{ "transportProfiles": { "email": { "ALL": { "logtypes": { "firewall.decryption": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "time_received_mp", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "tunnel.value", "source_uuid", "dest_uuid", "rule_matched_uuid", "client_to_firewall.value", "firewall_to_client.value", "tls_version.value", "tls_keyxchange.value", "tls_enc_algorithm.value", "tls_auth.value", "policy_name", "elliptic_curve.value", "error_index.value", "root_status.value", "chain_status.value", "proxy_type.value", "cert_serial", "fingerprint", "not_before", "not_after", "certificate_version.value", "certificate_size", "cn_len", "issuer_len", "root_cn_len", "sni_len", "cert_flags", "cn", "issuer_cn", "root_cn", "sni", "error_message", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "sequence_no", "app_category", "characteristics_of_app", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "customer_id", "cpadding", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "dest_device_class", "dest_device_os", "dest_location", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "log_source_name", "domain", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_cert_cn_truncated", "is_cert_ECDSA", "is_cert_RSA", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_dup_log", "is_encrypted", "is_forwarded", "is_ipv6", "is_issuer_cn_truncated", "is_mptcp_on", "is_nat", "is_non_std_dest_port", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_resume_session", "is_root_cn_truncated", "is_sni_truncated", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "log_source", "log_source_tz_offset", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "is_packet_capture", "padding", "padding3", "sanctioned_state_of_app", "source_device_class", "source_device_os", "source_location", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "tpadding", "tunneled_app", "vendor_name", "vsys_id", "vsys_name", "vpadding" ] }, "firewall.iptag": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "tag_name", "event_id.value", "count_of_repeats", "mapping_timeout", "mapping_data_source_name", "mapping_data_source_type.value", "mapping_data_source_sub_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "ip_subnet_range", "time_generated_high_res", "customer_id", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_set", "log_source", "log_source_tz_offset", "rule_matched", "rule_matched_uuid", "vendor_name" ] }, "firewall.userid": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "user", "mapping_data_source_name", "event_id", "count_of_repeats", "mapping_timeout", "source_port", "dest_port", "mapping_data_source.value", "mapping_data_source_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "mfa_factor_type", "auth_completion_time", "auth_factor_num", "ug_flags", "user_identified_by_source_as", "tag_name", "time_generated_high_res", "authenticated_user_info.domain", "authenticated_user_info.name", "authenticated_user_info.uuid", "customer_id", "is_dup_log", "is_duplicate_user", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "user_group_found", "vendor_name" ] }, "firewall.file_data": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "file_name", "url_category.value", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "pcap_id", "file_sha_256", "report_id", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "content_version", "sig_flags", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "gp_host_id", "endpoint_serial_number", "domain_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "partial_hash", "time_generated_high_res", "reason_data_filtering", "justification", "nssai_network_slice_type.value", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "cloud_hostname", "cloud_reportid", "customer_id", "dlp_version_flag", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "file_type", "file_url", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_dup_log", "is_encrypted", "is_ipv6", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "pcap", "location", "profile_name", "sanctioned_state_of_app", "severity", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "threat_category.value", "threat_name_firewall", "tunneled_app", "url_domain", "users", "vendor_name", "vsys_id" ] }, "firewall.threat": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "file_name", "threat_id", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "pcap_id", "file_sha_256", "cloud", "url_idx", "file_type", "sender_of_virus", "subject_of_email", "recipient_of_virus", "report_id", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "threat_category.value", "content_version", "sig_flags", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "host_id", "endpoint_serial_number", "domain_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "partial_hash", "time_generated_high_res", "nssai_network_slice_type.value", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "cloud_hostname", "cloud_reportid", "customer_id", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "file_url", "http_method.value", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_dup_log", "is_encrypted", "is_ipv6", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "pcap", "payload_protocol_id", "location", "sanctioned_state_of_app", "severity", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "threat_name", "threat_name_firewall", "tunneled_app", "url_domain", "users", "vendor_name", "verdict.value", "vsys_id" ] }, "firewall.url": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "uri", "url_category.value", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "content_type", "pcap_id", "url_idx", "user_agent", "xff", "referer", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "http_method.value", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "inline_ml_verdict.value", "content_version", "sig_flags", "http_headers", "url_category_list", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "gp_host_id", "endpoint_serial_number", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "nssai_network_slice_type.value", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "cloud_hostname", "cloud_reportid", "customer_id", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "file_url", "referer_fqdn", "referer_port", "referer_protocol.value", "referer_url_path", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_dup_log", "is_encrypted", "is_ipv6", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "pcap", "location", "sanctioned_state_of_app", "severity", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "tunneled_app", "url_domain", "users", "vendor_name", "vsys_id" ] }, "firewall.sctp": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "sequence_no", "ep_assoc_id", "payload_protocol_id", "vendor_severity.value", "sctp_chunk_type", "event_type.value", "event_code", "verification_tag_1", "verification_tag_2", "sctp_cause_code", "diam_app_id", "diam_cmd_code", "diam_avp_code", "stream_id", "association_end_reason.value", "map_op_code", "sccp_calling_ssn", "sccp_calling_gt", "sctp_filter", "chunks_total", "chunks_sent", "chunks_received", "packets_total", "packets_sent", "packets_received", "rule_matched_uuid", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "is_captive_portal", "content_version", "customer_id", "dest_device_class", "dest_device_mac", "dest_device_model", "dest_device_os", "dest_device_vendor", "dest_location", "dest_uuid", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decryption_log", "is_decrypted_payload_fwded", "is_dup_log", "is_ipv6", "is_l7_inspection_b4_session", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "session_end_reason.value", "sess_owner_rt_midx", "session_tracker", "severity", "source_device_class", "source_device_mac", "source_device_model", "source_device_os", "source_device_vendor", "source_location", "source_uuid", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "tunnel.value", "vendor_name", "vsys_id" ] }, "firewall.globalprotect": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "event_id.value", "stage", "auth_method", "tunnel", "source_user", "source_region", "endpoint_device_name", "public_ip.value", "public_ipv6.value", "private_ip.value", "private_ipv6.value", "host_id", "endpoint_serial_number", "endpoint_gp_version", "endpoint_os_type", "endpoint_os_version", "count_of_repeats", "quarantine_reason", "connection_error.value", "opaque", "status.value", "gpg_location", "login_duration", "connect_method", "connection_error.id", "portal", "sequence_no", "time_generated_high_res", "gateway_selection_type", "ssl_response_time", "gateway_priority.value", "attempted_gateways", "gateway", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "customer_id", "vendor_name" ] }, "firewall.hipmatch": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_user", "vsys", "endpoint_device_name", "endpoint_os_type", "source_ip.value", "hip_match_name", "count_of_repeats", "hip_match_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "source_ip_v6.value", "host_id", "endpoint_serial_number", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_mac", "source_device_host", "source", "timestamp_device_identification", "time_generated_high_res", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "customer_id", "uuid", "vendor_name" ] }, "firewall.tunnel": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "tunnel_event_type", "mobile_subscriber_isdn", "access_point_name", "radio_access_technology", "tunnel_message_type", "mobile_ip.value", "tunnel_endpoint_id_1", "tunnel_endpoint_id_2", "tunnel_interface", "tunnel_cause_code", "vendor_severity.value", "mobile_country_code", "mobile_network_code", "mobile_area_code", "mobile_base_station_code", "tunnel_event_code", "sequence_no", "source_location", "dest_location", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "bytes_total", "bytes_sent", "bytes_received", "packets_total", "packets_sent", "packets_received", "packets_dropped_max_encap", "packets_dropped_ukn_proto", "packets_dropped_strict_check", "packets_dropped_tunnel_frag", "tunnel_sessions_created", "tunnel_sessions_closed", "session_end_reason.value", "action_source.value", "session_start_time", "total_time_elapsed", "tunnel_inspection_rule", "tunnel_remote_user_ip.value", "tunnel_remote_imsi_id", "rule_matched_uuid", "dynusergroup_name", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "nssai_network_slice_differentiator.value", "nssai_network_slice_type.value", "pdu_session_id", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "content_version", "dest_device_class", "dest_device_mac", "dest_device_model", "dest_device_os", "dest_device_vendor", "dest_uuid", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decryption_log", "is_decrypted_payload_fwded", "is_dup_log", "is_ipv6", "is_l7_inspection_b4_session", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "customer_id", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "sanctioned_state_of_app", "sess_owner_rt_midx", "session_tracker", "severity", "source_device_class", "source_device_mac", "source_device_model", "source_device_os", "source_device_vendor", "source_uuid", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "standard_ports_of_app", "tunneled_app", "url_category.value", "users", "vendor_name", "vsys_id" ] }, "firewall.auth": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "user", "normalize_user", "object", "auth_policy", "count_of_repeats", "mfa_auth_id", "mfa_vendor", "log_set", "auth_server_profile", "auth_description", "client_type", "auth_event_name.value", "auth_factor_num", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "auth_proto", "rule_matched_uuid", "time_generated_high_res", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "service_region", "user_agent", "session_id", "authenticated_user_info.domain", "authenticated_user_info.name", "authenticated_user_info.uuid", "client_type_name.value", "customer_id", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "location", "rule_matched", "vendor_name" ] }, "firewall.traffic": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "bytes_total", "bytes_sent", "bytes_received", "packets_total", "session_start_time", "total_time_elapsed", "url_category.value", "sequence_no", "source_location", "dest_location", "packets_sent", "packets_received", "session_end_reason.value", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "action_source.value", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "ep_assoc_id", "chunks_total", "chunks_sent", "chunks_received", "rule_matched_uuid", "http2_connection", "link_change_count", "policy_id", "link_switches", "sdwan_cluster", "sdwan_device_type", "sdwan_cluster_type", "sdwan_site", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "host_id", "endpoint_serial_number", "source_dynamic_address_group", "dest_dynamic_address_group", "ha_session_owner", "time_generated_high_res", "nssai_network_slice_type.value", "nssai_network_slice_differentiator.value", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "customer_id", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_decryption_log", "is_decrypted_payload_fwded", "is_dup_log", "is_encrypted", "is_ipv6", "is_l7_inspection_b4_session", "is_mptcp_on", "is_non_std_dest_port", "is_offloaded", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "location", "sdwan_FEC_ratio", "sanctioned_state_of_app", "sess_owner_rt_midx", "session_tracker", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "tunneled_app", "users", "vendor_name", "vsys_id" ] }, "firewall.dns_security": { "filter": null, "selectedColumns": [ "vendor_name", "log_source_id", "log_time", "log_type.value", "sub_type.value", "time_generated", "record_type", "dest_ip.value", "gtid", "verdict.value", "threat_name", "source_ip.value", "from_zone", "action.value", "dst_zone", "dst_user", "customer_id", "dns_response", "dns_response_code", "protocol", "fqdn", "log_source", "total_time_elapsed", "source_user" ] }, "log.system": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "event_time", "vsys", "event_name.value", "event_component", "vendor_severity.value", "event_description", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "device_group.value", "template.value", "time_generated_high_res", "agent_content_version", "agent_data_collection_status.value", "agent_id", "agent_isolation_status", "agent_protection_status", "endpoint_tz_offset", "agent_version", "endpoint_cpu_architecture.value", "endpoint_device_domain", "endpoint_device_name", "endpoint_ip.value", "endpoint_os_type.value", "endpoint_os_version", "endpoint_user.domain", "endpoint_user.name", "endpoint_user.uuid", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "log_category.value", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "severity", "customer_id", "endpoint_is_vdi", "vendor_name", "vsys_id" ] }, "log.config": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "event_time", "event_client_ip.value", "vsys", "event_name.value", "admin_user", "client.value", "event_result.value", "event_path", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "device_group.value", "event_description", "template.value", "time_generated_high_res", "admin_user_info.name", "admin_user_info.domain", "admin_user_info.uuid", "event_detail", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "log_category.value", "is_exported", "log_source", "log_source_tz_offset", "severity", "customer_id", "vendor_name", "vendor_severity.value", "vsys_id" ] }, "endpoint.agent": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "event_id.value", "stage", "auth_method", "tunnel", "source_user", "source_region", "endpoint_device_name", "public_ip.value", "public_ipv6.value", "private_ip.value", "private_ipv6.value", "host_id", "endpoint_serial_number", "endpoint_gp_version", "endpoint_os_type", "endpoint_os_version", "count_of_repeats", "quarantine_reason", "connection_error.value", "opaque", "status.value", "gpg_location", "login_duration", "connect_method", "connection_error.id", "portal", "sequence_no", "time_generated_high_res", "gateway_selection_type", "ssl_response_time", "gateway_priority.value", "attempted_gateways", "gateway", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "panorama_serial", "pa_node_type.value", "pa_sub_tenant_id", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "customer_id", "vendor_name" ] } } }, "DEFAULT": { "logtypes": { "firewall.decryption": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "time_received_mp", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "tunnel.value", "source_uuid", "dest_uuid", "rule_matched_uuid", "client_to_firewall.value", "firewall_to_client.value", "tls_version.value", "tls_keyxchange.value", "tls_enc_algorithm.value", "tls_auth.value", "policy_name", "elliptic_curve.value", "error_index.value", "root_status.value", "chain_status.value", "proxy_type.value", "cert_serial", "fingerprint", "not_before", "not_after", "certificate_version.value", "certificate_size", "cn_len", "issuer_len", "root_cn_len", "sni_len", "cert_flags", "cn", "issuer_cn", "root_cn", "sni", "error_message", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "sequence_no" ] }, "firewall.iptag": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "tag_name", "event_id.value", "count_of_repeats", "mapping_timeout", "mapping_data_source_name", "mapping_data_source_type.value", "mapping_data_source_sub_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "ip_subnet_range", "time_generated_high_res" ] }, "firewall.userid": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "user", "mapping_data_source_name", "event_id", "count_of_repeats", "mapping_timeout", "source_port", "dest_port", "mapping_data_source.value", "mapping_data_source_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "mfa_factor_type", "auth_completion_time", "auth_factor_num", "ug_flags", "user_identified_by_source_as", "tag_name", "time_generated_high_res" ] }, "firewall.file_data": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "file_name", "url_category.value", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "pcap_id", "file_sha_256", "report_id", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "content_version", "sig_flags", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "gp_host_id", "endpoint_serial_number", "domain_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "partial_hash", "time_generated_high_res", "reason_data_filtering", "justification", "nssai_network_slice_type.value" ] }, "firewall.threat": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "file_name", "threat_id", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "pcap_id", "file_sha_256", "cloud", "url_idx", "file_type", "sender_of_virus", "subject_of_email", "recipient_of_virus", "report_id", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "threat_category.value", "content_version", "sig_flags", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "host_id", "endpoint_serial_number", "domain_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "partial_hash", "time_generated_high_res", "nssai_network_slice_type.value" ] }, "firewall.url": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "uri", "url_category.value", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "content_type", "pcap_id", "url_idx", "user_agent", "xff", "referer", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "http_method.value", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "inline_ml_verdict.value", "content_version", "sig_flags", "http_headers", "url_category_list", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "gp_host_id", "endpoint_serial_number", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "nssai_network_slice_type.value" ] }, "firewall.sctp": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "sequence_no", "ep_assoc_id", "payload_protocol_id", "vendor_severity.value", "sctp_chunk_type", "event_type.value", "event_code", "verification_tag_1", "verification_tag_2", "sctp_cause_code", "diam_app_id", "diam_cmd_code", "diam_avp_code", "stream_id", "association_end_reason.value", "map_op_code", "sccp_calling_ssn", "sccp_calling_gt", "sctp_filter", "chunks_total", "chunks_sent", "chunks_received", "packets_total", "packets_sent", "packets_received", "rule_matched_uuid", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res" ] }, "firewall.globalprotect": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "event_id.value", "stage", "auth_method", "tunnel", "source_user", "source_region", "endpoint_device_name", "public_ip.value", "public_ipv6.value", "private_ip.value", "private_ipv6.value", "host_id", "endpoint_serial_number", "endpoint_gp_version", "endpoint_os_type", "endpoint_os_version", "count_of_repeats", "quarantine_reason", "connection_error.value", "opaque", "status.value", "gpg_location", "login_duration", "connect_method", "connection_error.id", "portal", "sequence_no", "time_generated_high_res", "gateway_selection_type", "ssl_response_time", "gateway_priority.value", "attempted_gateways", "gateway", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id" ] }, "firewall.hipmatch": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_user", "vsys", "endpoint_device_name", "endpoint_os_type", "source_ip.value", "hip_match_name", "count_of_repeats", "hip_match_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "source_ip_v6.value", "host_id", "endpoint_serial_number", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_mac", "source_device_host", "source", "timestamp_device_identification", "time_generated_high_res" ] }, "firewall.tunnel": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "tunnel_event_type", "mobile_subscriber_isdn", "access_point_name", "radio_access_technology", "tunnel_message_type", "mobile_ip.value", "tunnel_endpoint_id_1", "tunnel_endpoint_id_2", "tunnel_interface", "tunnel_cause_code", "vendor_severity.value", "mobile_country_code", "mobile_network_code", "mobile_area_code", "mobile_base_station_code", "tunnel_event_code", "sequence_no", "source_location", "dest_location", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "bytes_total", "bytes_sent", "bytes_received", "packets_total", "packets_sent", "packets_received", "packets_dropped_max_encap", "packets_dropped_ukn_proto", "packets_dropped_strict_check", "packets_dropped_tunnel_frag", "tunnel_sessions_created", "tunnel_sessions_closed", "session_end_reason.value", "action_source.value", "session_start_time", "total_time_elapsed", "tunnel_inspection_rule", "tunnel_remote_user_ip.value", "tunnel_remote_imsi_id", "rule_matched_uuid", "dynusergroup_name", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "nssai_network_slice_differentiator.value", "nssai_network_slice_type.value", "pdu_session_id" ] }, "firewall.auth": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "user", "normalize_user", "object", "auth_policy", "count_of_repeats", "mfa_auth_id", "mfa_vendor", "log_set", "auth_server_profile", "auth_description", "client_type", "auth_event_name.value", "auth_factor_num", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "auth_proto", "rule_matched_uuid", "time_generated_high_res", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "service_region", "user_agent", "session_id" ] }, "firewall.traffic": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "bytes_total", "bytes_sent", "bytes_received", "packets_total", "session_start_time", "total_time_elapsed", "url_category.value", "sequence_no", "source_location", "dest_location", "packets_sent", "packets_received", "session_end_reason.value", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "action_source.value", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "ep_assoc_id", "chunks_total", "chunks_sent", "chunks_received", "rule_matched_uuid", "http2_connection", "link_change_count", "policy_id", "link_switches", "sdwan_cluster", "sdwan_device_type", "sdwan_cluster_type", "sdwan_site", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "host_id", "endpoint_serial_number", "source_dynamic_address_group", "dest_dynamic_address_group", "ha_session_owner", "time_generated_high_res", "nssai_network_slice_type.value", "nssai_network_slice_differentiator.value" ] }, "firewall.dns_security": { "filter": null, "selectedColumns": [ "vendor_name", "log_source_id", "log_time", "log_type.value", "sub_type.value", "time_generated", "record_type", "cloud_dns_client_ip.value", "dest_ip.value", "gtid", "verdict.value", "threat_name", "source_ip.value", "from_zone", "action.value", "dst_zone", "dst_user", "dns_parse_fqdn" ] }, "log.system": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "event_time", "vsys", "event_name.value", "event_component", "vendor_severity.value", "event_description", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "device_group.value", "template.value", "time_generated_high_res" ] }, "log.config": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "event_time", "event_client_ip.value", "vsys", "event_name.value", "admin_user", "client.value", "event_result.value", "event_path", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "device_group.value", "event_description", "template.value", "time_generated_high_res" ] }, "endpoint.agent": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "event_id.value", "stage", "auth_method", "tunnel", "source_user", "source_region", "endpoint_device_name", "public_ip.value", "public_ipv6.value", "private_ip.value", "private_ipv6.value", "host_id", "endpoint_serial_number", "endpoint_gp_version", "endpoint_os_type", "endpoint_os_version", "count_of_repeats", "quarantine_reason", "connection_error.value", "opaque", "status.value", "gpg_location", "login_duration", "connect_method", "connection_error.id", "portal", "sequence_no", "time_generated_high_res", "gateway_selection_type", "ssl_response_time", "gateway_priority.value", "attempted_gateways", "gateway", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id" ] } } } }, "syslog": { "CSV-ALL": { "logtypes": { "firewall.decryption": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "sequence_no", "source_location", "dest_location", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnel.value", "rule_matched_uuid", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "app_category", "characteristics_of_app", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "cert_flags", "cert_serial", "certificate_size", "certificate_version.value", "chain_status.value", "client_to_firewall.value", "cn", "cn_len", "customer_id", "cpadding", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "domain", "elliptic_curve.value", "error_index.value", "error_message", "fingerprint", "firewall_to_client.value", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_cert_cn_truncated", "is_cert_ECDSA", "is_cert_RSA", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_dup_log", "is_encrypted", "is_forwarded", "is_ipv6", "is_issuer_cn_truncated", "is_mptcp_on", "is_nat", "is_non_std_dest_port", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_resume_session", "is_root_cn_truncated", "is_sni_truncated", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "issuer_cn", "issuer_len", "is_exported", "log_source", "log_source_tz_offset", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "is_packet_capture", "padding", "padding3", "policy_name", "proxy_type.value", "root_cn_len", "root_cn", "root_status.value", "sni_len", "sanctioned_state_of_app", "sni", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "tls_auth.value", "tls_enc_algorithm.value", "tls_keyxchange.value", "tls_version.value", "not_after", "not_before", "time_received_mp", "tpadding", "tunneled_app", "vendor_name", "vsys_id", "vpadding" ] }, "firewall.iptag": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "rule_matched", "vsys", "log_set", "count_of_repeats", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "rule_matched_uuid", "time_generated_high_res", "customer_id", "event_id.value", "ip_subnet_range", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "mapping_data_source_name", "mapping_data_source_sub_type.value", "mapping_data_source_type.value", "mapping_timeout", "tag_name", "vendor_name", "vsys_id" ] }, "firewall.userid": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "vsys", "count_of_repeats", "source_port", "dest_port", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "time_generated_high_res", "auth_completion_time", "auth_factor_num", "authenticated_user_info.domain", "authenticated_user_info.name", "authenticated_user_info.uuid", "customer_id", "event_id", "is_dup_log", "is_duplicate_user", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "mfa_factor_type", "mapping_data_source.value", "mapping_data_source_name", "mapping_data_source_type.value", "mapping_timeout", "tag_name", "ug_flags", "user", "user_group_found", "user_identified_by_source_as", "vendor_name", "vsys_id" ] }, "firewall.file_data": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "url_category.value", "sequence_no", "source_location", "dest_location", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "endpoint_serial_number", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "nssai_network_slice_type.value", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "cloud_hostname", "cloud_reportid", "content_version", "customer_id", "dlp_version_flag", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "direction_of_attack.value", "domain_edl", "file_sha_256", "file_name", "file_type", "file_url", "gp_host_id", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_dup_log", "is_encrypted", "is_ipv6", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "justification", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "pcap", "pcap_id", "partial_hash", "location", "profile_name", "reason_data_filtering", "report_id", "sanctioned_state_of_app", "severity", "sig_flags", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "threat_category.value", "threat_name_firewall", "tunneled_app", "url_domain", "users", "vendor_name", "vendor_severity.value", "vsys_id" ] }, "firewall.threat": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "sequence_no", "source_location", "dest_location", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "host_id", "endpoint_serial_number", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "nssai_network_slice_type.value", "cloud", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "cloud_hostname", "cloud_reportid", "content_version", "customer_id", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "direction_of_attack.value", "domain_edl", "subject_of_email", "file_sha_256", "file_name", "file_type", "file_url", "http_method.value", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_dup_log", "is_encrypted", "is_ipv6", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "pcap", "pcap_id", "partial_hash", "payload_protocol_id", "location", "recipient_of_virus", "report_id", "sanctioned_state_of_app", "sender_of_virus", "severity", "sig_flags", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "threat_category.value", "threat_id", "threat_name", "threat_name_firewall", "tunneled_app", "url_idx", "url_domain", "users", "vendor_name", "vendor_severity.value", "verdict.value", "vsys_id" ] }, "firewall.url": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "url_category.value", "sequence_no", "source_location", "dest_location", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "endpoint_serial_number", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "nssai_network_slice_type.value", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "cloud_hostname", "cloud_reportid", "content_type", "content_version", "customer_id", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "direction_of_attack.value", "file_url", "gp_host_id", "http_headers", "http_method.value", "referer_fqdn", "referer_port", "referer_protocol.value", "referer_url_path", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "inline_ml_verdict.value", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_dup_log", "is_encrypted", "is_ipv6", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "pcap", "pcap_id", "location", "referer", "sanctioned_state_of_app", "severity", "sig_flags", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "tunneled_app", "uri", "url_category_list", "url_idx", "url_domain", "user_agent", "users", "vendor_name", "vendor_severity.value", "vsys_id", "xff" ] }, "firewall.sctp": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "packets_total", "sequence_no", "source_location", "dest_location", "packets_sent", "packets_received", "session_end_reason.value", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnel.value", "ep_assoc_id", "chunks_total", "chunks_sent", "chunks_received", "rule_matched_uuid", "source_device_model", "source_device_vendor", "source_device_mac", "dest_device_model", "dest_device_vendor", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "association_end_reason.value", "is_captive_portal", "content_version", "customer_id", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "diam_app_id", "diam_avp_code", "diam_cmd_code", "event_code", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decryption_log", "is_decrypted_payload_fwded", "is_dup_log", "is_ipv6", "is_l7_inspection_b4_session", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "map_op_code", "is_nat", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "payload_protocol_id", "event_type.value", "sccp_calling_gt", "sccp_calling_ssn", "sctp_cause_code", "sctp_chunk_type", "sctp_filter", "sess_owner_rt_midx", "session_tracker", "severity", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "stream_id", "vendor_name", "vendor_severity.value", "verification_tag_1", "verification_tag_2", "vsys_id" ] }, "firewall.globalprotect": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_user", "vsys", "count_of_repeats", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "host_id", "endpoint_serial_number", "time_generated_high_res", "attempted_gateways", "auth_method", "connection_error.value", "connection_error.id", "connect_method", "opaque", "endpoint_device_name", "endpoint_os_type", "endpoint_os_version", "event_id.value", "status.value", "gateway", "gateway_priority.value", "gateway_selection_type", "endpoint_gp_version", "gpg_location", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "login_duration", "portal", "private_ip.value", "private_ipv6.value", "public_ip.value", "public_ipv6.value", "quarantine_reason", "ssl_response_time", "source_region", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "stage", "customer_id", "tunnel", "vendor_name", "vsys_id" ] }, "firewall.hipmatch": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "source_user", "vsys", "count_of_repeats", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "host_id", "endpoint_serial_number", "time_generated_high_res", "endpoint_device_name", "endpoint_os_type", "hip_match_name", "hip_match_type.value", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "source", "source_device_class", "source_device_os", "source_ip_v6.value", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "customer_id", "timestamp_device_identification", "uuid", "vendor_name", "vsys_id" ] }, "firewall.tunnel": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "bytes_total", "bytes_sent", "bytes_received", "packets_total", "session_start_time", "total_time_elapsed", "url_category.value", "sequence_no", "source_location", "dest_location", "packets_sent", "packets_received", "session_end_reason.value", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "action_source.value", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "rule_matched_uuid", "dynusergroup_name", "source_device_model", "source_device_vendor", "source_device_mac", "dest_device_model", "dest_device_vendor", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "nssai_network_slice_type.value", "nssai_network_slice_differentiator.value", "access_point_name", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "content_version", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decryption_log", "is_decrypted_payload_fwded", "is_dup_log", "is_ipv6", "is_l7_inspection_b4_session", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "customer_id", "mobile_area_code", "mobile_base_station_code", "mobile_country_code", "mobile_ip.value", "mobile_network_code", "mobile_subscriber_isdn", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "packets_dropped_max_encap", "packets_dropped_ukn_proto", "packets_dropped_strict_check", "packets_dropped_tunnel_frag", "pdu_session_id", "radio_access_technology", "sanctioned_state_of_app", "sess_owner_rt_midx", "session_tracker", "severity", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "standard_ports_of_app", "tunnel_cause_code", "tunnel_endpoint_id_1", "tunnel_endpoint_id_2", "tunnel_event_code", "tunnel_event_type", "tunnel_inspection_rule", "tunnel_interface", "tunnel_message_type", "tunnel_remote_imsi_id", "tunnel_remote_user_ip.value", "tunnel_sessions_closed", "tunnel_sessions_created", "tunneled_app", "users", "vendor_name", "vendor_severity.value", "vsys_id" ] }, "firewall.auth": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "rule_matched", "vsys", "log_set", "session_id", "count_of_repeats", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "rule_matched_uuid", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "time_generated_high_res", "service_region", "auth_event_name.value", "auth_factor_num", "auth_server_profile", "authenticated_user_info.domain", "authenticated_user_info.name", "authenticated_user_info.uuid", "auth_description", "auth_policy", "auth_proto", "client_type", "client_type_name.value", "customer_id", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "mfa_auth_id", "mfa_vendor", "normalize_user", "object", "location", "user", "user_agent", "vendor_name", "vsys_id" ] }, "firewall.traffic": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "bytes_total", "bytes_sent", "bytes_received", "packets_total", "session_start_time", "total_time_elapsed", "url_category.value", "sequence_no", "source_location", "dest_location", "packets_sent", "packets_received", "session_end_reason.value", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "action_source.value", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "ep_assoc_id", "chunks_total", "chunks_sent", "chunks_received", "rule_matched_uuid", "http2_connection", "link_change_count", "policy_id", "link_switches", "sdwan_cluster", "sdwan_device_type", "sdwan_cluster_type", "sdwan_site", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "host_id", "endpoint_serial_number", "source_dynamic_address_group", "dest_dynamic_address_group", "ha_session_owner", "time_generated_high_res", "nssai_network_slice_type.value", "nssai_network_slice_differentiator.value", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "customer_id", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_decryption_log", "is_decrypted_payload_fwded", "is_dup_log", "is_encrypted", "is_ipv6", "is_l7_inspection_b4_session", "is_mptcp_on", "is_non_std_dest_port", "is_offloaded", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "location", "sdwan_FEC_ratio", "sanctioned_state_of_app", "sess_owner_rt_midx", "session_tracker", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "tunneled_app", "users", "vendor_name", "vsys_id" ] }, "firewall.dns_security": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "time_generated", "source_ip.value", "dest_ip.value", "source_user", "from_zone", "action.value", "total_time_elapsed", "customer_id", "verdict.value", "dns_response", "dns_response_code", "protocol", "dst_user", "fqdn", "log_source", "record_type", "gtid", "threat_name", "dst_zone", "vendor_name" ] }, "log.system": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "event_time", "vsys", "event_name.value", "event_component", "vendor_severity.value", "event_description", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "device_group.value", "template.value", "time_generated_high_res", "agent_content_version", "agent_data_collection_status.value", "agent_id", "agent_isolation_status", "agent_protection_status", "endpoint_tz_offset", "agent_version", "endpoint_cpu_architecture.value", "endpoint_device_domain", "endpoint_device_name", "endpoint_ip.value", "endpoint_os_type.value", "endpoint_os_version", "endpoint_user.domain", "endpoint_user.name", "endpoint_user.uuid", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "log_category.value", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "severity", "customer_id", "endpoint_is_vdi", "vendor_name", "vsys_id" ] }, "log.config": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "event_time", "event_client_ip.value", "vsys", "event_name.value", "admin_user", "client.value", "event_result.value", "event_path", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "device_group.value", "event_description", "template.value", "time_generated_high_res", "admin_user_info.name", "admin_user_info.domain", "admin_user_info.uuid", "event_detail", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "log_category.value", "is_exported", "log_source", "log_source_tz_offset", "severity", "customer_id", "vendor_name", "vendor_severity.value", "vsys_id" ] } } }, "CSV-DEFAULT": { "logtypes": { "firewall.decryption": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "time_received_mp", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "tunnel.value", "source_uuid", "dest_uuid", "rule_matched_uuid", "client_to_firewall.value", "firewall_to_client.value", "tls_version.value", "tls_keyxchange.value", "tls_enc_algorithm.value", "tls_auth.value", "policy_name", "elliptic_curve.value", "error_index.value", "root_status.value", "chain_status.value", "proxy_type.value", "cert_serial", "fingerprint", "not_before", "not_after", "certificate_version.value", "certificate_size", "cn_len", "issuer_len", "root_cn_len", "sni_len", "cert_flags", "cn", "issuer_cn", "root_cn", "sni", "error_message", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "sequence_no" ] }, "firewall.iptag": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "tag_name", "event_id.value", "count_of_repeats", "mapping_timeout", "mapping_data_source_name", "mapping_data_source_type.value", "mapping_data_source_sub_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "ip_subnet_range", "time_generated_high_res" ] }, "firewall.userid": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "user", "mapping_data_source_name", "event_id", "count_of_repeats", "mapping_timeout", "source_port", "dest_port", "mapping_data_source.value", "mapping_data_source_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "mfa_factor_type", "auth_completion_time", "auth_factor_num", "ug_flags", "user_identified_by_source_as", "tag_name", "time_generated_high_res" ] }, "firewall.file_data": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "file_name", "url_category.value", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "pcap_id", "file_sha_256", "report_id", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "content_version", "sig_flags", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "gp_host_id", "endpoint_serial_number", "domain_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "partial_hash", "time_generated_high_res", "reason_data_filtering", "justification", "nssai_network_slice_type.value" ] }, "firewall.threat": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "file_name", "threat_id", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "pcap_id", "file_sha_256", "cloud", "url_idx", "file_type", "sender_of_virus", "subject_of_email", "recipient_of_virus", "report_id", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "threat_category.value", "content_version", "sig_flags", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "host_id", "endpoint_serial_number", "domain_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "partial_hash", "time_generated_high_res", "nssai_network_slice_type.value" ] }, "firewall.url": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "uri", "url_category.value", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "content_type", "pcap_id", "url_idx", "user_agent", "xff", "referer", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "http_method.value", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "inline_ml_verdict.value", "content_version", "sig_flags", "http_headers", "url_category_list", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "gp_host_id", "endpoint_serial_number", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "nssai_network_slice_type.value" ] }, "firewall.sctp": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "sequence_no", "ep_assoc_id", "payload_protocol_id", "vendor_severity.value", "sctp_chunk_type", "event_type.value", "event_code", "verification_tag_1", "verification_tag_2", "sctp_cause_code", "diam_app_id", "diam_cmd_code", "diam_avp_code", "stream_id", "association_end_reason.value", "map_op_code", "sccp_calling_ssn", "sccp_calling_gt", "sctp_filter", "chunks_total", "chunks_sent", "chunks_received", "packets_total", "packets_sent", "packets_received", "rule_matched_uuid", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res" ] }, "firewall.globalprotect": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "event_id.value", "stage", "auth_method", "tunnel", "source_user", "source_region", "endpoint_device_name", "public_ip.value", "public_ipv6.value", "private_ip.value", "private_ipv6.value", "host_id", "endpoint_serial_number", "endpoint_gp_version", "endpoint_os_type", "endpoint_os_version", "count_of_repeats", "quarantine_reason", "connection_error.value", "opaque", "status.value", "gpg_location", "login_duration", "connect_method", "connection_error.id", "portal", "sequence_no", "time_generated_high_res", "gateway_selection_type", "ssl_response_time", "gateway_priority.value", "attempted_gateways", "gateway", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id" ] }, "firewall.hipmatch": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_user", "vsys", "endpoint_device_name", "endpoint_os_type", "source_ip.value", "hip_match_name", "count_of_repeats", "hip_match_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "source_ip_v6.value", "host_id", "endpoint_serial_number", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_mac", "source_device_host", "source", "timestamp_device_identification", "time_generated_high_res" ] }, "firewall.tunnel": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "tunnel_event_type", "mobile_subscriber_isdn", "access_point_name", "radio_access_technology", "tunnel_message_type", "mobile_ip.value", "tunnel_endpoint_id_1", "tunnel_endpoint_id_2", "tunnel_interface", "tunnel_cause_code", "vendor_severity.value", "mobile_country_code", "mobile_network_code", "mobile_area_code", "mobile_base_station_code", "tunnel_event_code", "sequence_no", "source_location", "dest_location", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "bytes_total", "bytes_sent", "bytes_received", "packets_total", "packets_sent", "packets_received", "packets_dropped_max_encap", "packets_dropped_ukn_proto", "packets_dropped_strict_check", "packets_dropped_tunnel_frag", "tunnel_sessions_created", "tunnel_sessions_closed", "session_end_reason.value", "action_source.value", "session_start_time", "total_time_elapsed", "tunnel_inspection_rule", "tunnel_remote_user_ip.value", "tunnel_remote_imsi_id", "rule_matched_uuid", "dynusergroup_name", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "nssai_network_slice_differentiator.value", "nssai_network_slice_type.value", "pdu_session_id" ] }, "firewall.auth": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "user", "normalize_user", "object", "auth_policy", "count_of_repeats", "mfa_auth_id", "mfa_vendor", "log_set", "auth_server_profile", "auth_description", "client_type", "auth_event_name.value", "auth_factor_num", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "auth_proto", "rule_matched_uuid", "time_generated_high_res", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "service_region", "user_agent", "session_id" ] }, "firewall.traffic": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "bytes_total", "bytes_sent", "bytes_received", "packets_total", "session_start_time", "total_time_elapsed", "url_category.value", "sequence_no", "source_location", "dest_location", "packets_sent", "packets_received", "session_end_reason.value", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "action_source.value", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "ep_assoc_id", "chunks_total", "chunks_sent", "chunks_received", "rule_matched_uuid", "http2_connection", "link_change_count", "policy_id", "link_switches", "sdwan_cluster", "sdwan_device_type", "sdwan_cluster_type", "sdwan_site", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "host_id", "endpoint_serial_number", "source_dynamic_address_group", "dest_dynamic_address_group", "ha_session_owner", "time_generated_high_res", "nssai_network_slice_type.value", "nssai_network_slice_differentiator.value" ] }, "firewall.dns_security": { "filter": null, "selectedColumns": [ "vendor_name", "log_source_id", "log_time", "log_type.value", "sub_type.value", "time_generated", "record_type", "cloud_dns_client_ip.value", "dest_ip.value", "gtid", "verdict.value", "threat_name", "source_ip.value", "from_zone", "action.value", "dst_zone", "dst_user", "dns_parse_fqdn" ] }, "log.system": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "event_time", "vsys", "event_name.value", "event_component", "vendor_severity.value", "event_description", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "device_group.value", "template.value", "time_generated_high_res" ] }, "log.config": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "event_time", "event_client_ip.value", "vsys", "event_name.value", "admin_user", "client.value", "event_result.value", "event_path", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "device_group.value", "event_description", "template.value", "time_generated_high_res" ] } } }, "ALL": { "logtypes": { "firewall.decryption": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "time_received_mp", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "tunnel.value", "source_uuid", "dest_uuid", "rule_matched_uuid", "client_to_firewall.value", "firewall_to_client.value", "tls_version.value", "tls_keyxchange.value", "tls_enc_algorithm.value", "tls_auth.value", "policy_name", "elliptic_curve.value", "error_index.value", "root_status.value", "chain_status.value", "proxy_type.value", "cert_serial", "fingerprint", "not_before", "not_after", "certificate_version.value", "certificate_size", "cn_len", "issuer_len", "root_cn_len", "sni_len", "cert_flags", "cn", "issuer_cn", "root_cn", "sni", "error_message", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "sequence_no", "app_category", "characteristics_of_app", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "customer_id", "cpadding", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "dest_device_class", "dest_device_os", "dest_location", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "log_source_name", "domain", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_cert_cn_truncated", "is_cert_ECDSA", "is_cert_RSA", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_dup_log", "is_encrypted", "is_forwarded", "is_ipv6", "is_issuer_cn_truncated", "is_mptcp_on", "is_nat", "is_non_std_dest_port", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_resume_session", "is_root_cn_truncated", "is_sni_truncated", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "log_source", "log_source_tz_offset", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "is_packet_capture", "padding", "padding3", "sanctioned_state_of_app", "source_device_class", "source_device_os", "source_location", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "tpadding", "tunneled_app", "vendor_name", "vsys_id", "vsys_name", "vpadding" ] }, "firewall.iptag": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "tag_name", "event_id.value", "count_of_repeats", "mapping_timeout", "mapping_data_source_name", "mapping_data_source_type.value", "mapping_data_source_sub_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "ip_subnet_range", "time_generated_high_res", "customer_id", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_set", "log_source", "log_source_tz_offset", "rule_matched", "rule_matched_uuid", "vendor_name" ] }, "firewall.userid": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "user", "mapping_data_source_name", "event_id", "count_of_repeats", "mapping_timeout", "source_port", "dest_port", "mapping_data_source.value", "mapping_data_source_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "mfa_factor_type", "auth_completion_time", "auth_factor_num", "ug_flags", "user_identified_by_source_as", "tag_name", "time_generated_high_res", "authenticated_user_info.domain", "authenticated_user_info.name", "authenticated_user_info.uuid", "customer_id", "is_dup_log", "is_duplicate_user", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "user_group_found", "vendor_name" ] }, "firewall.file_data": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "file_name", "url_category.value", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "pcap_id", "file_sha_256", "report_id", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "content_version", "sig_flags", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "gp_host_id", "endpoint_serial_number", "domain_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "partial_hash", "time_generated_high_res", "reason_data_filtering", "justification", "nssai_network_slice_type.value", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "cloud_hostname", "cloud_reportid", "customer_id", "dlp_version_flag", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "file_type", "file_url", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_dup_log", "is_encrypted", "is_ipv6", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "pcap", "location", "profile_name", "sanctioned_state_of_app", "severity", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "threat_category.value", "threat_name_firewall", "tunneled_app", "url_domain", "users", "vendor_name", "vsys_id" ] }, "firewall.threat": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "file_name", "threat_id", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "pcap_id", "file_sha_256", "cloud", "url_idx", "file_type", "sender_of_virus", "subject_of_email", "recipient_of_virus", "report_id", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "threat_category.value", "content_version", "sig_flags", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "host_id", "endpoint_serial_number", "domain_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "partial_hash", "time_generated_high_res", "nssai_network_slice_type.value", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "cloud_hostname", "cloud_reportid", "customer_id", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "file_url", "http_method.value", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_dup_log", "is_encrypted", "is_ipv6", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "pcap", "payload_protocol_id", "location", "sanctioned_state_of_app", "severity", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "threat_name", "threat_name_firewall", "tunneled_app", "url_domain", "users", "vendor_name", "verdict.value", "vsys_id" ] }, "firewall.url": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "uri", "url_category.value", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "content_type", "pcap_id", "url_idx", "user_agent", "xff", "referer", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "http_method.value", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "inline_ml_verdict.value", "content_version", "sig_flags", "http_headers", "url_category_list", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "gp_host_id", "endpoint_serial_number", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "nssai_network_slice_type.value", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "cloud_hostname", "cloud_reportid", "customer_id", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "file_url", "referer_fqdn", "referer_port", "referer_protocol.value", "referer_url_path", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_dup_log", "is_encrypted", "is_ipv6", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "pcap", "location", "sanctioned_state_of_app", "severity", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "tunneled_app", "url_domain", "users", "vendor_name", "vsys_id" ] }, "firewall.sctp": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "sequence_no", "ep_assoc_id", "payload_protocol_id", "vendor_severity.value", "sctp_chunk_type", "event_type.value", "event_code", "verification_tag_1", "verification_tag_2", "sctp_cause_code", "diam_app_id", "diam_cmd_code", "diam_avp_code", "stream_id", "association_end_reason.value", "map_op_code", "sccp_calling_ssn", "sccp_calling_gt", "sctp_filter", "chunks_total", "chunks_sent", "chunks_received", "packets_total", "packets_sent", "packets_received", "rule_matched_uuid", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "is_captive_portal", "content_version", "customer_id", "dest_device_class", "dest_device_mac", "dest_device_model", "dest_device_os", "dest_device_vendor", "dest_location", "dest_uuid", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decryption_log", "is_decrypted_payload_fwded", "is_dup_log", "is_ipv6", "is_l7_inspection_b4_session", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "session_end_reason.value", "sess_owner_rt_midx", "session_tracker", "severity", "source_device_class", "source_device_mac", "source_device_model", "source_device_os", "source_device_vendor", "source_location", "source_uuid", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "tunnel.value", "vendor_name", "vsys_id" ] }, "firewall.globalprotect": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "event_id.value", "stage", "auth_method", "tunnel", "source_user", "source_region", "endpoint_device_name", "public_ip.value", "public_ipv6.value", "private_ip.value", "private_ipv6.value", "host_id", "endpoint_serial_number", "endpoint_gp_version", "endpoint_os_type", "endpoint_os_version", "count_of_repeats", "quarantine_reason", "connection_error.value", "opaque", "status.value", "gpg_location", "login_duration", "connect_method", "connection_error.id", "portal", "sequence_no", "time_generated_high_res", "gateway_selection_type", "ssl_response_time", "gateway_priority.value", "attempted_gateways", "gateway", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "customer_id", "vendor_name" ] }, "firewall.hipmatch": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_user", "vsys", "endpoint_device_name", "endpoint_os_type", "source_ip.value", "hip_match_name", "count_of_repeats", "hip_match_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "source_ip_v6.value", "host_id", "endpoint_serial_number", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_mac", "source_device_host", "source", "timestamp_device_identification", "time_generated_high_res", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "customer_id", "uuid", "vendor_name" ] }, "firewall.tunnel": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "tunnel_event_type", "mobile_subscriber_isdn", "access_point_name", "radio_access_technology", "tunnel_message_type", "mobile_ip.value", "tunnel_endpoint_id_1", "tunnel_endpoint_id_2", "tunnel_interface", "tunnel_cause_code", "vendor_severity.value", "mobile_country_code", "mobile_network_code", "mobile_area_code", "mobile_base_station_code", "tunnel_event_code", "sequence_no", "source_location", "dest_location", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "bytes_total", "bytes_sent", "bytes_received", "packets_total", "packets_sent", "packets_received", "packets_dropped_max_encap", "packets_dropped_ukn_proto", "packets_dropped_strict_check", "packets_dropped_tunnel_frag", "tunnel_sessions_created", "tunnel_sessions_closed", "session_end_reason.value", "action_source.value", "session_start_time", "total_time_elapsed", "tunnel_inspection_rule", "tunnel_remote_user_ip.value", "tunnel_remote_imsi_id", "rule_matched_uuid", "dynusergroup_name", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "nssai_network_slice_differentiator.value", "nssai_network_slice_type.value", "pdu_session_id", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "content_version", "dest_device_class", "dest_device_mac", "dest_device_model", "dest_device_os", "dest_device_vendor", "dest_uuid", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decryption_log", "is_decrypted_payload_fwded", "is_dup_log", "is_ipv6", "is_l7_inspection_b4_session", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "customer_id", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "sanctioned_state_of_app", "sess_owner_rt_midx", "session_tracker", "severity", "source_device_class", "source_device_mac", "source_device_model", "source_device_os", "source_device_vendor", "source_uuid", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "standard_ports_of_app", "tunneled_app", "url_category.value", "users", "vendor_name", "vsys_id" ] }, "firewall.auth": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "user", "normalize_user", "object", "auth_policy", "count_of_repeats", "mfa_auth_id", "mfa_vendor", "log_set", "auth_server_profile", "auth_description", "client_type", "auth_event_name.value", "auth_factor_num", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "auth_proto", "rule_matched_uuid", "time_generated_high_res", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "service_region", "user_agent", "session_id", "authenticated_user_info.domain", "authenticated_user_info.name", "authenticated_user_info.uuid", "client_type_name.value", "customer_id", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "location", "rule_matched", "vendor_name" ] }, "firewall.traffic": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "bytes_total", "bytes_sent", "bytes_received", "packets_total", "session_start_time", "total_time_elapsed", "url_category.value", "sequence_no", "source_location", "dest_location", "packets_sent", "packets_received", "session_end_reason.value", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "action_source.value", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "ep_assoc_id", "chunks_total", "chunks_sent", "chunks_received", "rule_matched_uuid", "http2_connection", "link_change_count", "policy_id", "link_switches", "sdwan_cluster", "sdwan_device_type", "sdwan_cluster_type", "sdwan_site", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "host_id", "endpoint_serial_number", "source_dynamic_address_group", "dest_dynamic_address_group", "ha_session_owner", "time_generated_high_res", "nssai_network_slice_type.value", "nssai_network_slice_differentiator.value", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "customer_id", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_decryption_log", "is_decrypted_payload_fwded", "is_dup_log", "is_encrypted", "is_ipv6", "is_l7_inspection_b4_session", "is_mptcp_on", "is_non_std_dest_port", "is_offloaded", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "location", "sdwan_FEC_ratio", "sanctioned_state_of_app", "sess_owner_rt_midx", "session_tracker", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "tunneled_app", "users", "vendor_name", "vsys_id" ] }, "firewall.dns_security": { "filter": null, "selectedColumns": [ "vendor_name", "log_source_id", "log_time", "log_type.value", "sub_type.value", "time_generated", "record_type", "dest_ip.value", "gtid", "verdict.value", "threat_name", "source_ip.value", "from_zone", "action.value", "dst_zone", "dst_user", "customer_id", "dns_response", "dns_response_code", "protocol", "fqdn", "log_source", "total_time_elapsed", "source_user" ] }, "log.system": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "event_time", "vsys", "event_name.value", "event_component", "vendor_severity.value", "event_description", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "device_group.value", "template.value", "time_generated_high_res", "agent_content_version", "agent_data_collection_status.value", "agent_id", "agent_isolation_status", "agent_protection_status", "endpoint_tz_offset", "agent_version", "endpoint_cpu_architecture.value", "endpoint_device_domain", "endpoint_device_name", "endpoint_ip.value", "endpoint_os_type.value", "endpoint_os_version", "endpoint_user.domain", "endpoint_user.name", "endpoint_user.uuid", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "log_category.value", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "severity", "customer_id", "endpoint_is_vdi", "vendor_name", "vsys_id" ] }, "log.config": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "event_time", "event_client_ip.value", "vsys", "event_name.value", "admin_user", "client.value", "event_result.value", "event_path", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "device_group.value", "event_description", "template.value", "time_generated_high_res", "admin_user_info.name", "admin_user_info.domain", "admin_user_info.uuid", "event_detail", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "log_category.value", "is_exported", "log_source", "log_source_tz_offset", "severity", "customer_id", "vendor_name", "vendor_severity.value", "vsys_id" ] }, "endpoint.agent": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "event_id.value", "stage", "auth_method", "tunnel", "source_user", "source_region", "endpoint_device_name", "public_ip.value", "public_ipv6.value", "private_ip.value", "private_ipv6.value", "host_id", "endpoint_serial_number", "endpoint_gp_version", "endpoint_os_type", "endpoint_os_version", "count_of_repeats", "quarantine_reason", "connection_error.value", "opaque", "status.value", "gpg_location", "login_duration", "connect_method", "connection_error.id", "portal", "sequence_no", "time_generated_high_res", "gateway_selection_type", "ssl_response_time", "gateway_priority.value", "attempted_gateways", "gateway", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "panorama_serial", "pa_node_type.value", "pa_sub_tenant_id", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "customer_id", "vendor_name" ] } } }, "DEFAULT": { "logtypes": { "firewall.decryption": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "time_received_mp", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "tunnel.value", "source_uuid", "dest_uuid", "rule_matched_uuid", "client_to_firewall.value", "firewall_to_client.value", "tls_version.value", "tls_keyxchange.value", "tls_enc_algorithm.value", "tls_auth.value", "policy_name", "elliptic_curve.value", "error_index.value", "root_status.value", "chain_status.value", "proxy_type.value", "cert_serial", "fingerprint", "not_before", "not_after", "certificate_version.value", "certificate_size", "cn_len", "issuer_len", "root_cn_len", "sni_len", "cert_flags", "cn", "issuer_cn", "root_cn", "sni", "error_message", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "sequence_no" ] }, "firewall.iptag": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "tag_name", "event_id.value", "count_of_repeats", "mapping_timeout", "mapping_data_source_name", "mapping_data_source_type.value", "mapping_data_source_sub_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "ip_subnet_range", "time_generated_high_res" ] }, "firewall.userid": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "user", "mapping_data_source_name", "event_id", "count_of_repeats", "mapping_timeout", "source_port", "dest_port", "mapping_data_source.value", "mapping_data_source_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "mfa_factor_type", "auth_completion_time", "auth_factor_num", "ug_flags", "user_identified_by_source_as", "tag_name", "time_generated_high_res" ] }, "firewall.file_data": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "file_name", "url_category.value", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "pcap_id", "file_sha_256", "report_id", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "content_version", "sig_flags", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "gp_host_id", "endpoint_serial_number", "domain_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "partial_hash", "time_generated_high_res", "reason_data_filtering", "justification", "nssai_network_slice_type.value" ] }, "firewall.threat": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "file_name", "threat_id", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "pcap_id", "file_sha_256", "cloud", "url_idx", "file_type", "sender_of_virus", "subject_of_email", "recipient_of_virus", "report_id", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "threat_category.value", "content_version", "sig_flags", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "host_id", "endpoint_serial_number", "domain_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "partial_hash", "time_generated_high_res", "nssai_network_slice_type.value" ] }, "firewall.url": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "uri", "url_category.value", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "content_type", "pcap_id", "url_idx", "user_agent", "xff", "referer", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "http_method.value", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "inline_ml_verdict.value", "content_version", "sig_flags", "http_headers", "url_category_list", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "gp_host_id", "endpoint_serial_number", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "nssai_network_slice_type.value" ] }, "firewall.sctp": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "sequence_no", "ep_assoc_id", "payload_protocol_id", "vendor_severity.value", "sctp_chunk_type", "event_type.value", "event_code", "verification_tag_1", "verification_tag_2", "sctp_cause_code", "diam_app_id", "diam_cmd_code", "diam_avp_code", "stream_id", "association_end_reason.value", "map_op_code", "sccp_calling_ssn", "sccp_calling_gt", "sctp_filter", "chunks_total", "chunks_sent", "chunks_received", "packets_total", "packets_sent", "packets_received", "rule_matched_uuid", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res" ] }, "firewall.globalprotect": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "event_id.value", "stage", "auth_method", "tunnel", "source_user", "source_region", "endpoint_device_name", "public_ip.value", "public_ipv6.value", "private_ip.value", "private_ipv6.value", "host_id", "endpoint_serial_number", "endpoint_gp_version", "endpoint_os_type", "endpoint_os_version", "count_of_repeats", "quarantine_reason", "connection_error.value", "opaque", "status.value", "gpg_location", "login_duration", "connect_method", "connection_error.id", "portal", "sequence_no", "time_generated_high_res", "gateway_selection_type", "ssl_response_time", "gateway_priority.value", "attempted_gateways", "gateway", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id" ] }, "firewall.hipmatch": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_user", "vsys", "endpoint_device_name", "endpoint_os_type", "source_ip.value", "hip_match_name", "count_of_repeats", "hip_match_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "source_ip_v6.value", "host_id", "endpoint_serial_number", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_mac", "source_device_host", "source", "timestamp_device_identification", "time_generated_high_res" ] }, "firewall.tunnel": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "tunnel_event_type", "mobile_subscriber_isdn", "access_point_name", "radio_access_technology", "tunnel_message_type", "mobile_ip.value", "tunnel_endpoint_id_1", "tunnel_endpoint_id_2", "tunnel_interface", "tunnel_cause_code", "vendor_severity.value", "mobile_country_code", "mobile_network_code", "mobile_area_code", "mobile_base_station_code", "tunnel_event_code", "sequence_no", "source_location", "dest_location", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "bytes_total", "bytes_sent", "bytes_received", "packets_total", "packets_sent", "packets_received", "packets_dropped_max_encap", "packets_dropped_ukn_proto", "packets_dropped_strict_check", "packets_dropped_tunnel_frag", "tunnel_sessions_created", "tunnel_sessions_closed", "session_end_reason.value", "action_source.value", "session_start_time", "total_time_elapsed", "tunnel_inspection_rule", "tunnel_remote_user_ip.value", "tunnel_remote_imsi_id", "rule_matched_uuid", "dynusergroup_name", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "nssai_network_slice_differentiator.value", "nssai_network_slice_type.value", "pdu_session_id" ] }, "firewall.auth": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "user", "normalize_user", "object", "auth_policy", "count_of_repeats", "mfa_auth_id", "mfa_vendor", "log_set", "auth_server_profile", "auth_description", "client_type", "auth_event_name.value", "auth_factor_num", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "auth_proto", "rule_matched_uuid", "time_generated_high_res", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "service_region", "user_agent", "session_id" ] }, "firewall.traffic": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "bytes_total", "bytes_sent", "bytes_received", "packets_total", "session_start_time", "total_time_elapsed", "url_category.value", "sequence_no", "source_location", "dest_location", "packets_sent", "packets_received", "session_end_reason.value", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "action_source.value", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "ep_assoc_id", "chunks_total", "chunks_sent", "chunks_received", "rule_matched_uuid", "http2_connection", "link_change_count", "policy_id", "link_switches", "sdwan_cluster", "sdwan_device_type", "sdwan_cluster_type", "sdwan_site", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "host_id", "endpoint_serial_number", "source_dynamic_address_group", "dest_dynamic_address_group", "ha_session_owner", "time_generated_high_res", "nssai_network_slice_type.value", "nssai_network_slice_differentiator.value" ] }, "firewall.dns_security": { "filter": null, "selectedColumns": [ "vendor_name", "log_source_id", "log_time", "log_type.value", "sub_type.value", "time_generated", "record_type", "cloud_dns_client_ip.value", "dest_ip.value", "gtid", "verdict.value", "threat_name", "source_ip.value", "from_zone", "action.value", "dst_zone", "dst_user", "dns_parse_fqdn" ] }, "log.system": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "event_time", "vsys", "event_name.value", "event_component", "vendor_severity.value", "event_description", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "device_group.value", "template.value", "time_generated_high_res" ] }, "log.config": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "event_time", "event_client_ip.value", "vsys", "event_name.value", "admin_user", "client.value", "event_result.value", "event_path", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "device_group.value", "event_description", "template.value", "time_generated_high_res" ] }, "endpoint.agent": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "event_id.value", "stage", "auth_method", "tunnel", "source_user", "source_region", "endpoint_device_name", "public_ip.value", "public_ipv6.value", "private_ip.value", "private_ipv6.value", "host_id", "endpoint_serial_number", "endpoint_gp_version", "endpoint_os_type", "endpoint_os_version", "count_of_repeats", "quarantine_reason", "connection_error.value", "opaque", "status.value", "gpg_location", "login_duration", "connect_method", "connection_error.id", "portal", "sequence_no", "time_generated_high_res", "gateway_selection_type", "ssl_response_time", "gateway_priority.value", "attempted_gateways", "gateway", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id" ] } } } }, "https": { "ALL": { "logtypes": { "firewall.decryption": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "time_received_mp", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "tunnel.value", "source_uuid", "dest_uuid", "rule_matched_uuid", "client_to_firewall.value", "firewall_to_client.value", "tls_version.value", "tls_keyxchange.value", "tls_enc_algorithm.value", "tls_auth.value", "policy_name", "elliptic_curve.value", "error_index.value", "root_status.value", "chain_status.value", "proxy_type.value", "cert_serial", "fingerprint", "not_before", "not_after", "certificate_version.value", "certificate_size", "cn_len", "issuer_len", "root_cn_len", "sni_len", "cert_flags", "cn", "issuer_cn", "root_cn", "sni", "error_message", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "sequence_no", "app_category", "characteristics_of_app", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "customer_id", "cpadding", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "dest_device_class", "dest_device_os", "dest_location", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "log_source_name", "domain", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_cert_cn_truncated", "is_cert_ECDSA", "is_cert_RSA", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_dup_log", "is_encrypted", "is_forwarded", "is_ipv6", "is_issuer_cn_truncated", "is_mptcp_on", "is_nat", "is_non_std_dest_port", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_resume_session", "is_root_cn_truncated", "is_sni_truncated", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "log_source", "log_source_tz_offset", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "is_packet_capture", "padding", "padding3", "sanctioned_state_of_app", "source_device_class", "source_device_os", "source_location", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "tpadding", "tunneled_app", "vendor_name", "vsys_id", "vsys_name", "vpadding" ] }, "firewall.iptag": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "tag_name", "event_id.value", "count_of_repeats", "mapping_timeout", "mapping_data_source_name", "mapping_data_source_type.value", "mapping_data_source_sub_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "ip_subnet_range", "time_generated_high_res", "customer_id", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_set", "log_source", "log_source_tz_offset", "rule_matched", "rule_matched_uuid", "vendor_name" ] }, "firewall.userid": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "user", "mapping_data_source_name", "event_id", "count_of_repeats", "mapping_timeout", "source_port", "dest_port", "mapping_data_source.value", "mapping_data_source_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "mfa_factor_type", "auth_completion_time", "auth_factor_num", "ug_flags", "user_identified_by_source_as", "tag_name", "time_generated_high_res", "authenticated_user_info.domain", "authenticated_user_info.name", "authenticated_user_info.uuid", "customer_id", "is_dup_log", "is_duplicate_user", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "user_group_found", "vendor_name" ] }, "firewall.file_data": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "file_name", "url_category.value", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "pcap_id", "file_sha_256", "report_id", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "content_version", "sig_flags", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "gp_host_id", "endpoint_serial_number", "domain_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "partial_hash", "time_generated_high_res", "reason_data_filtering", "justification", "nssai_network_slice_type.value", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "cloud_hostname", "cloud_reportid", "customer_id", "dlp_version_flag", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "file_type", "file_url", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_dup_log", "is_encrypted", "is_ipv6", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "pcap", "location", "profile_name", "sanctioned_state_of_app", "severity", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "threat_category.value", "threat_name_firewall", "tunneled_app", "url_domain", "users", "vendor_name", "vsys_id" ] }, "firewall.threat": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "file_name", "threat_id", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "pcap_id", "file_sha_256", "cloud", "url_idx", "file_type", "sender_of_virus", "subject_of_email", "recipient_of_virus", "report_id", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "threat_category.value", "content_version", "sig_flags", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "host_id", "endpoint_serial_number", "domain_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "partial_hash", "time_generated_high_res", "nssai_network_slice_type.value", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "cloud_hostname", "cloud_reportid", "customer_id", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "file_url", "http_method.value", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_dup_log", "is_encrypted", "is_ipv6", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "pcap", "payload_protocol_id", "location", "sanctioned_state_of_app", "severity", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "threat_name", "threat_name_firewall", "tunneled_app", "url_domain", "users", "vendor_name", "verdict.value", "vsys_id" ] }, "firewall.url": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "uri", "url_category.value", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "content_type", "pcap_id", "url_idx", "user_agent", "xff", "referer", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "http_method.value", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "inline_ml_verdict.value", "content_version", "sig_flags", "http_headers", "url_category_list", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "gp_host_id", "endpoint_serial_number", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "nssai_network_slice_type.value", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "cloud_hostname", "cloud_reportid", "customer_id", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "file_url", "referer_fqdn", "referer_port", "referer_protocol.value", "referer_url_path", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_dup_log", "is_encrypted", "is_ipv6", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "pcap", "location", "sanctioned_state_of_app", "severity", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "tunneled_app", "url_domain", "users", "vendor_name", "vsys_id" ] }, "firewall.sctp": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "sequence_no", "ep_assoc_id", "payload_protocol_id", "vendor_severity.value", "sctp_chunk_type", "event_type.value", "event_code", "verification_tag_1", "verification_tag_2", "sctp_cause_code", "diam_app_id", "diam_cmd_code", "diam_avp_code", "stream_id", "association_end_reason.value", "map_op_code", "sccp_calling_ssn", "sccp_calling_gt", "sctp_filter", "chunks_total", "chunks_sent", "chunks_received", "packets_total", "packets_sent", "packets_received", "rule_matched_uuid", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "is_captive_portal", "content_version", "customer_id", "dest_device_class", "dest_device_mac", "dest_device_model", "dest_device_os", "dest_device_vendor", "dest_location", "dest_uuid", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decryption_log", "is_decrypted_payload_fwded", "is_dup_log", "is_ipv6", "is_l7_inspection_b4_session", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "session_end_reason.value", "sess_owner_rt_midx", "session_tracker", "severity", "source_device_class", "source_device_mac", "source_device_model", "source_device_os", "source_device_vendor", "source_location", "source_uuid", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "tunnel.value", "vendor_name", "vsys_id" ] }, "firewall.globalprotect": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "event_id.value", "stage", "auth_method", "tunnel", "source_user", "source_region", "endpoint_device_name", "public_ip.value", "public_ipv6.value", "private_ip.value", "private_ipv6.value", "host_id", "endpoint_serial_number", "endpoint_gp_version", "endpoint_os_type", "endpoint_os_version", "count_of_repeats", "quarantine_reason", "connection_error.value", "opaque", "status.value", "gpg_location", "login_duration", "connect_method", "connection_error.id", "portal", "sequence_no", "time_generated_high_res", "gateway_selection_type", "ssl_response_time", "gateway_priority.value", "attempted_gateways", "gateway", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "customer_id", "vendor_name" ] }, "firewall.hipmatch": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_user", "vsys", "endpoint_device_name", "endpoint_os_type", "source_ip.value", "hip_match_name", "count_of_repeats", "hip_match_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "source_ip_v6.value", "host_id", "endpoint_serial_number", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_mac", "source_device_host", "source", "timestamp_device_identification", "time_generated_high_res", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "customer_id", "uuid", "vendor_name" ] }, "firewall.tunnel": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "tunnel_event_type", "mobile_subscriber_isdn", "access_point_name", "radio_access_technology", "tunnel_message_type", "mobile_ip.value", "tunnel_endpoint_id_1", "tunnel_endpoint_id_2", "tunnel_interface", "tunnel_cause_code", "vendor_severity.value", "mobile_country_code", "mobile_network_code", "mobile_area_code", "mobile_base_station_code", "tunnel_event_code", "sequence_no", "source_location", "dest_location", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "bytes_total", "bytes_sent", "bytes_received", "packets_total", "packets_sent", "packets_received", "packets_dropped_max_encap", "packets_dropped_ukn_proto", "packets_dropped_strict_check", "packets_dropped_tunnel_frag", "tunnel_sessions_created", "tunnel_sessions_closed", "session_end_reason.value", "action_source.value", "session_start_time", "total_time_elapsed", "tunnel_inspection_rule", "tunnel_remote_user_ip.value", "tunnel_remote_imsi_id", "rule_matched_uuid", "dynusergroup_name", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "nssai_network_slice_differentiator.value", "nssai_network_slice_type.value", "pdu_session_id", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "content_version", "dest_device_class", "dest_device_mac", "dest_device_model", "dest_device_os", "dest_device_vendor", "dest_uuid", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decryption_log", "is_decrypted_payload_fwded", "is_dup_log", "is_ipv6", "is_l7_inspection_b4_session", "is_mptcp_on", "is_non_std_dest_port", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "customer_id", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "sanctioned_state_of_app", "sess_owner_rt_midx", "session_tracker", "severity", "source_device_class", "source_device_mac", "source_device_model", "source_device_os", "source_device_vendor", "source_uuid", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "standard_ports_of_app", "tunneled_app", "url_category.value", "users", "vendor_name", "vsys_id" ] }, "firewall.auth": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "user", "normalize_user", "object", "auth_policy", "count_of_repeats", "mfa_auth_id", "mfa_vendor", "log_set", "auth_server_profile", "auth_description", "client_type", "auth_event_name.value", "auth_factor_num", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "auth_proto", "rule_matched_uuid", "time_generated_high_res", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "service_region", "user_agent", "session_id", "authenticated_user_info.domain", "authenticated_user_info.name", "authenticated_user_info.uuid", "client_type_name.value", "customer_id", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "location", "rule_matched", "vendor_name" ] }, "firewall.traffic": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "bytes_total", "bytes_sent", "bytes_received", "packets_total", "session_start_time", "total_time_elapsed", "url_category.value", "sequence_no", "source_location", "dest_location", "packets_sent", "packets_received", "session_end_reason.value", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "action_source.value", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "ep_assoc_id", "chunks_total", "chunks_sent", "chunks_received", "rule_matched_uuid", "http2_connection", "link_change_count", "policy_id", "link_switches", "sdwan_cluster", "sdwan_device_type", "sdwan_cluster_type", "sdwan_site", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "host_id", "endpoint_serial_number", "source_dynamic_address_group", "dest_dynamic_address_group", "ha_session_owner", "time_generated_high_res", "nssai_network_slice_type.value", "nssai_network_slice_differentiator.value", "app_category", "container_of_app", "risk_of_app", "app_sub_category", "technology_of_app", "is_captive_portal", "customer_id", "dest_device_class", "dest_device_os", "dest_user_info.domain", "dest_user_info.name", "dest_user_info.uuid", "inbound_if_details.port", "inbound_if_details.slot", "inbound_if_details.type.value", "inbound_if_details.unit", "is_client_to_server", "is_container", "is_decrypt_mirror", "is_decrypted", "is_decryption_log", "is_decrypted_payload_fwded", "is_dup_log", "is_encrypted", "is_ipv6", "is_l7_inspection_b4_session", "is_mptcp_on", "is_non_std_dest_port", "is_offloaded", "is_packet_capture", "is_phishing", "is_prisma_branch", "is_prisma_mobile", "is_proxy", "is_recon_excluded", "is_saas_app", "is_server_to_client", "is_source_x_fwded", "is_sym_return", "is_transaction", "is_tunnel_inspected", "is_url_denied", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "is_nat", "non_standard_dest_port", "outbound_if_details.port", "outbound_if_details.slot", "outbound_if_details.type.value", "outbound_if_details.unit", "location", "sdwan_FEC_ratio", "sanctioned_state_of_app", "sess_owner_rt_midx", "session_tracker", "source_device_class", "source_device_os", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "tunneled_app", "users", "vendor_name", "vsys_id" ] }, "firewall.dns_security": { "filter": null, "selectedColumns": [ "vendor_name", "log_source_id", "log_time", "log_type.value", "sub_type.value", "time_generated", "record_type", "dest_ip.value", "gtid", "verdict.value", "threat_name", "source_ip.value", "from_zone", "action.value", "dst_zone", "dst_user", "customer_id", "dns_response", "dns_response_code", "protocol", "fqdn", "log_source", "total_time_elapsed", "source_user" ] }, "log.system": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "event_time", "vsys", "event_name.value", "event_component", "vendor_severity.value", "event_description", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "device_group.value", "template.value", "time_generated_high_res", "agent_content_version", "agent_data_collection_status.value", "agent_id", "agent_isolation_status", "agent_protection_status", "endpoint_tz_offset", "agent_version", "endpoint_cpu_architecture.value", "endpoint_device_domain", "endpoint_device_name", "endpoint_ip.value", "endpoint_os_type.value", "endpoint_os_version", "endpoint_user.domain", "endpoint_user.name", "endpoint_user.uuid", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "log_category.value", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "severity", "customer_id", "endpoint_is_vdi", "vendor_name", "vsys_id" ] }, "log.config": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "event_time", "event_client_ip.value", "vsys", "event_name.value", "admin_user", "client.value", "event_result.value", "event_path", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "device_group.value", "event_description", "template.value", "time_generated_high_res", "admin_user_info.name", "admin_user_info.domain", "admin_user_info.uuid", "event_detail", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "log_category.value", "is_exported", "log_source", "log_source_tz_offset", "severity", "customer_id", "vendor_name", "vendor_severity.value", "vsys_id" ] }, "endpoint.agent": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "event_id.value", "stage", "auth_method", "tunnel", "source_user", "source_region", "endpoint_device_name", "public_ip.value", "public_ipv6.value", "private_ip.value", "private_ipv6.value", "host_id", "endpoint_serial_number", "endpoint_gp_version", "endpoint_os_type", "endpoint_os_version", "count_of_repeats", "quarantine_reason", "connection_error.value", "opaque", "status.value", "gpg_location", "login_duration", "connect_method", "connection_error.id", "portal", "sequence_no", "time_generated_high_res", "gateway_selection_type", "ssl_response_time", "gateway_priority.value", "attempted_gateways", "gateway", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "is_dup_log", "is_prisma_branch", "is_prisma_mobile", "is_exported", "is_forwarded", "log_source", "log_source_tz_offset", "panorama_serial", "pa_node_type.value", "pa_sub_tenant_id", "source_user_info.domain", "source_user_info.name", "source_user_info.uuid", "customer_id", "vendor_name" ] } } }, "DEFAULT": { "logtypes": { "firewall.decryption": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "time_received_mp", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "tunnel.value", "source_uuid", "dest_uuid", "rule_matched_uuid", "client_to_firewall.value", "firewall_to_client.value", "tls_version.value", "tls_keyxchange.value", "tls_enc_algorithm.value", "tls_auth.value", "policy_name", "elliptic_curve.value", "error_index.value", "root_status.value", "chain_status.value", "proxy_type.value", "cert_serial", "fingerprint", "not_before", "not_after", "certificate_version.value", "certificate_size", "cn_len", "issuer_len", "root_cn_len", "sni_len", "cert_flags", "cn", "issuer_cn", "root_cn", "sni", "error_message", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "sequence_no" ] }, "firewall.iptag": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "tag_name", "event_id.value", "count_of_repeats", "mapping_timeout", "mapping_data_source_name", "mapping_data_source_type.value", "mapping_data_source_sub_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "ip_subnet_range", "time_generated_high_res" ] }, "firewall.userid": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "user", "mapping_data_source_name", "event_id", "count_of_repeats", "mapping_timeout", "source_port", "dest_port", "mapping_data_source.value", "mapping_data_source_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "mfa_factor_type", "auth_completion_time", "auth_factor_num", "ug_flags", "user_identified_by_source_as", "tag_name", "time_generated_high_res" ] }, "firewall.file_data": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "file_name", "url_category.value", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "pcap_id", "file_sha_256", "report_id", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "content_version", "sig_flags", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "gp_host_id", "endpoint_serial_number", "domain_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "partial_hash", "time_generated_high_res", "reason_data_filtering", "justification", "nssai_network_slice_type.value" ] }, "firewall.threat": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "file_name", "threat_id", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "pcap_id", "file_sha_256", "cloud", "url_idx", "file_type", "sender_of_virus", "subject_of_email", "recipient_of_virus", "report_id", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "threat_category.value", "content_version", "sig_flags", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "host_id", "endpoint_serial_number", "domain_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "partial_hash", "time_generated_high_res", "nssai_network_slice_type.value" ] }, "firewall.url": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "uri", "url_category.value", "vendor_severity.value", "direction_of_attack.value", "sequence_no", "source_location", "dest_location", "content_type", "pcap_id", "url_idx", "user_agent", "xff", "referer", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "source_uuid", "dest_uuid", "http_method.value", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "inline_ml_verdict.value", "content_version", "sig_flags", "http_headers", "url_category_list", "rule_matched_uuid", "http2_connection", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "gp_host_id", "endpoint_serial_number", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "nssai_network_slice_type.value" ] }, "firewall.sctp": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "sequence_no", "ep_assoc_id", "payload_protocol_id", "vendor_severity.value", "sctp_chunk_type", "event_type.value", "event_code", "verification_tag_1", "verification_tag_2", "sctp_cause_code", "diam_app_id", "diam_cmd_code", "diam_avp_code", "stream_id", "association_end_reason.value", "map_op_code", "sccp_calling_ssn", "sccp_calling_gt", "sctp_filter", "chunks_total", "chunks_sent", "chunks_received", "packets_total", "packets_sent", "packets_received", "rule_matched_uuid", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res" ] }, "firewall.globalprotect": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "event_id.value", "stage", "auth_method", "tunnel", "source_user", "source_region", "endpoint_device_name", "public_ip.value", "public_ipv6.value", "private_ip.value", "private_ipv6.value", "host_id", "endpoint_serial_number", "endpoint_gp_version", "endpoint_os_type", "endpoint_os_version", "count_of_repeats", "quarantine_reason", "connection_error.value", "opaque", "status.value", "gpg_location", "login_duration", "connect_method", "connection_error.id", "portal", "sequence_no", "time_generated_high_res", "gateway_selection_type", "ssl_response_time", "gateway_priority.value", "attempted_gateways", "gateway", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id" ] }, "firewall.hipmatch": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_user", "vsys", "endpoint_device_name", "endpoint_os_type", "source_ip.value", "hip_match_name", "count_of_repeats", "hip_match_type.value", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "source_ip_v6.value", "host_id", "endpoint_serial_number", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_mac", "source_device_host", "source", "timestamp_device_identification", "time_generated_high_res" ] }, "firewall.tunnel": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "tunnel_event_type", "mobile_subscriber_isdn", "access_point_name", "radio_access_technology", "tunnel_message_type", "mobile_ip.value", "tunnel_endpoint_id_1", "tunnel_endpoint_id_2", "tunnel_interface", "tunnel_cause_code", "vendor_severity.value", "mobile_country_code", "mobile_network_code", "mobile_area_code", "mobile_base_station_code", "tunnel_event_code", "sequence_no", "source_location", "dest_location", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "bytes_total", "bytes_sent", "bytes_received", "packets_total", "packets_sent", "packets_received", "packets_dropped_max_encap", "packets_dropped_ukn_proto", "packets_dropped_strict_check", "packets_dropped_tunnel_frag", "tunnel_sessions_created", "tunnel_sessions_closed", "session_end_reason.value", "action_source.value", "session_start_time", "total_time_elapsed", "tunnel_inspection_rule", "tunnel_remote_user_ip.value", "tunnel_remote_imsi_id", "rule_matched_uuid", "dynusergroup_name", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "source_dynamic_address_group", "dest_dynamic_address_group", "time_generated_high_res", "nssai_network_slice_differentiator.value", "nssai_network_slice_type.value", "pdu_session_id" ] }, "firewall.auth": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "source_ip.value", "user", "normalize_user", "object", "auth_policy", "count_of_repeats", "mfa_auth_id", "mfa_vendor", "log_set", "auth_server_profile", "auth_description", "client_type", "auth_event_name.value", "auth_factor_num", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id", "auth_proto", "rule_matched_uuid", "time_generated_high_res", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "service_region", "user_agent", "session_id" ] }, "firewall.traffic": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "source_ip.value", "dest_ip.value", "nat_source.value", "nat_dest.value", "rule_matched", "source_user", "dest_user", "app", "vsys", "from_zone", "to_zone", "inbound_if.value", "outbound_if.value", "log_set", "session_id", "count_of_repeats", "source_port", "dest_port", "nat_source_port", "nat_dest_port", "protocol.value", "action.value", "bytes_total", "bytes_sent", "bytes_received", "packets_total", "session_start_time", "total_time_elapsed", "url_category.value", "sequence_no", "source_location", "dest_location", "packets_sent", "packets_received", "session_end_reason.value", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "action_source.value", "source_uuid", "dest_uuid", "tunnelid_imsi", "monitor_tag_imei", "parent_session_id", "parent_start_time", "tunnel.value", "ep_assoc_id", "chunks_total", "chunks_sent", "chunks_received", "rule_matched_uuid", "http2_connection", "link_change_count", "policy_id", "link_switches", "sdwan_cluster", "sdwan_device_type", "sdwan_cluster_type", "sdwan_site", "dynusergroup_name", "xff_ip.value", "source_device_category", "source_device_profile", "source_device_model", "source_device_vendor", "source_device_osfamily", "source_device_osversion", "source_device_host", "source_device_mac", "dest_device_category", "dest_device_profile", "dest_device_model", "dest_device_vendor", "dest_device_osfamily", "dest_device_osversion", "dest_device_host", "dest_device_mac", "container_id", "pod_namespace", "pod_name", "source_edl", "dest_edl", "host_id", "endpoint_serial_number", "source_dynamic_address_group", "dest_dynamic_address_group", "ha_session_owner", "time_generated_high_res", "nssai_network_slice_type.value", "nssai_network_slice_differentiator.value" ] }, "firewall.dns_security": { "filter": null, "selectedColumns": [ "vendor_name", "log_source_id", "log_time", "log_type.value", "sub_type.value", "time_generated", "record_type", "cloud_dns_client_ip.value", "dest_ip.value", "gtid", "verdict.value", "threat_name", "source_ip.value", "from_zone", "action.value", "dst_zone", "dst_user", "dns_parse_fqdn" ] }, "log.system": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "event_time", "vsys", "event_name.value", "event_component", "vendor_severity.value", "event_description", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "device_group.value", "template.value", "time_generated_high_res" ] }, "log.config": { "filter": null, "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "event_time", "event_client_ip.value", "vsys", "event_name.value", "admin_user", "client.value", "event_result.value", "event_path", "sequence_no", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "device_group.value", "event_description", "template.value", "time_generated_high_res" ] }, "endpoint.agent": { "selectedColumns": [ "log_time", "log_source_id", "log_type.value", "sub_type.value", "config_version.value", "time_generated", "vsys", "event_id.value", "stage", "auth_method", "tunnel", "source_user", "source_region", "endpoint_device_name", "public_ip.value", "public_ipv6.value", "private_ip.value", "private_ipv6.value", "host_id", "endpoint_serial_number", "endpoint_gp_version", "endpoint_os_type", "endpoint_os_version", "count_of_repeats", "quarantine_reason", "connection_error.value", "opaque", "status.value", "gpg_location", "login_duration", "connect_method", "connection_error.id", "portal", "sequence_no", "time_generated_high_res", "gateway_selection_type", "ssl_response_time", "gateway_priority.value", "attempted_gateways", "gateway", "dg_hier_level_1", "dg_hier_level_2", "dg_hier_level_3", "dg_hier_level_4", "vsys_name", "log_source_name", "vsys_id" ] } } } } } }