Content Comparison

Table of Contents

minLevel	2
maxLevel	2
type	flat

Introduction

The table tags beginning with cef0.paloAltoNetworks identifies identify events in CEF format generated by Palo Alto.

...

Events in CEF format don’t have a specific tag structure, as explained in Technologies supported in CEF syslog format. They are always sent to a table with the structure cef0.deviceVendor.deviceProduct.

...

Tag

...

Data table

...

In this case, the valid data tables are:

Tags	Data tables
`cef0.paloAltoNetworks.cortexXdr`	`cef0.paloAltoNetworks.cortexXdr`
`cef0.paloAltoNetworks.cortexXdrAgent`	`cef0.paloAltoNetworks.`

panOsCEF

`cortexXdrAgent`
`cef0.paloAltoNetworks.lf`	`cef0.paloAltoNetworks.lf`

CEF

cef0.paloAltoNetworks.paloAltoNetworksCortexXsoar

cef0.paloAltoNetworks.

cortexXdrAgentCEF

`paloAltoNetworksCortexXsoar`
`cef0.paloAltoNetworks.panOs`	`cef0.paloAltoNetworks`

.paloAltoNetworksCortexXsoar

`.panOs`
`cef0.paloaltonetworks.panwiot`	`cef0.paloaltonetworks.panwiot`

How is the data sent to Devo?

Learn more about CEF syslog format and how Devo tags these events in Technologies supported in CEF syslog format.

Table structure

This is These are the set displayed by these tables.fields displayed in this table:

cef0.paloAltoNetworks.panOscortexXdr
cef0.paloAltoNetworks.lfcortexXdrAgent
cef0.paloAltoNetworks.paloAltoNetworksCortexXsoarlf
cef0.paloAltoNetworks.cortexXdrAgentpaloAltoNetworksCortexXsoar

...

cef0.paloAltoNetworks.panOs
cef0.

...

paloaltonetworks.panwiot

Anchor
tag1
tag1
cef0.paloAltoNetworks.

...

cortexXdr

Field	Type	Source field name	Extra

Label

rawMessage

str

✓

hostchain

str

✓

fields
eventdate	`timestamp`

-


hostname	`str`

-


priorityCode	`str`

-


cefTag	`str`

-


cefVersion	`str`

-


embDeviceVendor	`str`

-


embDeviceProduct	`str`

-


deviceVersion	`str`

-


signatureID	`str`

-


name	`str`

-


severity	`str`

-


_cefVer	`str`

-


act	`str`

-


app	`str`

-

cn1Label

str

-

cn1

int8

-

cn2Label

str

-

cn2

int8

-

cn3Label

str

-

cn3

int8

-

cnt

int4

-


cat	`str`

-


cs1Label	`str`

-


cs1	`str`

-


cs2Label	`str`

-


cs2	`str`

-


cs3Label	`str`

-


cs3	`str`

-


cs4Label	`str`

-


cs4	`str`

-


cs5Label	`str`

-


cs5	`str`

-


cs6Label	`str`

-


cs6	`str`

-

destinationTranslatedAddress


dst	`ip4`

-

destinationTranslatedPort

int4

-

deviceExternalId


dpt	`str`

-

deviceInboundInterface

end

str

timestamp

-

deviceOutboundInterface

dst

ip4

-

duser

str

-

dvchost

str

-

dvc

ip4

-

externalId

str

-

filePath

str

-

fileType

str

-

fname

str

-

in

int8

-

msg

str

-

out

int8

-

proto

str

-


deviceFacility	`str`

-


externalId	`int8`
fileHash	`str`
filePath	`str`
request	`str`

-

rt

shost

timestamp

str

-

sourceTranslatedAddress

sourceTranslatedPort

int4

-


src	`ip4`

-

src

ip4

-

start

timestamp

-


spt	`int4`

-


suser	`str`

-

agt

ip4

-

ahost


CSPaccountname	`str`

-

aid


cgoSha256	`str`

-

arcSightEventPath


incident	`str`

-

art

assetCriticality

int4

-

at


initiatorPath	`str`

-


initiatorSha256	`str`

-

atz


osParentCmd	`str`

-

av


osParentName	`str`

-

catdt


osParentSha256	`str`

-

categoryBehavior


osParentSignature	`str`

-

categoryDeviceGroup


osParentSigner	`str`

-

categoryObject


targetprocesscmd	`str`

-

categoryOutcome


targetprocessname	`str`

-

customerID


targetprocesssha256	`str`

-

customerURI


targetprocesssignature	`str`

-

destinationAssetId


tenantCDLid	`str`

-

destinationGeoCountryCode


tenantname	`str`

-

destinationGeoLocationInfo


hostchain	`str`

-

destinationGeoPostalCode

✓

str

destinationGeoRegionCode

tag

-

str

-

cefTag

destinationZoneExternalID

str

-

destinationZoneID

✓
rawMessage	`str`

-

destinationZoneURI

✓

str

Anchor

...

tag2

...

deviceAssetId

...

str

...

-

...

deviceFacility

...

str

...

-

...

deviceSeverity

...

str

...

-

...

deviceZoneID

...

str

...

-

...

deviceZoneURI

...

str

...

-

...

dlat

...

float8

...

-

...

dlong

...

float8

...

-

...

dpt

...

int4

...

-

...

dtz

...

str

...

-

...

eventAnnotationAuditTrail

...

str

...

-

...

eventAnnotationEndTime

...

timestamp

...

-

...

eventAnnotationEventId

...

str

...

-

...

eventAnnotationFlags

...

str

...

-

...

eventAnnotationManagerReceiptTime

...

timestamp

...

-

...

eventAnnotationModificationTime

...

timestamp

...

-

...

eventAnnotationStageID

...

str

...

-

...

eventAnnotationStageUpdateTime

...

timestamp

...

-

...

eventAnnotationStageURI

...

str

...

-

...

eventAnnotationVersion

...

int4

...

-

...

eventId

...

str

...

-

...

flexNumber1

...

int4

...

-

...

flexNumber1Label

...

str

...

-

...

flexString1

...

str

...

-

...

flexString1Label

...

str

...

-

...

flexString2

...

str

...

-

...

flexString2Label

...

str

...

-

...

generatorID

...

str

...

-

...

locality

...

int4

...

-

...

modelConfidence

...

int4

...

-

...

mrt

...

timestamp

...

-

...

priority

...

int4

...

-

...

relevance

...

int4

...

-

...

slat

...

float8

...

-

...

slong

...

float8

...

-

...

sourceAssetId

...

str

...

-

...

sourceGeoCountryCode

...

str

...

-

...

sourceGeoLocationInfo

...

str

...

-

...

sourceGeoPostalCode

...

str

...

-

...

sourceGeoRegionCode

...

str

...

-

...

sourceTranslatedZoneExternalID

...

str

...

-

...

sourceTranslatedZoneID

...

str

...

-

...

sourceTranslatedZoneURI

...

str

...

-

...

sourceZoneExternalID

...

str

...

-

...

sourceZoneID

...

str

...

-

...

sourceZoneURI

...

str

...

-

...

type

...

int4

...

-

...

tag

...

str

...

✓

...

tag2
cef0.paloAltoNetworks.cortexXdrAgent

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
dvchost	`str`
shost	`str`
cat	`str`
end	`timestamp`
rt	`timestamp`
cs1Label	`str`
cs1	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
msg	`str`
tenantname	`str`
tenantCDLid	`str`
CSPaccountname	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

Anchor
tag3
tag3
cef0.paloAltoNetworks.lf

Field	Type	Source field name	Extra

Label

fields
eventdate	`timestamp`

-


hostname	`str`

-


priorityCode	`str`

-


cefTag	`str`

-


cefVersion	`str`

-


embDeviceVendor	`str`

-


embDeviceProduct	`str`

-


deviceVersion	`str`

-


signatureID	`str`

-


name	`str`

-


severity	`str`

-


_cefVer	`str`

-


act	`str`

-


app	`str`

-


cat	`str`

-


c6a1Label	`str`

-


c6a1	`str`

-


cn1Label	`str`

-


cn1	`int8`

-


cn2Label	`str`

-


cn2	`int8`

-


cn3Label	`str`

-


cn3	`int8`

-


cnt	`int4`

-


cs1Label	`str`

-


cs1	`str`

-


cs2Label	`str`

-


cs2	`str`

-


cs3Label	`str`

-


cs3	`str`

-


cs4Label	`str`

-


cs4	`str`

-


cs5Label	`str`

-


cs5	`str`

-


cs6Label	`str`

-


cs6	`str`

-


destinationServiceName	`str`

-


destinationTranslatedAddress	`ip4`

-


destinationTranslatedPort	`int4`

-


deviceExternalId	`str`

-


deviceInboundInterface	`str`

-


deviceOutboundInterface	`str`

-


dhost	`str`

-


dst	`ip4`

-


dpt	`int4`

-


duser	`str`

-


dvchost	`str`

-


end	`timestamp`

-


externalId	`int8`

-


fileId	`str`

-


fname	`str`

-


in	`int8`

-


msg	`str`

-


out	`int8`

-


proto	`str`

-


reason	`str`

-


requestClientApplication	`str`

-


requestMethod	`str`

-


requestContext	`str`

-


request	`str`

-


rt	`timestamp`

-


dtz	`str`

-


shost	`str`

-


sourceTranslatedAddress	`ip4`

-


sourceTranslatedPort	`int4`

-


src	`ip4`

-


spt	`int4`

-


start	`timestamp`

-


suser	`str`

-


flexString2	`str`

-


flexString2Label	`str`

-


PanOSAttemptedGateways	`str`

-


PanOSAuthMethod	`str`

-


PanOSBytes	`str`

-


PanOSChunksReceived	`str`

-


PanOSChunksSent	`str`

-


PanOSChunksTotal	`str`

-


PanOSConfigVersion	`str`

-


PanOSConnectionError	`str`

-


PanOSConnectionErrorID	`str`

-


PanOSConnectionMethod	`str`

-


PanOSContainerID	`str`

-


PanOSContainerName	`str`

-


PanOSContainerNameSpace	`str`

-


PanOSContentVersion	`str`

-


PanOSCountOfRepeats	`str`

-


PanOSDescription	`str`

-


PanOSDestinationDeviceCategory	`str`

-


PanOSDestinationDeviceHost	`str`

-


PanOSDestinationDeviceMac	`str`

-


PanOSDestinationDeviceModel	`str`

-


PanOSDestinationDeviceOSFamily	`str`

-


PanOSDestinationDeviceOSVersion	`str`

-


PanOSDestinationDeviceProfile	`str`

-


PanOSDestinationDeviceVendor	`str`

-


PanOSDestinationDynamicAddressGroup	`str`

-


PanOSDestinationEDL	`str`

-


PanOSDestinationLocation	`str`

-


PanOSDestinationUUID	`str`

-


PanOSDeviceGroup	`str`

-


PanOSDeviceName	`str`

-


PanOSDeviceSN	`str`

-


PanOSDGHierarchyLevel1	`str`

-


PanOSDGHierarchyLevel2	`str`

-


PanOSDGHierarchyLevel3	`str`

-


PanOSDGHierarchyLevel4	`str`

-


PanOSDynamicUserGroupName	`str`

-


PanOSEndpointAssociationID	`str`

-


PanOSEndpointDeviceName	`str`

-


PanOSEndpointOSType	`str`

-


PanOSEndpointOSVersion	`str`

-


PanOSEndpointSerialNumber	`str`

-


PanOSEndpointSN	`str`

-


PanOSEventDescription	`str`

-


PanOSEventIDValue	`str`

-


PanOSEventResult	`str`

-


PanOSEventStatus	`str`

-


PanOSEventTime	`timestamp`

-


PanOSGateway	`str`

-


PanOSGatewayPriority	`str`

-


PanOSGatewaySelectionType	`str`

-


PanOSGlobalProtectClientVersion	`str`

-


PanOSGlobalProtectGatewayLocation	`str`

-


PanOSGPHostID	`str`

-


PanOSHASessionOwner	`str`

-


PanOSHipMatchType	`str`

-


PanOSHostID	`str`

-


PanOSHTTP2Connection	`str`

-


PanOSHTTPHeaders	`str`

-


PanOSIMEI	`str`

-


PanOSIMSI	`str`

-


PanOSInlineMLVerdict	`str`

-


PanOSLinkChangeCount	`str`

-


PanOSLinkSwitches	`str`

-


PanOSLoginDuration	`str`

-


PanOSNSSAINetworkSliceDifferentiator	`str`

-


PanOSNSSAINetworkSliceType	`str`

-


PanOSPacketsReceived	`str`

-


PanOSPacketsSent	`str`

-


PanOSParentSessionID	`str`

-


PanOSParentStarttime	`timestamp`

-


PanOSPortal	`str`

-


PanOSPrivateIPv4	`ip4`

-


PanOSPrivateIPv6	`str`

-


PanOSPublicIPv4	`ip4`

-


PanOSPublicIPv6	`str`

-


PanOSQuarantineReason	`str`

-


PanOSReferer	`str`

-


PanOSRuleUUID	`str`

-


PanOSSDWANCluster	`str`

-


PanOSSDWANClusterType	`str`

-


PanOSSDWANDeviceType	`str`

-


PanOSSDWANPolicyName	`str`

-


PanOSSDWANSite	`str`

-


PanOSSequenceNo	`str`

-


PanOSSessionStartTime	`timestamp`

-


PanOSSigFlags	`str`

-


PanOSSource	`str`

-


PanOSSourceDeviceCategory	`str`

-


PanOSSourceDeviceHost	`str`

-


PanOSSourceDeviceMac	`str`

-


PanOSSourceDeviceModel	`str`

-


PanOSSourceDeviceOSFamily	`str`

-


PanOSSourceDeviceOSVersion	`str`

-


PanOSSourceDeviceProfile	`str`

-


PanOSSourceDeviceVendor	`str`

-


PanOSSourceDynamicAddressGroup	`str`

-


PanOSSourceEDL	`str`

-


PanOSSourceLocation	`str`

-


PanOSSourceRegion	`str`

-


PanOSSourceUser	`str`

-


PanOSSourceUserName	`str`

-


PanOSSourceUUID	`str`

-


PanOSSSLResponseTime	`str`

-


PanOSStage	`str`

-


PanOSTag	`str`

-


PanOSTemplate	`str`

-


PanOSThreatID	`str`

-


PanOSThreatCategory	`str`

-


PanOSTimeGeneratedHighResolution	`str`

-


PanOSTimestampDeviceIdentification	`str`

-


PanOSTunnel	`str`

-


PanOSTunnelType	`str`

-


PanOSUGFlags	`str`

-


PanOSURLCategoryList	`str`

-


PanOSURLCounter	`str`

-


PanOSUserIdentifiedBySource	`str`

-


PanOSVirtualSystem	`str`

-


PanOSVirtualSystemID	`str`

-


PanOSVirtualSystemName	`str`

-


PanOSXForwardedFor	`str`

-


PanOSXForwardedForIP	`ip4`

-


hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

...

Anchor

...

tag4
tag4
cef0.paloAltoNetworks.paloAltoNetworksCortexXsoar

Field	Type	Source field name	Extra

Label

fields
eventdate	`timestamp`

-


hostname	`str`

-


priorityCode	`str`

-


cefTag	`str`

-


cefVersion	`str`

-


embDeviceVendor	`str`

-


embDeviceProduct	`str`

-


deviceVersion	`str`

-


signatureID	`str`

-


name	`str`

-


severity	`str`

-


_cefVer	`str`

-


cs1Label	`str`

-


cs1	`str`

-


cs2Label	`str`

-


cs2	`str`

-


suser	`str`

-


startTime	`timestamp`

-


hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`

-

✓

...

Anchor

...

tag5
tag5
cef0.paloAltoNetworks.

...

panOs

Field	Type	Source field name	Extra

Label

fields
eventdate	`timestamp`

-


hostname	`str`

-


priorityCode	`str`

-


cefTag	`str`

-


cefVersion	`str`

-


embDeviceVendor	`str`

-


embDeviceProduct	`str`

-


deviceVersion	`str`

-


signatureID	`str`

-


name	`str`

-


severity	`str`
_cefVer	`str`

-

dvchost


act	`str`

-

shost


app	`str`

-


cat	`str`
cn1Label	`str`
cn1	`int8`
cn2Label	`str`

-

end

timestamp

-

rt

timestamp

-


cn2	`int8`
cn3Label	`str`
cn3	`int8`
cnt	`int4`
cs1Label	`str`

-


cs1	`str`

-


cs2Label	`str`

-


cs2	`str`

-


cs3Label	`str`

-


cs3	`str`

-


cs4Label	`str`

-

cs4

str

-

msg

str

-

tenantname

str

-

tenantCDLid

str

-

CSPaccountname

str

-

hostchain

str

✓

tag

str

✓

rawMessage

str

✓

How is the data sent to Devo?

...


cs4	`str`
cs5Label	`str`
cs5	`str`
cs6Label	`str`
cs6	`str`
destinationTranslatedAddress	`ip4`
destinationTranslatedPort	`int4`
deviceExternalId	`str`
deviceInboundInterface	`str`
deviceOutboundInterface	`str`
dst	`ip4`
duser	`str`
dvchost	`str`
dvc	`ip4`
externalId	`str`
filePath	`str`
fileType	`str`
fname	`str`
in	`int8`
msg	`str`
out	`int8`
proto	`str`
request	`str`
rt	`timestamp`
sourceTranslatedAddress	`ip4`
sourceTranslatedPort	`int4`
spt	`int4`
src	`ip4`
start	`timestamp`
suser	`str`
agt	`ip4`
ahost	`str`
aid	`str`
arcSightEventPath	`str`
art	`str`
assetCriticality	`int4`
at	`str`
atz	`str`
av	`str`
catdt	`str`
categoryBehavior	`str`
categoryDeviceGroup	`str`
categoryObject	`str`
categoryOutcome	`str`
customerID	`str`
customerURI	`str`
destinationAssetId	`str`
destinationGeoCountryCode	`str`
destinationGeoLocationInfo	`str`
destinationGeoPostalCode	`str`
destinationGeoRegionCode	`str`
destinationZoneExternalID	`str`
destinationZoneID	`str`
destinationZoneURI	`str`
deviceAssetId	`str`
deviceFacility	`str`
deviceSeverity	`str`
deviceZoneID	`str`
deviceZoneURI	`str`
dlat	`float8`
dlong	`float8`
dpt	`int4`
dtz	`str`
eventAnnotationAuditTrail	`str`
eventAnnotationEndTime	`timestamp`
eventAnnotationEventId	`str`
eventAnnotationFlags	`str`
eventAnnotationManagerReceiptTime	`timestamp`
eventAnnotationModificationTime	`timestamp`
eventAnnotationStageID	`str`
eventAnnotationStageUpdateTime	`timestamp`
eventAnnotationStageURI	`str`
eventAnnotationVersion	`int4`
eventId	`str`
flexNumber1	`int4`
flexNumber1Label	`str`
flexString1	`str`
flexString1Label	`str`
flexString2	`str`
flexString2Label	`str`
generatorID	`str`
locality	`int4`
modelConfidence	`int4`
mrt	`timestamp`
priority	`int4`
relevance	`int4`
slat	`float8`
slong	`float8`
sourceAssetId	`str`
sourceGeoCountryCode	`str`
sourceGeoLocationInfo	`str`
sourceGeoPostalCode	`str`
sourceGeoRegionCode	`str`
sourceTranslatedZoneExternalID	`str`
sourceTranslatedZoneID	`str`
sourceTranslatedZoneURI	`str`
sourceZoneExternalID	`str`
sourceZoneID	`str`
sourceZoneURI	`str`
type	`int4`
tag	`str`	cefTag	✓
rawMessage	`str`		✓
hostchain	`str`		✓

Anchor
tag6
tag6
cef0.paloaltonetworks.panwiot

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priority_code	`str`
cef_tag	`str`
cef_version	`str`
emb_device_vendor	`str`
emb_device_product	`str`
device_version	`str`
signature_id	`str`
name	`str`
severity	`str`
device_custom_string_1_label	`str`
device_custom_string_1	`str`
device_custom_string_2_label	`str`
device_custom_string_2	`str`
device_custom_string_3_label	`str`
device_custom_string_3	`str`
device_custom_string_4_label	`str`
device_custom_string_4	`str`
device_hostname	`str`
device_ip	`ip4`
device_mac	`str`
device_custom_string_10	`str`
device_custom_string_10_label	`str`
device_custom_string_15	`str`
device_custom_string_15_label	`str`
device_custom_string_16	`str`
device_custom_string_16_label	`str`
device_custom_string_17	`str`
device_custom_string_17_label	`str`
device_custom_string_22	`str`
device_custom_string_22_label	`str`
device_custom_string_44	`str`
device_custom_string_44_label	`str`
device_custom_string_7	`str`
device_custom_string_7_label	`str`
device_custom_string_8	`str`
device_custom_string_8_label	`str`
device_custom_string_9	`str`
device_custom_string_9_label	`str`
hostchain	`str`		✓
tag	`str`	cef_tag	✓
rawMessage	`str`		✓

Version	Old Version 4	New Version 5
Changes made by	Former user	Juan Tomás Alonso Nieto
Saved on	Dec 22, 2022	Oct 10, 2023

Versions Compared

Key

Introduction

How is the data sent to Devo?

Table structure

Anchor
tag1
tag1
cef0.paloAltoNetworks.

cortexXdr

Anchor

tag2

tag2
cef0.paloAltoNetworks.cortexXdrAgent

Anchor
tag3
tag3
cef0.paloAltoNetworks.lf

Anchor

tag4
tag4
cef0.paloAltoNetworks.paloAltoNetworksCortexXsoar

Anchor

tag5
tag5
cef0.paloAltoNetworks.

panOs

How is the data sent to Devo?

Anchor
tag6
tag6
cef0.paloaltonetworks.panwiot

Content Comparison

Versions Compared

Key

Introduction

How is the data sent to Devo?

Table structure

Anchortag1tag1cef0.paloAltoNetworks.

cortexXdr

Anchor

tag2

tag2cef0.paloAltoNetworks.cortexXdrAgent

Anchortag3tag3cef0.paloAltoNetworks.lf

Anchor

tag4tag4cef0.paloAltoNetworks.paloAltoNetworksCortexXsoar

Anchor

tag5tag5cef0.paloAltoNetworks.

panOs

How is the data sent to Devo?

Anchortag6tag6cef0.paloaltonetworks.panwiot

Anchor
tag1
tag1
cef0.paloAltoNetworks.

tag2
cef0.paloAltoNetworks.cortexXdrAgent

Anchor
tag3
tag3
cef0.paloAltoNetworks.lf

tag4
tag4
cef0.paloAltoNetworks.paloAltoNetworksCortexXsoar

tag5
tag5
cef0.paloAltoNetworks.

Anchor
tag6
tag6
cef0.paloaltonetworks.panwiot