GlobalProtect HTTPS Fields

Table of Contents

GlobalProtect HTTPS Fields

The following table identifies the GlobalProtect field names that the Log Forwarding app uses when you forward logs using the HTTPS log format.

HTTPS Name	Query Name
AttemptedGateways	attempted_gateways
AuthMethod	auth_method
ConfigVersion	config_version.value
ConnectionMethod	connect_method
ConnectionErrorID	connection_error.id
ConnectionError	connection_error.value
CountOfRepeats	count_of_repeats
TenantID	customer_id
DGHierarchyLevel1	dg_hier_level_1
DGHierarchyLevel2	dg_hier_level_2
DGHierarchyLevel3	dg_hier_level_3
DGHierarchyLevel4	dg_hier_level_4
EndpointDeviceName	endpoint_device_name
GlobalProtectClientVersion	endpoint_gp_version
EndpointOSType	endpoint_os_type
EndpointOSVersion	endpoint_os_version
EndpointSN	endpoint_serial_number
EventIDValue	event_id.value
Gateway	gateway
GatewayPriority	gateway_priority.value
GatewaySelectionType	gateway_selection_type
GlobalProtectGatewayLocation	gpg_location
HostID	host_id
IsDuplicateLog	is_dup_log
LogExported	is_exported
LogForwarded	is_forwarded
IsPrismaNetworks	is_prisma_branch
IsPrismaUsers	is_prisma_mobile
LogSource	log_source
LogSourceGroupID	log_source_group_id
DeviceSN	log_source_id
DeviceName	log_source_name
LogSourceTimeZoneOffset	log_source_tz_offset
TimeReceived	log_time
LogType	log_type.value
LoginDuration	login_duration
Description	opaque
PanoramaSN	panorama_serial
PlatformType	platform_type
Portal	portal
PrivateIPv4	private_ip.value
PrivateIPv6	private_ipv6.value
ProjectName	project_name
PublicIPv4	public_ip.value
PublicIPv6	public_ipv6.value
QuarantineReason	quarantine_reason
SequenceNo	sequence_no
SourceRegion	source_region
SourceUserName	source_user
SourceUserDomain	source_user_info.domain
SourceUserName	source_user_info.name
SourceUserUUID	source_user_info.uuid
SSLResponseTime	ssl_response_time
Stage	stage
EventStatus	status.value
LogSubtype	sub_type.value
TimeGenerated	time_generated
TimeGeneratedHighResolution	time_generated_high_res
TunnelType	tunnel
VendorName	vendor_name
VirtualSystem	vsys
VirtualSystemID	vsys_id
VirtualSystemName	vsys_name

GlobalProtect EMAIL Fields

GlobalProtect LEEF Fields

Strata Logging Service Docs

GlobalProtect HTTPS Fields

Strata Logging Service Docs

GlobalProtect HTTPS Fields

Activation & Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Endpoints

Visibility & Monitoring

Best Practices

Experts Corner