Decryption HTTPS Fields

Table of Contents

Decryption HTTPS Fields

The following table identifies the Decryption field names that the Log Forwarding app uses when you forward logs using the HTTPS log format.

HTTPS Name	Query Name	Field Type
Action	action.value	string
Application	app	string
ApplicationCategory	app_category	string
ApplicationSubcategory	app_sub_category	string
CertificateFlags	cert_flags	int
CertificateSerial	cert_serial	string
CertificateSize	certificate_size	int
CertificateVersion	certificate_version.value	string
ChainStatus	chain_status.value	string
ApplicationCharacteristics	characteristics_of_app	array
ClientFlagResumeSession	client_flag_resume_session.value	string
ClientTLSAuth	client_tls_auth.value	string
ClientTLSCipher	client_tls_cipher.value	string
ClientTLSEllipticCurve	client_tls_elliptic_curve.value	string
ClientTLSEncryptionAlgorithm	client_tls_enc_algorithm.value	string
ClientTLSKeyExchange	client_tls_keyxchange.value	string
ClientTLSVersion	client_tls_version.value	string
ClientToFirewall	client_to_firewall.value	string
CommonName	cn	string
CommonNameLength	cn_len	int
ConfigVersion	config_version.value	string
ContainerID	container_id	string
ApplicationContainer	container_of_app	string
RepeatCount	count_of_repeats	int
Cpadding	cpadding	int
CortexDataLakeTenantID	customer_id	string
DecryptionStatus	decryption_status.value	string
DecryptionStatusReason	decryption_status_reason.value	string
DestinationDeviceCategory	dest_device_category	string
DestinationDeviceClass	dest_device_class	string
DestinationDeviceHost	dest_device_host	string
DestinationDeviceMac	dest_device_mac	string
DestinationDeviceModel	dest_device_model	string
DestinationDeviceOS	dest_device_os	string
DestinationDeviceOSFamily	dest_device_osfamily	string
DestinationDeviceOSVersion	dest_device_osversion	string
DestinationDeviceProfile	dest_device_profile	string
DestinationDeviceVendor	dest_device_vendor	string
DestinationDynamicAddressGroup	dest_dynamic_address_group	string
DestinationEDL	dest_edl	string
DestinationAddress	dest_ip.value	ip
DestinationLocation	dest_location	string
DestinationPort	dest_port	int
DestinationUser	dest_user	string
DestinationUserInfoDomain	dest_user_info.domain	string
DestinationUserInfoName	dest_user_info.name	string
DestinationUserInfoUUID	dest_user_info.uuid	long
DestinationUUID	dest_uuid	string
DGHierarchyLevel1	dg_hier_level_1	int
DGHierarchyLevel2	dg_hier_level_2	int
DGHierarchyLevel3	dg_hier_level_3	int
DGHierarchyLevel4	dg_hier_level_4	int
Domain	domain	int
DestinationDeviceID	dst_adv_dev_id	string
EllipticCurve	elliptic_curve.value	string
ErrorIndex	error_index.value	string
ErrorMessage	error_message	string
F2CCertName	f2c_cert_name	string
Fingerprint	fingerprint	string
FirewallToClient	firewall_to_client.value	string
FromZone	from_zone	string
InboundInterface	inbound_if.value	string
InboundInterfaceDetailsPort	inbound_if_details.port	int
InboundInterfaceDetailsSlot	inbound_if_details.slot	int
InboundInterfaceDetailsType	inbound_if_details.type.value	string
InboundInterfaceDetailsUnit	inbound_if_details.unit	int
CaptivePortal	is_captive_portal	boolean
IsCertECDSA	is_cert_ECDSA	boolean
IsCertRSA	is_cert_RSA	boolean
IsCertCNTruncated	is_cert_cn_truncated	boolean
IsClienttoServer	is_client_to_server	boolean
IsContainer	is_container	boolean
IsDecryptMirror	is_decrypt_mirror	boolean
IsDecrypted	is_decrypted	boolean
IsDuplicateLog	is_dup_log	boolean
IsEncrypted	is_encrypted	boolean
LogExported	is_exported	boolean
IsForwarded	is_forwarded	boolean
IsIPV6	is_ipv6	boolean
IsIssuerCNTruncated	is_issuer_cn_truncated	boolean
IsMptcpOn	is_mptcp_on	boolean
IsNAT	is_nat	boolean
IsNonStandardDestinationPort	is_non_std_dest_port	boolean
PacketCapture	is_packet_capture	boolean
IsPhishing	is_phishing	boolean
IsPrismaNetwork	is_prisma_branch	boolean
IsPrismaUsers	is_prisma_mobile	boolean
IsProxy	is_proxy	boolean
IsReconExcluded	is_recon_excluded	boolean
IsResumeSession	is_resume_session	boolean
IsRootCNTruncated	is_root_cn_truncated	boolean
IsSaaSApplication	is_saas_app	boolean
IsServertoClient	is_server_to_client	boolean
IsSNITruncated	is_sni_truncated	boolean
IsSourceXForwarded	is_source_x_fwded	boolean
IsSystemReturn	is_sym_return	boolean
IsTransaction	is_transaction	boolean
IsTunnelInspected	is_tunnel_inspected	boolean
IsURLDenied	is_url_denied	boolean
IssuerCommonName	issuer_cn	string
IssuerNameLength	issuer_len	int
K8SClusterID	k8s_cluster_id	int
LogSetting	log_set	string
LogSource	log_source	string
LogSourceGroupID	log_source_group_id	string
DeviceSN	log_source_id	string
DeviceName	log_source_name	string
LogSourceTimeZoneOffset	log_source_tz_offset	int
TimeReceived	log_time	timestamp
LogType	log_type.value	string
NATDestination	nat_dest.value	ip
NATDestinationPort	nat_dest_port	int
NATSource	nat_source.value	ip
NATSourcePort	nat_source_port	int
TimeNotAfter	not_after	timestamp
TimeNotBefore	not_before	timestamp
OutboundInterface	outbound_if.value	string
OutboundInterfaceDetailsPort	outbound_if_details.port	int
OutboundInterfaceDetailsSlot	outbound_if_details.slot	int
OutboundInterfaceDetailsType	outbound_if_details.type.value	string
OutboundInterfaceDetailsUnit	outbound_if_details.unit	int
Padding	padding	int
Padding3	padding3	int
PanoramaSN	panorama_serial	string
PlatformType	platform_type	string
ContainerName	pod_name	string
ContainerNameSpace	pod_namespace	string
PolicyName	policy_name	string
Protocol	protocol.value	string
ProxyType	proxy_type.value	string
ApplicationRisk	risk_of_app	int
RootCommonName	root_cn	string
RootCNLength	root_cn_len	int
RootStatus	root_status.value	string
Rule	rule_matched	string
RuleUUID	rule_matched_uuid	string
SanctionedStateOfApp	sanctioned_state_of_app	boolean
SequenceNo	sequence_no	long
ServerCertSignatureAlgorithm	server_cert_sig_algorithm.value	string
ServerCertStatus	server_cert_status.value	string
ServerFlagResumeSession	server_flag_resume_session.value	string
ServerTLSCipher	server_tls_cipher.value	string
SessionID	session_id	int
ServerNameIndication	sni	string
SNILength	sni_len	int
SourceDeviceCategory	source_device_category	string
SourceDeviceClass	source_device_class	string
SourceDeviceHost	source_device_host	string
SourceDeviceMac	source_device_mac	string
SourceDeviceModel	source_device_model	string
SourceDeviceOS	source_device_os	string
SourceDeviceOSFamily	source_device_osfamily	string
SourceDeviceOSVersion	source_device_osversion	string
SourceDeviceProfile	source_device_profile	string
SourceDeviceVendor	source_device_vendor	string
SourceDynamicAddressGroup	source_dynamic_address_group	string
SourceEDL	source_edl	string
SourceAddress	source_ip.value	ip
SourceLocation	source_location	string
SourcePort	source_port	int
SourceUser	source_user	string
SourceUserInfoDomain	source_user_info.domain	string
SourceUserInfoName	source_user_info.name	string
SourceUserInfoUUID	source_user_info.uuid	long
SourceUUID	source_uuid	string
SourceDeviceID	src_adv_dev_id	string
Subtype	sub_type.value	string
ApplicationTechnology	technology_of_app	string
TimeGenerated	time_generated	timestamp
TimeGeneratedHighResolution	time_generated_high_res	timestamp_high_res
TimeReceivedManagementPlane	time_received_mp	string
TLSAuth	tls_auth.value	string
TLSEncryptionAlgorithm	tls_enc_algorithm.value	string
TLSKeyExchange	tls_keyxchange.value	string
TLSVersion	tls_version.value	string
ToZone	to_zone	string
Tpadding	tpadding	int
TSGID	tsg_id	string
Tunnel	tunnel.value	string
TunneledApplication	tunneled_app	string
VendorName	vendor_name	string
Vpadding	vpadding	int
VirtualLocation	vsys	string
VirtualSystemID	vsys_id	int
VirtualSystemName	vsys_name	string

Decryption EMAIL Fields

Decryption LEEF Fields

Strata Logging Service Docs

Decryption HTTPS Fields

Strata Logging Service Docs

Decryption HTTPS Fields

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Endpoints

Visibility & Monitoring

Best Practices

Experts Corner