cef0.paloAltoNetworks

Introduction

The tags beginning with cef0.paloAltoNetworks identify events in CEF format generated by Palo Alto.

Tag structure

Events in CEF format don’t have a specific tag structure, as explained in Technologies supported in CEF syslog format. They are always sent to a table with the structure cef0.deviceVendor.deviceProduct.

In this case, the valid data tables are:

Tags	Data tables
`cef0.paloAltoNetworks.cortexXdr`	`cef0.paloAltoNetworks.cortexXdr`
`cef0.paloAltoNetworks.cortexXdrAgent`	`cef0.paloAltoNetworks.cortexXdrAgent`
`cef0.paloAltoNetworks.cortexXsoar`	`cef0.paloAltoNetworks.cortexXsoar`
`cef0.paloAltoNetworks.lf`	`cef0.paloAltoNetworks.lf`
`cef0.paloAltoNetworks.paloAltoNetworksCortexXsoar`	`cef0.paloAltoNetworks.paloAltoNetworksCortexXsoar`
`cef0.paloAltoNetworks.panOs`	`cef0.paloAltoNetworks.panOs`
`cef0.paloaltonetworks.panwiot`	`cef0.paloaltonetworks.panwiot`

How is the data sent to Devo?

Learn more about CEF syslog format and how Devo tags these events in Technologies supported in CEF syslog format.

Table structure

These are the fields displayed in this table:

cef0.paloAltoNetworks.cortexXdr
cef0.paloAltoNetworks.cortexXdrAgent
cef0.paloAltoNetworks.cortexXsoar
cef0.paloAltoNetworks.lf
cef0.paloAltoNetworks.paloAltoNetworksCortexXsoar
cef0.paloAltoNetworks.panOs
cef0.paloaltonetworks.panwiot

cef0.paloAltoNetworks.cortexXdr

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
app	`str`
cat	`str`
cs1Label	`str`
cs1	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
cs5Label	`str`
cs5	`str`
cs6Label	`str`
cs6	`str`
dst	`ip4`
dpt	`str`
end	`timestamp`
deviceFacility	`str`
externalId	`int8`
fileHash	`str`
filePath	`str`
request	`str`
shost	`str`
src	`ip4`
spt	`int4`
suser	`str`
CSPaccountname	`str`
cgoSha256	`str`
incident	`str`
initiatorPath	`str`
initiatorSha256	`str`
osParentCmd	`str`
osParentName	`str`
osParentSha256	`str`
osParentSignature	`str`
osParentSigner	`str`
targetprocesscmd	`str`
targetprocessname	`str`
targetprocesssha256	`str`
targetprocesssignature	`str`
tenantCDLid	`str`
tenantname	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

cef0.paloAltoNetworks.cortexXdrAgent

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
dvchost	`str`
shost	`str`
cat	`str`
end	`timestamp`
rt	`timestamp`
cs1Label	`str`
cs1	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
msg	`str`
tenantname	`str`
tenantCDLid	`str`
CSPaccountname	`str`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

cef0.paloAltoNetworks.cortexXsoar

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
machine	`str`
priority_code	`str`
cef_tag	`str`
cef_version	`str`
emb_device_vendor	`str`
emb_device_product	`str`
device_version	`str`
signature_id	`str`
name	`str`
severity	`str`
device_custom_string_1_label	`str`
device_custom_string_1	`str`
device_custom_string_2_label	`str`
device_custom_string_2	`str`
device_custom_string_3_label	`str`
device_custom_string_3	`str`
device_custom_string_4_label	`str`
device_custom_string_4	`str`
end	`timestamp`
external_id	`int8`
message	`str`
source_username	`str`
cs_paccountname	`str`
tenant_cd_lid	`str`
tenantname	`str`
hostchain	`str`		✓
tag	`str`	cef_tag	✓
rawMessage	`str`		✓

cef0.paloAltoNetworks.lf

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
app	`str`
cat	`str`
c6a1Label	`str`
c6a1	`str`
cn1Label	`str`
cn1	`int8`
cn2Label	`str`
cn2	`int8`
cn3Label	`str`
cn3	`int8`
cnt	`int4`
cs1Label	`str`
cs1	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
cs5Label	`str`
cs5	`str`
cs6Label	`str`
cs6	`str`
destinationServiceName	`str`
destinationTranslatedAddress	`ip4`
destinationTranslatedPort	`int4`
deviceExternalId	`str`
deviceInboundInterface	`str`
deviceOutboundInterface	`str`
dhost	`str`
dst	`ip4`
dpt	`int4`
duser	`str`
dvchost	`str`
end	`timestamp`
externalId	`int8`
fileId	`str`
fname	`str`
in	`int8`
msg	`str`
out	`int8`
proto	`str`
reason	`str`
requestClientApplication	`str`
requestMethod	`str`
requestContext	`str`
request	`str`
rt	`timestamp`
dtz	`str`
shost	`str`
sourceTranslatedAddress	`ip4`
sourceTranslatedPort	`int4`
src	`ip4`
spt	`int4`
start	`timestamp`
suser	`str`
flexString2	`str`
flexString2Label	`str`
PanOSAttemptedGateways	`str`
PanOSAuthMethod	`str`
PanOSBytes	`str`
PanOSChunksReceived	`str`
PanOSChunksSent	`str`
PanOSChunksTotal	`str`
PanOSConfigVersion	`str`
PanOSConnectionError	`str`
PanOSConnectionErrorID	`str`
PanOSConnectionMethod	`str`
PanOSContainerID	`str`
PanOSContainerName	`str`
PanOSContainerNameSpace	`str`
PanOSContentVersion	`str`
PanOSCountOfRepeats	`str`
PanOSDescription	`str`
PanOSDestinationDeviceCategory	`str`
PanOSDestinationDeviceHost	`str`
PanOSDestinationDeviceMac	`str`
PanOSDestinationDeviceModel	`str`
PanOSDestinationDeviceOSFamily	`str`
PanOSDestinationDeviceOSVersion	`str`
PanOSDestinationDeviceProfile	`str`
PanOSDestinationDeviceVendor	`str`
PanOSDestinationDynamicAddressGroup	`str`
PanOSDestinationEDL	`str`
PanOSDestinationLocation	`str`
PanOSDestinationUUID	`str`
PanOSDeviceGroup	`str`
PanOSDeviceName	`str`
PanOSDeviceSN	`str`
PanOSDGHierarchyLevel1	`str`
PanOSDGHierarchyLevel2	`str`
PanOSDGHierarchyLevel3	`str`
PanOSDGHierarchyLevel4	`str`
PanOSDynamicUserGroupName	`str`
PanOSEndpointAssociationID	`str`
PanOSEndpointDeviceName	`str`
PanOSEndpointOSType	`str`
PanOSEndpointOSVersion	`str`
PanOSEndpointSerialNumber	`str`
PanOSEndpointSN	`str`
PanOSEventDescription	`str`
PanOSEventIDValue	`str`
PanOSEventResult	`str`
PanOSEventStatus	`str`
PanOSEventTime	`timestamp`
PanOSGateway	`str`
PanOSGatewayPriority	`str`
PanOSGatewaySelectionType	`str`
PanOSGlobalProtectClientVersion	`str`
PanOSGlobalProtectGatewayLocation	`str`
PanOSGPHostID	`str`
PanOSHASessionOwner	`str`
PanOSHipMatchType	`str`
PanOSHostID	`str`
PanOSHTTP2Connection	`str`
PanOSHTTPHeaders	`str`
PanOSIMEI	`str`
PanOSIMSI	`str`
PanOSInlineMLVerdict	`str`
PanOSLinkChangeCount	`str`
PanOSLinkSwitches	`str`
PanOSLoginDuration	`str`
PanOSNSSAINetworkSliceDifferentiator	`str`
PanOSNSSAINetworkSliceType	`str`
PanOSPacketsReceived	`str`
PanOSPacketsSent	`str`
PanOSParentSessionID	`str`
PanOSParentStarttime	`timestamp`
PanOSPortal	`str`
PanOSPrivateIPv4	`ip4`
PanOSPrivateIPv6	`str`
PanOSPublicIPv4	`ip4`
PanOSPublicIPv6	`str`
PanOSQuarantineReason	`str`
PanOSReferer	`str`
PanOSRuleUUID	`str`
PanOSSDWANCluster	`str`
PanOSSDWANClusterType	`str`
PanOSSDWANDeviceType	`str`
PanOSSDWANPolicyName	`str`
PanOSSDWANSite	`str`
PanOSSequenceNo	`str`
PanOSSessionStartTime	`timestamp`
PanOSSigFlags	`str`
PanOSSource	`str`
PanOSSourceDeviceCategory	`str`
PanOSSourceDeviceHost	`str`
PanOSSourceDeviceMac	`str`
PanOSSourceDeviceModel	`str`
PanOSSourceDeviceOSFamily	`str`
PanOSSourceDeviceOSVersion	`str`
PanOSSourceDeviceProfile	`str`
PanOSSourceDeviceVendor	`str`
PanOSSourceDynamicAddressGroup	`str`
PanOSSourceEDL	`str`
PanOSSourceLocation	`str`
PanOSSourceRegion	`str`
PanOSSourceUser	`str`
PanOSSourceUserName	`str`
PanOSSourceUUID	`str`
PanOSSSLResponseTime	`str`
PanOSStage	`str`
PanOSTag	`str`
PanOSTemplate	`str`
PanOSThreatID	`str`
PanOSThreatCategory	`str`
PanOSTimeGeneratedHighResolution	`str`
PanOSTimestampDeviceIdentification	`str`
PanOSTunnel	`str`
PanOSTunnelType	`str`
PanOSUGFlags	`str`
PanOSURLCategoryList	`str`
PanOSURLCounter	`str`
PanOSUserIdentifiedBySource	`str`
PanOSVirtualSystem	`str`
PanOSVirtualSystemID	`str`
PanOSVirtualSystemName	`str`
PanOSXForwardedFor	`str`
PanOSXForwardedForIP	`ip4`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

cef0.paloAltoNetworks.paloAltoNetworksCortexXsoar

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
cs1Label	`str`
cs1	`str`
cs2Label	`str`
cs2	`str`
suser	`str`
startTime	`timestamp`
hostchain	`str`		✓
tag	`str`	cefTag	✓
rawMessage	`str`		✓

cef0.paloAltoNetworks.panOs

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priorityCode	`str`
cefTag	`str`
cefVersion	`str`
embDeviceVendor	`str`
embDeviceProduct	`str`
deviceVersion	`str`
signatureID	`str`
name	`str`
severity	`str`
_cefVer	`str`
act	`str`
app	`str`
cat	`str`
cn1Label	`str`
cn1	`int8`
cn2Label	`str`
cn2	`int8`
cn3Label	`str`
cn3	`int8`
cnt	`int4`
cs1Label	`str`
cs1	`str`
cs2Label	`str`
cs2	`str`
cs3Label	`str`
cs3	`str`
cs4Label	`str`
cs4	`str`
cs5Label	`str`
cs5	`str`
cs6Label	`str`
cs6	`str`
destinationTranslatedAddress	`ip4`
destinationTranslatedPort	`int4`
deviceExternalId	`str`
deviceInboundInterface	`str`
deviceOutboundInterface	`str`
dst	`ip4`
duser	`str`
dvchost	`str`
dvc	`ip4`
externalId	`str`
filePath	`str`
fileType	`str`
fname	`str`
in	`int8`
msg	`str`
out	`int8`
proto	`str`
request	`str`
rt	`timestamp`
sourceTranslatedAddress	`ip4`
sourceTranslatedPort	`int4`
spt	`int4`
src	`ip4`
start	`timestamp`
suser	`str`
agt	`ip4`
ahost	`str`
aid	`str`
arcSightEventPath	`str`
art	`str`
assetCriticality	`int4`
at	`str`
atz	`str`
av	`str`
catdt	`str`
categoryBehavior	`str`
categoryDeviceGroup	`str`
categoryObject	`str`
categoryOutcome	`str`
customerID	`str`
customerURI	`str`
destinationAssetId	`str`
destinationGeoCountryCode	`str`
destinationGeoLocationInfo	`str`
destinationGeoPostalCode	`str`
destinationGeoRegionCode	`str`
destinationZoneExternalID	`str`
destinationZoneID	`str`
destinationZoneURI	`str`
deviceAssetId	`str`
deviceFacility	`str`
deviceSeverity	`str`
deviceZoneID	`str`
deviceZoneURI	`str`
dlat	`float8`
dlong	`float8`
dpt	`int4`
dtz	`str`
eventAnnotationAuditTrail	`str`
eventAnnotationEndTime	`timestamp`
eventAnnotationEventId	`str`
eventAnnotationFlags	`str`
eventAnnotationManagerReceiptTime	`timestamp`
eventAnnotationModificationTime	`timestamp`
eventAnnotationStageID	`str`
eventAnnotationStageUpdateTime	`timestamp`
eventAnnotationStageURI	`str`
eventAnnotationVersion	`int4`
eventId	`str`
flexNumber1	`int4`
flexNumber1Label	`str`
flexString1	`str`
flexString1Label	`str`
flexString2	`str`
flexString2Label	`str`
generatorID	`str`
locality	`int4`
modelConfidence	`int4`
mrt	`timestamp`
priority	`int4`
relevance	`int4`
slat	`float8`
slong	`float8`
sourceAssetId	`str`
sourceGeoCountryCode	`str`
sourceGeoLocationInfo	`str`
sourceGeoPostalCode	`str`
sourceGeoRegionCode	`str`
sourceTranslatedZoneExternalID	`str`
sourceTranslatedZoneID	`str`
sourceTranslatedZoneURI	`str`
sourceZoneExternalID	`str`
sourceZoneID	`str`
sourceZoneURI	`str`
type	`int4`
tag	`str`	cefTag	✓
rawMessage	`str`		✓
hostchain	`str`		✓

cef0.paloaltonetworks.panwiot

Field	Type	Source field name	Extra fields
eventdate	`timestamp`
hostname	`str`
priority_code	`str`
cef_tag	`str`
cef_version	`str`
emb_device_vendor	`str`
emb_device_product	`str`
device_version	`str`
signature_id	`str`
name	`str`
severity	`str`
device_custom_string_1_label	`str`
device_custom_string_1	`str`
device_custom_string_2_label	`str`
device_custom_string_2	`str`
device_custom_string_3_label	`str`
device_custom_string_3	`str`
device_custom_string_4_label	`str`
device_custom_string_4	`str`
device_hostname	`str`
device_ip	`ip4`
device_mac	`str`
device_custom_string_10	`str`
device_custom_string_10_label	`str`
device_custom_string_15	`str`
device_custom_string_15_label	`str`
device_custom_string_16	`str`
device_custom_string_16_label	`str`
device_custom_string_17	`str`
device_custom_string_17_label	`str`
device_custom_string_22	`str`
device_custom_string_22_label	`str`
device_custom_string_44	`str`
device_custom_string_44_label	`str`
device_custom_string_7	`str`
device_custom_string_7_label	`str`
device_custom_string_8	`str`
device_custom_string_8_label	`str`
device_custom_string_9	`str`
device_custom_string_9_label	`str`
hostchain	`str`		✓
tag	`str`	cef_tag	✓
rawMessage	`str`		✓