sase.paloalto

[ 1 Introduction ] [ 2 Valid tags and data tables ]

Introduction

Tags beginning with sase.paloalto identify events generated by Paloalto.

Valid tags and data tables

The full tag must have 4 levels. The first two are fixed as saso.paloalto. The third level identifies the type of events sent, and the fourth level indicates the event subtype.

Technology	Brand	Type	Subtype

Technology	Brand	Type	Subtype
saso	paloalto	prisma_access prisma_cloud prisma_saas	threat audit cwp activity_monitoring system_audit incident policy_violation remediation

These are the valid tags and corresponding data tables that will receive the parsers' data:

Tag	Data table

Tag	Data table
sase.paloalto.prisma_access.threat	sase.paloalto.prisma_access.threat
sase.paloalto.prisma_cloud.audit	sase.paloalto.prisma_cloud.audit
sase.paloalto.prisma_cloud.cwp	sase.paloalto.prisma_cloud.cwp
sase.paloalto.prisma_saas.activity_monitoring	sase.paloalto.prisma_saas.activity_monitoring
sase.paloalto.prisma_saas.admin_audit	sase.paloalto.prisma_saas.admin_audit
sase.paloalto.prisma_saas.incident	sase.paloalto.prisma_saas.incident
sase.paloalto.prisma_saas.invalid	sase.paloalto.prisma_saas.invalid
sase.paloalto.prisma_saas.other	sase.paloalto.prisma_saas.other
sase.paloalto.prisma_saas.policy_violation	sase.paloalto.prisma_saas.policy_violation
sase.paloalto.prisma_saas.remediation	sase.paloalto.prisma_saas.remediation