Palo Alto Fields

Field Name	Example Values	Field Type	Notes
pan_alert_direction		keyword	Indicates the direction of the attack, client-to-server or server-to-client: 0—direction of the threat is client to server. 1—direction of the threat is server to client
pan_after_change_detail		keyword	This field is in custom logs only; it is not in the default format. - It contains the full xpath after the configuration change.
pan_assoc_id		keyword	Number to idetify all connections for an association between to SCTP endpoints
pan_auth_method		keyword	A string showing the authentication type, such as LDAP, RADIUS or SAML
pan_before_change_detail		keyword	This field is in custom logs only; it is not in the default format. - It contains the full xpath after the configuration change.
pan_cloud_hostname		keyword	FQDN of WildFire appliance or Cloud where file was uploaded
pan_dev_group_level_[1-4]		keyword	ID Numbers that indicate the device groups location within DG Hierarchy
pan_dynusergroup_name		keyword	Name of the dynamic user group that contains the user who initiated the session.
pan_event_name		keyword	String showing the name of the event.
pan_event_object		keyword	Name of the object associated with the system event.
pan_evidence		keyword	A summary statement that indicates how many times the host has matched against the conditions defined in the correlation object. For example, Host visited known malware URl (19 times).
pan_flags		keyword	32-bit field that provides details on session
pan_gp_client_version		keyword	The client’s GlobalProtect app version.
pan_gp_connect_method		keyword	A string showing the how the GlobalProtect app connects to Gateway, (for example, on-demand or user-login)
pan_gp_error		keyword	A string showing that error that has occurred in any event.
pan_gp_error_code		keyword	An integer associated with any errors that occurred
pan_gp_error_extended		keyword	Additional information for any event that has occurred.
pan_gp_hostname		keyword	The name of the GlobalProtect portal or gateway.
pan_gp_hostid		keyword	Unique ID GlobalProtect assigns to identify the host.
pan_gp_location_name		keyword	A string showing the administrator-defined location of the GlobalProtect portal or gateway.
pan_gp_reason		keyword	A string that shows the reason for the quarantine
pan_hip		keyword	Name of the HIP object or profile.
pan_hip_type		keyword	Whether the hip field represents a HIP object or a HIP profile.
pan_http2		keyword	Identifies if traffic used an HTTP/2 Connection by displaying one of the following values: Parent session ID—HTTP/2 connection. OR. 0—SSL session
pan_link_changes		keyword	Number of link flaps during session
pan_link_switches		keyword	Contains up to four link flap entries, with each entry containing the link name, link tag, link type, physical interface, timestamp, bytes read, bytes written, link health, and link flap cause.
pan_log_action		keyword	Log Forwarding Profile Applied to Session
pan_log_panorama		keyword	A bit field indicating if the log was forwarded to Panorama
pan_log_subtype		keyword	Subtype of Given Log
pan_module		keyword	It provides additional information about the sub-system generating the log
pan_monitor_tag		keyword	IMEI 15/16 Digit number
pan_object_id		keyword	Name of the object associated with the system event.
pan_objectname		keyword	Name of the correlation object that was matched on.
pan_parent_session_id		keyword	ID of the session in which this session is tunneled
pan_parent_start_time		keyword	Time the Tunnel Session began
pan_pcap_id		keyword	Packet Capture ID
pan_ppid		keyword	ID of the protocol for the payload of the data chunk
pan_sctp_chunks_sum		keyword	Sum of SCTP chunks sent and received for an association.
pan_sctp_chunks_tx		keyword	Number of SCTP chunks sent for an association.
pan_sctp_chunks_rx		keyword	Number of SCTP chunks received for an association.
pan_sdwan_cluster		keyword	Name of the SD-WAN cluster.
pan_sdwan_cluster_type		keyword	Type of cluster (mesh or hub-spoke)
pan_sdwan_device_type		keyword	Type of device (hub or branch)
pan_sdwan_policy_id		keyword	Name of the SD-WAN policy.
pan_sdwan_site_name		keyword	Name of the SD-WAN site
pan_session_end_reason			The reason the session was terminated
pan_source_region		keyword	The region for the user who initiated the session.
pan_tunnel_id		keyword	International Mobile Subscriber Identity Number
pan_tunnel_stage		keyword	A string showing the stage of the connection (for example, before-login, login, or tunnel)
pan_url_index		keyword	Counter allowing you to correlate order of log entries in URL Filtering/WildFire
pan_wildfire_hash		keyword	Binary Hash of file sent to WildFire
pan_wildfire_report_id		keyword	Identifies the analysis request on Wildfire Cloud/Appliance