DNS Security LEEF Fields

Table of Contents

DNS Security LEEF Fields

The following table identifies the DNS Security field names that the Log Forwarding app uses when you forward logs using the LEEF log format.

When you create a syslog forwarding profile , you can optionally create a profile token that the Log Forwarding app uses when it sends logs to the syslog server. If you configure a profile token, it appears in the log line immediately after the log type information (for example, TRAFFIC, THREAT, HIPMATCH, and so forth). The token will appear on a parameter called profileToken.

LEEF Name	Query Name	Field Type
Action	action.value	Custom
CortexDataLakeTenantId	customer_id	Custom
DNSResolverIP	dest_ip.value	Custom
DNSResponse	dns_response	Custom
DNSResponseCode	dns_response_code	Custom
DestinationUser	dst_user	Custom
ToZone	dst_zone	Custom
url	fqdn	Predefined
FromZone	from_zone	Custom
ThreatID	gtid	Custom
LogSource	log_source	Custom
LogSourceGroupID	log_source_group_id	Custom
DeviceSN	log_source_id	Custom
TimeReceived	log_time	Custom
cat	log_type.value	Predefined
PanoramaSN	panorama_serial	Custom
PlatformType	platform_type	Custom
DNSSecurityVersion	protocol	Custom
RecordType	record_type	Custom
src	source_ip.value	Predefined
UsrName	source_user	Custom
SubType	sub_type.value	Custom
ThreatName	threat_name	Custom
devTime	time_generated	Predefined
SessionDuration	total_time_elapsed	Custom
Vendor	vendor_name	Header
EventID	verdict.value	Header

DNS Security HTTPS Fields

Decryption

Strata Logging Service Docs

DNS Security LEEF Fields

Strata Logging Service Docs

DNS Security LEEF Fields

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Endpoints

Visibility & Monitoring

Best Practices

Experts Corner