keyword
panw.panos.dst.dynamic_address_group	Original destination source dynamic address group.	keyword
panw.panos.dst.external_dynamic_list	The name of the external dynamic list that contains the destination IP address of the traffic.	keyword
panw.panos.dst.host	The hostname of the device that Device-ID identifies as the destination for the traffic.	keyword
panw.panos.dst.mac	The MAC address for the device that Device-ID identifies as the destination for the traffic.	keyword
panw.panos.dst.model	The model of the device that Device-ID identifies as the destination for the traffic.	keyword
panw.panos.dst.os.family	The operating system type for the device that Device-ID identifies as the destination for the traffic.	keyword
panw.panos.dst.os.version	The version of the operating system for the device that Device-ID identifies as the destination for the traffic.	keyword
panw.panos.dst.profile	The device profile for the device that Device-ID identifies as the destination for the traffic.	keyword
panw.panos.dst.vendor	The vendor of the device that Device-ID identifies as the destination for the traffic.	keyword
panw.panos.dynamic_user.group.name	Name of the dynamic user group that contains the user who initiated the session.	keyword
panw.panos.elapsed_time	Elapsed time of the session.	long
panw.panos.elliptic_curve	The elliptic cryptography curve that the client and server negotiate and use for connections that use ECDHE cipher suites.	keyword
panw.panos.end_ip_address	IP address of a mobile subscriber allocated by a PGW/GGSN.	ip
panw.panos.endreason	The reason a session terminated.	keyword
panw.panos.error_code	An integer associated with any errors that occurred.	integer
panw.panos.error_message	A string showing that error that has occurred in any event.	keyword
panw.panos.event.id	A string showing the name of the event.	keyword
panw.panos.event.reason	A string that shows the reason for the quarantine.	keyword
panw.panos.event.result	Result of the authentication attempt.	keyword
panw.panos.event.status	The status (success or failure) of the event.	keyword
panw.panos.event_code	Event code describing the GTP event.	keyword
panw.panos.event_type	Defines event triggered by a GTP message when checks in GTP protection profile are applied to the GTP traffic. Also triggered by the start or end of a GTP session.	keyword
panw.panos.evidence	A summary statement that indicates how many times the host has matched against the conditions defined in the correlation object. For example, Host visited known malware URl (19 times).	keyword
panw.panos.factorcompletiontime	Time the authentication was completed.	date
panw.panos.factorno	Indicates the use of primary authentication (1) or additional factors (2, 3).	integer
panw.panos.factortype	Vendor used to authenticate a user when Multi Factor authentication is present.	keyword
panw.panos.file.hash	Only for WildFire subtype; all other types do not use this field. The filedigest string shows the binary hash of the file sent to be analyzed by the WildFire service.	keyword
panw.panos.file.type	Only for WildFire subtype; all other types do not use this field. Specifies the type of file that the firewall forwarded for WildFire analysis.	keyword
panw.panos.flow_id	An internal numerical identifier applied to each session.	keyword
panw.panos.forwarded_ip	Only for the URL Filtering subtype; all other types do not use this field. The X-Forwarded-For field in the HTTP header contains the IP address of the user who requested the web page. It allows you to identify the IP address of the user, which is useful particularly if you have a proxy server on your network that replaces the user IP address with its own address in the source IP address field of the packet header.	ip
panw.panos.gateway	The name of the gateway that is specified on the portal configuration.	keyword
panw.panos.generated_time	Time the log was generated on the dataplane.	date
panw.panos.hash	The authentication algorithm used for the session, for example, SHA, SHA256, SHA384, etc.	keyword
panw.panos.high_resolution_timestamp	Time in milliseconds the log was received at the management plane. The format for this new field is YYYY-MM-DDThh:ss:sssTZD.	date
panw.panos.host.id	Unique ID GlobalProtect assigns to identify the host.	keyword
panw.panos.host.ip	Hostname or IP address of the client machine.	ip
panw.panos.hs_stage_c2f	The stage of the TLS handshake from the client to the firewall.	keyword
panw.panos.hs_stage_f2s	The stage of the TLS handshake from the firewall to the server.	keyword
panw.panos.http2_connection	Identifies if traffic used an HTTP/2 connection by displaying one of the following values: TCP connection session ID - session is HTTP/2, 0 - session is not HTTP/2.	keyword
panw.panos.http_content_type	Content type of the HTTP response data.	keyword
panw.panos.http_headers	Indicates the inserted HTTP header in the URL log entries on the firewall.	keyword
panw.panos.http_method	Describes the HTTP Method used in the web request.	keyword
panw.panos.imei	International Mobile Equipment Identity (IMEI) is a unique 15 or 16 digit number allocated to each mobile station equipment.	keyword
panw.panos.imsi	International Mobile Subscriber Identity (IMSI) is a unique number allocated to each mobile subscriber in the GSM/UMTS/EPS system.	keyword
panw.panos.inbound_interface	Interface that the session was sourced from.	keyword
panw.panos.interface	3GPP interface from which a GTP message is received.	keyword
panw.panos.is_offloaded	Displays 1 if traffic flow has been offloaded or 0 if traffic flow was not offloaded.	keyword
panw.panos.issuer_common_name.length	The length of the issuer common name.	long
panw.panos.issuer_common_name.value	The name of the organization that verified the certificate’s contents.	keyword
panw.panos.justification	Justification for Data Filtering action.	keyword
panw.panos.link.change_count	Number of link flaps that occurred during the session.	long
panw.panos.link.switches	Contains up to four link flap entries, with each entry containing the link name, link tag, link type, physical interface, timestamp, bytes read, bytes written, link health, and link flap cause.	keyword
panw.panos.location	A string showing the administrator-defined location of the GlobalProtect portal or gateway.	keyword
panw.panos.log_profile	The MAC address of the user’s machine or device.	keyword
panw.panos.logged_time	The time the log was received.	date
panw.panos.login_duration	The length of time, in seconds, the user is connected to the GlobalProtect gateway from logging in to logging out.	long
panw.panos.machine.mac_address	The MAC address of the user’s machine or device.	keyword
panw.panos.machine.name	The name of the user’s machine.	keyword
panw.panos.machine.os	The operating system installed on the user’s machine or device (or on the client system).	keyword
panw.panos.matchname	Name of the HIP object or profile.	keyword
panw.panos.matchtype	Whether the document represents a HIP object or a HIP profile.	keyword
panw.panos.max_encapsulation	Number of packets the firewall dropped because the packet exceeded the maximum number of encapsulation levels configured in the Tunnel Inspection policy rule.	long
panw.panos.mcc	Mobile country code of serving core network operator.	keyword
panw.panos.message_type	Indicates the GTP message type.	keyword
panw.panos.misc	Field with variable length and containes URL,Filename based on threat sub-type. A Filename has a maximum of 63 characters. A URL has a maximum of 1023 characters.	keyword
panw.panos.mnc	Mobile network code of serving core network operator.	keyword
panw.panos.module	This field is valid only when the value of the Subtype field is general. It provides additional information about the sub-system generating the log; values are general, management, auth, ha, upgrade, chassis.	keyword
panw.panos.msisdn	Service identity associated with the mobile subscriber composed of a Country Code, National Destination Code and a Subscriber. Consists of decimal digits (0-9) only with a maximum of 15 digits.	keyword
panw.panos.network.application	Application associated with the session.	keyword
panw.panos.network.bytes	Number of total bytes (transmit and receive) for the session.	long
panw.panos.network.direction	Indicates the direction of the attack, client-to-server or server-to-client: 0 - direction of the threat is client to server, 1 - direction of the threat is server to client.	keyword
panw.panos.network.nat.community_id	Community ID flow-hash for the NAT 5-tuple.	keyword
panw.panos.network.packets	Number of total packets (transmit and receive) for the session.	long
panw.panos.network.pcap_id	The packet capture (pcap) ID is a 64 bit unsigned integral denoting an ID to correlate threat pcap files with extended pcaps taken as a part of that flow. All threat logs will contain either a pcap_id of 0 (no associated pcap), or an ID referencing the extended pcap file.	keyword
panw.panos.normalize_user	Normalized version of username being authenticated (such as appending a domain name to the username).	keyword
panw.panos.nsdsai_sd	The A Slice Differentiator of the Network Slice ID.	keyword
panw.panos.nsdsai_sst	The A Slice Service Type of the Network Slice ID.	keyword
panw.panos.nssai_sd	The A Slice Differentiator of the Network Slice ID.	keyword
panw.panos.nssai_sst	The A Slice Service Type of the Network Slice ID.	keyword
panw.panos.object.id	Name of the object associated with the system event.	keyword
panw.panos.object.name	Name of the correlation object that was matched on.	keyword
panw.panos.observer.serial_number	Serial number of the device that generated the log.	keyword
panw.panos.op_code	Identifies the operation code of application layer SS7 protocols, like MAP or CAP, in the data chunk which triggered the event.	keyword
panw.panos.outbound_interface	Interface that the session was destined to.	keyword
panw.panos.packets_received	Number of server-to-client packets for the session.	long
panw.panos.packets_sent	Number of client-to-server packets for the session.	long
panw.panos.parent_session.id	ID of the session in which this session is tunneled. Applies to inner tunnel (if two levels of tunneling) or inside content (if one level of tunneling) only.	keyword
panw.panos.parent_session.start_time	Year/month/day hours:minutes:seconds that the parent tunnel session began.	date
panw.panos.partial_hash	Machine Learning partial hash.	keyword
panw.panos.path	The path of the configuration command issued; up to 512 bytes in length.	keyword
panw.panos.payload_protocol_id	ID of the protocol for the payload in the data portion of the data chunk.	keyword
panw.panos.pcap_id	Unique packet capture ID that defines the location of the pcap file on the firewall.	keyword
panw.panos.pdu_session.id	Session ID for the collection of L4 segments inside a tunnel.	keyword
panw.panos.pod.name	The application POD being secured.	keyword
panw.panos.pod.namespace	The namespace of the application POD being secured.	keyword
panw.panos.policy.id	Name of the SD-WAN policy.	keyword
panw.panos.policy.name	The name of the Decryption policy associated with the session.	keyword
panw.panos.portal	The name of the GlobalProtect portal or gateway.	keyword
panw.panos.priority	The priority order of the gateway that is based on highest (1), high (2), medium (3), low (4), or lowest (5) to which the GlobalProtect app can connect.	keyword
panw.panos.private.ip	The private IP address for the user who initiated the session.	ip
panw.panos.private.ipv6	The private IPv6 address for the user who initiated the session.	ip
panw.panos.protocol	IP protocol associated with the session.	keyword
panw.panos.proxy_type	The Decryption proxy type, such as Forward for Forward Proxy, Inbound for Inbound Inspection, No Decrypt for undecrypted traffic, GlobalProtect, etc.	keyword
panw.panos.public.ip	The public IP address for the user who initiated the session.	ip
panw.panos.public.ipv6	The public IPv6 address for the user who initiated the session.	ip
panw.panos.radio_access_technology_type	Type of technology used for radio access. For example, EUTRAN, WLAN, Virtual, HSPA Evolution, GAN and GERAN.	keyword
panw.panos.reason	Reason for Data Filtering action.	keyword
panw.panos.received_time	Time the log was received at the management plane.	date
panw.panos.recipient	Specifies the name of the receiver of an email.	keyword
panw.panos.referrer	The Referer field in the HTTP header contains the URL of the web page that linked the user to another web page; it is the source that redirected (referred) the user to the web page that is being requested.	keyword
panw.panos.region	The geographical region where the traffic originates.	keyword
panw.panos.related_vsys	Virtual System associated with the session.	keyword
panw.panos.remote_user.id	IMSI identity of a remote user, and if available, one IMEI identity or one MSISDN identity.	keyword
panw.panos.remote_user.ip	IPv4 or IPv6 address of a remote user.	ip
panw.panos.repeat_count	Number of sessions with same Source IP, Destination IP, Application, and Subtype seen within 5 seconds.	long
panw.panos.response_time	The SSL response time of the selected gateway that is measured in milliseconds on the endpoint during tunnel setup.	long
panw.panos.result	Result of the configuration action; values are Submitted, Succeeded, Failed, and Unauthorized.	keyword
panw.panos.root_certificate_status	The status of the root certificate, for example, trusted, untrusted, or uninspected.	keyword
panw.panos.root_common_name.length	The length of the root common name.	long
panw.panos.root_common_name.value	The name of the root certificate authority.	keyword
panw.panos.rule_uuid	The UUID that permanently identifies the rule.	keyword
panw.panos.ruleset	Name of the rule that the session matched.	keyword
panw.panos.sccp.calling_gt	The Signaling Connection Control Part (SCCP) calling party global title (GT) in the data chunk which triggered the event.	keyword
panw.panos.sccp.calling_ssn	The Signaling Connection Control Part (SCCP) calling party subsystem number (SSN) in the data chunk which triggered the event.	keyword
panw.panos.sctp.assoc_end_reason	reason an association was terminated.	keyword
panw.panos.sctp.assoc_id	Number that identifies all connections for an association between two SCTP endpoints.	keyword
panw.panos.sctp.cause_code	Sent by an endpoint to specify reason for an error condition to other endpoint of same SCTP association.	keyword
panw.panos.sctp.chunk_type	Describes the type of information contained in a chunk, such as control or data.	keyword
panw.panos.sctp.chunks	Sum of SCTP chunks sent and received for an association.	long
panw.panos.sctp.chunks_received	Number of SCTP chunks received for an association.	long
panw.panos.sctp.chunks_sent	Number of SCTP chunks sent for an association.	long
panw.panos.sctp.filter	Name of the filter that the SCTP chunk matched.	keyword
panw.panos.sctp.stream_id	ID of the stream which carries the data chunk which triggered the event.	keyword
panw.panos.sctp.verification.tag_1	Used by endpoint1 which initiates the association to verify if the SCTP packet received belongs to current SCTP association and validate the endpoint2.	keyword
panw.panos.sctp.verification.tag_2	Used by endpoint2 to verify if the SCTP packet received belongs to current SCTP association and validate the endpoint1.	keyword
panw.panos.sdwan.cluster.name	Name of the SD-WAN cluster.	keyword
panw.panos.sdwan.cluster.type	Type of cluster (mesh or hub-spoke).	keyword
panw.panos.sdwan.device_type	Type of device (hub or branch).	keyword
panw.panos.sdwan.site	Name of the SD-WAN site.	keyword
panw.panos.selection_type	The connection method that is selected to connect to the gateway.	keyword
panw.panos.sender	Specifies the name of the sender of an email.	keyword
panw.panos.sequence_number	A 64-bit log entry identifier incremented sequentially; each log type has unique number space.	keyword
panw.panos.serial_number	Serial number of the user’s machine or device.	keyword
panw.panos.server_name_indication.length	The length of the Server Name Indication (hostname).	long
panw.panos.server_name_indication.value	The hostname of the server that the client is trying to contact. Using SNIs enables a server to host multiple websites and present multiple certificates on the same IP address and TCP port because each website has a unique SNI.	keyword
panw.panos.server_profile	Authentication server used for authentication.	keyword
panw.panos.session.owner	The original high availability (HA) peer session owner in an HA cluster from which the session table data was synchronized upon HA failover.	keyword
panw.panos.sessions.closed	Number of completed/closed sessions created.	long
panw.panos.sessions.created	Number of inner sessions created.	long
panw.panos.severity	Severity associated with the event; values are informational, low, medium, high, critical.	keyword
panw.panos.source.ip	Original session source IP address.	ip
panw.panos.source.ipv6	IPv6 address of the user’s machine or device.	ip
panw.panos.source.location	Source country or Internal region for private addresses; maximum length is 32 bytes.	keyword
panw.panos.source.nat.ip	If Source NAT performed, the post-NAT Source IP address.	ip
panw.panos.source.nat.port	Post-NAT source port.	long
panw.panos.source.port	Source port utilized by the session.	long
panw.panos.source.region	The region for the user who initiated the session.	keyword
panw.panos.source.user	The username of the user who initiated the session.	keyword
panw.panos.source.zone	Zone the session was sourced from.	keyword
panw.panos.source_vm_uuid	Identifies the source universal unique identifier for a guest virtual machine in the VMware NSX environment.	keyword
panw.panos.src.category	The category for the device that Device-ID identifies as the source of the traffic.	keyword
panw.panos.src.dynamic_address_group	Original session source dynamic address group.	keyword
panw.panos.src.external_dynamic_list	The name of the external dynamic list that contains the source IP address of the traffic.	keyword
panw.panos.src.host	The hostname of the device that Device-ID identifies as the source of the traffic.	keyword
panw.panos.src.mac	The MAC address for the device that Device-ID identifies as the source of the traffic.	keyword
panw.panos.src.model	The model of the device that Device-ID identifies as the source of the traffic.	keyword
panw.panos.src.os.family	The operating system type for the device that Device-ID identifies as the source of the traffic.	keyword
panw.panos.src.os.version	The version of the operating system for the device that Device-ID identifies as the source of the traffic.	keyword
panw.panos.src.profile	The device profile for the device that Device-ID identifies as the source of the traffic.	keyword
panw.panos.src.vendor	The vendor of the device that Device-ID identifies as the source of the traffic.	keyword
panw.panos.stage	A string showing the stage of the connection (for example, before-login, login, or tunnel).	keyword
panw.panos.start_time	Time of session start.	date
panw.panos.strict_check	Number of packets the firewall dropped because the tunnel protocol header in the packet failed to comply with the RFC for the tunnel protocol, as enabled in the Tunnel Inspection policy rule (Drop packet if tunnel protocol fails strict header check).	long
panw.panos.sub_type	Subtype of logs.	keyword
panw.panos.subject	Specifies the subject of an email.	keyword
panw.panos.subject_common_name.length	The length of the subject common name.	long
panw.panos.subject_common_name.value	The domain name (the name of the server that the certificate protects).	keyword
panw.panos.tag.name	The tag mapped to the source IP address.	keyword
panw.panos.threat.id	Palo Alto Networks identifier for the threat.	keyword
panw.panos.threat.name	Identifier for known and custom threats.	keyword
panw.panos.threat_category	Describes threat categories used to classify different types of threat signatures.If a domain external dynamic list generated the log, domain-edl populates this field.	keyword
panw.panos.timeout	Timeout after which the IP/User Mappings and IP address-to-tag mapping are cleared.	integer
panw.panos.tls.auth	The authentication algorithm used for the session, for example, SHA, SHA256, SHA384, etc.	keyword
panw.panos.tls.encryption	The algorithm used to encrypt the session data, such as AES-128-CBC, AES-256-GCM, etc.	keyword
panw.panos.tls.error_type	The type of error that occurred: Cipher, Resource, Resume, Version, Protocol, Certificate, Feature, or HSM.	keyword
panw.panos.tls.key_exchange_algorithm	The key exchange algorithm used for the session.	keyword
panw.panos.tls.version	The version of TLS protocol used for the session.	keyword
panw.panos.tunnel_endpoint.identifier1	Identifies the GTP tunnel in the network node. TEID1 is the first TEID in the GTP message.	keyword
panw.panos.tunnel_endpoint.identifier2	Identifies the GTP tunnel in the network node. TEID2 is the second TEID in the GTP message.	keyword
panw.panos.tunnel_fragment	Number of packets the firewall dropped because of fragmentation errors.	long
panw.panos.tunnel_inspection_rule	Name of the tunnel inspection rule matching the cleartext tunnel traffic.	keyword
panw.panos.tunnel_type	Type of tunnel, such as GRE or IPSec or SSLVPN.	keyword
panw.panos.type	Specifies the type of log; values are HIP-MATCH, CONFIG, GLOBALPROTECT, THREAT, TRAFFIC, USERID, AUTHENTICATION, CORRELATION, DECRYPTION, GTP, IPTAG, SCTP, SYSTEM.	keyword
panw.panos.ugflags	Displays whether the user group that was found during user group mapping. Supported values are: User Group Found—Indicates whether the user could be mapped to a group.Duplicate User—Indicates whether duplicate users were found in a user group. Displays N/A if no user group is found.	keyword
panw.panos.unknown_protocol	Number of packets the firewall dropped because the packet contains an unknown protocol, as enabled in the Tunnel Inspection policy rule (Drop packet if unknown protocol inside tunnel).	long
panw.panos.url.category	For URL Subtype, it is the URL Category; For WildFire subtype, it is the verdict on the file and is either ‘malware’, ‘phishing’, ‘grayware’, or ‘benign’; For other subtypes, the value is ‘any’.	keyword
panw.panos.url_category_list	Lists the URL Filtering categories that the firewall used to enforce policy.	keyword
panw.panos.url_idx	Used in URL Filtering and WildFire subtypes. When an application uses TCP keepalives to keep a connection open for a length of time, all the log entries for that session have a single session ID. In such cases, when you have a single threat log (and session ID) that includes multiple URL entries, the url_idx is a counter that allows you to correlate the order of each log entry within the single session. For example, to learn the URL of a file that the firewall forwarded to WildFire for analysis, locate the session ID and the url_idx from the WildFire Submissions log and search for the same session ID and url_idx in your URL filtering logs. The log entry that matches the session ID and url_idx will contain the URL of the file that was forwarded to WildFire.	keyword
panw.panos.user	End user being authenticated.	keyword
panw.panos.user_agent	Only for the URL Filtering subtype; all other types do not use this field. The User Agent field specifies the web browser that the user used to access the URL, for example Internet Explorer. This information is sent in the HTTP request to the server.	keyword
panw.panos.user_by_source	Indicates the username received from the source through IP address-to-username mapping.	keyword
panw.panos.vendor	Vendor providing additional factor authentication.	keyword
panw.panos.virtual_sys	Virtual System associated with the session.	keyword
panw.panos.vsys_id	A unique identifier for a virtual system on a Palo Alto Networks firewall.	keyword
panw.panos.vsys_name	The name of the virtual system associated with the session; only valid on firewalls enabled for multiple virtual systems.	keyword
panw.panos.wildfire.name	Only for WildFire subtype; all other types do not use this field. The cloud string displays the FQDN of either the WildFire appliance (private) or the WildFire cloud (public) from where the file was uploaded for analysis.	keyword
panw.panos.wildfire.report_id	Only for Data Filtering and WildFire subtype; all other types do not use this field. Identifies the analysis request on the firewall, WildFire cloud, or the WildFire appliance.	keyword
panw.panos.x_forwarded_for	Only for the URL Filtering subtype; all other types do not use this field. The X-Forwarded-For field in the HTTP header contains the IP address of the user who requested the web page. It allows you to identify the IP address of the user, which is useful particularly if you have a proxy server on your network that replaces the user IP address with its own address in the source IP address field of the packet header.	keyword
panw.panos.xff.ip	The IP address of the user who requested the web page or the IP address of the next to last device that the request traversed. If the request goes through one or more proxies, load balancers, or other upstream devices, the firewall displays the IP address of the most recent device.	ip
related.hash	All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search).	keyword
related.hosts	All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases.	keyword
related.ip	All of the IPs seen on your event.	ip
related.user	All the user names or other user identifiers seen on the event.	keyword
rule.name	The name of the rule or signature generating the event.	keyword
rule.uuid	A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event.	keyword
server.bytes	Bytes sent from the server to the client.	long
server.ip	IP address of the server (IPv4 or IPv6).	ip
server.nat.ip	Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers.	ip
server.nat.port	Translated port of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers.	long
server.packets	Packets sent from the server to the client.	long
server.port	Port of the server.	long
server.user.name	Short name or login of the user.	keyword
server.user.name.text	Multi-field of `server.user.name`.	match_only_text
session.start_time	Time of session start.	date
source.address	Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.	keyword
source.as.number	Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.	long
source.as.organization.name	Organization name.	keyword
source.as.organization.name.text	Multi-field of `source.as.organization.name`.	match_only_text
source.bytes	Bytes sent from the source to the destination.	long
source.geo.city_name	City name.	keyword
source.geo.continent_name	Name of the continent.	keyword
source.geo.country_iso_code	Country ISO code.	keyword
source.geo.country_name	Country name.	keyword
source.geo.location	Longitude and latitude.	geo_point
source.geo.name	User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation.	keyword
source.geo.region_iso_code	Region ISO code.	keyword
source.geo.region_name	Region name.	keyword
source.ip	IP address of the source (IPv4 or IPv6).	ip
source.nat.ip	Translated ip of source based NAT sessions (e.g. internal client to internet) Typically connections traversing load balancers, firewalls, or routers.	ip
source.nat.port	Translated port of source based NAT sessions. (e.g. internal client to internet) Typically used with load balancers, firewalls, or routers.	long
source.packets	Packets sent from the source to the destination.	long
source.port	Port of the source.	long
source.user.domain	Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name.	keyword
source.user.email	User email address.	keyword
source.user.name	Short name or login of the user.	keyword
source.user.name.text	Multi-field of `source.user.name`.	match_only_text
syslog.facility	Syslog numeric facility of the event.	long
syslog.facility_label	Syslog text-based facility of the event.	keyword
syslog.priority	Syslog priority of the event.	long
syslog.severity_label	Syslog text-based severity of the event.	keyword
tags	List of keywords used to tag each event.	keyword
tls.cipher	String indicating the cipher used during the current connection.	keyword
tls.client.hash.md5	Certificate fingerprint using the MD5 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash.	keyword
tls.client.hash.sha1	Certificate fingerprint using the SHA1 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash.	keyword
tls.client.hash.sha256	Certificate fingerprint using the SHA256 digest of DER-encoded version of certificate offered by the client. For consistency with other hash values, this value should be formatted as an uppercase hash.	keyword
tls.client.not_after	Date/Time indicating when client certificate is no longer considered valid.	date
tls.client.not_before	Date/Time indicating when client certificate is first considered valid.	date
tls.client.server_name	Also called an SNI, this tells the server which hostname to which the client is attempting to connect to. When this value is available, it should get copied to `destination.domain`.	keyword
tls.client.x509.issuer.common_name	List of common name (CN) of issuing certificate authority.	keyword
tls.client.x509.public_key_size	The size of the public key space in bits.	long
tls.client.x509.serial_number	Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.	keyword
tls.client.x509.subject.common_name	List of common names (CN) of subject.	keyword
tls.client.x509.version_number	Version of x509 format.	keyword
tls.curve	String indicating the curve used for the given cipher, when applicable.	keyword
tls.version	Numeric part of the version parsed from the original string.	keyword
tls.version_protocol	Normalized lowercase protocol name parsed from original string.	keyword
url.domain	Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.	keyword
url.extension	The field contains the file extension from the original request url, excluding the leading dot. The file extension is only set if it exists, as not every url has a file extension. The leading period must not be included. For example, the value must be "png", not ".png". Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").	keyword
url.original	Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not.	wildcard
url.original.text	Multi-field of `url.original`.	match_only_text
url.path	Path of the request, such as "/search".	wildcard
url.query	The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases.	keyword
user.domain	Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name.	keyword
user.email	User email address.	keyword
user.name	Short name or login of the user.	keyword
user.name.text	Multi-field of `user.name`.	match_only_text
user_agent.device.name	Name of the device.	keyword
user_agent.name	Name of the user agent.	keyword
user_agent.original	Unparsed user_agent string.	keyword
user_agent.original.text	Multi-field of `user_agent.original`.	match_only_text
user_agent.os.full	Operating system name, including the version or code name.	keyword
user_agent.os.full.text	Multi-field of `user_agent.os.full`.	match_only_text
user_agent.os.name	Operating system name, without the version.	keyword
user_agent.os.name.text	Multi-field of `user_agent.os.name`.	match_only_text
user_agent.os.version	Operating system version as a raw string.	keyword
user_agent.version	Version of the user agent.	keyword

Changelog

Version	Details	Kibana version(s)
3.22.0	Enhancement View pull request Add session.start_time for ML jobs	8.7.1 or higher
3.21.2	Enhancement View pull request Changed owners	8.7.1 or higher
3.21.1	Bug fix View pull request Fix exclude_files pattern.	8.7.1 or higher
3.21.0	Enhancement View pull request ECS version updated to 8.11.0.	8.7.1 or higher
3.20.0	Enhancement View pull request Add support for PANOS v11.	8.7.1 or higher
3.19.0	Enhancement View pull request Update the package format_version to 3.0.0.	8.7.1 or higher
3.18.0	Bug fix View pull request Correct invalid ECS field usages at root-level.	8.7.1 or higher
3.17.0	Enhancement View pull request ECS version updated to 8.10.0.	8.7.1 or higher
3.16.0	Enhancement View pull request Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI.	8.7.1 or higher
3.15.0	Enhancement View pull request Update package-spec to 2.9.0.	8.7.1 or higher
3.14.0	Enhancement View pull request Update package to ECS 8.9.0.	8.7.1 or higher
3.13.0	Enhancement View pull request Convert dashboards to Lens.	8.7.1 or higher
3.12.0	Enhancement View pull request Ensure event.kind is correctly set for pipeline errors.	8.2.1 or higher
3.11.0	Enhancement View pull request Split panw.panos.url_category_list field in threat logs	8.2.1 or higher
3.10.0	Enhancement View pull request Accept usernames containing spaces.	8.2.1 or higher
3.9.0	Enhancement View pull request Update package to ECS 8.8.0.	8.2.1 or higher
3.8.0	Enhancement View pull request Lowercase host.name field	8.2.1 or higher
3.7.2	Bug fix View pull request Fix handling of usernames terminated with a dollar sign with alternative format.	8.2.1 or higher
3.7.1	Bug fix View pull request Fix handling of usernames terminated with a dollar sign.	8.2.1 or higher
3.7.0	Bug fix View pull request Enable RFC 6587 framing by default on TCP input.	8.2.1 or higher
3.6.0	Enhancement View pull request Update package to ECS 8.7.0.	—
3.5.2	Enhancement View pull request Added categories and/or subcategories.	8.2.1 or higher
3.5.1	Bug fix View pull request Ensure numeric timezones are correctly interpreted.	8.2.1 or higher
3.5.0	Enhancement View pull request Update package to ECS 8.6.0.	8.2.1 or higher
3.4.2	Bug fix View pull request Fix discrepancies in user fields and conform to ECS	8.2.1 or higher
3.4.1	Bug fix View pull request Fix handling of related.ip when host.ip is an array.	8.2.1 or higher
3.4.0	Enhancement View pull request Process URL for THREAT url subtype.	8.2.1 or higher
3.3.0	Enhancement View pull request Add an on_failure processor to the date processor. Bug fix View pull request Field source.user.name & source.user.domain is not mapped properly.	8.2.1 or higher
3.2.2	Bug fix View pull request Support strings on `panos.certificate.size` field	8.2.1 or higher
3.2.1	Bug fix View pull request Remove duplicate fields.	8.2.1 or higher
3.2.0	Enhancement View pull request Update package to ECS 8.5.0.	8.2.1 or higher
3.1.2	Bug fix View pull request Fix handling of event.outcome.	8.2.1 or higher
3.1.1	Bug fix View pull request fix adding processors to tcp and udp configs	8.2.1 or higher
3.1.0	Enhancement View pull request Update package to ECS 8.4.0	8.2.1 or higher
3.0.2	Bug fix View pull request Preserve original event for syslog messages.	8.2.1 or higher
3.0.1	Enhancement View pull request Improve TCP, SSL config description and example.	8.2.1 or higher
3.0.0	Enhancement View pull request Add support for PAN-OS 10.2 and enhance the 'panos' data stream to collect additional logs.	8.2.1 or higher
2.3.1	Enhancement View pull request Update package name and description to align with standard wording	8.2.1 or higher
2.3.0	Enhancement View pull request Update package to ECS 8.3.0.	8.2.1 or higher
2.2.2	Bug fix View pull request Fix mapping for zone breakout	8.2.1 or higher
2.2.1	Bug fix View pull request Fix search terms in saved searches Bug fix View pull request Remove invalid value in sample event and publish in documentation Enhancement View pull request Add threat term to threat data set event.category	—
2.2.0	Enhancement View pull request Replace syslog input with UDP/TCP input and syslog processor.	—
2.1.0	Enhancement View pull request Add GeoIP/ASN data for `*.nat.ip` fields	8.0.0 or higher
2.0.0	Enhancement View pull request Migrate map visualisation from tile_map to map object	—
1.6.0	Enhancement View pull request Update to ECS 8.2	7.16.0 or higher 8.0.0 or higher
1.5.3	Enhancement View pull request Remove invalid field values	7.16.0 or higher 8.0.0 or higher
1.5.2	Enhancement View pull request Add documentation for multi-fields	7.16.0 or higher 8.0.0 or higher
1.5.1	Enhancement View pull request Extend and explicitly link to event streams that are handled.	7.16.0 or higher 8.0.0 or higher
1.5.0	Enhancement View pull request Add HIP Match event handling. Enhancement View pull request Add User ID event handling. Enhancement View pull request Add Global Protect event handling.	—
1.4.0	Enhancement View pull request Update to ECS 8.0	7.14.0 or higher 8.0.0 or higher
1.3.2	Bug fix View pull request Regenerate test files using the new GeoIP database	7.14.0 or higher 8.0.0 or higher
1.3.1	Bug fix View pull request Change test public IPs to the supported subset	—
1.3.0	Enhancement View pull request Add 8.0.0 version constraint	7.14.0 or higher 8.0.0 or higher
1.2.3	Enhancement View pull request Uniform with guidelines	7.14.0 or higher
1.2.2	Enhancement View pull request Update Title and Description.	—
1.2.1	Bug fix View pull request Fix logic that checks for the 'forwarded' tag	—
1.2.0	Enhancement View pull request Update to ECS 1.12.0	—
1.1.3	Enhancement View pull request Add time zone offset input	7.14.0 or higher
1.1.2	Enhancement View pull request Convert to generated ECS fields	—
1.1.1	Enhancement View pull request update to ECS 1.11.0	—
1.1.0	Enhancement View pull request Update integration description	—
1.0.0	Enhancement View pull request make GA Enhancement View pull request Set "event.module" and "event.dataset"	7.14.0 or higher
0.8.1	Enhancement View pull request use `wildcard` field type for the relevant ECS fields	—
0.8.0	Enhancement View pull request update to ECS 1.10.0 and add fixes to event.original	—
0.7.2	Enhancement View pull request Make event.original optional	—
0.7.1	Enhancement View pull request update to ECS 1.9.0	—
0.7.0	Enhancement View pull request Moving edge processing to ES Ingest pipelines	—
0.6.1	Bug fix View pull request Change kibana.version constraint to be more conservative.	—
0.1.0	Enhancement View pull request initial release	—

On this page