Network Activity Data

act

-

-

The action

action

-

-

The traffic processing action

app

-

-

The network protocol

application

-

-

The name of the requested application

archFiles

-

-

The file information extracted from detected files

authType

-

-

The authorization type

azId

-

-

The Availability Zone ID

bytes

-

-

The number of transmitted data (in bytes)

clientGroup

-

-

The client IP network group

clientHost

-

-

The client IP hostname

clientIp

-

The endpoint IP

clientMAC

-

-

The client MAC address

clientPort

-

The client port

clientProtocol

-

-

The client protocol

clientTls

-

-

The transport layer security of the client

cloudAccountId

-

-

The owner AWS account ID of the source network interface

cnt

-

-

The total number of logs

companyName

-

-

The company name

contentEncoding

-

-

The content encoding of the request or the response

dOSName

-

-

The destination OS

dUser1

-

The latest sign-in user of the destination

detectionType

-

-

The scan type

deviceGUID

-

-

The non-endpoint object such as a network appliance

dhost

-

The destination hostname

direction

-

-

The object transfer direction

dmac

-

-

The destination MAC address

dnsQueryType

-

-

The record type requested by the DNS protocol

dpt

-

The service destination port of the private application server

dst

-

The destination IP

dstLocation

-

-

The destination country

dstZone

-

-

The destination zone of the Palo Alto Networks firewall session

duration

-

-

The time it took the scanner to complete the scan (in milliseconds)

duser

-

The email recipient

dvc

-

-

The IP address of the Deep Discovery Inspector or Virtual Network Sensor appliance

dvchost

-

-

The network device hostname

e2eLatency

-

-

The end-to-end traffic latency time (in milliseconds)

endpointGuid

-

The device GUID

endpointHostName

-

The hostname of the device on which the event was detected

eventId

-

-

The event ID

eventName

-

-

The log type

eventSubName

-

-

The Zero Trust Secure Access - Internet Access cloud app action or the Palo Alto Networks firewall log sub-type

eventTime

-

-

The time the agent or product detected the event

failedHTTPSInspection

-

-

The HTTPS traffic inspection failure

fileHash

-

The SHA-1 of the file that violated the policy

fileHashSha256

-

The SHA-256 of the file that violated the policy

fileName

-

The name of the file that violated the policy

fileSize

-

-

The size of the file that is violating the policy

fileType

-

-

The type of file which is violating the policy

filterRiskLevel

-

-

The top level filter risk of the event

flowDirection

-

-

The network interface traffic direction

flowId

-

-

The network analysis flow ID

flowType

-

-

The type of traffic

ftpTrans

-

-

The transaction information of the FTP protocol

hostName

-

The hostname

httpLocation

-

The HTTP location header

httpReferer

-

The HTTP referer header

httpXForwardedFor

-

-

The HTTP X-Forwarded-For header

httpXForwardedForGroup

-

-

The X-Forwarded-For IP network group

httpXForwardedForHost

-

-

The X-Forwarded-For IP hostname

httpXForwardedForIp

-

The X-Forwarded-For IP used by the network appliance

instanceId

-

-

The instance ID

ipProto

-

-

The protocol number

ja3Hash

-

-

The JA3 hash

ja3sHash

-

-

The JA3S hash

logStatus

-

-

The VPC Flow Log status

mailMsgSubject

-

The email subject

malName

-

-

The name of the detected malware

-

mimeType

-

-

The MIME type or content type of the response body

msgId

-

The service provider message ID

networkInterfaceId

-

-

The network interface ID

objectId

-

-

The UUID of the Zero Trust Secure Access private access application

objectIps

-

The IP address resolved by the DNS protocol

osName

-

-

The host OS

overSsl

-

-

The SSL protocol connection

packets

-

-

The number of transmitted data packets

pktDstAddr

-

The packet level destination IP

pktDstCloudServiceName

-

-

The subset IP address range name for cloud service destination IP

pktSrcAddr

-

The packet level source IP

pktSrcCloudServiceName

-

-

The subset IP address range name for cloud service source IP

pname

-

-

The product name

policyName

-

-

The name of the triggered policy

policyTemplate

-

-

The Data Loss Prevention template name

policyTreePath

-

-

The policy tree path (endpoint only)

policyUuid

-

-

The policy UUID

principalName

-

The User Principal Name

productCode

-

-

The product which sent the log

profile

-

-

The name of the triggered Threat Protection template or Data Loss Prevention profile

-

pver

-

-

The product version

regionCode

-

-

The network interface AWS Region

reqAppVersion

-

-

The client application version number

reqDataSize

-

-

The data volume transmitted over the transport layer by the client (in bytes)

reqScannedBytes

-

-

The data volume transmitted by the client (in bytes)

request

-

The destination URL that the user is accessing

requestBase

-

The URL domain

requestClientApplication

-

-

The HTTP user agent

requestDate

-

-

The HTTP date header

requestHeaders

-

-

The list of HTTP headers without sensitive information

requestMethod

-

-

The network protocol request method

requestMimeType

-

-

The type of request content

requestSize

-

-

The request length

requests

-

The URLs of the request

resolvedUrlGroup

-

-

The IP address FQDN network group

resolvedUrlIp

-

The IP address of the FQDN

resolvedUrlPort

-

The HTTP server port

respAppVersion

-

-

The server application version number

respArchFiles

-

-

The file information extracted from files detected in response direction

respCode

-

-

The network protocol response code

respDataSize

-

-

The data volume transmitted over the transport layer by the server (in bytes)

respDate

-

-

The HTTP response date header

respFileHash

-

The SHA-1 of the file detected in the response direction

respFileHashSha256

-

The SHA-256 of the file detected in the response direction

respFileType

-

-

The file type detected in the response direction

respHeaders

-

-

The list of HTTP response headers without sensitive information

respMethod

-

-

The response method

respScannedBytes

-

-

The data volume transmitted by the server (in bytes)

responseSize

-

-

The response length

ruleName

-

-

The name of the triggered cloud access rule

ruleUuid

-

-

The risk assessment and control design that is defined by Zero Trust Secure Access risk control rules

sOSName

-

-

The source OS

sUser1

-

The latest sign-in user of the source

sender

-

-

The roaming users or Trend Micro Web Security gateway where the web traffic passed

serverGroup

-

-

The server IP network group

serverHost

-

-

The server IP hostname

serverIp

-

The server IP

serverMAC

-

-

The server MAC address

serverPort

-

The server port

serverProtocol

-

-

The version of the HTTP protocol between the Service Gateway and server/website

serverRespTime

-

-

The time the server took to respond to the request (in milliseconds)

serverTls

-

-

The TLS version between the Service Gateway and server/website

sessionEnd

-

-

The session end time (in seconds)

sessionEndReason

-

-

The reason why a session was terminated

sessionStart

-

-

The session start time (in seconds)

shost

-

The source hostname

smac

-

-

The source MAC address

src

-

The source IP

srcLocation

-

-

The source country

srcZone

-

-

The source zone of the Palo Alto Networks firewall session

sslCertCommonName

-

The certificate common name

sslCertFingerprint

-

-

The certificate fingerprint

sslCertIssuer

-

-

The issuer of the certificate

sslCertSANs

-

-

The Subject Alternative Name of the certificate

sslCertSerialNumber

-

-

The certificate serial number

sslCertValidFrom

-

-

The certificate validity start time

sslCertValidUntil

-

-

The certificate validity end time

status

-

-

The network analysis flow session status

subLocationId

-

-

The sub-location ID

subLocationType

-

-

The sub-location type

subnetId

-

-

The subnet ID

suid

-

The user name or IP address (IPv4)

suser

-

The email sender

tags

-

The detected technique ID based on the alert filter

tcpFlags

-

-

The bitmask value of the FIN/SYN/RST/SYN-ACK TCP flags

tlsJA3Fingerprint

-

-

The JA3 fingerprint

-

tlsJA3SFingerprint

-

-

The raw JA3S

tlsSelectedCipher

-

-

The selected cipher of the TLS protocol

trafficPath

-

-

The egress traffic path number

trafficType

-

-

The traffic type

userDepartment

-

-

The user department request method

userDomain

-

The Microsoft Entra ID domain or the domain of the Trend Micro Anti-Spam administrator portal user name

uuid

-

-

The unique key of the log

vpcId

-

-

The VPC ID

vsysName

-

-

The Palo Alto Networks virtual system of the session