Cortex Data Lake

Palo Alto Networks Strata Logging Service XSOAR Connector provides cloud-based, centralized log storage and aggregation for your organization on premise, virtual (private cloud and public cloud) firewalls, for Prisma Access, and for cloud-delivered services such as Cortex XDR.

Analytics & SIEM · Strata Logging Service by Palo Alto Networks

Details

ID	`Cortex Data Lake`
Provider	Palo Alto Networks
Category	Analytics & SIEM
From Version	5.0.0
Docker Image	`demisto/python_pancloud_v2:1.0.0.11206988`
Supported Modules	Agentix

README

Overview

Palo Alto Networks Strata Logging Service XSOAR Connector provides cloud-based, centralized log storage and aggregation for your on premise, virtual (private cloud and public cloud) firewalls, for Prisma Access, and for cloud-delivered services such as Cortex XDR.
This integration was integrated and tested with version 2 of Strata Logging Service XSOAR Connector.

Configure Strata Logging Service XSOAR Connector on Cortex XSOAR

Go to the Palo Alto Networks HUB and select and add the Cortex XSOAR app as described here.
The following screen will appear:
In the Palo Alto Networks Cortex XSOAR Playground or War Room, run the !GetLicenseID command to get the License ID.
The License ID will be used in Step 4.
(Cortex XOAR 6.x) Go to Settings > ABOUT > License and get the value in the license field Customer name.

(Cortex xSOAR 8, Administrators only ) Go to Profile > ABOUT and get the value in the license field Customer name.

The Customer name will be used in Step 4.
In the Palo Alto Networks HUB, enter the License ID and the Customer name in the screen obtained in Step 1. The License ID and Customer name were obtained in Steps 2 and 3. Click Start Authorization Process to get the Authentication Token, Registration ID, and Encryption Key - these three fields will be used in the Palo Alto Networks Cortex v2 integration instance in Step 7 below.
In Palo Alto Networks Cortex XSOAR, navigate to Settings > Integrations > Servers & Services.
Search for Strata Logging Service XSOAR Connector.
Click Add instance to create and configure a new integration instance.
- Name: A textual name for the integration instance.
- Authentication Token: Retrieved in the authentication process in Step 4.
- Registration ID: Retrieved in the authentication process in Step 4.
  - The token retrieval URL is inferred based on the tenant’s FedRAMP status unless explicitly specified in the Registration ID parameter in the format REGISTRATION_ID@URL.
- Encryption Key: Retrieved in the authentication process in Step 4.
- Fetch incidents: Whether to fetch incidents or not.
- first_fetch_timestamp: First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year).
- Fetch Table: Choose the table from which incidents will be fetched.
- Severity of events to fetch (Firewall): Select from all, Critical, High, Medium,Low, Informational, Unused.
- Subtype of events to fetch (Firewall): Select from all, attack, url, virus, spyware, vulnerability, file, scan, flood, packet, resource, data, url-content, wildfire, extpcap, wildfire-virus, http-hdr-insert, http-hdr, email-hdr, spyware-dns, spyware-wildfire-dns, spyware-wpc-dns, spyware-custom-dns, spyware-cloud-dns, spyware-raven, spyware-wildfire-raven, spyware-wpc-raven, wpc-virus,sctp
- Fetch Fields: Comma-separated fields that will be fetched with every incident, e.g., “pcap,session_id”. Enter “*” for all possible fields.
- Fetch Filter: Specify the filter that should be used to fetch incidents. Can not be used in combination with the Subtype and Severity parameters.
- Incidents fetched per query: How many incidents will be fetched per query. Caution: high number could create overload. Default is 10.
- proxy: Use system proxy settings.
- insecure: Trust any certificate (not secure).
Click Test to validate the URLs, token, and connection.

In order for the integration to work, the following URLs need to be accessible:

For authentication:
- oproxy.demisto.ninja
- api.paloaltonetworks.com
For API requests, one of the following:
- US: api.us.cdl.paloaltonetworks.com
- EU: api.nl.cdl.paloaltonetworks.com

Fetched Incidents Data

The integration can fetch incidents from the following tables:

firewall.auth
firewall.decryption
firewall.extpcap
firewall.file_data
firewall.globalprotect
firewall.hipmatch
firewall.iptag
firewall.threat
firewall.traffic
firewall.url
firewall.userid
log.system
log.config

CDL Server - API Calls Caching Mechanism

The integration implements a caching mechanism for repetitive error when requesting access token from CDL server.
When the integration reaches the limit of allowed calls, the following error will be shown:

We have found out that your recent attempts to authenticate against the CDL server have failed. Therefore we have limited the number of calls that the CDL integration performs.

The integration will re-attempt authentication if the command was called under the following cases:

First hour - once every minute.
First 48 hours - once in 10 minutes.
After that every 60 minutes.

If you wish to try authenticating again, run the ‘cdl-reset-authentication-timeout’ command and retry.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cdl-query-logs
cdl-get-critical-threat-logs
cdl-get-social-applications
cdl-search-by-file-hash
cdl-query-traffic-logs
cdl-query-threat-logs
cdl-query-url-logs
cdl-query-file-data
cdl-reset-authentication-timeout
cdl-query-gp-logs
sls-query-logs
sls-get-critical-threat-logs
sls-get-social-applications
sls-search-by-file-hash
sls-query-traffic-logs
sls-query-threat-logs
sls-query-url-logs
sls-query-file-data
sls-query-gp-logs

1. cdl-query-logs

Runs a query on the Cortex logging service.

Base Command

cdl-query-logs

Input

Argument Name	Description	Required
query	A free-text SQL query. For example, query=”SELECT * FROM `firewall.traffic` limit 10”. There are multiple tables in Loggings, for example: threat, traffic, and so on. Refer to the Cortex Logging service schema reference for the full list.	Optional
limit	The number of logs to return. Default is 10	Optional
page	Page to return.	Optional
page_size	Number of entries per page. Defaults to 50 (in case only page was provided).	Optional
transform_results	If set to false, query results are not mapped into the standard command context. Default is “true”.	Optional

Context Output

Path	Type	Description
CDL.Logging.Action	String	Identifies the action that the firewall took for the network traffic.
CDL.Logging.App	String	Application associated with the network traffic.
CDL.Logging.Protocol	String	IP protocol associated with the session.
CDL.Logging.DestinationIP	String	Original destination IP address.
CDL.Logging.RuleMatched	String	Name of the security policy rule that the network traffic matched.
CDL.Logging.CharacteristicOfApp	Number	Identifies the behavioral characteristic of the application associated with the network traffic.
CDL.Logging.LogSourceName	String	Name of the source of the log.
CDL.Logging.IsNat	number	Indicates if the firewall is performing network address translation (NAT) for the logged traffic.
CDL.Logging.NatDestinationPort	Number	Post-NAT destination port.
CDL.Logging.NatDestination	String	If destination NAT performed, the post-NAT destination IP address.
CDL.Logging.NatSource	String	If source NAT was performed, the post-NAT source IP address.
CDL.Logging.SourceIP	String	Original source IP address.
CDL.Logging.AppCategory	String	Identifies the high-level family of the application.
CDL.Logging.SourceLocation	String	Source country or internal region for private addresses.
CDL.Logging.DestinationLocation	String	Destination country or internal region for private addresses.
CDL.Logging.FileSHA256	String	The binary hash (SHA256) of the file sent for virus analysis.
CDL.Logging.FileName	String	The name of the infected file.
CDL.Logging.TimeGenerated	Date	Time when the log was generated on the firewall’s data plane.

Command Example

!cdl-query-logs query="SELECT * FROM `firewall.traffic` limit 1"

Context Example

{
  "CDL.Logging": [
    {
      "Action": "allow",
      "App": "smtp",
      "Protocol": "tcp",
      "DestinationIP": "206.116.22.23",
      "RuleMatched": "taplog",
      "CharacteristicOfApp": [
        "3",
        "4",
        "5",
        "6",
        "7",
        "8"
      ],
      "LogSourceName": "gw",
      "NatDestination": "0.0.0.0",
      "NatSource": "0.0.0.0",
      "SourceIP": "10.154.1.20",
      "AppCategory": "collaboration",
      "SourceLocation": "10.0.0.0-10.255.255.255",
      "DestinationLocation": "CA",
      "TimeGenerated": "2020-03-18T19:36:37"
    }
  ]
}

Human Readable Output

Logs traffic table

Action	App	AppCategory	CharacteristicOfApp	DestinationIP	DestinationLocation	LogSourceName	NatDestination	NatSource	Protocol	RuleMatched	SourceIP	SourceLocation	TimeGenerated
allow	smtp	collaboration	3,4,5,6,7,8	206.116.22.23	CA	gw	0.0.0.0	0.0.0.0	tcp	taplog	10.154.1.20	10.0.0.0-10.255.255.255	2020-03-18T19:36:37

2. cdl-get-critical-threat-logs

Runs a query on the Cortex logging service, according to preset queries.

Base Command

cdl-get-critical-threat-logs

Input

Argument Name	Description	Required
start_time	The query start time. For example, start_time=”2018-04-26 00:00:00”	Optional
end_time	The query end time. For example, end_time=”2018-04-26 00:00:00”	Optional
limit	The number of logs to return. Default is 10	Optional
page	Page to return.	Optional
page_size	Number of entries per page. Defaults to 50 (in case only page was provided).	Optional
time_range	First log time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)	Optional

Context Output

Path	Type	Description
CDL.Logging.Threat.SessionID	String	Identifies the firewall’s internal identifier for a specific network session.
CDL.Logging.Threat.Action	String	Identifies the action that the firewall took for the network traffic.
CDL.Logging.Threat.App	String	Application associated with the network traffic.
CDL.Logging.Threat.Nat	String	Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1.
CDL.Logging.Threat.SubcategoryOfApp	String	Identifies the application’s subcategory. The subcategory is related to the application’s category, which is identified in category_of_app.
CDL.Logging.Threat.PcapID	String	Packet capture (pcap) ID. This is used to correlate threat pcap files with extended pcaps taken as a part of the session flow. All threat logs will contain either a pcap_id of 0 (no associated pcap) , or an ID referencing the extended pcap file.
CDL.Logging.Threat.Natdst	String	If destination NAT performed, the post-NAT destination IP address. The IP address is an IPv4/IPv6 address in hex format.
CDL.Logging.Threat.Flags	String	Bit field which provides details on the session, such as whether the session use IPv6, whether the session was denied due to a URL filtering rule, and/or whether the log corresponds to a transaction within an HTTP proxy session.
CDL.Logging.Threat.Dport	String	Network traffic’s destination port. If this value is 0, then the app is using its standard port.
CDL.Logging.Threat.ThreatID	String	Numerical identifier for the threat type. All threats encountered by Palo Alto Networks firewalls are assigned a unique identifier
CDL.Logging.Threat.Natsrc	String	If source NAT was performed, the post-NAT source IP address. The IP address is an IPv4/IPv6 address in hex format.
CDL.Logging.Threat.CategoryOfApp	String	Identifies the managing application, or parent, of the application associated with this network traffic, if any.
CDL.Logging.Threat.Srcloc	String	Source country or internal region for private addresses. The internal region is a user-defined name for a specific network in the user’s enterprise.
CDL.Logging.Threat.Dstloc	String	Destination country or internal region for private addresses. The internal region is a user-defined name for a specific network in the user’s enterprise.
CDL.Logging.Threat.To	String	Networking zone to which the traffic was sent.
CDL.Logging.Threat.RiskOfApp	String	Indicates how risky the application is from a network security perspective. Values range from 1-5, where 5 is the riskiest.
CDL.Logging.Threat.Natsport	String	Post-NAT source port.
CDL.Logging.Threat.URLDenied	String	Session was denied due to a URL filtering rule.
CDL.Logging.Threat.CharacteristicOfApp	String	Identifies the behavioral characteristic of the application associated with the network traffic.
CDL.Logging.Threat.HTTPMethod	String	Only in URL filtering logs. Describes the HTTP Method used in the web request
CDL.Logging.Threat.From	String	The networking zone from which the traffic originated.
CDL.Logging.Threat.Vsys	String	Virtual system associated with the network traffic.
CDL.Logging.Threat.ReceiveTime	String	Time the log was received at the management plane.
CDL.Logging.Threat.Users	String	Srcuser or dstuser or srcip (one of).
CDL.Logging.Threat.Proto	String	IP protocol associated with the session.
CDL.Logging.Threat.Natdport	String	Post-NAT destination port.
CDL.Logging.Threat.Dst	String	Original destination IP address. The IP address is an IPv4/ IPv6 address in hex format.
CDL.Logging.Threat.Rule	String	Name of the security policy rule that the network traffic matched.
CDL.Logging.Threat.CategoryOfThreatID	String	Threat category of the detected threat.
CDL.Logging.Threat.DeviceName	String	The hostname of the firewall that logged the network traffic.
CDL.Logging.Threat.Subtype	String	Subtype of the threat log.
CDL.Logging.Threat.TimeReceived	String	Time the log was received at the management plane.
CDL.Logging.Threat.Direction	String	Indicates the direction of the attack, client-to-server or server-to-client:
CDL.Logging.Threat.Misc	String	The meaning of this field differs according to the log’s subtype: Subtype is URL, this field contains the requested URI. Subtype is File, this field contains the file name or file type. Subtype is Virus, this field contains the file name. Subtype is WildFire, this field contains the file name.
CDL.Logging.Threat.Severity	String	Severity associated with the event.
CDL.Logging.Threat.Src	String	Original source IP address. The IP address is an IPv4/IPv6 address in hex format.
CDL.Logging.Threat.TimeGenerated	String	Time the log was generated on the data plane.
CDL.Logging.Threat.Serial	String	Serial number of the firewall that generated the log.
CDL.Logging.Threat.VsysID	String	A unique identifier for a virtual system on a Palo Alto Networks firewall.
CDL.Logging.Threat.URLDomain	String	The name of the internet domain that was visited in this session.
CDL.Logging.Threat.Category	String	For the URL subtype, this identifies the URL Category. For the WildFire subtype, this identifies the verdict on the file. It is one of ‘malicious’, ‘phishing’, ‘grayware’, or ‘benign’;
CDL.Logging.Threat.Sport	String	Source port utilized by the session.
CDL.Logging.Threat.IsPhishing	Boolean	Detected enterprise credential submission by an end user.
IP.Address	String	IP address.
Domain.Name	String	The domain name, for example: “google.com”.
File.SHA256	String	The SHA256 hash of the file.
File.Name	String	The full file name (including file extension).
File.Type	String	The file type, as determined by libmagic (same as displayed in file entries).

Command Example

!cdl-get-critical-threat-logs limit="1" time_range="10 days"

Context Example

{
  "CDL.Logging.Threat": [
    {
      "SessionID": 103986,
      "Action": "reset-both",
      "App": "imap",
      "IsNat": false,
      "SubcategoryOfApp": "email",
      "PcapID": 0,
      "NatDestination": "0.0.0.0",
      "Flags": 8192,
      "DestinationPort": 143,
      "ThreatID": 30663,
      "NatSource": "0.0.0.0",
      "IsURLDenied": false,
      "Users": "10.154.10.88",
      "TimeGenerated": "2020-03-18T15:46:10",
      "IsPhishing": false,
      "AppCategory": "collaboration",
      "SourceLocation": "10.0.0.0-10.255.255.255",
      "DestinationLocation": "CH",
      "ToZone": "TapZone",
      "RiskOfApp": 4,
      "NatSourcePort": 0,
      "CharacteristicOfApp": [
        "3",
        "4",
        "5",
        "8"
      ],
      "FromZone": "TapZone",
      "Vsys": "vsys1",
      "Protocol": "tcp",
      "NatDestinationPort": 0,
      "DestinationIP": "84.74.104.27",
      "SourceIP": "10.154.10.88",
      "RuleMatched": "taplog",
      "ThreatCategory": "overflow",
      "LogSourceName": "gw",
      "Subtype": "vulnerability",
      "Direction": "server to client",
      "FileName": "iZJvnxT27.PpT",
      "VendorSeverity": "Critical",
      "LogTime": "2020-03-18T15:46:37",
      "LogSourceID": "007251000070976",
      "VsysID": 1,
      "URLDomain": null,
      "URLCategory": "any",
      "SourcePort": 14484
    }
  ]
}

Human Readable Output

Logs threat table

Action	App	AppCategory	CharacteristicOfApp	DestinationIP	DestinationLocation	DestinationPort	Direction	FileName	Flags	FromZone	IsNat	IsPhishing	IsURLDenied	LogSourceID	LogSourceName	LogTime	NatDestination	NatDestinationPort	NatSource	NatSourcePort	PcapID	Protocol	RiskOfApp	RuleMatched	SessionID	SourceIP	SourceLocation	SourcePort	SubcategoryOfApp	Subtype	ThreatCategory	ThreatID	TimeGenerated	ToZone	URLCategory	URLDomain	Users	VendorSeverity	Vsys	VsysID
reset-both	imap	collaboration	3,4,5,8	84.74.104.27	CH	143	server to client	iZJvnxT27.PpT	8192	TapZone	false	false	false	007251000070976	gw	2020-03-18T15:46:37	0.0.0.0	0	0.0.0.0	0	0	tcp	4	taplog	103986	10.154.10.88	10.0.0.0-10.255.255.255	14484	email	vulnerability	overflow	30663	2020-03-18T15:46:10	TapZone	any		10.154.10.88	Critical	vsys1	1

3. cdl-get-social-applications

Runs a query on the Cortex logging service, according to preset queries.

Base Command

cdl-get-social-applications

Input

Argument Name	Description	Required
start_time	Query start time. For example, start_time=”2018-04-26 00:00:00”	Optional
end_time	Query end time. For example, end_time=”2018-04-26 00:00:00”	Optional
limit	Amount of logs. Default is 10	Optional
page	Page to return.	Optional
page_size	Number of entries per page. Defaults to 50 (in case only page was provided).	Optional
time_range	First log time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)	Optional

Context Output

Path	Type	Description
CDL.Logging.Traffic.Action	String	Identifies the action that the firewall took for the network traffic.
CDL.Logging.Traffic.RiskOfApp	String	Indicates how risky the application is from a network security perspective.
CDL.Logging.Traffic.NatSourcePort	String	Post-NAT source port.
CDL.Logging.Traffic.SessionID	String	Identifies the firewall’s internal identifier for a specific network session.
CDL.Logging.Traffic.Packets	String	Number of total packets (transmit and receive) seen for the session.
CDL.Logging.Traffic.CharacteristicOfApp	String	Identifies the behavioral characteristic of the application associated with the network traffic.
CDL.Logging.Traffic.App	String	Application associated with the network traffic.
CDL.Logging.Traffic.Vsys	String	Virtual system associated with the network traffic.
CDL.Logging.Traffic.IsNat	String	Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1.
CDL.Logging.Traffic.LogTime	date	Time the log was received in Strata Logging Service XSOAR Connector.
CDL.Logging.Traffic.SubcategoryOfApp	String	Identifies the application’s subcategory. The subcategory is related to the application’s category,
CDL.Logging.Traffic.Protocol	String	IP protocol associated with the session.
CDL.Logging.Traffic.NatDestinationPort	String	Post-NAT destination port.
CDL.Logging.Traffic.DestinationIP	String	Original destination IP address.
CDL.Logging.Traffic.NatDestination	String	If destination NAT performed, the post-NAT destination IP address.
CDL.Logging.Traffic.RuleMatched	String	Name of the security policy rule that the network traffic matched.
CDL.Logging.Traffic.DestinationPort	String	Network traffic’s destination port. If this value is 0, then the app is using its standard port.
CDL.Logging.Traffic.TotalTimeElapsed	String	Total time taken for the network session to complete.
CDL.Logging.Traffic.LogSourceName	String	Device name of the source of the log
CDL.Logging.Traffic.Subtype	String	The log sub type.
CDL.Logging.Traffic.Users	String	Source/Destination user. If neither is available, source_ip is used.
CDL.Logging.Traffic.TunneledApp	String	Is app tunneled.
CDL.Logging.Traffic.IsPhishing	String	Indicates whether enterprise credentials were submitted by an end user.
CDL.Logging.Traffic.SessionEndReason	String	The reason a session terminated.
CDL.Logging.Traffic.NatSource	String	If source NAT was performed, the post-NAT source IP address.
CDL.Logging.Traffic.SourceIP	String	Original source IP address.
CDL.Logging.Traffic.SessionStartIP	date	Time when the session was established.
CDL.Logging.Traffic.TimeGenerated	date	Time when the log was generated on the firewall’s data plane.
CDL.Logging.Traffic.AppCategory	String	Identifies the high-level family of the application.
CDL.Logging.Traffic.SourceLocation	String	Source country or internal region for private addresses.
CDL.Logging.Traffic.DestinationLocation	String	Destination country or internal region for private addresses.
CDL.Logging.Traffic.LogSourceID	String	ID that uniquely identifies the source of the log. If the source is a firewall, this is its serial number.
CDL.Logging.Traffic.TotalBytes	String	Number of total bytes (transmit and receive).
CDL.Logging.Traffic.VsysID	String	A unique identifier for a virtual system on a Palo Alto Networks firewall.
CDL.Logging.Traffic.ToZone	String	Networking zone to which the traffic was sent.
CDL.Logging.Traffic.URLCategory	String	The URL category.
CDL.Logging.Traffic.SourcePort	String	Source port utilized by the session.
CDL.Logging.Traffic.Tunnel	String	Type of tunnel.

Command Example

!cdl-get-social-applications limit="2" time_range="10 days"

Context Example

{
  "CDL.Logging.Traffic": [
    {
      "Action": "allow",
      "RiskOfApp": 4,
      "SessionID": 108356,
      "Packets": 7,
      "CharacteristicOfApp": [
        "3",
        "4",
        "5",
        "6",
        "8"
      ],
      "App": "facebook-base",
      "Vsys": "vsys1",
      "LogTime": "2020-03-18T15:54:40",
      "SubcategoryOfApp": "social-networking",
      "Protocol": "tcp",
      "DestinationIP": "131.130.159.25",
      "NatDestination": "0.0.0.0",
      "RuleMatched": "taplog",
      "DestinationPort": 80,
      "LogSourceName": "gw",
      "Subtype": "start",
      "Users": "10.154.230.43",
      "TunneledApp": "tunneled-app",
      "SessionEndReason": "n-a",
      "NatSource": "0.0.0.0",
      "SourceIP": "10.154.230.43",
      "SessionStartIP": "2020-03-18T15:54:14",
      "TimeGenerated": "2020-03-18T15:54:16",
      "AppCategory": "collaboration",
      "SourceLocation": "10.0.0.0-10.255.255.255",
      "DestinationLocation": "AT",
      "LogSourceID": "007251000070976",
      "TotalBytes": 946,
      "VsysID": 1,
      "ToZone": "TapZone",
      "URLCategory": "social-networking",
      "SourcePort": 37252,
      "Tunnel": "N/A"
    },
    {
      "Action": "allow",
      "RiskOfApp": 4,
      "SessionID": 276377,
      "Packets": 768,
      "CharacteristicOfApp": [
        "3",
        "4",
        "5",
        "6",
        "8"
      ],
      "App": "facebook-base",
      "Vsys": "vsys1",
      "LogTime": "2020-03-16T15:54:36",
      "SubcategoryOfApp": "social-networking",
      "Protocol": "tcp",
      "DestinationIP": "213.191.250.86",
      "NatDestination": "0.0.0.0",
      "RuleMatched": "taplog",
      "DestinationPort": 80,
      "TotalTimeElapsed": 1,
      "LogSourceName": "gw",
      "Subtype": "end",
      "Users": "10.154.227.21",
      "TunneledApp": "tunneled-app",
      "SessionEndReason": "tcp-fin",
      "NatSource": "0.0.0.0",
      "SourceIP": "10.154.227.21",
      "SessionStartIP": "2020-03-16T15:53:58",
      "TimeGenerated": "2020-03-16T15:54:16",
      "AppCategory": "collaboration",
      "SourceLocation": "10.0.0.0-10.255.255.255",
      "DestinationLocation": "IE",
      "LogSourceID": "007251000070976",
      "TotalBytes": 384468,
      "VsysID": 1,
      "ToZone": "TapZone",
      "URLCategory": "social-networking",
      "SourcePort": 53174,
      "Tunnel": "N/A"
    }
  ]
}

Human Readable Output

Logs traffic table

Action	App	AppCategory	CharacteristicOfApp	DestinationIP	DestinationLocation	DestinationPort	LogSourceID	LogSourceName	LogTime	NatDestination	NatSource	Packets	Protocol	RiskOfApp	RuleMatched	SessionEndReason	SessionID	SessionStartIP	SourceIP	SourceLocation	SourcePort	SubcategoryOfApp	Subtype	TimeGenerated	ToZone	TotalBytes	Tunnel	TunneledApp	URLCategory	Users	Vsys	VsysID
allow	facebook-base	collaboration	3,4,5,6,8	131.130.159.25	AT	80	007251000070976	gw	2020-03-18T15:54:40	0.0.0.0	0.0.0.0	7	tcp	4	taplog	n-a	108356	2020-03-18T15:54:14	10.154.230.43	10.0.0.0-10.255.255.255	37252	social-networking	start	2020-03-18T15:54:16	TapZone	946	N/A	tunneled-app	social-networking	10.154.230.43	vsys1	1
allow	facebook-base	collaboration	3,4,5,6,8	213.191.250.86	IE	80	007251000070976	gw	2020-03-16T15:54:36	0.0.0.0	0.0.0.0	768	tcp	4	taplog	tcp-fin	276377	2020-03-16T15:53:58	10.154.227.21	10.0.0.0-10.255.255.255	53174	social-networking	end	2020-03-16T15:54:16	TapZone	384468	N/A	tunneled-app	social-networking	10.154.227.21	vsys1	1

4. cdl-search-by-file-hash

Runs a query on the threat table with the query ‘SELECT * FROM firewall.threat WHERE file_sha_256 = '

Base Command

cdl-search-by-file-hash

Input

Argument Name	Description	Required
start_time	The query start time. For example, start_time=”2018-04-26 00:00:00”	Optional
end_time	The query end time. For example, end_time=”2018-04-26 00:00:00”	Optional
limit	The number of logs to return. Default is 10.	Optional
page	Page to return.	Optional
page_size	Number of entries per page. Defaults to 50 (in case only page was provided).	Optional
time_range	First log time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)	Optional
SHA256	The SHA256 hash of the file for the query. For example, SHA256=”503ca1a4fc0d48b18c0336f544ba0f0abf305ae3a3f49b3c2b86b8645d6572dc” would return all logs associated with this file.	Required

Context Output

Path	Type	Description
CDL.Logging.Threat.SessionID	String	Identifies the firewall’s internal identifier for a specific network session.
CDL.Logging.Threat.Action	String	Identifies the action that the firewall took for the network traffic.
CDL.Logging.Threat.App	String	Application associated with the network traffic.
CDL.Logging.Threat.Nat	String	Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1.
CDL.Logging.Threat.SubcategoryOfApp	String	Identifies the application’s subcategory. The subcategory is related to the application’s category, which is identified in category_of_app.
CDL.Logging.Threat.PcapID	String	Packet capture (pcap) ID. This is used to correlate threat pcap files with extended pcaps taken as a part of the session flow. All threat logs will contain either a pcap_id of 0 (no associated pcap) , or an ID referencing the extended pcap file.
CDL.Logging.Threat.Natdst	String	If destination NAT performed, the post-NAT destination IP address. The IP address is an IPv4/IPv6 address in hex format.
CDL.Logging.Threat.Flags	String	Bit field which provides details on the session, such as whether the session use IPv6, whether the session was denied due to a URL filtering rule, and/or whether the log corresponds to a transaction within an HTTP proxy session.
CDL.Logging.Threat.Dport	String	Network traffic’s destination port. If this value is 0, then the app is using its standard port.
CDL.Logging.Threat.ThreatID	String	Numerical identifier for the threat type. All threats encountered by Palo Alto Networks firewalls are assigned a unique identifier
CDL.Logging.Threat.Natsrc	String	If source NAT was performed, the post-NAT source IP address. The IP address is an IPv4/IPv6 address in hex format.
CDL.Logging.Threat.CategoryOfApp	String	Identifies the managing application, or parent, of the application associated with this network traffic, if any.
CDL.Logging.Threat.Srcloc	String	Source country or internal region for private addresses. The internal region is a user-defined name for a specific network in the user’s enterprise.
CDL.Logging.Threat.Dstloc	String	Destination country or internal region for private addresses. The internal region is a user-defined name for a specific network in the user’s enterprise.
CDL.Logging.Threat.To	String	Networking zone to which the traffic was sent.
CDL.Logging.Threat.RiskOfApp	String	Indicates how risky the application is from a network security perspective. Values range from 1-5, where 5 is the riskiest.
CDL.Logging.Threat.Natsport	String	Post-NAT source port.
CDL.Logging.Threat.URLDenied	String	Session was denied due to a URL filtering rule.
CDL.Logging.Threat.CharacteristicOfApp	String	Identifies the behavioral characteristic of the application associated with the network traffic.
CDL.Logging.Threat.HTTPMethod	String	Only in URL filtering logs. Describes the HTTP Method used in the web request
CDL.Logging.Threat.From	String	The networking zone from which the traffic originated.
CDL.Logging.Threat.Vsys	String	Virtual system associated with the network traffic.
CDL.Logging.Threat.ReceiveTime	String	Time the log was received at the management plane.
CDL.Logging.Threat.Users	String	Srcuser or dstuser or srcip (one of).
CDL.Logging.Threat.Proto	String	IP protocol associated with the session.
CDL.Logging.Threat.Natdport	String	Post-NAT destination port.
CDL.Logging.Threat.Dst	String	Original destination IP address. The IP address is an IPv4/ IPv6 address in hex format.
CDL.Logging.Threat.Rule	String	Name of the security policy rule that the network traffic matched.
CDL.Logging.Threat.CategoryOfThreatID	String	Threat category of the detected threat.
CDL.Logging.Threat.DeviceName	String	The hostname of the firewall that logged the network traffic.
CDL.Logging.Threat.Subtype	String	Subtype of the threat log.
CDL.Logging.Threat.TimeReceived	String	Time the log was received at the management plane.
CDL.Logging.Threat.Direction	String	Indicates the direction of the attack, client-to-server or server-to-client:
CDL.Logging.Threat.Misc	String	The meaning of this field differs according to the log’s subtype: Subtype is URL, this field contains the requested URI. Subtype is File, this field contains the file name or file type. Subtype is Virus, this field contains the file name. Subtype is WildFire, this field contains the file name.
CDL.Logging.Threat.Severity	String	Severity associated with the event.
CDL.Logging.Threat.Src	String	Original source IP address. The IP address is an IPv4/IPv6 address in hex format.
CDL.Logging.Threat.TimeGenerated	String	Time the log was generated on the data plane.
CDL.Logging.Threat.Serial	String	Serial number of the firewall that generated the log.
CDL.Logging.Threat.VsysID	String	A unique identifier for a virtual system on a Palo Alto Networks firewall.
CDL.Logging.Threat.URLDomain	String	The name of the internet domain that was visited in this session.
CDL.Logging.Threat.Category	String	For the URL subtype, this identifies the URL Category. For the WildFire subtype, this identifies the verdict on the file. It is one of ‘malicious’, ‘phishing’, ‘grayware’, or ‘benign’;
CDL.Logging.Threat.Sport	String	Source port utilized by the session.
CDL.Logging.Threat.IsPhishing	Boolean	Detected enterprise credential submission by an end user.
IP.Address	String	IP address.
Domain.Name	String	The domain name, for example: “google.com”.
File.SHA256	String	The SHA256 hash of the file.
File.Name	String	The full file name (including file extension).
File.Type	String	The file type, as determined by libmagic (same as displayed in file entries).

Command Example

!cdl-search-by-file-hash SHA256="cbdf1f3cccd949e6e96c425b3d7ccc463b956f002f694472e4d24a12ff2cea4d" limit=1 time_range="10 days"

Context Example

{
  "CDL.Logging.Threat": [
    {
      "SessionID": 784600,
      "Action": "block",
      "App": "smtp",
      "IsNat": false,
      "SubcategoryOfApp": "email",
      "PcapID": 0,
      "NatDestination": "0.0.0.0",
      "Flags": 8192,
      "DestinationPort": 25,
      "ThreatID": 52033,
      "NatSource": "0.0.0.0",
      "IsURLDenied": false,
      "Users": "10.154.246.167",
      "TimeGenerated": "2020-03-25T15:42:08",
      "IsPhishing": false,
      "AppCategory": "collaboration",
      "SourceLocation": "10.0.0.0-10.255.255.255",
      "DestinationLocation": "US",
      "ToZone": "TapZone",
      "RiskOfApp": 5,
      "NatSourcePort": 0,
      "CharacteristicOfApp": [
        "3",
        "4",
        "5",
        "6",
        "7",
        "8"
      ],
      "FromZone": "TapZone",
      "Vsys": "vsys1",
      "Protocol": "tcp",
      "NatDestinationPort": 0,
      "DestinationIP": "67.53.137.201",
      "SourceIP": "10.154.246.167",
      "RuleMatched": "taplog",
      "ThreatCategory": "",
      "LogSourceName": "gw",
      "Subtype": "wildfire",
      "Direction": "client to server",
      "FileName": "o93yr.ECr",
      "VendorSeverity": "Informational",
      "LogTime": "2020-03-25T15:42:13",
      "LogSourceID": "007251000070976",
      "VsysID": 1,
      "URLDomain": null,
      "URLCategory": "",
      "SourcePort": 51819,
      "FileSHA256": "cbdf1f3cccd949e6e96c425b3d7ccc463b956f002f694472e4d24a12ff2cea4d"
    }
  ]
}

Human Readable Output

Logs threat table

Action	App	AppCategory	CharacteristicOfApp	DestinationIP	DestinationLocation	DestinationPort	Direction	FileName	FileSHA256	Flags	FromZone	IsNat	IsPhishing	IsURLDenied	LogSourceID	LogSourceName	LogTime	NatDestination	NatDestinationPort	NatSource	NatSourcePort	PcapID	Protocol	RiskOfApp	RuleMatched	SessionID	SourceIP	SourceLocation	SourcePort	SubcategoryOfApp	Subtype	ThreatCategory	ThreatID	TimeGenerated	ToZone	URLCategory	URLDomain	Users	VendorSeverity	Vsys	VsysID
block	smtp	collaboration	3,4,5,6,7,8	67.53.137.201	US	25	client to server	o93yr.ECr	cbdf1f3cccd949e6e96c425b3d7ccc463b956f002f694472e4d24a12ff2cea4d	8192	TapZone	false	false	false	007251000070976	gw	2020-03-25T15:42:13	0.0.0.0	0	0.0.0.0	0	0	tcp	5	taplog	784600	10.154.246.167	10.0.0.0-10.255.255.255	51819	email	wildfire		52033	2020-03-25T15:42:08	TapZone			10.154.246.167	Informational	vsys1	1

5. cdl-query-traffic-logs

Searches the Cortex firewall.traffic table. Traffic logs contain entries for the end of each network session

Base Command

cdl-query-traffic-logs

Input

Argument Name	Description	Required
source_ip	A source IP address or an array of source IPs addresses for which to search, for example 1.1.1.1,2.2.2.2.	Optional
rule	A rule name or an array of rule names to search.	Optional
from_zone	A source zone name or an array of source zone names to search.	Optional
to_zone	A destination zone name or an array of zone names to search.	Optional
source_port	Source port utilized by the session. Can be port number or an array of destination port numbers to search. For example ‘443’ or ‘443,445’	Optional
action	An action name or an array of action names to search.	Optional
query	A free-text query for which to search. This forms the WHERE part of the query, for example, !cdl-query-traffic-logs query=”source_ip.value LIKE ‘192.168.1.*’ AND dest_ip.value=’8.8.8.8’ And dest_port=1234”	Optional
fields	The fields that are selected in the query. Selection can be “all” (same as *) or a comma separated list of specific fields in the table.	Optional
start_time	The query start time. For example, start_time=”2018-04-26 00:00:00”	Optional
end_time	The query end time. For example, end_time=”2018-04-26 00:00:00”.	Optional
time_range	First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)	Optional
limit	The number of logs to return. Default is 5.	Optional
page	Page to return.	Optional
page_size	Number of entries per page. Defaults to 50 (in case only page was provided).	Optional
dest_ip	A destination IP address or an array of destination IPs addresses for which to search, for example 1.1.1.1,2.2.2.2.	Optional
dest_port	Destination port utilized by the session. Can be port number or an array of destination port numbers to search. For example ‘443’ or ‘443,445’	Optional
ip	IP address. Enter an IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2.	Optional
port	Port utilized by the session. Enter a port or array of ports to search.	Optional

Context Output

Path	Type	Description
CDL.Logging.Traffic.Action	String	Identifies the action that the firewall took for the network traffic.
CDL.Logging.Traffic.RiskOfApp	String	Indicates how risky the application is from a network security perspective.
CDL.Logging.Traffic.NatSourcePort	String	Post-NAT source port.
CDL.Logging.Traffic.SessionID	String	Identifies the firewall’s internal identifier for a specific network session.
CDL.Logging.Traffic.Packets	String	Number of total packets (transmit and receive) seen for the session.
CDL.Logging.Traffic.CharacteristicOfApp	String	Identifies the behavioral characteristic of the application associated with the network traffic.
CDL.Logging.Traffic.App	String	Application associated with the network traffic.
CDL.Logging.Traffic.Vsys	String	Virtual system associated with the network traffic.
CDL.Logging.Traffic.IsNat	String	Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1.
CDL.Logging.Traffic.LogTime	date	Time the log was received in Strata Logging Service XSOAR Connector.
CDL.Logging.Traffic.SubcategoryOfApp	String	Identifies the application’s subcategory. The subcategory is related to the application’s category,
CDL.Logging.Traffic.Protocol	String	IP protocol associated with the session.
CDL.Logging.Traffic.NatDestinationPort	String	Post-NAT destination port.
CDL.Logging.Traffic.DestinationIP	String	Original destination IP address.
CDL.Logging.Traffic.NatDestination	String	If destination NAT performed, the post-NAT destination IP address.
CDL.Logging.Traffic.RuleMatched	String	Name of the security policy rule that the network traffic matched.
CDL.Logging.Traffic.DestinationPort	String	Network traffic’s destination port. If this value is 0, then the app is using its standard port.
CDL.Logging.Traffic.TotalTimeElapsed	String	Total time taken for the network session to complete.
CDL.Logging.Traffic.LogSourceName	String	Device name of the source of the log
CDL.Logging.Traffic.Subtype	String	The log sub type.
CDL.Logging.Traffic.Users	String	Source/Destination user. If neither is available, source_ip is used.
CDL.Logging.Traffic.TunneledApp	String	Is app tunneled.
CDL.Logging.Traffic.IsPhishing	String	Indicates whether enterprise credentials were submitted by an end user.
CDL.Logging.Traffic.SessionEndReason	String	The reason a session terminated.
CDL.Logging.Traffic.NatSource	String	If source NAT was performed, the post-NAT source IP address.
CDL.Logging.Traffic.SourceIP	String	Original source IP address.
CDL.Logging.Traffic.SessionStartIP	date	Time when the session was established.
CDL.Logging.Traffic.TimeGenerated	date	Time when the log was generated on the firewall’s data plane.
CDL.Logging.Traffic.AppCategory	String	Identifies the high-level family of the application.
CDL.Logging.Traffic.SourceLocation	String	Source country or internal region for private addresses.
CDL.Logging.Traffic.DestinationLocation	String	Destination country or internal region for private addresses.
CDL.Logging.Traffic.LogSourceID	String	ID that uniquely identifies the source of the log. If the source is a firewall, this is its serial number.
CDL.Logging.Traffic.TotalBytes	String	Number of total bytes (transmit and receive).
CDL.Logging.Traffic.VsysID	String	A unique identifier for a virtual system on a Palo Alto Networks firewall.
CDL.Logging.Traffic.ToZone	String	Networking zone to which the traffic was sent.
CDL.Logging.Traffic.URLCategory	String	The URL category.
CDL.Logging.Traffic.SourcePort	String	Source port utilized by the session.
CDL.Logging.Traffic.Tunnel	String	Type of tunnel.
CDL.Logging.Traffic.SourceDeviceHost	String	Hostname of the device from which the session originated.
CDL.Logging.Traffic.DestDeviceHost	String	Hostname of the device session destination.

Command Example

!cdl-query-traffic-logs action="allow" fields="vendor_name,log_source,rule_matched,dest_location,log_time" time_range="10 days" limit="5"

!cdl-query-traffic-logs query="log_source_id = '{firewall_target}'" fields=all limit=5 start_time="2018-07-13 00:00:00"

Context Example

{
    "CDL.Logging.Traffic": [
        {
            "RuleMatched": "taplog", 
            "ID": "N2eE+oI3d+esVqaqtVGJv95p4VpTYIihtY50eFi8jgo=", 
            "DestinationLocation": "TH", 
            "LogTime": "2020-03-21T16:50:18Z"
        }, 
        {
            "RuleMatched": "taplog", 
            "ID": "+zZj7TRjBYRXuSdYrbKAYSjoQDyw4vtNwMhvjlbKGrc=", 
            "DestinationLocation": "US", 
            "LogTime": "2020-03-21T16:50:18Z"
        }, 
        {
            "RuleMatched": "taplog", 
            "ID": "PetZR587UGE/wOkxgS2b+zF364WTmJ29VnV2gihfJZM=", 
            "DestinationLocation": "US", 
            "LogTime": "2020-03-21T16:50:33Z"
        }, 
        {
            "RuleMatched": "taplog", 
            "ID": "t6dTRzTObu15RCxw6Nk7SPFXe83uxr06yPMC5Px1p8c=", 
            "DestinationLocation": "RO", 
            "LogTime": "2020-03-21T16:50:18Z"
        }, 
        {
            "RuleMatched": "taplog", 
            "ID": "X4tXn5Ub82q/DDaCyqcZfSboshpWOu+5xvOSf7ydtrY=", 
            "DestinationLocation": "CL", 
            "LogTime": "2020-03-21T16:50:18Z"
        }
    ]
}

Human Readable Output

dest_location	log_source	log_time	rule_matched	vendor_name
TH	firewall	1584809418000000	taplog	Palo Alto Networks
US	firewall	1584809418000000	taplog	Palo Alto Networks
US	firewall	1584809433000000	taplog	Palo Alto Networks
RO	firewall	1584809418000000	taplog	Palo Alto Networks
CL	firewall	1584809418000000	taplog	Palo Alto Networks

6. cdl-query-threat-logs

Searches the Cortex panw.threat table, which is the threat logs table for PAN-OS/Panorama.

Base Command

cdl-query-threat-logs

Input

Argument Name	Description	Required
source_ip	Original source IP address. Enter an IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2.	Optional
dest_ip	Original destination IP address. Enter an IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2.	Optional
rule_matched	Name of the security policy rule that the network traffic matched. Enter a rule name or array of rule names to search.	Optional
from_zone	The networking zone from which the traffic originated. Enter zone or array of zones to search.	Optional
to_zone	Networking zone to which the traffic was sent. Enter zone or array of zones to search.	Optional
source_port	Source port utilized by the session. Enter a port or array of ports to search.	Optional
dest_port	Network traffic’s destination port. Enter a port or array of ports to search.	Optional
action	The action that the firewall took for the network traffic. Enter an action or array of actions to search.	Optional
file_sha_256	The binary hash (SHA256) of the file. Enter a SHA256 hash or array of SHA256 hashes to search.	Optional
file_name	The name of the file that is blocked. Enter a file name or array of file names to search.	Optional
query	Free input query to search. This is the WHERE part of the query. so an example will be !cdl-query-traffic-logs query=”source_ip.value LIKE ‘192.168.1.*’ AND dst = ‘192.168.1.12’”	Optional
fields	The fields that are selected in the query. Selection can be “all” (same as *) or listing of specific fields in the table. List of fields can be found after viewing all the outputted fields with all.	Optional
start_time	The query start time. For example, start_time=”2018-04-26 00:00:00”	Optional
end_time	The query end time. For example, end_time=”2018-04-26 00:00:00”	Optional
time_range	First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)	Optional
limit	The number of logs to return. Default is 5.	Optional
page	Page to return.	Optional
page_size	Number of entries per page. Defaults to 50 (in case only page was provided).	Optional
ip	IP address. Enter an IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2.	Optional
port	Port utilized by the session. Enter a port or array of ports to search.	Optional

Context Output

Path	Type	Description
CDL.Logging.Threat.SessionID	String	Identifies the firewall’s internal identifier for a specific network session.
CDL.Logging.Threat.Action	String	Identifies the action that the firewall took for the network traffic.
CDL.Logging.Threat.App	String	Application associated with the network traffic.
CDL.Logging.Threat.Nat	String	Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1.
CDL.Logging.Threat.SubcategoryOfApp	String	Identifies the application’s subcategory. The subcategory is related to the application’s category, which is identified in category_of_app.
CDL.Logging.Threat.PcapID	String	Packet capture (pcap) ID. This is used to correlate threat pcap files with extended pcaps taken as a part of the session flow. All threat logs will contain either a pcap_id of 0 (no associated pcap) , or an ID referencing the extended pcap file.
CDL.Logging.Threat.Natdst	String	If destination NAT performed, the post-NAT destination IP address. The IP address is an IPv4/IPv6 address in hex format.
CDL.Logging.Threat.Flags	String	Bit field which provides details on the session, such as whether the session use IPv6, whether the session was denied due to a URL filtering rule, and/or whether the log corresponds to a transaction within an HTTP proxy session.
CDL.Logging.Threat.Dport	String	Network traffic’s destination port. If this value is 0, then the app is using its standard port.
CDL.Logging.Threat.ThreatID	String	Numerical identifier for the threat type. All threats encountered by Palo Alto Networks firewalls are assigned a unique identifier
CDL.Logging.Threat.Natsrc	String	If source NAT was performed, the post-NAT source IP address. The IP address is an IPv4/IPv6 address in hex format.
CDL.Logging.Threat.CategoryOfApp	String	Identifies the managing application, or parent, of the application associated with this network traffic, if any.
CDL.Logging.Threat.Srcloc	String	Source country or internal region for private addresses. The internal region is a user-defined name for a specific network in the user’s enterprise.
CDL.Logging.Threat.Dstloc	String	Destination country or internal region for private addresses. The internal region is a user-defined name for a specific network in the user’s enterprise.
CDL.Logging.Threat.To	String	Networking zone to which the traffic was sent.
CDL.Logging.Threat.RiskOfApp	String	Indicates how risky the application is from a network security perspective. Values range from 1-5, where 5 is the riskiest.
CDL.Logging.Threat.Natsport	String	Post-NAT source port.
CDL.Logging.Threat.URLDenied	String	Session was denied due to a URL filtering rule.
CDL.Logging.Threat.CharacteristicOfApp	String	Identifies the behavioral characteristic of the application associated with the network traffic.
CDL.Logging.Threat.HTTPMethod	String	Only in URL filtering logs. Describes the HTTP Method used in the web request
CDL.Logging.Threat.From	String	The networking zone from which the traffic originated.
CDL.Logging.Threat.Vsys	String	Virtual system associated with the network traffic.
CDL.Logging.Threat.ReceiveTime	String	Time the log was received at the management plane.
CDL.Logging.Threat.Users	String	Srcuser or dstuser or srcip (one of).
CDL.Logging.Threat.Proto	String	IP protocol associated with the session.
CDL.Logging.Threat.Natdport	String	Post-NAT destination port.
CDL.Logging.Threat.Dst	String	Original destination IP address. The IP address is an IPv4/ IPv6 address in hex format.
CDL.Logging.Threat.Rule	String	Name of the security policy rule that the network traffic matched.
CDL.Logging.Threat.CategoryOfThreatID	String	Threat category of the detected threat.
CDL.Logging.Threat.DeviceName	String	The hostname of the firewall that logged the network traffic.
CDL.Logging.Threat.Subtype	String	Subtype of the threat log.
CDL.Logging.Threat.TimeReceived	String	Time the log was received at the management plane.
CDL.Logging.Threat.Direction	String	Indicates the direction of the attack, client-to-server or server-to-client:
CDL.Logging.Threat.Misc	String	The meaning of this field differs according to the log’s subtype: Subtype is URL, this field contains the requested URI. Subtype is File, this field contains the file name or file type. Subtype is Virus, this field contains the file name. Subtype is WildFire, this field contains the file name.
CDL.Logging.Threat.Severity	String	Severity associated with the event.
CDL.Logging.Threat.Src	String	Original source IP address. The IP address is an IPv4/IPv6 address in hex format.
CDL.Logging.Threat.TimeGenerated	String	Time the log was generated on the data plane.
CDL.Logging.Threat.Serial	String	Serial number of the firewall that generated the log.
CDL.Logging.Threat.VsysID	String	A unique identifier for a virtual system on a Palo Alto Networks firewall.
CDL.Logging.Threat.URLDomain	String	The name of the internet domain that was visited in this session.
CDL.Logging.Threat.Category	String	For the URL subtype, this identifies the URL Category. For the WildFire subtype, this identifies the verdict on the file. It is one of ‘malicious’, ‘phishing’, ‘grayware’, or ‘benign’;
CDL.Logging.Threat.Sport	String	Source port utilized by the session.
CDL.Logging.Threat.IsPhishing	Boolean	Detected enterprise credential submission by an end user.
CDL.Logging.Threat.SourceDeviceHost	String	Hostname of the device from which the session originated.
CDL.Logging.Threat.DestDeviceHost	String	Hostname of the device session destination.
IP.Address	String	IP address.
Domain.Name	String	The domain name, for example: “google.com”.
File.SHA256	String	The SHA256 hash of the file.
File.Name	String	The full file name (including file extension).
File.Type	String	The file type, as determined by libmagic (same as displayed in file entries).

Command Examples

!cdl-query-threat-logs query="is_packet_capture = true AND severity = \"Critical\"" fields=pcap limit=10
!cdl-query-threat-logs action="allow" fields="vendor_name,log_source,rule_matched,dest_location,log_time" time_range="10 days" limit="1"

Context Example

{
    "CDL.Logging.Threat": [
        {
            "NatDestinationPort": null, 
            "VsysID": null, 
            "RuleMatched": "taplog", 
            "FromZone": null, 
            "URLDomain": null, 
            "DestinationLocation": "AE", 
            "IsPhishing": null, 
            "URLCategory": "", 
            "NatSource": "", 
            "NatSourcePort": null, 
            "IsURLDenied": null, 
            "PcapID": null, 
            "Direction": "", 
            "Users": null, 
            "ThreatID": null, 
            "SessionID": null, 
            "CharacteristicOfApp": null, 
            "VendorSeverity": "", 
            "LogTime": "2020-02-22T16:50:23Z", 
            "IsNat": null, 
            "SubcategoryOfApp": null, 
            "SourceIP": "", 
            "RiskOfApp": null, 
            "DestinationIP": "", 
            "Vsys": null, 
            "TimeGenerated": null, 
            "Subtype": "", 
            "Flags": null, 
            "ToZone": null, 
            "Action": "", 
            "AppCategory": null, 
            "ThreatCategory": null, 
            "Protocol": "", 
            "LogSourceName": null, 
            "App": null, 
            "Misc": null, 
            "DestinationPort": null, 
            "SourcePort": null, 
            "NatDestination": "", 
            "SourceLocation": null, 
            "LogSourceID": null
        }
    ]
}

Human Readable Output

Logs threat table

dest_location	log_source	log_time	rule_matched	vendor_name
AE	firewall	1582390223000000	taplog	Palo Alto Networks

7. cdl-query-url-logs

Searches the URL table

Base Command

cdl-query-url-logs

Input

Argument Name	Description	Required
source_ip	Original source IP address. Enter an IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2.	Optional
dest_ip	Original destination IP address. Enter an IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2.	Optional
rule_matched	Name of the security policy rule that the network traffic matched. Enter a rule name or array of rule names to search.	Optional
from_zone	The networking zone from which the traffic originated. Enter zone or array of zones to search.	Optional
to_zone	Networking zone to which the traffic was sent. Enter zone or array of zones to search.	Optional
source_port	Source port utilized by the session. Enter a port or array of ports to search.	Optional
dest_port	Network traffic’s destination port. Enter a port or array of ports to search.	Optional
action	The action that the firewall took for the network traffic. Enter an action or array of actions to search.	Optional
query	Free input query to search. This is the WHERE part of the query. so an example will be !cdl-query-url-logs query=”source_ip.value LIKE ‘192.168.1.*’ AND dest_ip.value = ‘192.168.1.12’”	Optional
fields	The fields that are selected in the query. Selection can be “all” (same as *) or listing of specific fields in the table. List of fields can be found after viewing all the outputted fields with all.	Optional
start_time	The query start time. For example, start_time=”2018-04-26 00:00:00”	Optional
end_time	The query end time. For example, end_time=”2018-04-26 00:00:00”	Optional
time_range	First log time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)	Optional
limit	The number of logs to return. Default is 5.	Optional
page	Page to return.	Optional
page_size	Number of entries per page. Defaults to 50 (in case only page was provided).	Optional
ip	IP address. Enter an IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2.	Optional
port	Port utilized by the session. Enter a port or array of ports to search.	Optional
url	This argument allows to perform a LIKE search of the specified values on the Url and Uri fields An example value will be paloaltonetworks.com,demisto which will provide results like <https://apps.paloaltonetworks.com> and <https://demisto.com>	Optional

Context Output

Path	Type	Description
CDL.Logging.URL.SessionID	String	Identifies the firewall’s internal identifier for a specific network session.
CDL.Logging.URL.Action	String	Identifies the action that the firewall took for the network traffic.
CDL.Logging.URL.App	String	Application associated with the network traffic.
CDL.Logging.URL.PcapID	String	Packet capture (pcap) ID. This is used to correlate threat pcap files with extended pcaps taken as a part of the session flow. All threat logs will contain either a pcap_id of 0 (no associated pcap) , or an ID referencing the extended pcap file.
CDL.Logging.URL.DestinationPort	String	Network traffic’s destination port. If this value is 0, then the app is using its standard port.
CDL.Logging.URL.AppCategory	String	Identifies the high-level family of the application.
CDL.Logging.URL.AppSubCategory	String	Identifies the application’s subcategory. The subcategory is related to the application’s category, which is identified in category_of_app.
CDL.Logging.URL.SourceLocation	String	Source country or internal region for private addresses.
CDL.Logging.URL.DestinationLocation	String	Destination country or internal region for private addresses.
CDL.Logging.URL.ToZone	String	Networking zone to which the traffic was sent.
CDL.Logging.URL.FromZone	String	The networking zone from which the traffic originated.
CDL.Logging.URL.Protocol	String	IP protocol associated with the session.
CDL.Logging.URL.DestinationIP	String	Original destination IP address.
CDL.Logging.URL.SourceIP	String	Original source IP address.
CDL.Logging.URL.RuleMatched	String	Unique identifier for the security policy rule that the network traffic matched.
CDL.Logging.URL.ThreatCategory	String	Threat category of the detected threat.
CDL.Logging.URL.ThreatName	String	Threat name of the detected threat.
CDL.Logging.URL.Subtype	String	Identifies the log subtype.
CDL.Logging.URL.LogTime	String	Time the log was received in Strata Logging Service XSOAR Connector.
CDL.Logging.URL.LogSourceName	String	Name that uniquely identifies the source of the log.
CDL.Logging.URL.Denied	Boolean	Indicates whether the session was denied due to a URL filtering rule.
CDL.Logging.URL.Category	String	The URL category.
CDL.Logging.URL.SourcePort	Number	Source port utilized by the session.
CDL.Logging.URL.Url	String	The name of the internet domain that was visited in this session.
CDL.Logging.URL.Uri	String	The URI address
CDL.Logging.URL.ContentType	String	Content type of the HTTP response data.
CDL.Logging.URL.HTTPMethod	String	The HTTP Method used
in the web request
CDL.Logging.URL.Severity	String	Severity associated with the event.
CDL.Logging.URL.UserAgent	String	The web browser that the user
used to access the URL.
CDL.Logging.URL.RefererProtocol	Number	The protocol used in the HTTP REFERER header field.
CDL.Logging.URL.RefererPort	Number	The port used in the HTTP REFERER header field.
CDL.Logging.URL.RefererFQDN	String	The full domain name used in the HTTP REFERER
header field.
CDL.Logging.URL.RefererURL	String	The url used in the HTTP REFERER header field.
CDL.Logging.URL.SrcUser	String	The username that initiated the network traffic.
CDL.Logging.URL.SrcUserInfo	String	The initiated user info.
CDL.Logging.URL.DstUser	String	The username to which the network traffic was destined.
CDL.Logging.URL.DstUserInfo	String	The destination user info.
CDL.Logging.URL.TechnologyOfApp	String	The networking technology used by the identified application.
CDL.Logging.URL.SourceDeviceHost	String	Hostname of the device from which the session originated.
CDL.Logging.URL.DestDeviceHost	String	Hostname of the device session destination.

Command Example

!cdl-query-url-logs action="alert" ip=1.1.1.1 limit="1"

Context Example

{
    "CDL": {
        "Logging": {
            "URL": [
                {
                    "Action": "alert",
                    "App": "web-browsing",
                    "AppCategory": "general-internet",
                    "AppSubcategory": "internet-utility",
                    "Category": "unknown",
                    "ContentType": null,
                    "Denied": false,
                    "DestinationIP": "1.1.1.1",
                    "DestinationLocation": "TH",
                    "DestinationPort": 80,
                    "DstUser": null,
                    "DstUserInfo": null,
                    "FromZone": "TapZone",
                    "HTTPMethod": "get",
                    "LogSourceName": "gw",
                    "LogTime": "2019-11-04T02:00:19",
                    "PcapID": 0,
                    "Protocol": "tcp",
                    "RefererFQDN": null,
                    "RefererPort": null,
                    "RefererProtocol": null,
                    "RefererURL": null,
                    "RuleMatched": "taplog",
                    "SessionID": 123456,
                    "Severity": "Informational",
                    "SourceIP": "2.2.2.2",
                    "SourceLocation": "2.0.0.0-10.255.255.255",
                    "SourcePort": 123,
                    "SrcUser": null,
                    "SrcUserInfo": null,
                    "Subtype": "url",
                    "TechnologyOfApp": "browser-based",
                    "ThreatCategory": null,
                    "ThreatName": null,
                    "ToZone": "TapZone",
                    "URI": "eujea0rudykqgbvianr5lqfgrykbufbamkeyizdw1npk96zax5c4h8sbxs1kgqx31nwp5jsfsgif8iorqvjocpnyff8f7ob0ukbz5rsr8swlxtrv9a0hdppm8rkjrh8hopy3dhb0lxlah9myxx70qxwtipjeufremdmg8m3vyxgxu/",
                    "URL": "kcaxusaqu8wmjfs47qnnxw7wikiwteujea0rudykqgbvianr5lqfgrykbufbamkeyizdw1npk96zax5c4h8sbxs1kgqx31nwp5jsfsgif8iorqvjocpnyff8f7ob0ukbz5rsr8swlxtrv9a0hdppm8rkjrh8hopy3dhb0lxlah9myxx70qxwtipjeufremdmg8m3vyxgxu",
                    "UserAgent": null
                }
            ]
        }
    }
}

Human Readable Output

Logs url table

Action Application Destination Address RuleMatched Source Address TimeGenerated

alert web-browsing 1.1.1.1 taplog 2.2.2.2 2019-11-04T02:00:04

Action	Application	Destination Address	RuleMatched	Source Address	TimeGenerated
alert	web-browsing	1.1.1.1	taplog	2.2.2.2	2019-11-04T02:00:04

8. cdl-query-file-data

Searches the Cortex firewall.file_data table.

Base Command

cdl-query-file-data

Input

Argument Name	Description	Required
action	Identifies the action that the firewall took for the network traffic. Possible values are: unknown, n-a, aged-out, decoder, tcp-reuse, resources-unavailable, tcp-fin, tcp-rst-from-server, tcp-rst-from-client, policy-deny, threat, decrypt-error, decrypt-unsupport-param, decrypt-cert-validation, request-timeout, shutdown-from-endpoint, abort-from-endpoint, split-tunnel.	Optional
app	Application associated with the network traffic.	Optional
app_category	Identifies the high-level family of the application.	Optional
dest_device_host	Hostname of the device to which the session was directed.	Optional
dest_ip	Original destination IP address.	Optional
dest_edl	The name of the external dynamic list that contains the destination IP address of the traffic.	Optional
dest_dynamic_address_group	The dynamic address group that Device-ID identifies as the destination for the traffic.	Optional
dest_location	Destination country or internal region for private addresses.	Optional
dest_port	Network traffic’s destination port. If this value is 0, then the app is using its standard port.	Optional
dest_user	The username to which the network traffic was destined.	Optional
file_name	The name of the file that is blocked.	Optional
file_sha_256	The binary hash (SHA256) of the file.	Optional
file_type	Palo Alto Networks textual identifier for the threat.	Optional
from_zone	The networking zone from which the traffic originated.	Optional
is_server_to_client	Indicates if direction of traffic is from server to client.	Optional
is_url_denied	Indicates whether the session was denied due to a URL filtering rule.	Optional
log_type	Identifies the log type.	Optional
nat_dest	If destination NAT performed, the post-NAT destination IP address.	Optional
nat_dest_port	Post-NAT destination port.	Optional
nat_source	If source NAT was performed, the post-NAT source IP address.	Optional
nat_source_port	Post-NAT source port.	Optional
rule_matched	Name of the security policy rule that the network traffic matched.	Optional
rule_matched_uuid	Unique identifier for the security policy rule that the network traffic matched.	Optional
severity	Severity as defined by the platform.	Optional
source_device_host	Hostname of the device from which the session originated.	Optional
source_ip	Original source IP address.	Optional
source_edl	The name of the external dynamic list that contains the source IP address of the traffic.	Optional
source_dynamic_address_group	The dynamic address group that Device-ID identifies as the source of the traffic.	Optional
source_location	Source country or internal region for private addresses.	Optional
source_port	Source port utilized by the session.	Optional
source_user	The username that initiated the network traffic.	Optional
sub_type	Identifies the log subtype.	Optional
url_category	The URL category.	Optional
url_domain	The name of the internet domain that was visited in this session.	Optional
start_time	The query start time. For example, start_time=”2018-04-26 00:00:00”.	Optional
end_time	The query end time. For example, end_time=”2018-04-26 00:00:00”.	Optional
time_range	First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).	Optional
limit	Limit the results to return. The default is 5.	Optional
page	Page to return.	Optional
page_size	Number of entries per page. Defaults to 50 (in case only page was provided).	Optional

Context Output

Path	Type	Description
CDL.Logging.File.App	String	Application associated with the network traffic.
CDL.Logging.File.TimeGenerated	Date	Time when the log was generated on the firewall’s data plane.
CDL.Logging.File.SourceIP	String	Original source IP address.
CDL.Logging.File.DestinationLocation	String	Destination country or internal region for private addresses.
CDL.Logging.File.FileSHA256	String	The binary hash (SHA256) of the file.
CDL.Logging.File.FileName	String	The name of the file that is blocked.
CDL.Logging.File.RuleMatched	String	Name of the security policy rule that the network traffic matched.
CDL.Logging.File.LogSourceName	String	Name of the source of the log - hostname of the firewall that logged the network traffic.
CDL.Logging.File.NatDestination	String	If destination NAT performed, the post-NAT destination IP address.
CDL.Logging.File.NatDestinationPort	Number	Post-NAT destination port.
CDL.Logging.File.CharacteristicOfApp	String	Identifies the behavioral characteristic of the application associated with the network traffic.
CDL.Logging.File.SourceLocation	String	Source country or internal region for private addresses.
CDL.Logging.File.DestinationIP	String	Original destination IP address.
CDL.Logging.File.Action	String	Identifies the action that the firewall took for the network traffic.
CDL.Logging.File.IsNat	Boolean	Indicates if the firewall is performing network address translation (NAT) for the logged traffic.
CDL.Logging.File.Protocol	String	IP protocol associated with the session.
CDL.Logging.File.NatSource	String	If source NAT was performed, the post-NAT source IP address.
CDL.Logging.File.AppCategory	String	Identifies the high-level family of the application.
CDL.Logging.File.IsUrlDenied	Boolean	Indicates whether the session was denied due to a URL filtering rule.
CDL.Logging.File.IsTunnelInspected	Boolean	Indicates whether the payload for the outer tunnel was inspected.
CDL.Logging.File.SequenceNo	Number	The log entry identifier, which is incremented sequentially.
CDL.Logging.File.IsDecryptMirror	Boolean	Indicates whether decrypted traffic was sent out in clear text through a mirror port.
CDL.Logging.File.IsNonStdDestPort	Boolean	Indicates if the destination port is non-standard.
CDL.Logging.File.RuleMatchedUuid	String	Unique identifier for the security policy rule that the network traffic matched.
CDL.Logging.File.IsProxy	Boolean	Indicates whether the SSL session is decrypted (SSL Proxy).
CDL.Logging.File.VendorSeverity	String	Severity associated with the event.
CDL.Logging.File.IsPhishing	Boolean	Indicates whether enterprise credentials were submitted by an end user.
CDL.Logging.File.ToZone	String	Networking zone to which the traffic was sent.
CDL.Logging.File.Flags	Number	Bit field which provides details on the session, such as whether the session use IPv6.
CDL.Logging.File.Tunnel	String	Type of tunnel.
CDL.Logging.File.CloudHostname	String	The hostname in which the VM-series firewall is running.
CDL.Logging.File.Http2Connection	Number	Parent session ID for an HTTP/2 connection. If the traffic is not using HTTP/2, this field is set to 0.
CDL.Logging.File.IsPrismaBranch	Boolean	Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.
CDL.Logging.File.OutboundIf	String	Interface to which the network traffic was destined.
CDL.Logging.File.IsSymReturn	Boolean	Indicates whether symmetric return was used to forward traffic for this session.
CDL.Logging.File.URLCategory	String	The URL category.
CDL.Logging.File.IsReconExcluded	Boolean	Indicates whether source for the flow is on the firewall allow list and not subject to recon protection.
CDL.Logging.File.SanctionedStateOfApp	Boolean	Indicates whether the application has been flagged as sanctioned by the firewall administrator.
CDL.Logging.File.ReportID	Number	Identifies the analysis requested from the sandbox (cloud or appliance).
CDL.Logging.File.DestinationPort	Number	Network traffic’s destination port. If this value is 0, then the app is using
its standard port.
CDL.Logging.File.IsDupLog	Boolean	Indicates whether this log data is available in multiple locations, such as from Strata Logging Service XSOAR Connector as well as from an on-premise log collector.
CDL.Logging.File.LogTime	Date	Time the log was received in Strata Logging Service XSOAR Connector.
CDL.Logging.File.SessionID	Number	Identifies the firewall’s internal identifier for a specific network session.
CDL.Logging.File.RecordSize	Number	Record size.
CDL.Logging.File.IngestionTime	Date	Ingestion time of the log.
CDL.Logging.File.CountOfRepeats	Number	Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.
CDL.Logging.File.VsysID	Number	A unique identifier for a virtual system on a Palo Alto Networks firewall.
CDL.Logging.File.VendorName	String	Identifies the vendor that produced the data.
CDL.Logging.File.IsMptcpOn	Boolean	Indicates whether the option is enabled on the next-generation firewall that allows a client to use multiple paths to connect to a destination host.
CDL.Logging.File.IsClientToServer	Boolean	Indicates if direction of traffic is from client to server.
CDL.Logging.File.IsServerToClient	Boolean	Indicates if direction of traffic is from server to client.
CDL.Logging.File.IsPacketCapture	Boolean	Indicates whether the session has a packet capture (PCAP).
CDL.Logging.File.IsTransaction	Boolean	Indicates whether the log corresponds to a transaction within an HTTP proxy session (Proxy Transaction).
CDL.Logging.File.InboundIf	String	Interface from which the network traffic was sourced.
CDL.Logging.File.FromZone	String	The networking zone from which the traffic originated.
CDL.Logging.File.FileType	String	Palo Alto Networks textual identifier for the threat.
CDL.Logging.File.IsPrismaMobile	Boolean	Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise.
CDL.Logging.File.IsContainer	Boolean	Indicates if the session is a container page access (Container Page).
CDL.Logging.File.IsSaasApp	Boolean	Internal use field. Indicates whether the application associated with this network traffic is a SAAS application.
CDL.Logging.File.Vsys	String	Unique identifier for a virtual system on a Palo Alto Networks firewall.
CDL.Logging.File.IsNat	Boolean	Indicates if the firewall is performing network address translation (NAT) for the logged traffic.
CDL.Logging.File.FileID	Number	Numerical identifier for the threat type.
CDL.Logging.File.IsCaptivePortal	Boolean	Indicates if user information for the session was captured through Captive Portal.
CDL.Logging.File.Protocol	String	IP protocol associated with the session.
CDL.Logging.File.CustomerID	Number	The ID that uniquely identifies the Strata Logging Service XSOAR Connector instance which received this log record.
CDL.Logging.File.Subtype	String	Identifies the log subtype.
CDL.Logging.File.TunneledApp	String	Tunneled app (For internal use only).
CDL.Logging.File.LogSourceID	String	ID that uniquely identifies the source of the log - serial number of the firewall that generated the log.
CDL.Logging.File.IsForwarded	Boolean	Internal-use field that indicates if the log is being forwarded.
CDL.Logging.File.RiskOfApp	Number	Indicates how risky the application is from a network security perspective.
CDL.Logging.File.PcapID	Number	Packet capture ID.
CDL.Logging.File.AppSubcategory	String	Identifies the application’s subcategory.
CDL.Logging.File.IsExported	Boolean	Indicates if this log was exported from the firewall using the firewall’s log export function.
CDL.Logging.File.Severity	String	Severity as defined by the platform.
CDL.Logging.File.NatSourcePort	Number	Post-NAT source port.
CDL.Logging.File.LogType	String	Identifies the log type.
CDL.Logging.File.LogSet	String	Log forwarding profile name that was applied to the session. This name was defined by the firewall’s administrator.
CDL.Logging.File.TechnologyOfApp	String	The networking technology used by the identified application.
CDL.Logging.File.DirectionOfAttack	String	Indicates the direction of the attack.
CDL.Logging.File.LogSource	String	Identifies the origin of the data - the system that produced the data.

Command Example

!cdl-query-file-data source_ip="10.10.10.101" time_range="6 months" limit="1"

Context Example

{
    "CDL": {
        "Logging": {
            "File": [
                {
                    "Action": "alert",
                    "App": "web-browsing",
                    "AppCategory": "general-internet",
                    "AppSubcategory": "internet-utility",
                    "CharacteristicOfApp": [
                        "3",
                        "4",
                        "5",
                        "6",
                        "8"
                    ],
                    "CloudHostname": "CloudHostName",
                    "CountOfRepeats": 1,
                    "CustomerID": "117270019",
                    "DestinationIP": "2.2.2.2",
                    "DestinationLocation": "US",
                    "DestinationPort": 80,
                    "DirectionOfAttack": "server to client",
                    "FileID": 52270,
                    "FileName": "TestFileName",
                    "FileSHA256": null,
                    "FileType": "Google Chrome Extension File",
                    "Flags": 4202496,
                    "FromZone": "LAN",
                    "Http2Connection": 0,
                    "InboundIf": "ethernet",
                    "IngestionTime": 2020-04-21T18:47:31,
                    "IsCaptivePortal": false,
                    "IsClientToServer": false,
                    "IsContainer": false,
                    "IsDecryptMirror": false,
                    "IsDupLog": false,
                    "IsExported": false,
                    "IsForwarded": true,
                    "IsMptcpOn": false,
                    "IsNat": true,
                    "IsNonStdDestPort": false,
                    "IsPacketCapture": false,
                    "IsParismaMobile": null,
                    "IsPhishing": false,
                    "IsPrismaBranch": false,
                    "IsProxy": false,
                    "IsReconExcluded": false,
                    "IsSaasApp": false,
                    "IsServerToClient": false,
                    "IsSymReturn": false,
                    "IsTransaction": false,
                    "IsTunnelInspected": false,
                    "IsUrlDenied": false,
                    "LogSet": "DEFAULT",
                    "LogSource": "firewall",
                    "LogSourceID": "015351000045229",
                    "LogSourceName": "Aristotle",
                    "LogTime": "2020-04-21T18:47:31",
                    "LogType": "threat",
                    "NatDestination": "2.2.2.2",
                    "NatDestinationPort": 80,
                    "NatSource": "3.3.3.3",
                    "NatSourcePort": 12345,
                    "OutboundIf": "ethernet",
                    "PcapID": 0,
                    "Protocol": "tcp",
                    "RecordSize": 3477,
                    "ReportID": 0,
                    "RiskOfApp": 4,
                    "RuleMatched": "INTERNET",
                    "RuleMatchedUuid": "123d644f-7691-437a-8f9b-4567c511bac2",
                    "SanctionedStateOfApp": false,
                    "SequenceNo": 327,
                    "SessionID": 16753,
                    "Severity": "Low",
                    "SourceIP": "10.10.10.101",
                    "Subtype": "file",
                    "TechnologyOfApp": "browser-based",
                    "TimeGenerated": "2020-04-21T18:47:12",
                    "ToZone": "ISP",
                    "Tunnel": "N/A",
                    "TunneledApp": "tunneled-app",
                    "URLCategory": "computer-and-internet-info",
                    "VendorName": "Palo Alto Networks",
                    "VendorSeverity": "Low",
                    "Vsys": "vsys1",
                    "VsysID": 1
                }
            ]
        }
    }
}

Human Readable Output

Logs file_data table

Action Application Destination Address FileID FileName FileType RuleMatched Source Address TimeGenerated

alert web-browsing 2.2.2.2 52270 ANindV94kHC673w9zWXj8TY Google Chrome Extension File INTERNET 10.10.10.101 2020-04-21T18:47:12

Action	Application	Destination Address	FileID	FileName	FileType	RuleMatched	Source Address	TimeGenerated
alert	web-browsing	2.2.2.2	52270	ANindV94kHC673w9zWXj8TY	Google Chrome Extension File	INTERNET	10.10.10.101	2020-04-21T18:47:12

9. cdl-reset-authentication-timeout

Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.

Base Command

cdl-reset-authentication-timeout

Command Example


#### Human Readable Output

```Caching mechanism failure time counters have been successfully reset.```

### 10. cdl-query-gp-logs

***
Searches the GlobalProtect VPN log table.

#### Base Command

`cdl-query-gp-logs`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| limit | The maximum number of logs to return. Default is 10. | Optional |
| page | Page to return. | Optional |
| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional |
| transform_results | If set to false, query results are not mapped into the standard command context. Possible values are: true, false. Default is true. | Optional |
| fields | The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all". Default is all. | Optional |
| end_time | The query end time. For example, end_time="2018-04-26 00:00:00". | Optional |
| start_time | The query start time. For example, start_time="2018-04-26 00:00:00". Default is '1970-01-01 00:00:00'. | Optional |
| time_range | First log time (&lt;number&gt; &lt;time unit&gt;. For example, 12 minutes, 7 days, 3 weeks). | Optional |
| event_name | Event name for which to search. | Optional |
| gateway | GlobalProtect gateway for which to search. | Optional |
| private_ipv4 | Private IP address (v4) of the user that connected for which to search. | Optional |
| private_ipv6 | Private IP address (v6) of the user that connected for which to search. | Optional |
| public_ipv4 | Public IP address (v4) of the user that connected for which to search. | Optional |
| public_ipv6 | Public IP address (v6) of the user that connected for which to search. | Optional |
| source_user | The source username for which to search. | Optional |
| event_status | Event status (success or failure) for which to search. | Optional |
| portal | GlobalProtect portal for which to search. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| CDL.Logging.GlobalProtect.AttemptedGateways | unknown | All gateways that were available and attempted for the client location. |
| CDL.Logging.GlobalProtect.AuthMethod | unknown | Authentication method used for the GlobalProtect connection. |
| CDL.Logging.GlobalProtect.ConnectMethod | unknown | Identifies how the GlobalProtect app connected to the the Gateway. |
| CDL.Logging.GlobalProtect.ConnectionErrorID | unknown | Enumeration integer assigned to the connection_error field value. |
| CDL.Logging.GlobalProtect.ConnectionErrorValue | unknown | Error information for unsuccessful connection. |
| CDL.Logging.GlobalProtect.CountOfRepeats | unknown | Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval. |
| CDL.Logging.GlobalProtect.CustomerID | unknown | The ID that uniquely identifies the Cortex Data Lake instance which received this log record. |
| CDL.Logging.GlobalProtect.EndpointDeviceName | unknown | Name of the device that the user used for the connection. |
| CDL.Logging.GlobalProtect.EndpointGPVersion | unknown | GlobalProtect client version number. |
| CDL.Logging.GlobalProtect.EndpointOSType | unknown | OS type of the endpoint on which the GlobalProtect client is deployed. |
| CDL.Logging.GlobalProtect.EndpointOSVersion | unknown | OS version of the endpoint on which the GlobalProtect client is deployed. |
| CDL.Logging.GlobalProtect.EndpointSN | unknown | ID that uniquely identifies the endpoint on which the GlobalProtect client is deployed. |
| CDL.Logging.GlobalProtect.EventID | unknown | The name of the event. |
| CDL.Logging.GlobalProtect.Gateway | unknown | Gateway for the connection. |
| CDL.Logging.GlobalProtect.GatewayPriority | unknown | Priority of the gateway. |
| CDL.Logging.GlobalProtect.GatewaySelectionType | unknown | Gateway selection method i.e., automatic, preferred, or manual. |
| CDL.Logging.GlobalProtect.GPGatewayLocation | unknown | Location of the GlobalProtect gateway. |
| CDL.Logging.GlobalProtect.HostID | unknown | Unique identifier GlobalProtect has assigned to the host. |
| CDL.Logging.GlobalProtect.IsDuplicateLog | unknown | Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector. |
| CDL.Logging.GlobalProtect.IsExported | unknown | Indicates if this log was exported from the firewall using the firewall's log export function. |
| CDL.Logging.GlobalProtect.IsForwarded | unknown | Internal use field that indicates if the log is being forwarded. |
| CDL.Logging.GlobalProtect.IsPrismaBranch | unknown | Internal use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise. |
| CDL.Logging.GlobalProtect.IsPrismaMobile | unknown | Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise. |
| CDL.Logging.GlobalProtect.LogSource | unknown | Identifies the origin of the data. |
| CDL.Logging.GlobalProtect.LogSourceID | unknown | ID that uniquely identifies the source of the log. |
| CDL.Logging.GlobalProtect.LogSourceName | unknown | Name of the source of the log. |
| CDL.Logging.GlobalProtect.LogTime | unknown | Time the log was received in Strata Logging Service XSOAR Connector. |
| CDL.Logging.GlobalProtect.LogType | unknown | Identifies the log type. |
| CDL.Logging.GlobalProtect.LoginDuration | unknown | Duration for which the connected user was logged on. |
| CDL.Logging.GlobalProtect.Opaque | unknown | Additional information regarding the event. |
| CDL.Logging.GlobalProtect.PanoramaSN | unknown | Panorama Serial associated with CDL. |
| CDL.Logging.GlobalProtect.PlatformType | unknown | The platform type. |
| CDL.Logging.GlobalProtect.Portal | unknown | GlobalProtect portal or gateway that the user connected to. |
| CDL.Logging.GlobalProtect.PrivateIPv4 | unknown | Private IP address \(v4\) of the user that connected. |
| CDL.Logging.GlobalProtect.PrivateIPv6 | unknown | Private IP address \(v6\) of the user that connected. |
| CDL.Logging.GlobalProtect.ProjectName | unknown | Project name. |
| CDL.Logging.GlobalProtect.PublicIPv4 | unknown | Public IP address \(v4\) of the user that connected. |
| CDL.Logging.GlobalProtect.PublicIPv6 | unknown | Public IP address \(v6\) of the user that connected. |
| CDL.Logging.GlobalProtect.QuarantineReason | unknown | Quarantine reason. |
| CDL.Logging.GlobalProtect.SequenceNo | unknown | The log entry identifier, which is incremented sequentially. |
| CDL.Logging.GlobalProtect.SourceRegion | unknown | Region of the gateway \(or user\) that connected. |
| CDL.Logging.GlobalProtect.SourceUser | unknown | The username that connected. |
| CDL.Logging.GlobalProtect.SourceUserDomain | unknown | Domain to which the source user belongs. |
| CDL.Logging.GlobalProtect.SourceUserName | unknown | The source user username. |
| CDL.Logging.GlobalProtect.SourceUserUUID | unknown | Unique identifier assigned to the source user. |
| CDL.Logging.GlobalProtect.SSLResponseTime | unknown | SSL response time in milliseconds. |
| CDL.Logging.GlobalProtect.Stage | unknown | Name of the stage in the GlobalProtect connection workflow. |
| CDL.Logging.GlobalProtect.EventStatus | unknown | The status \(success or failure\) of the event. |
| CDL.Logging.GlobalProtect.Subtype | unknown | The log subtype. |
| CDL.Logging.GlobalProtect.TimeGenerated | unknown | Time when the log was generated on the firewall's data plane. |
| CDL.Logging.GlobalProtect.TunnelType | unknown | Tunnel type i.e., SSL or VPN. |
| CDL.Logging.GlobalProtect.VendorName | unknown | The vendor that produced the data. |

##### Command Example

```!cdl-query-gp-logs time_range="10 days" limit="1"```

##### Context Example

{
“CDL.Logging.GlobalProtect”: [
{
“AttemptedGateways”: “gateway1,500,1;”,
“AuthMethod”: “SAML”,
“ConnectionErrorID”: “”,
“ConnectionErrorValue”: “”,
“CountOfRepeats”: 1,
“CustomerID”: “117270019”,
“EndpointDeviceName”: “device1”,
“EndpointGPVersion”: “328198”,
“EndpointOSType”: “Windows”,
“EndpointOSVersion”: “”,
“EventID”: “gateway-auth”,
“Gateway”: “gateway1”,
“GatewayPriority”: “1”,
“GatewaySelectionType”: “automatic”,
“HostID”: “12341234-1234-1234-1234-123412341234”,
“IsDuplicateLog”: false,
“IsExported”: false,
“IsForwarded”: false,
“IsPrismaBranch”: false,
“IsPrismaMobile”: false,
“LogSource”: “gw”,
“LogSourceID”: “007251000070976”,
“LogSourceName”: “gw1”,
“LogTime”: “2025-03-10T20:58:12”,
“LogType”: “globalprotect”,
“LoginDuration”: 1000,
“Opaque”: “”,
“PlatformType”: “”,
“Portal”: “portal1”,
“PrivateIPv4”: “10.0.0.1”,
“PrivateIPv6”: “”,
“ProjectName”: “”,
“PublicIPv4”: “206.116.22.23”,
“PublicIPv6”: “”,
“QuarantineReason”: “”,
“SequenceNo”: 123,
“SourceRegion”: “US”,
“SourceUser”: “user1”,
“SourceUserDomain”: “domain1”,
“SourceUserName”: “user1”,
“SSLResponseTime”: 500,
“Stage”: “login”,
“EventStatus”: “success”,
“Subtype”: “globalprotect”,
“TimeGenerated”: “2025-03-10T20:58:11”,
“TunnelType”: “IPSec”,
“VendorName”: “Palo Alto Networks”
}
]
}


##### Human Readable Output

### Logs globalprotect table

|AttemptedGateways|AuthMethod|ConnectionErrorID|ConnectionErrorValue|CountOfRepeats|CustomerID|EndpointDeviceName|EndpointGPVersion|EndpointOSType|EndpointOSVersion|EventID|Gateway|GatewayPriority|GatewaySelectionType|HostID|IsDuplicateLog|IsExported|IsForwarded|IsPrismaBranch|IsPrismaMobile|LogSource|LogSourceID|LogSourceName|LogTime|LogType|LoginDuration|Opaque|PlatformType|Portal|PrivateIPv4|PrivateIPv6|ProjectName|PublicIPv4|PublicIPv6|QuarantineReason|SequenceNo|SourceRegion|SourceUser|SourceUserDomain|SourceUserName|SSLResponseTime|Stage|EventStatus|Subtype|TimeGenerated|TunnelType|VendorName|
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| gateway1,500,1; | SAML |  |  | 1 | 117270019 | device1 | 328198 | Windows |  | gateway-auth | gateway1 | 1 | automatic | 12341234-1234-1234-1234-123412341234 | false | false | false | false | false | gw | 007251000070976 | gw1 | 2025-03-10T20 | globalprotect | 1000 |  |  | portal1 | 10.0.0.1 |  |  | 206.116.22.23 |  |  | 123 | US | user1 | domain1 | user1 | 500 | login | success | globalprotect | 2025-03-10T20 | IPSec | Palo Alto Networks |

### 11. sls-query-logs

Runs a query on the Cortex logging service.

##### Base Command

`sls-query-logs`

##### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| query | A free-text SQL query. For example, query="SELECT * FROM \`firewall.traffic\` limit 10". There are multiple tables in Loggings, for example: threat, traffic, and so on. Refer to the Strata Logging service schema reference for the full list. | Optional |
| limit | The number of logs to return. Default is 10 | Optional |
| page | Page to return. | Optional |
| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional |
| transform_results | If set to false, query results are not mapped into the standard command context. Default is "true". | Optional |

##### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| SLS.Logging.Action | String | Identifies the action that the firewall took for the network traffic. |
| SLS.Logging.App | String | Application associated with the network traffic. |
| SLS.Logging.Protocol | String | IP protocol associated with the session. |
| SLS.Logging.DestinationIP | String | Original destination IP address. |
| SLS.Logging.RuleMatched | String | Name of the security policy rule that the network traffic matched. |
| SLS.Logging.CharacteristicOfApp | Number | Identifies the behavioral characteristic of the application associated with the network traffic. |
| SLS.Logging.LogSourceName | String | Name of the source of the log. |
| SLS.Logging.IsNat | number | Indicates if the firewall is performing network address translation (NAT) for the logged traffic. |
| SLS.Logging.NatDestinationPort | Number | Post-NAT destination port. |
| SLS.Logging.NatDestination | String | If destination NAT performed, the post-NAT destination IP address. |
| SLS.Logging.NatSource | String | If source NAT was performed, the post-NAT source IP address. |
| SLS.Logging.SourceIP | String | Original source IP address. |
| SLS.Logging.AppCategory | String | Identifies the high-level family of the application. |
| SLS.Logging.SourceLocation | String | Source country or internal region for private addresses. |
| SLS.Logging.DestinationLocation | String | Destination country or internal region for private addresses. |
| SLS.Logging.FileSHA256 | String | The binary hash (SHA256) of the file sent for virus analysis. |
| SLS.Logging.FileName | String | The name of the infected file. |
| SLS.Logging.TimeGenerated | Date | Time when the log was generated on the firewall's data plane. |

##### Command Example

```!sls-query-logs query="SELECT * FROM `firewall.traffic` limit 1"```

##### Context Example

{
“SLS.Logging”: [
{
“Action”: “allow”,
“App”: “smtp”,
“Protocol”: “tcp”,
“DestinationIP”: “206.116.22.23”,
“RuleMatched”: “taplog”,
“CharacteristicOfApp”: [
“3”,
“4”,
“5”,
“6”,
“7”,
“8”
],
“LogSourceName”: “gw”,
“NatDestination”: “0.0.0.0”,
“NatSource”: “0.0.0.0”,
“SourceIP”: “10.154.1.20”,
“AppCategory”: “collaboration”,
“SourceLocation”: “10.0.0.0-10.255.255.255”,
“DestinationLocation”: “CA”,
“TimeGenerated”: “2020-03-18T19:36:37”
}
]
}


##### Human Readable Output

### Logs traffic table

|Action|App|AppCategory|CharacteristicOfApp|DestinationIP|DestinationLocation|LogSourceName|NatDestination|NatSource|Protocol|RuleMatched|SourceIP|SourceLocation|TimeGenerated|
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| allow | smtp | collaboration | 3,4,5,6,7,8 | 206.116.22.23 | CA | gw | 0.0.0.0 | 0.0.0.0 | tcp | taplog | 10.154.1.20 | 10.0.0.0-10.255.255.255 | 2020-03-18T19:36:37 |

### 12. sls-get-critical-threat-logs

---
Runs a query on the Cortex logging service, according to preset queries.

##### Base Command

`sls-get-critical-threat-logs`

##### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| start_time | The query start time. For example, start_time="2018-04-26 00:00:00" | Optional |
| end_time | The query end time. For example, end_time="2018-04-26 00:00:00" | Optional |
| limit | The number of logs to return. Default is 10 | Optional |
| page | Page to return. | Optional |
| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional |
| time_range | First log time (\<number\> \<time unit\>, e.g., 12 hours, 7 days, 3 months, 1 year) | Optional |

##### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| SLS.Logging.Threat.SessionID | String | Identifies the firewall's internal identifier for a specific network session. |
| SLS.Logging.Threat.Action | String | Identifies the action that the firewall took for the network traffic. |
| SLS.Logging.Threat.App | String | Application associated with the network traffic. |
| SLS.Logging.Threat.Nat | String | Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1. |
| SLS.Logging.Threat.SubcategoryOfApp | String | Identifies the application's subcategory. The subcategory is related to the application's category, which is identified in category_of_app. |
| SLS.Logging.Threat.PcapID | String | Packet capture (pcap) ID. This is used to correlate threat pcap files with extended pcaps taken as a part of the session flow. All threat logs will contain either a pcap_id of 0 (no associated pcap) , or an ID referencing the extended pcap file. |
| SLS.Logging.Threat.Natdst | String | If destination NAT performed, the post-NAT destination IP address. The IP address is an IPv4/IPv6 address in hex format. |
| SLS.Logging.Threat.Flags | String | Bit field which provides details on the session, such as whether the session use IPv6, whether the session was denied due to a URL filtering rule, and/or whether the log corresponds to a transaction within an HTTP proxy session. |
| SLS.Logging.Threat.Dport | String | Network traffic's destination port. If this value is 0, then the app is using its standard port. |
| SLS.Logging.Threat.ThreatID | String | Numerical identifier for the threat type. All threats encountered by Palo Alto Networks firewalls are assigned a unique identifier |
| SLS.Logging.Threat.Natsrc | String | If source NAT was performed, the post-NAT source IP address. The IP address is an IPv4/IPv6 address in hex format. |
| SLS.Logging.Threat.CategoryOfApp | String | Identifies the managing application, or parent, of the application associated with this network traffic, if any. |
| SLS.Logging.Threat.Srcloc | String | Source country or internal region for private addresses. The internal region is a user-defined name for a specific network in the user's enterprise. |
| SLS.Logging.Threat.Dstloc | String | Destination country or internal region for private addresses. The internal region is a user-defined name for a specific network in the user's enterprise. |
| SLS.Logging.Threat.To | String | Networking zone to which the traffic was sent. |
| SLS.Logging.Threat.RiskOfApp | String | Indicates how risky the application is from a network security perspective. Values range from 1-5, where 5 is the riskiest. |
| SLS.Logging.Threat.Natsport | String | Post-NAT source port. |
| SLS.Logging.Threat.URLDenied | String | Session was denied due to a URL filtering rule. |
| SLS.Logging.Threat.CharacteristicOfApp | String | Identifies the behavioral characteristic of the application associated with the network traffic. |
| SLS.Logging.Threat.HTTPMethod | String | Only in URL filtering logs. Describes the HTTP Method used in the web request |
| SLS.Logging.Threat.From | String | The networking zone from which the traffic originated. |
| SLS.Logging.Threat.Vsys | String | Virtual system associated with the network traffic. |
| SLS.Logging.Threat.ReceiveTime | String | Time the log was received at the management plane. |
| SLS.Logging.Threat.Users | String | Srcuser or dstuser or srcip (one of). |
| SLS.Logging.Threat.Proto | String | IP protocol associated with the session. |
| SLS.Logging.Threat.Natdport | String | Post-NAT destination port. |
| SLS.Logging.Threat.Dst | String | Original destination IP address. The IP address is an IPv4/ IPv6 address in hex format. |
| SLS.Logging.Threat.Rule | String | Name of the security policy rule that the network traffic matched. |
| SLS.Logging.Threat.CategoryOfThreatID | String | Threat category of the detected threat. |
| SLS.Logging.Threat.DeviceName | String | The hostname of the firewall that logged the network traffic. |
| SLS.Logging.Threat.Subtype | String | Subtype of the threat log. |
| SLS.Logging.Threat.TimeReceived | String | Time the log was received at the management plane. |
| SLS.Logging.Threat.Direction | String | Indicates the direction of the attack, client-to-server or server-to-client: |
| SLS.Logging.Threat.Misc | String | The meaning of this field differs according to the log's subtype: Subtype is URL, this field contains the requested URI. Subtype is File, this field contains the file name or file type. Subtype is Virus, this field contains the file name. Subtype is WildFire, this field contains the file name. |
| SLS.Logging.Threat.Severity | String | Severity associated with the event. |
| SLS.Logging.Threat.Src | String | Original source IP address. The IP address is an IPv4/IPv6 address in hex format. |
| SLS.Logging.Threat.TimeGenerated | String | Time the log was generated on the data plane. |
| SLS.Logging.Threat.Serial | String | Serial number of the firewall that generated the log. |
| SLS.Logging.Threat.VsysID | String | A unique identifier for a virtual system on a Palo Alto Networks firewall. |
| SLS.Logging.Threat.URLDomain | String | The name of the internet domain that was visited in this session. |
| SLS.Logging.Threat.Category | String | For the URL subtype, this identifies the URL Category. For the WildFire subtype, this identifies the verdict on the file. It is one of ‘malicious’, ‘phishing’, ‘grayware’, or ‘benign’; |
| SLS.Logging.Threat.Sport | String | Source port utilized by the session. |
| SLS.Logging.Threat.IsPhishing | Boolean | Detected enterprise credential submission by an end user. |
| IP.Address | String | IP address. |
| Domain.Name | String | The domain name, for example: "google.com". |
| File.SHA256 | String | The SHA256 hash of the file. |
| File.Name | String | The full file name (including file extension). |
| File.Type | String | The file type, as determined by libmagic (same as displayed in file entries). |

##### Command Example

```!sls-get-critical-threat-logs limit="1" time_range="10 days"```

##### Context Example

{
“SLS.Logging.Threat”: [
{
“SessionID”: 103986,
“Action”: “reset-both”,
“App”: “imap”,
“IsNat”: false,
“SubcategoryOfApp”: “email”,
“PcapID”: 0,
“NatDestination”: “0.0.0.0”,
“Flags”: 8192,
“DestinationPort”: 143,
“ThreatID”: 30663,
“NatSource”: “0.0.0.0”,
“IsURLDenied”: false,
“Users”: “10.154.10.88”,
“TimeGenerated”: “2020-03-18T15:46:10”,
“IsPhishing”: false,
“AppCategory”: “collaboration”,
“SourceLocation”: “10.0.0.0-10.255.255.255”,
“DestinationLocation”: “CH”,
“ToZone”: “TapZone”,
“RiskOfApp”: 4,
“NatSourcePort”: 0,
“CharacteristicOfApp”: [
“3”,
“4”,
“5”,
“8”
],
“FromZone”: “TapZone”,
“Vsys”: “vsys1”,
“Protocol”: “tcp”,
“NatDestinationPort”: 0,
“DestinationIP”: “84.74.104.27”,
“SourceIP”: “10.154.10.88”,
“RuleMatched”: “taplog”,
“ThreatCategory”: “overflow”,
“LogSourceName”: “gw”,
“Subtype”: “vulnerability”,
“Direction”: “server to client”,
“FileName”: “iZJvnxT27.PpT”,
“VendorSeverity”: “Critical”,
“LogTime”: “2020-03-18T15:46:37”,
“LogSourceID”: “007251000070976”,
“VsysID”: 1,
“URLDomain”: null,
“URLCategory”: “any”,
“SourcePort”: 14484
}
]
}


##### Human Readable Output

### Logs threat table

|Action|App|AppCategory|CharacteristicOfApp|DestinationIP|DestinationLocation|DestinationPort|Direction|FileName|Flags|FromZone|IsNat|IsPhishing|IsURLDenied|LogSourceID|LogSourceName|LogTime|NatDestination|NatDestinationPort|NatSource|NatSourcePort|PcapID|Protocol|RiskOfApp|RuleMatched|SessionID|SourceIP|SourceLocation|SourcePort|SubcategoryOfApp|Subtype|ThreatCategory|ThreatID|TimeGenerated|ToZone|URLCategory|URLDomain|Users|VendorSeverity|Vsys|VsysID|
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| reset-both | imap | collaboration | 3,4,5,8 | 84.74.104.27 | CH | 143 | server to client | iZJvnxT27.PpT | 8192 | TapZone | false | false | false | 007251000070976 | gw | 2020-03-18T15:46:37 | 0.0.0.0 | 0 | 0.0.0.0 | 0 | 0 | tcp | 4 | taplog | 103986 | 10.154.10.88 | 10.0.0.0-10.255.255.255 | 14484 | email | vulnerability | overflow | 30663 | 2020-03-18T15:46:10 | TapZone | any |  | 10.154.10.88 | Critical | vsys1 | 1 |

### 13. sls-get-social-applications

___
Runs a query on the Cortex logging service, according to preset queries.

##### Base Command

`sls-get-social-applications`

##### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| start_time | Query start time. For example, start_time="2018-04-26 00:00:00" | Optional |
| end_time | Query end time. For example, end_time="2018-04-26 00:00:00" | Optional |
| limit | Amount of logs. Default is 10 | Optional |
| page | Page to return. | Optional |
| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional |
| time_range | First log time (\<number\> \<time unit\>, e.g., 12 hours, 7 days, 3 months, 1 year) | Optional |

##### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| SLS.Logging.Traffic.Action | String | Identifies the action that the firewall took for the network traffic. |
| SLS.Logging.Traffic.RiskOfApp | String | Indicates how risky the application is from a network security perspective. |
| SLS.Logging.Traffic.NatSourcePort | String | Post-NAT source port. |
| SLS.Logging.Traffic.SessionID | String | Identifies the firewall's internal identifier for a specific network session. |
| SLS.Logging.Traffic.Packets | String | Number of total packets (transmit and receive) seen for the session. |
| SLS.Logging.Traffic.CharacteristicOfApp | String | Identifies the behavioral characteristic of the application associated with the network traffic. |
| SLS.Logging.Traffic.App | String | Application associated with the network traffic. |
| SLS.Logging.Traffic.Vsys | String | Virtual system associated with the network traffic. |
| SLS.Logging.Traffic.IsNat | String | Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1. |
| SLS.Logging.Traffic.LogTime | date | Time the log was received in Strata Logging Service XSOAR Connector. |
| SLS.Logging.Traffic.SubcategoryOfApp | String | Identifies the application's subcategory. The subcategory is related to the application's category, |
| SLS.Logging.Traffic.Protocol | String | IP protocol associated with the session. |
| SLS.Logging.Traffic.NatDestinationPort | String | Post-NAT destination port. |
| SLS.Logging.Traffic.DestinationIP | String | Original destination IP address. |
| SLS.Logging.Traffic.NatDestination | String | If destination NAT performed, the post-NAT destination IP address. |
| SLS.Logging.Traffic.RuleMatched | String | Name of the security policy rule that the network traffic matched. |
| SLS.Logging.Traffic.DestinationPort | String | Network traffic's destination port. If this value is 0, then the app is using its standard port. |
| SLS.Logging.Traffic.TotalTimeElapsed | String | Total time taken for the network session to complete. |
| SLS.Logging.Traffic.LogSourceName | String | Device name of the source of the log |
| SLS.Logging.Traffic.Subtype | String | The log sub type. |
| SLS.Logging.Traffic.Users | String | Source/Destination user. If neither is available, source_ip is used. |
| SLS.Logging.Traffic.TunneledApp | String | Is app tunneled. |
| SLS.Logging.Traffic.IsPhishing | String | Indicates whether enterprise credentials were submitted by an end user. |
| SLS.Logging.Traffic.SessionEndReason | String | The reason a session terminated. |
| SLS.Logging.Traffic.NatSource | String | If source NAT was performed, the post-NAT source IP address. |
| SLS.Logging.Traffic.SourceIP | String | Original source IP address. |
| SLS.Logging.Traffic.SessionStartIP | date | Time when the session was established. |
| SLS.Logging.Traffic.TimeGenerated | date | Time when the log was generated on the firewall's data plane. |
| SLS.Logging.Traffic.AppCategory | String | Identifies the high-level family of the application. |
| SLS.Logging.Traffic.SourceLocation | String | Source country or internal region for private addresses. |
| SLS.Logging.Traffic.DestinationLocation | String | Destination country or internal region for private addresses. |
| SLS.Logging.Traffic.LogSourceID | String | ID that uniquely identifies the source of the log. If the source is a firewall, this is its serial number. |
| SLS.Logging.Traffic.TotalBytes | String | Number of total bytes (transmit and receive). |
| SLS.Logging.Traffic.VsysID | String | A unique identifier for a virtual system on a Palo Alto Networks firewall. |
| SLS.Logging.Traffic.ToZone | String | Networking zone to which the traffic was sent. |
| SLS.Logging.Traffic.URLCategory | String | The URL category. |
| SLS.Logging.Traffic.SourcePort | String | Source port utilized by the session. |
| SLS.Logging.Traffic.Tunnel | String | Type of tunnel. |

##### Command Example

```!sls-get-social-applications limit="2" time_range="10 days"```

##### Context Example

{
“SLS.Logging.Traffic”: [
{
“Action”: “allow”,
“RiskOfApp”: 4,
“SessionID”: 108356,
“Packets”: 7,
“CharacteristicOfApp”: [
“3”,
“4”,
“5”,
“6”,
“8”
],
“App”: “facebook-base”,
“Vsys”: “vsys1”,
“LogTime”: “2020-03-18T15:54:40”,
“SubcategoryOfApp”: “social-networking”,
“Protocol”: “tcp”,
“DestinationIP”: “131.130.159.25”,
“NatDestination”: “0.0.0.0”,
“RuleMatched”: “taplog”,
“DestinationPort”: 80,
“LogSourceName”: “gw”,
“Subtype”: “start”,
“Users”: “10.154.230.43”,
“TunneledApp”: “tunneled-app”,
“SessionEndReason”: “n-a”,
“NatSource”: “0.0.0.0”,
“SourceIP”: “10.154.230.43”,
“SessionStartIP”: “2020-03-18T15:54:14”,
“TimeGenerated”: “2020-03-18T15:54:16”,
“AppCategory”: “collaboration”,
“SourceLocation”: “10.0.0.0-10.255.255.255”,
“DestinationLocation”: “AT”,
“LogSourceID”: “007251000070976”,
“TotalBytes”: 946,
“VsysID”: 1,
“ToZone”: “TapZone”,
“URLCategory”: “social-networking”,
“SourcePort”: 37252,
“Tunnel”: “N/A”
},
{
“Action”: “allow”,
“RiskOfApp”: 4,
“SessionID”: 276377,
“Packets”: 768,
“CharacteristicOfApp”: [
“3”,
“4”,
“5”,
“6”,
“8”
],
“App”: “facebook-base”,
“Vsys”: “vsys1”,
“LogTime”: “2020-03-16T15:54:36”,
“SubcategoryOfApp”: “social-networking”,
“Protocol”: “tcp”,
“DestinationIP”: “213.191.250.86”,
“NatDestination”: “0.0.0.0”,
“RuleMatched”: “taplog”,
“DestinationPort”: 80,
“TotalTimeElapsed”: 1,
“LogSourceName”: “gw”,
“Subtype”: “end”,
“Users”: “10.154.227.21”,
“TunneledApp”: “tunneled-app”,
“SessionEndReason”: “tcp-fin”,
“NatSource”: “0.0.0.0”,
“SourceIP”: “10.154.227.21”,
“SessionStartIP”: “2020-03-16T15:53:58”,
“TimeGenerated”: “2020-03-16T15:54:16”,
“AppCategory”: “collaboration”,
“SourceLocation”: “10.0.0.0-10.255.255.255”,
“DestinationLocation”: “IE”,
“LogSourceID”: “007251000070976”,
“TotalBytes”: 384468,
“VsysID”: 1,
“ToZone”: “TapZone”,
“URLCategory”: “social-networking”,
“SourcePort”: 53174,
“Tunnel”: “N/A”
}
]
}


##### Human Readable Output

### Logs traffic table

### Logs traffic table

|Action|App|AppCategory|CharacteristicOfApp|DestinationIP|DestinationLocation|DestinationPort|LogSourceID|LogSourceName|LogTime|NatDestination|NatSource|Packets|Protocol|RiskOfApp|RuleMatched|SessionEndReason|SessionID|SessionStartIP|SourceIP|SourceLocation|SourcePort|SubcategoryOfApp|Subtype|TimeGenerated|ToZone|TotalBytes|Tunnel|TunneledApp|URLCategory|Users|Vsys|VsysID|
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| allow | facebook-base | collaboration | 3,4,5,6,8 | 131.130.159.25 | AT | 80 | 007251000070976 | gw | 2020-03-18T15:54:40 | 0.0.0.0 | 0.0.0.0 | 7 | tcp | 4 | taplog | n-a | 108356 | 2020-03-18T15:54:14 | 10.154.230.43 | 10.0.0.0-10.255.255.255 | 37252 | social-networking | start | 2020-03-18T15:54:16 | TapZone | 946 | N/A | tunneled-app | social-networking | 10.154.230.43 | vsys1 | 1 |
| allow | facebook-base | collaboration | 3,4,5,6,8 | 213.191.250.86 | IE | 80 | 007251000070976 | gw | 2020-03-16T15:54:36 | 0.0.0.0 | 0.0.0.0 | 768 | tcp | 4 | taplog | tcp-fin | 276377 | 2020-03-16T15:53:58 | 10.154.227.21 | 10.0.0.0-10.255.255.255 | 53174 | social-networking | end | 2020-03-16T15:54:16 | TapZone | 384468 | N/A | tunneled-app | social-networking | 10.154.227.21 | vsys1 | 1 |

### 14. sls-search-by-file-hash

---
Runs a query on the threat table with the query 'SELECT * FROM `firewall.threat` WHERE file_sha_256 = <file_hash>'

##### Base Command

`sls-search-by-file-hash`

##### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| start_time | The query start time. For example, start_time="2018-04-26 00:00:00" | Optional |
| end_time | The query end time. For example, end_time="2018-04-26 00:00:00" | Optional |
| limit | The number of logs to return. Default is 10. | Optional |
| page | Page to return. | Optional |
| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional |
| time_range | First log time (\<number\> \<time unit\>, e.g., 12 hours, 7 days, 3 months, 1 year) | Optional |
| SHA256 | The SHA256 hash of the file for the query. For example, SHA256="503ca1a4fc0d48b18c0336f544ba0f0abf305ae3a3f49b3c2b86b8645d6572dc" would return all logs associated with this file. | Required |

##### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| SLS.Logging.Threat.SessionID | String | Identifies the firewall's internal identifier for a specific network session. |
| SLS.Logging.Threat.Action | String | Identifies the action that the firewall took for the network traffic. |
| SLS.Logging.Threat.App | String | Application associated with the network traffic. |
| SLS.Logging.Threat.Nat | String | Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1. |
| SLS.Logging.Threat.SubcategoryOfApp | String | Identifies the application's subcategory. The subcategory is related to the application's category, which is identified in category_of_app. |
| SLS.Logging.Threat.PcapID | String | Packet capture (pcap) ID. This is used to correlate threat pcap files with extended pcaps taken as a part of the session flow. All threat logs will contain either a pcap_id of 0 (no associated pcap) , or an ID referencing the extended pcap file. |
| SLS.Logging.Threat.Natdst | String | If destination NAT performed, the post-NAT destination IP address. The IP address is an IPv4/IPv6 address in hex format. |
| SLS.Logging.Threat.Flags | String | Bit field which provides details on the session, such as whether the session use IPv6, whether the session was denied due to a URL filtering rule, and/or whether the log corresponds to a transaction within an HTTP proxy session. |
| SLS.Logging.Threat.Dport | String | Network traffic's destination port. If this value is 0, then the app is using its standard port. |
| SLS.Logging.Threat.ThreatID | String | Numerical identifier for the threat type. All threats encountered by Palo Alto Networks firewalls are assigned a unique identifier |
| SLS.Logging.Threat.Natsrc | String | If source NAT was performed, the post-NAT source IP address. The IP address is an IPv4/IPv6 address in hex format. |
| SLS.Logging.Threat.CategoryOfApp | String | Identifies the managing application, or parent, of the application associated with this network traffic, if any. |
| SLS.Logging.Threat.Srcloc | String | Source country or internal region for private addresses. The internal region is a user-defined name for a specific network in the user's enterprise. |
| SLS.Logging.Threat.Dstloc | String | Destination country or internal region for private addresses. The internal region is a user-defined name for a specific network in the user's enterprise. |
| SLS.Logging.Threat.To | String | Networking zone to which the traffic was sent. |
| SLS.Logging.Threat.RiskOfApp | String | Indicates how risky the application is from a network security perspective. Values range from 1-5, where 5 is the riskiest. |
| SLS.Logging.Threat.Natsport | String | Post-NAT source port. |
| SLS.Logging.Threat.URLDenied | String | Session was denied due to a URL filtering rule. |
| SLS.Logging.Threat.CharacteristicOfApp | String | Identifies the behavioral characteristic of the application associated with the network traffic. |
| SLS.Logging.Threat.HTTPMethod | String | Only in URL filtering logs. Describes the HTTP Method used in the web request |
| SLS.Logging.Threat.From | String | The networking zone from which the traffic originated. |
| SLS.Logging.Threat.Vsys | String | Virtual system associated with the network traffic. |
| SLS.Logging.Threat.ReceiveTime | String | Time the log was received at the management plane. |
| SLS.Logging.Threat.Users | String | Srcuser or dstuser or srcip (one of). |
| SLS.Logging.Threat.Proto | String | IP protocol associated with the session. |
| SLS.Logging.Threat.Natdport | String | Post-NAT destination port. |
| SLS.Logging.Threat.Dst | String | Original destination IP address. The IP address is an IPv4/ IPv6 address in hex format. |
| SLS.Logging.Threat.Rule | String | Name of the security policy rule that the network traffic matched. |
| SLS.Logging.Threat.CategoryOfThreatID | String | Threat category of the detected threat. |
| SLS.Logging.Threat.DeviceName | String | The hostname of the firewall that logged the network traffic. |
| SLS.Logging.Threat.Subtype | String | Subtype of the threat log. |
| SLS.Logging.Threat.TimeReceived | String | Time the log was received at the management plane. |
| SLS.Logging.Threat.Direction | String | Indicates the direction of the attack, client-to-server or server-to-client: |
| SLS.Logging.Threat.Misc | String | The meaning of this field differs according to the log's subtype: Subtype is URL, this field contains the requested URI. Subtype is File, this field contains the file name or file type. Subtype is Virus, this field contains the file name. Subtype is WildFire, this field contains the file name. |
| SLS.Logging.Threat.Severity | String | Severity associated with the event. |
| SLS.Logging.Threat.Src | String | Original source IP address. The IP address is an IPv4/IPv6 address in hex format. |
| SLS.Logging.Threat.TimeGenerated | String | Time the log was generated on the data plane. |
| SLS.Logging.Threat.Serial | String | Serial number of the firewall that generated the log. |
| SLS.Logging.Threat.VsysID | String | A unique identifier for a virtual system on a Palo Alto Networks firewall. |
| SLS.Logging.Threat.URLDomain | String | The name of the internet domain that was visited in this session. |
| SLS.Logging.Threat.Category | String | For the URL subtype, this identifies the URL Category. For the WildFire subtype, this identifies the verdict on the file. It is one of ‘malicious’, ‘phishing’, ‘grayware’, or ‘benign’; |
| SLS.Logging.Threat.Sport | String | Source port utilized by the session. |
| SLS.Logging.Threat.IsPhishing | Boolean | Detected enterprise credential submission by an end user. |
| IP.Address | String | IP address. |
| Domain.Name | String | The domain name, for example: "google.com". |
| File.SHA256 | String | The SHA256 hash of the file. |
| File.Name | String | The full file name (including file extension). |
| File.Type | String | The file type, as determined by libmagic (same as displayed in file entries). |

##### Command Example

```!sls-search-by-file-hash SHA256="cbdf1f3cccd949e6e96c425b3d7ccc463b956f002f694472e4d24a12ff2cea4d" limit=1 time_range="10 days"```

##### Context Example

{
“SLS.Logging.Threat”: [
{
“SessionID”: 784600,
“Action”: “block”,
“App”: “smtp”,
“IsNat”: false,
“SubcategoryOfApp”: “email”,
“PcapID”: 0,
“NatDestination”: “0.0.0.0”,
“Flags”: 8192,
“DestinationPort”: 25,
“ThreatID”: 52033,
“NatSource”: “0.0.0.0”,
“IsURLDenied”: false,
“Users”: “10.154.246.167”,
“TimeGenerated”: “2020-03-25T15:42:08”,
“IsPhishing”: false,
“AppCategory”: “collaboration”,
“SourceLocation”: “10.0.0.0-10.255.255.255”,
“DestinationLocation”: “US”,
“ToZone”: “TapZone”,
“RiskOfApp”: 5,
“NatSourcePort”: 0,
“CharacteristicOfApp”: [
“3”,
“4”,
“5”,
“6”,
“7”,
“8”
],
“FromZone”: “TapZone”,
“Vsys”: “vsys1”,
“Protocol”: “tcp”,
“NatDestinationPort”: 0,
“DestinationIP”: “67.53.137.201”,
“SourceIP”: “10.154.246.167”,
“RuleMatched”: “taplog”,
“ThreatCategory”: “”,
“LogSourceName”: “gw”,
“Subtype”: “wildfire”,
“Direction”: “client to server”,
“FileName”: “o93yr.ECr”,
“VendorSeverity”: “Informational”,
“LogTime”: “2020-03-25T15:42:13”,
“LogSourceID”: “007251000070976”,
“VsysID”: 1,
“URLDomain”: null,
“URLCategory”: “”,
“SourcePort”: 51819,
“FileSHA256”: “cbdf1f3cccd949e6e96c425b3d7ccc463b956f002f694472e4d24a12ff2cea4d”
}
]
}


##### Human Readable Output

### Logs threat table

|Action|App|AppCategory|CharacteristicOfApp|DestinationIP|DestinationLocation|DestinationPort|Direction|FileName|FileSHA256|Flags|FromZone|IsNat|IsPhishing|IsURLDenied|LogSourceID|LogSourceName|LogTime|NatDestination|NatDestinationPort|NatSource|NatSourcePort|PcapID|Protocol|RiskOfApp|RuleMatched|SessionID|SourceIP|SourceLocation|SourcePort|SubcategoryOfApp|Subtype|ThreatCategory|ThreatID|TimeGenerated|ToZone|URLCategory|URLDomain|Users|VendorSeverity|Vsys|VsysID|
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| block | smtp | collaboration | 3,4,5,6,7,8 | 67.53.137.201 | US | 25 | client to server | o93yr.ECr | cbdf1f3cccd949e6e96c425b3d7ccc463b956f002f694472e4d24a12ff2cea4d | 8192 | TapZone | false | false | false | 007251000070976 | gw | 2020-03-25T15:42:13 | 0.0.0.0 | 0 | 0.0.0.0 | 0 | 0 | tcp | 5 | taplog | 784600 | 10.154.246.167 | 10.0.0.0-10.255.255.255 | 51819 | email | wildfire |  | 52033 | 2020-03-25T15:42:08 | TapZone |  |  | 10.154.246.167 | Informational | vsys1 | 1 |

### 15. sls-query-traffic-logs

___

Runs a query on the firewall.traffic table. Traffic logs contain entries for the end of each network session

##### Base Command

`sls-query-traffic-logs`

##### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| source_ip | A source IP address or an array of source IPs addresses for which to search, for example 1.1.1.1,2.2.2.2. | Optional |
| rule | A rule name or an array of rule names to search. | Optional |
| from_zone | A source zone  name or an array of source zone names to search. | Optional |
| to_zone | A destination zone name or an array of zone names to search. | Optional |
| source_port | Source port utilized by the session. Can be port number or an array of destination port numbers to search. For example '443' or '443,445' | Optional |
| action | An action name or an array of action names to search. | Optional |
| query | A free-text query for which to search. This forms the WHERE part of the query, for example, !sls-query-traffic-logs query="source_ip.value LIKE '192.168.1.*' AND dest_ip.value='8.8.8.8' And dest_port=1234" | Optional |
| fields | The fields that are selected in the query. Selection can be "all" (same as *) or a comma separated list of specific fields in the table.  | Optional |
| start_time | The query start time. For example, start_time="2018-04-26 00:00:00" | Optional |
| end_time | The query end time. For example, end_time="2018-04-26 00:00:00". | Optional |
| time_range | First fetch time (\<number\> \<time unit\>, e.g., 12 hours, 7 days, 3 months, 1 year) | Optional |
| limit | The number of logs to return. Default is 5. | Optional |
| page | Page to return. | Optional |
| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional |
| dest_ip | A destination IP address or an array of destination IPs addresses for which to search, for example 1.1.1.1,2.2.2.2. | Optional |
| dest_port | Destination port utilized by the session. Can be port number or an array of destination port numbers to search. For example '443' or '443,445' | Optional |
| ip | IP address. Enter an IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2. | Optional |
| port | Port utilized by the session. Enter a port or array of ports to search. | Optional |

##### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| SLS.Logging.Traffic.Action | String | Identifies the action that the firewall took for the network traffic. |
| SLS.Logging.Traffic.RiskOfApp | String | Indicates how risky the application is from a network security perspective. |
| SLS.Logging.Traffic.NatSourcePort | String | Post-NAT source port. |
| SLS.Logging.Traffic.SessionID | String | Identifies the firewall's internal identifier for a specific network session. |
| SLS.Logging.Traffic.Packets | String | Number of total packets (transmit and receive) seen for the session. |
| SLS.Logging.Traffic.CharacteristicOfApp | String | Identifies the behavioral characteristic of the application associated with the network traffic. |
| SLS.Logging.Traffic.App | String | Application associated with the network traffic. |
| SLS.Logging.Traffic.Vsys | String | Virtual system associated with the network traffic. |
| SLS.Logging.Traffic.IsNat | String | Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1. |
| SLS.Logging.Traffic.LogTime | date | Time the log was received in Strata Logging Service XSOAR Connector. |
| SLS.Logging.Traffic.SubcategoryOfApp | String | Identifies the application's subcategory. The subcategory is related to the application's category, |
| SLS.Logging.Traffic.Protocol | String | IP protocol associated with the session. |
| SLS.Logging.Traffic.NatDestinationPort | String | Post-NAT destination port. |
| SLS.Logging.Traffic.DestinationIP | String | Original destination IP address. |
| SLS.Logging.Traffic.NatDestination | String | If destination NAT performed, the post-NAT destination IP address. |
| SLS.Logging.Traffic.RuleMatched | String | Name of the security policy rule that the network traffic matched. |
| SLS.Logging.Traffic.DestinationPort | String | Network traffic's destination port. If this value is 0, then the app is using its standard port. |
| SLS.Logging.Traffic.TotalTimeElapsed | String | Total time taken for the network session to complete. |
| SLS.Logging.Traffic.LogSourceName | String | Device name of the source of the log |
| SLS.Logging.Traffic.Subtype | String | The log sub type. |
| SLS.Logging.Traffic.Users | String | Source/Destination user. If neither is available, source_ip is used. |
| SLS.Logging.Traffic.TunneledApp | String | Is app tunneled. |
| SLS.Logging.Traffic.IsPhishing | String | Indicates whether enterprise credentials were submitted by an end user. |
| SLS.Logging.Traffic.SessionEndReason | String | The reason a session terminated. |
| SLS.Logging.Traffic.NatSource | String | If source NAT was performed, the post-NAT source IP address. |
| SLS.Logging.Traffic.SourceIP | String | Original source IP address. |
| SLS.Logging.Traffic.SessionStartIP | date | Time when the session was established. |
| SLS.Logging.Traffic.TimeGenerated | date | Time when the log was generated on the firewall's data plane. |
| SLS.Logging.Traffic.AppCategory | String | Identifies the high-level family of the application. |
| SLS.Logging.Traffic.SourceLocation | String | Source country or internal region for private addresses. |
| SLS.Logging.Traffic.DestinationLocation | String | Destination country or internal region for private addresses. |
| SLS.Logging.Traffic.LogSourceID | String | ID that uniquely identifies the source of the log. If the source is a firewall, this is its serial number. |
| SLS.Logging.Traffic.TotalBytes | String | Number of total bytes (transmit and receive). |
| SLS.Logging.Traffic.VsysID | String | A unique identifier for a virtual system on a Palo Alto Networks firewall. |
| SLS.Logging.Traffic.ToZone | String | Networking zone to which the traffic was sent. |
| SLS.Logging.Traffic.URLCategory | String | The URL category. |
| SLS.Logging.Traffic.SourcePort | String | Source port utilized by the session. |
| SLS.Logging.Traffic.Tunnel | String | Type of tunnel. |
| SLS.Logging.Traffic.SourceDeviceHost | String | Hostname of the device from which the session originated. |
| SLS.Logging.Traffic.DestDeviceHost | String | Hostname of the device session destination.

##### Command Example

```!sls-query-traffic-logs action="allow" fields="vendor_name,log_source,rule_matched,dest_location,log_time" time_range="10 days" limit="5"```

```!sls-query-traffic-logs query="log_source_id = '{firewall_target}'" fields=all limit=5 start_time="2018-07-13 00:00:00"```

##### Context Example

{
“SLS.Logging.Traffic”: [
{
“RuleMatched”: “taplog”,
“ID”: “N2eE+oI3d+esVqaqtVGJv95p4VpTYIihtY50eFi8jgo=”,
“DestinationLocation”: “TH”,
“LogTime”: “2020-03-21T16:50:18Z”
},
{
“RuleMatched”: “taplog”,
“ID”: “+zZj7TRjBYRXuSdYrbKAYSjoQDyw4vtNwMhvjlbKGrc=”,
“DestinationLocation”: “US”,
“LogTime”: “2020-03-21T16:50:18Z”
},
{
“RuleMatched”: “taplog”,
“ID”: “PetZR587UGE/wOkxgS2b+zF364WTmJ29VnV2gihfJZM=”,
“DestinationLocation”: “US”,
“LogTime”: “2020-03-21T16:50:33Z”
},
{
“RuleMatched”: “taplog”,
“ID”: “t6dTRzTObu15RCxw6Nk7SPFXe83uxr06yPMC5Px1p8c=”,
“DestinationLocation”: “RO”,
“LogTime”: “2020-03-21T16:50:18Z”
},
{
“RuleMatched”: “taplog”,
“ID”: “X4tXn5Ub82q/DDaCyqcZfSboshpWOu+5xvOSf7ydtrY=”,
“DestinationLocation”: “CL”,
“LogTime”: “2020-03-21T16:50:18Z”
}
]
}


##### Human Readable Output

|dest_location|log_source|log_time|rule_matched|vendor_name|
|---|---|---|---|---|
| TH |  firewall | 1584809418000000 | taplog | Palo Alto Networks |
| US |  firewall | 1584809418000000 | taplog | Palo Alto Networks |
| US |  firewall | 1584809433000000 | taplog | Palo Alto Networks |
| RO |  firewall | 1584809418000000 | taplog | Palo Alto Networks |
| CL |  firewall | 1584809418000000 | taplog | Palo Alto Networks |

### 16. sls-query-threat-logs

---
Searches the firewall.threat table, which is the threat logs table for PAN-OS/Panorama.

##### Base Command

`sls-query-threat-logs`

##### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| source_ip | Original source IP address. Enter an IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2. | Optional |
| dest_ip | Original destination IP address. Enter an IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2. | Optional |
| rule_matched | Name of the security policy rule that the network traffic matched. Enter a rule name or array of rule names to search. | Optional |
| from_zone | The networking zone from which the traffic originated. Enter zone or array of zones to search. | Optional |
| to_zone | Networking zone to which the traffic was sent. Enter zone or array of zones to search. | Optional |
| source_port | Source port utilized by the session. Enter a port or array of ports to search. | Optional |
| dest_port | Network traffic's destination port. Enter a port or array of ports to search. | Optional |
| action | The action that the firewall took for the network traffic. Enter an action or array of actions to search. | Optional |
| file_sha_256 | The binary hash (SHA256) of the file. Enter a SHA256 hash or array of SHA256 hashes to search. | Optional |
| file_name | The name of the file that is blocked. Enter a file name or array of file names to search. | Optional |
| query | Free input query to search. This is the WHERE part of the query. so an example will be !sls-query-traffic-logs query="source_ip.value LIKE '192.168.1.*' AND dst = '192.168.1.12'" | Optional |
| fields | The fields that are selected in the query. Selection can be "all" (same as *) or listing of specific fields in the table. List of fields can be found after viewing all the outputted fields with all. | Optional |
| start_time | The query start time. For example, start_time="2018-04-26 00:00:00" | Optional |
| end_time | The query end time. For example, end_time="2018-04-26 00:00:00" | Optional |
| time_range | First fetch time (\<number\> \<time unit\>, e.g., 12 hours, 7 days, 3 months, 1 year) | Optional |
| limit | The number of logs to return. Default is 5. | Optional |
| page | Page to return. | Optional |
| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional |
| ip | IP address. Enter an IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2. | Optional |
| port | Port utilized by the session. Enter a port or array of ports to search. | Optional |

##### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| SLS.Logging.Threat.SessionID | String | Identifies the firewall's internal identifier for a specific network session. |
| SLS.Logging.Threat.Action | String | Identifies the action that the firewall took for the network traffic. |
| SLS.Logging.Threat.App | String | Application associated with the network traffic. |
| SLS.Logging.Threat.Nat | String | Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1. |
| SLS.Logging.Threat.SubcategoryOfApp | String | Identifies the application's subcategory. The subcategory is related to the application's category, which is identified in category_of_app. |
| SLS.Logging.Threat.PcapID | String | Packet capture (pcap) ID. This is used to correlate threat pcap files with extended pcaps taken as a part of the session flow. All threat logs will contain either a pcap_id of 0 (no associated pcap) , or an ID referencing the extended pcap file. |
| SLS.Logging.Threat.Natdst | String | If destination NAT performed, the post-NAT destination IP address. The IP address is an IPv4/IPv6 address in hex format. |
| SLS.Logging.Threat.Flags | String | Bit field which provides details on the session, such as whether the session use IPv6, whether the session was denied due to a URL filtering rule, and/or whether the log corresponds to a transaction within an HTTP proxy session. |
| SLS.Logging.Threat.Dport | String | Network traffic's destination port. If this value is 0, then the app is using its standard port. |
| SLS.Logging.Threat.ThreatID | String | Numerical identifier for the threat type. All threats encountered by Palo Alto Networks firewalls are assigned a unique identifier |
| SLS.Logging.Threat.Natsrc | String | If source NAT was performed, the post-NAT source IP address. The IP address is an IPv4/IPv6 address in hex format. |
| SLS.Logging.Threat.CategoryOfApp | String | Identifies the managing application, or parent, of the application associated with this network traffic, if any. |
| SLS.Logging.Threat.Srcloc | String | Source country or internal region for private addresses. The internal region is a user-defined name for a specific network in the user's enterprise. |
| SLS.Logging.Threat.Dstloc | String | Destination country or internal region for private addresses. The internal region is a user-defined name for a specific network in the user's enterprise. |
| SLS.Logging.Threat.To | String | Networking zone to which the traffic was sent. |
| SLS.Logging.Threat.RiskOfApp | String | Indicates how risky the application is from a network security perspective. Values range from 1-5, where 5 is the riskiest. |
| SLS.Logging.Threat.Natsport | String | Post-NAT source port. |
| SLS.Logging.Threat.URLDenied | String | Session was denied due to a URL filtering rule. |
| SLS.Logging.Threat.CharacteristicOfApp | String | Identifies the behavioral characteristic of the application associated with the network traffic. |
| SLS.Logging.Threat.HTTPMethod | String | Only in URL filtering logs. Describes the HTTP Method used in the web request |
| SLS.Logging.Threat.From | String | The networking zone from which the traffic originated. |
| SLS.Logging.Threat.Vsys | String | Virtual system associated with the network traffic. |
| SLS.Logging.Threat.ReceiveTime | String | Time the log was received at the management plane. |
| SLS.Logging.Threat.Users | String | Srcuser or dstuser or srcip (one of). |
| SLS.Logging.Threat.Proto | String | IP protocol associated with the session. |
| SLS.Logging.Threat.Natdport | String | Post-NAT destination port. |
| SLS.Logging.Threat.Dst | String | Original destination IP address. The IP address is an IPv4/ IPv6 address in hex format. |
| SLS.Logging.Threat.Rule | String | Name of the security policy rule that the network traffic matched. |
| SLS.Logging.Threat.CategoryOfThreatID | String | Threat category of the detected threat. |
| SLS.Logging.Threat.DeviceName | String | The hostname of the firewall that logged the network traffic. |
| SLS.Logging.Threat.Subtype | String | Subtype of the threat log. |
| SLS.Logging.Threat.TimeReceived | String | Time the log was received at the management plane. |
| SLS.Logging.Threat.Direction | String | Indicates the direction of the attack, client-to-server or server-to-client: |
| SLS.Logging.Threat.Misc | String | The meaning of this field differs according to the log's subtype: Subtype is URL, this field contains the requested URI. Subtype is File, this field contains the file name or file type. Subtype is Virus, this field contains the file name. Subtype is WildFire, this field contains the file name. |
| SLS.Logging.Threat.Severity | String | Severity associated with the event. |
| SLS.Logging.Threat.Src | String | Original source IP address. The IP address is an IPv4/IPv6 address in hex format. |
| SLS.Logging.Threat.TimeGenerated | String | Time the log was generated on the data plane. |
| SLS.Logging.Threat.Serial | String | Serial number of the firewall that generated the log. |
| SLS.Logging.Threat.VsysID | String | A unique identifier for a virtual system on a Palo Alto Networks firewall. |
| SLS.Logging.Threat.URLDomain | String | The name of the internet domain that was visited in this session. |
| SLS.Logging.Threat.Category | String | For the URL subtype, this identifies the URL Category. For the WildFire subtype, this identifies the verdict on the file. It is one of ‘malicious’, ‘phishing’, ‘grayware’, or ‘benign’; |
| SLS.Logging.Threat.Sport | String | Source port utilized by the session. |
| SLS.Logging.Threat.IsPhishing | Boolean | Detected enterprise credential submission by an end user. |
| SLS.Logging.Threat.SourceDeviceHost | String | Hostname of the device from which the session originated. |
| SLS.Logging.Threat.DestDeviceHost | String | Hostname of the device session destination. |
| IP.Address | String | IP address. |
| Domain.Name | String | The domain name, for example: "google.com". |
| File.SHA256 | String | The SHA256 hash of the file. |
| File.Name | String | The full file name (including file extension). |
| File.Type | String | The file type, as determined by libmagic (same as displayed in file entries). |

##### Command Examples

```!sls-query-threat-logs query="is_packet_capture = true AND severity = \"Critical\"" fields=pcap limit=10```
```!sls-query-threat-logs action="allow" fields="vendor_name,log_source,rule_matched,dest_location,log_time" time_range="10 days" limit="1"```

##### Context Example

{
“SLS.Logging.Threat”: [
{
“NatDestinationPort”: null,
“VsysID”: null,
“RuleMatched”: “taplog”,
“FromZone”: null,
“URLDomain”: null,
“DestinationLocation”: “AE”,
“IsPhishing”: null,
“URLCategory”: “”,
“NatSource”: “”,
“NatSourcePort”: null,
“IsURLDenied”: null,
“PcapID”: null,
“Direction”: “”,
“Users”: null,
“ThreatID”: null,
“SessionID”: null,
“CharacteristicOfApp”: null,
“VendorSeverity”: “”,
“LogTime”: “2020-02-22T16:50:23Z”,
“IsNat”: null,
“SubcategoryOfApp”: null,
“SourceIP”: “”,
“RiskOfApp”: null,
“DestinationIP”: “”,
“Vsys”: null,
“TimeGenerated”: null,
“Subtype”: “”,
“Flags”: null,
“ToZone”: null,
“Action”: “”,
“AppCategory”: null,
“ThreatCategory”: null,
“Protocol”: “”,
“LogSourceName”: null,
“App”: null,
“Misc”: null,
“DestinationPort”: null,
“SourcePort”: null,
“NatDestination”: “”,
“SourceLocation”: null,
“LogSourceID”: null
}
]
}


##### Human Readable Output

### Logs threat table

|dest_location|log_source|log_time|rule_matched|vendor_name|
|---|---|---|---|---|
| AE | firewall | 1582390223000000 | taplog | Palo Alto Networks |

### 17. sls-query-url-logs

---
***
Searches the firewall.url table

#### Base Command

`sls-query-url-logs`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| source_ip | Original source IP address. Enter an IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2. | Optional |
| dest_ip | Original destination IP address. Enter an IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2. | Optional |
| rule_matched | Name of the security policy rule that the network traffic matched. Enter a rule name or array of rule names to search. | Optional |
| from_zone | The networking zone from which the traffic originated. Enter zone or array of zones to search. | Optional |
| to_zone | Networking zone to which the traffic was sent. Enter zone or array of zones to search. | Optional |
| source_port | Source port utilized by the session. Enter a port or array of ports to search. | Optional |
| dest_port | Network traffic's destination port. Enter a port or array of ports to search. | Optional |
| action | The action that the firewall took for the network traffic. Enter an action or array of actions to search. | Optional |
| query | Free input query to search. This is the WHERE part of the query. so an example will be !sls-query-url-logs query="source_ip.value LIKE '192.168.1.*' AND dest_ip.value = '192.168.1.12'" | Optional |
| fields | The fields that are selected in the query. Selection can be "all" (same as *) or listing of specific fields in the table. List of fields can be found after viewing all the outputted fields with all. | Optional |
| start_time | The query start time. For example, start_time="2018-04-26 00:00:00" | Optional |
| end_time | The query end time. For example, end_time="2018-04-26 00:00:00" | Optional |
| time_range | First log time (&lt;number&gt; &lt;time unit&gt;, e.g., 12 hours, 7 days, 3 months, 1 year) | Optional |
| limit | The number of logs to return. Default is 5. | Optional |
| page | Page to return. | Optional |
| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional |
| ip | IP address. Enter an IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2. | Optional |
| port | Port utilized by the session. Enter a port or array of ports to search. | Optional |
| url | This argument allows to perform a LIKE search of the specified values on the Url and Uri fields An example value will be paloaltonetworks.com,demisto which will provide results like https://apps.paloaltonetworks.com and https://demisto.com | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| SLS.Logging.URL.SessionID | String | Identifies the firewall's internal identifier for a specific network session. |
| SLS.Logging.URL.Action | String | Identifies the action that the firewall took for the network traffic. |
| SLS.Logging.URL.App | String | Application associated with the network traffic. |
| SLS.Logging.URL.PcapID | String | Packet capture \(pcap\) ID. This is used to correlate threat pcap files with extended pcaps taken as a part of the session flow. All threat logs will contain either a pcap\_id of 0 \(no associated pcap\) , or an ID referencing the extended pcap file. |
| SLS.Logging.URL.DestinationPort | String | Network traffic's destination port. If this value is 0, then the app is using its standard port. |
| SLS.Logging.URL.AppCategory | String | Identifies the high\-level family of the application. |
| SLS.Logging.URL.AppSubCategory | String | Identifies the application's subcategory. The subcategory is related to the application's category, which is identified in category\_of\_app. |
| SLS.Logging.URL.SourceLocation | String | Source country or internal region for private addresses. |
| SLS.Logging.URL.DestinationLocation | String | Destination country or internal region for private addresses. |
| SLS.Logging.URL.ToZone | String | Networking zone to which the traffic was sent. |
| SLS.Logging.URL.FromZone | String | The networking zone from which the traffic originated. |
| SLS.Logging.URL.Protocol | String | IP protocol associated with the session. |
| SLS.Logging.URL.DestinationIP | String | Original destination IP address. |
| SLS.Logging.URL.SourceIP | String | Original source IP address. |
| SLS.Logging.URL.RuleMatched | String | Unique identifier for the security policy rule that the network traffic matched. |
| SLS.Logging.URL.ThreatCategory | String | Threat category of the detected threat. |
| SLS.Logging.URL.ThreatName | String | Threat name of the detected threat. |
| SLS.Logging.URL.Subtype | String | Identifies the log subtype. |
| SLS.Logging.URL.LogTime | String | Time the log was received in Strata Logging Service XSOAR Connector. |
| SLS.Logging.URL.LogSourceName | String | Name that uniquely identifies the source of the log. |
| SLS.Logging.URL.Denied | Boolean | Indicates whether the session was denied due to a URL filtering rule. |
| SLS.Logging.URL.Category | String | The URL category. |
| SLS.Logging.URL.SourcePort | Number | Source port utilized by the session. |
| SLS.Logging.URL.Url | String | The name of the internet domain that was visited in this session. |
| SLS.Logging.URL.Uri | String | The URI address |
| SLS.Logging.URL.ContentType | String | Content type of the HTTP response data. |
| SLS.Logging.URL.HTTPMethod | String | The HTTP Method used in the web request |
| SLS.Logging.URL.Severity | String | Severity associated with the event. |
| SLS.Logging.URL.UserAgent | String | The web browser that the user used to access the URL. |
| SLS.Logging.URL.RefererProtocol | Number | The protocol used in the HTTP REFERER header field. |
| SLS.Logging.URL.RefererPort | Number | The port used in the HTTP REFERER header field. |
| SLS.Logging.URL.RefererFQDN | String | The full domain name used in the HTTP REFERER header field. |
| SLS.Logging.URL.RefererURL | String | The url used in the HTTP REFERER header field. |
| SLS.Logging.URL.SrcUser | String | The username that initiated the network traffic. |
| SLS.Logging.URL.SrcUserInfo | String | The initiated user info. |
| SLS.Logging.URL.DstUser | String | The username to which the network traffic was destined. |
| SLS.Logging.URL.DstUserInfo | String | The destination user info. |
| SLS.Logging.URL.TechnologyOfApp | String | The networking technology used by the identified application. |
| SLS.Logging.URL.SourceDeviceHost | String | Hostname of the device from which the session originated. |
| SLS.Logging.URL.DestDeviceHost | String | Hostname of the device session destination. |

#### Command Example

```!sls-query-url-logs action="alert" ip=1.1.1.1 limit="1"```

#### Context Example

{
“SLS”: {
“Logging”: {
“URL”: [
{
“Action”: “alert”,
“App”: “web-browsing”,
“AppCategory”: “general-internet”,
“AppSubcategory”: “internet-utility”,
“Category”: “unknown”,
“ContentType”: null,
“Denied”: false,
“DestinationIP”: “1.1.1.1”,
“DestinationLocation”: “TH”,
“DestinationPort”: 80,
“DstUser”: null,
“DstUserInfo”: null,
“FromZone”: “TapZone”,
“HTTPMethod”: “get”,
“LogSourceName”: “gw”,
“LogTime”: “2019-11-04T02:00:19”,
“PcapID”: 0,
“Protocol”: “tcp”,
“RefererFQDN”: null,
“RefererPort”: null,
“RefererProtocol”: null,
“RefererURL”: null,
“RuleMatched”: “taplog”,
“SessionID”: 123456,
“Severity”: “Informational”,
“SourceIP”: “2.2.2.2”,
“SourceLocation”: “2.0.0.0-10.255.255.255”,
“SourcePort”: 123,
“SrcUser”: null,
“SrcUserInfo”: null,
“Subtype”: “url”,
“TechnologyOfApp”: “browser-based”,
“ThreatCategory”: null,
“ThreatName”: null,
“ToZone”: “TapZone”,
“URI”: “eujea0rudykqgbvianr5lqfgrykbufbamkeyizdw1npk96zax5c4h8sbxs1kgqx31nwp5jsfsgif8iorqvjocpnyff8f7ob0ukbz5rsr8swlxtrv9a0hdppm8rkjrh8hopy3dhb0lxlah9myxx70qxwtipjeufremdmg8m3vyxgxu/”,
“URL”: “kcaxusaqu8wmjfs47qnnxw7wikiwteujea0rudykqgbvianr5lqfgrykbufbamkeyizdw1npk96zax5c4h8sbxs1kgqx31nwp5jsfsgif8iorqvjocpnyff8f7ob0ukbz5rsr8swlxtrv9a0hdppm8rkjrh8hopy3dhb0lxlah9myxx70qxwtipjeufremdmg8m3vyxgxu”,
“UserAgent”: null
}
]
}
}
}


#### Human Readable Output

>### Logs url table
>
>|Action|Application|Destination Address|RuleMatched|Source Address|TimeGenerated|
>|---|---|---|---|---|---|
>| alert | web-browsing | 1.1.1.1 | taplog | 2.2.2.2 | 2019-11-04T02:00:04 |

### 18. sls-query-file-data

***
Searches the firewall.file_data table.

#### Base Command

`sls-query-file-data`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| action | Identifies the action that the firewall took for the network traffic. Possible values are: unknown, n-a, aged-out, decoder, tcp-reuse, resources-unavailable, tcp-fin, tcp-rst-from-server, tcp-rst-from-client, policy-deny, threat, decrypt-error, decrypt-unsupport-param, decrypt-cert-validation, request-timeout, shutdown-from-endpoint, abort-from-endpoint, split-tunnel. | Optional |
| app | Application associated with the network traffic. | Optional |
| app_category | Identifies the high-level family of the application. | Optional |
| dest_device_host | Hostname of the device to which the session was directed. | Optional |
| dest_ip | Original destination IP address. | Optional |
| dest_edl | The name of the external dynamic list that contains the destination IP address of the traffic. | Optional |
| dest_dynamic_address_group | The dynamic address group that Device-ID identifies as the destination for the traffic. | Optional |
| dest_location | Destination country or internal region for private addresses. | Optional |
| dest_port | Network traffic's destination port. If this value is 0, then the app is using<br/>its standard port. | Optional |
| dest_user | The username to which the network traffic was destined. | Optional |
| file_name | The name of the file that is blocked. | Optional |
| file_sha_256 | The binary hash (SHA256) of the file. | Optional |
| file_type | Palo Alto Networks textual identifier for the threat. | Optional |
| from_zone | The networking zone from which the traffic originated. | Optional |
| is_server_to_client | Indicates if direction of traffic is from server to client. | Optional |
| is_url_denied | Indicates whether the session was denied due to a URL filtering rule. | Optional |
| log_type | Identifies the log type. | Optional |
| nat_dest | If destination NAT performed, the post-NAT destination IP address. | Optional |
| nat_dest_port | Post-NAT destination port. | Optional |
| nat_source | If source NAT was performed, the post-NAT source IP address. | Optional |
| nat_source_port | Post-NAT source port. | Optional |
| rule_matched | Name of the security policy rule that the network traffic matched. | Optional |
| rule_matched_uuid | Unique identifier for the security policy rule that the network traffic matched. | Optional |
| severity | Severity as defined by the platform. | Optional |
| source_device_host | Hostname of the device from which the session originated. | Optional |
| source_ip | Original source IP address. | Optional |
| source_edl | The name of the external dynamic list that contains the source IP address of the traffic. | Optional |
| source_dynamic_address_group | The dynamic address group that Device-ID identifies as the source of the traffic. | Optional |
| source_location | Source country or internal region for private addresses. | Optional |
| source_port | Source port utilized by the session. | Optional |
| source_user | The username that initiated the network traffic. | Optional |
| sub_type | Identifies the log subtype. | Optional |
| url_category | The URL category. | Optional |
| url_domain | The name of the internet domain that was visited in this session. | Optional |
| start_time | The query start time. For example, start_time="2018-04-26 00:00:00". | Optional |
| end_time | The query end time. For example, end_time="2018-04-26 00:00:00". | Optional |
| time_range | First log time (&lt;number&gt; &lt;time unit&gt;. For example, 12 minutes, 7 days, 3 weeks). | Optional |
| limit | Limit the results to return. The default is 5. | Optional |
| page | Page to return. | Optional |
| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| SLS.Logging.File.App | String | Application associated with the network traffic. |
| SLS.Logging.File.TimeGenerated | Date | Time when the log was generated on the firewall's data plane. |
| SLS.Logging.File.SourceIP | String | Original source IP address. |
| SLS.Logging.File.DestinationLocation | String | Destination country or internal region for private addresses. |
| SLS.Logging.File.FileSHA256 | String | The binary hash \(SHA256\) of the file. |
| SLS.Logging.File.FileName | String | The name of the file that is blocked. |
| SLS.Logging.File.RuleMatched | String | Name of the security policy rule that the network traffic matched. |
| SLS.Logging.File.LogSourceName | String | Name of the source of the log - hostname of the firewall that logged the network traffic. |
| SLS.Logging.File.NatDestination | String | If destination NAT performed, the post-NAT destination IP address. |
| SLS.Logging.File.NatDestinationPort | Number | Post-NAT destination port. |
| SLS.Logging.File.CharacteristicOfApp | String | Identifies the behavioral characteristic of the application associated with the network traffic. |
| SLS.Logging.File.SourceLocation | String | Source country or internal region for private addresses. |
| SLS.Logging.File.DestinationIP | String | Original destination IP address. |
| SLS.Logging.File.Action | String | Identifies the action that the firewall took for the network traffic. |
| SLS.Logging.File.IsNat | Boolean | Indicates if the firewall is performing network address translation \(NAT\) for the logged traffic. |
| SLS.Logging.File.Protocol | String | IP protocol associated with the session. |
| SLS.Logging.File.NatSource | String | If source NAT was performed, the post-NAT source IP address. |
| SLS.Logging.File.AppCategory | String | Identifies the high-level family of the application. |
| SLS.Logging.File.IsUrlDenied | Boolean | Indicates whether the session was denied due to a URL filtering rule. |
| SLS.Logging.File.IsTunnelInspected | Boolean | Indicates whether the payload for the outer tunnel was inspected. |
| SLS.Logging.File.SequenceNo | Number | The log entry identifier, which is incremented sequentially. |
| SLS.Logging.File.IsDecryptMirror | Boolean | Indicates whether decrypted traffic was sent out in clear text through a mirror port. |
| SLS.Logging.File.IsNonStdDestPort | Boolean | Indicates if the destination port is non-standard. |
| SLS.Logging.File.RuleMatchedUuid | String | Unique identifier for the security policy rule that the network traffic matched. |
| SLS.Logging.File.IsProxy | Boolean | Indicates whether the SSL session is decrypted \(SSL Proxy\). |
| SLS.Logging.File.VendorSeverity | String | Severity associated with the event. |
| SLS.Logging.File.IsPhishing | Boolean | Indicates whether enterprise credentials were submitted by an end user. |
| SLS.Logging.File.ToZone | String | Networking zone to which the traffic was sent. |
| SLS.Logging.File.Flags | Number | Bit field which provides details on the session, such as whether the session use IPv6. |
| SLS.Logging.File.Tunnel | String | Type of tunnel. |
| SLS.Logging.File.CloudHostname | String | The hostname in which the VM-series firewall is running. |
| SLS.Logging.File.Http2Connection | Number | Parent session ID for an HTTP/2 connection. If the traffic is not using HTTP/2, this field is set to 0. |
| SLS.Logging.File.IsPrismaBranch | Boolean | Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise. |
| SLS.Logging.File.OutboundIf | String | Interface to which the network traffic was destined. |
| SLS.Logging.File.IsSymReturn | Boolean | Indicates whether symmetric return was used to forward traffic for this session. |
| SLS.Logging.File.URLCategory | String | The URL category. |
| SLS.Logging.File.IsReconExcluded | Boolean | Indicates whether source for the flow is on the firewall allow list and not subject to recon protection. |
| SLS.Logging.File.SanctionedStateOfApp | Boolean | Indicates whether the application has been flagged as sanctioned by the firewall administrator. |
| SLS.Logging.File.ReportID | Number | Identifies the analysis requested from the sandbox \(cloud or appliance\). |
| SLS.Logging.File.DestinationPort | Number | Network traffic's destination port. If this value is 0, then the app is using
its standard port. |
| SLS.Logging.File.IsDupLog | Boolean | Indicates whether this log data is available in multiple locations, such as from Strata Logging Service XSOAR Connector as well as from an on-premise log collector. |
| SLS.Logging.File.LogTime | Date | Time the log was received in Strata Logging Service XSOAR Connector. |
| SLS.Logging.File.SessionID | Number | Identifies the firewall's internal identifier for a specific network session. |
| SLS.Logging.File.RecordSize | Number | Record size. |
| SLS.Logging.File.IngestionTime | Date | Ingestion time of the log. |
| SLS.Logging.File.CountOfRepeats | Number | Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval. |
| SLS.Logging.File.VsysID | Number | A unique identifier for a virtual system on a Palo Alto Networks firewall. |
| SLS.Logging.File.VendorName | String | Identifies the vendor that produced the data. |
| SLS.Logging.File.IsMptcpOn | Boolean | Indicates whether the option is enabled on the next-generation firewall that allows a client to use multiple paths to connect to a destination host. |
| SLS.Logging.File.IsClientToServer | Boolean | Indicates if direction of traffic is from client to server. |
| SLS.Logging.File.IsServerToClient | Boolean | Indicates if direction of traffic is from server to client. |
| SLS.Logging.File.IsPacketCapture | Boolean | Indicates whether the session has a packet capture \(PCAP\). |
| SLS.Logging.File.IsTransaction | Boolean | Indicates whether the log corresponds to a transaction within an HTTP proxy session \(Proxy Transaction\). |
| SLS.Logging.File.InboundIf | String | Interface from which the network traffic was sourced. |
| SLS.Logging.File.FromZone | String | The networking zone from which the traffic originated. |
| SLS.Logging.File.FileType | String | Palo Alto Networks textual identifier for the threat. |
| SLS.Logging.File.IsPrismaMobile | Boolean | Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise. |
| SLS.Logging.File.IsContainer | Boolean | Indicates if the session is a container page access \(Container Page\). |
| SLS.Logging.File.IsSaasApp | Boolean | Internal use field. Indicates whether the application associated with this network traffic is a SAAS application. |
| SLS.Logging.File.Vsys | String | Unique identifier for a virtual system on a Palo Alto Networks firewall. |
| SLS.Logging.File.IsNat | Boolean | Indicates if the firewall is performing network address translation \(NAT\) for the logged traffic. |
| SLS.Logging.File.FileID | Number | Numerical identifier for the threat type. |
| SLS.Logging.File.IsCaptivePortal | Boolean | Indicates if user information for the session was captured through Captive Portal. |
| SLS.Logging.File.Protocol | String | IP protocol associated with the session. |
| SLS.Logging.File.CustomerID | Number | The ID that uniquely identifies the Strata Logging Service XSOAR Connector instance which received this log record. |
| SLS.Logging.File.Subtype | String | Identifies the log subtype. |
| SLS.Logging.File.TunneledApp | String | Tunneled app \(For internal use only\). |
| SLS.Logging.File.LogSourceID | String | ID that uniquely identifies the source of the log - serial number of the firewall that generated the log. |
| SLS.Logging.File.IsForwarded | Boolean | Internal-use field that indicates if the log is being forwarded. |
| SLS.Logging.File.RiskOfApp | Number | Indicates how risky the application is from a network security perspective. |
| SLS.Logging.File.PcapID | Number | Packet capture ID. |
| SLS.Logging.File.AppSubcategory | String | Identifies the application's subcategory. |
| SLS.Logging.File.IsExported | Boolean | Indicates if this log was exported from the firewall using the firewall's log export function. |
| SLS.Logging.File.Severity | String | Severity as defined by the platform. |
| SLS.Logging.File.NatSourcePort | Number | Post-NAT source port. |
| SLS.Logging.File.LogType | String | Identifies the log type. |
| SLS.Logging.File.LogSet | String | Log forwarding profile name that was applied to the session. This name was defined by the firewall's administrator. |
| SLS.Logging.File.TechnologyOfApp | String | The networking technology used by the identified application. |
| SLS.Logging.File.DirectionOfAttack | String | Indicates the direction of the attack. |
| SLS.Logging.File.LogSource | String | Identifies the origin of the data - the system that produced the data. |

#### Command Example

```!sls-query-file-data source_ip="10.10.10.101" time_range="6 months" limit="1"```

#### Context Example

{
“SLS”: {
“Logging”: {
“File”: [
{
“Action”: “alert”,
“App”: “web-browsing”,
“AppCategory”: “general-internet”,
“AppSubcategory”: “internet-utility”,
“CharacteristicOfApp”: [
“3”,
“4”,
“5”,
“6”,
“8”
],
“CloudHostname”: “CloudHostName”,
“CountOfRepeats”: 1,
“CustomerID”: “117270019”,
“DestinationIP”: “2.2.2.2”,
“DestinationLocation”: “US”,
“DestinationPort”: 80,
“DirectionOfAttack”: “server to client”,
“FileID”: 52270,
“FileName”: “TestFileName”,
“FileSHA256”: null,
“FileType”: “Google Chrome Extension File”,
“Flags”: 4202496,
“FromZone”: “LAN”,
“Http2Connection”: 0,
“InboundIf”: “ethernet”,
“IngestionTime”: 2020-04-21T18:47:31,
“IsCaptivePortal”: false,
“IsClientToServer”: false,
“IsContainer”: false,
“IsDecryptMirror”: false,
“IsDupLog”: false,
“IsExported”: false,
“IsForwarded”: true,
“IsMptcpOn”: false,
“IsNat”: true,
“IsNonStdDestPort”: false,
“IsPacketCapture”: false,
“IsParismaMobile”: null,
“IsPhishing”: false,
“IsPrismaBranch”: false,
“IsProxy”: false,
“IsReconExcluded”: false,
“IsSaasApp”: false,
“IsServerToClient”: false,
“IsSymReturn”: false,
“IsTransaction”: false,
“IsTunnelInspected”: false,
“IsUrlDenied”: false,
“LogSet”: “DEFAULT”,
“LogSource”: “firewall”,
“LogSourceID”: “015351000045229”,
“LogSourceName”: “Aristotle”,
“LogTime”: “2020-04-21T18:47:31”,
“LogType”: “threat”,
“NatDestination”: “2.2.2.2”,
“NatDestinationPort”: 80,
“NatSource”: “3.3.3.3”,
“NatSourcePort”: 12345,
“OutboundIf”: “ethernet”,
“PcapID”: 0,
“Protocol”: “tcp”,
“RecordSize”: 3477,
“ReportID”: 0,
“RiskOfApp”: 4,
“RuleMatched”: “INTERNET”,
“RuleMatchedUuid”: “123d644f-7691-437a-8f9b-4567c511bac2”,
“SanctionedStateOfApp”: false,
“SequenceNo”: 327,
“SessionID”: 16753,
“Severity”: “Low”,
“SourceIP”: “10.10.10.101”,
“Subtype”: “file”,
“TechnologyOfApp”: “browser-based”,
“TimeGenerated”: “2020-04-21T18:47:12”,
“ToZone”: “ISP”,
“Tunnel”: “N/A”,
“TunneledApp”: “tunneled-app”,
“URLCategory”: “computer-and-internet-info”,
“VendorName”: “Palo Alto Networks”,
“VendorSeverity”: “Low”,
“Vsys”: “vsys1”,
“VsysID”: 1
}
]
}
}
}


#### Human Readable Output

>### Logs file_data table
>
>|Action|Application|Destination Address|FileID|FileName|FileType|RuleMatched|Source Address|TimeGenerated|
>|---|---|---|---|---|---|---|---|---|
>| alert | web-browsing | 2.2.2.2 | 52270 | ANindV94kHC673w9zWXj8TY | Google Chrome Extension File | INTERNET | 10.10.10.101 | 2020-04-21T18:47:12 |

### 19. sls-query-gp-logs

***
Searches the firewall.globalprotect log table.

#### Base Command

`sls-query-gp-logs`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| limit | The maximum number of logs to return. Default is 10. | Optional |
| page | Page to return. | Optional |
| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional |
| transform_results | If set to false, query results are not mapped into the standard command context. Possible values are: true, false. Default is true. | Optional |
| fields | The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all". Default is all. | Optional |
| end_time | The query end time. For example, end_time="2018-04-26 00:00:00". | Optional |
| start_time | The query start time. For example, start_time="2018-04-26 00:00:00". Default is '1970-01-01 00:00:00'. | Optional |
| time_range | First log time (&lt;number&gt; &lt;time unit&gt;. For example, 12 minutes, 7 days, 3 weeks). | Optional |
| event_name | Event name for which to search. | Optional |
| gateway | GlobalProtect gateway for which to search. | Optional |
| private_ipv4 | Private IP address (v4) of the user that connected for which to search. | Optional |
| private_ipv6 | Private IP address (v6) of the user that connected for which to search. | Optional |
| public_ipv4 | Public IP address (v4) of the user that connected for which to search. | Optional |
| public_ipv6 | Public IP address (v6) of the user that connected for which to search. | Optional |
| source_user | The source username for which to search. | Optional |
| event_status | Event status (success or failure) for which to search. | Optional |
| portal | GlobalProtect portal for which to search. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| SLS.Logging.GlobalProtect.AttemptedGateways | unknown | All gateways that were available and attempted for the client location. |
| SLS.Logging.GlobalProtect.AuthMethod | unknown | Authentication method used for the GlobalProtect connection. |
| SLS.Logging.GlobalProtect.ConnectMethod | unknown | Identifies how the GlobalProtect app connected to the the Gateway. |
| SLS.Logging.GlobalProtect.ConnectionErrorID | unknown | Enumeration integer assigned to the connection_error field value. |
| SLS.Logging.GlobalProtect.ConnectionErrorValue | unknown | Error information for unsuccessful connection. |
| SLS.Logging.GlobalProtect.CountOfRepeats | unknown | Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval. |
| SLS.Logging.GlobalProtect.CustomerID | unknown | The ID that uniquely identifies the Cortex Data Lake instance which received this log record. |
| SLS.Logging.GlobalProtect.EndpointDeviceName | unknown | Name of the device that the user used for the connection. |
| SLS.Logging.GlobalProtect.EndpointGPVersion | unknown | GlobalProtect client version number. |
| SLS.Logging.GlobalProtect.EndpointOSType | unknown | OS type of the endpoint on which the GlobalProtect client is deployed. |
| SLS.Logging.GlobalProtect.EndpointOSVersion | unknown | OS version of the endpoint on which the GlobalProtect client is deployed. |
| SLS.Logging.GlobalProtect.EndpointSN | unknown | ID that uniquely identifies the endpoint on which the GlobalProtect client is deployed. |
| SLS.Logging.GlobalProtect.EventID | unknown | The name of the event. |
| SLS.Logging.GlobalProtect.Gateway | unknown | Gateway for the connection. |
| SLS.Logging.GlobalProtect.GatewayPriority | unknown | Priority of the gateway. |
| SLS.Logging.GlobalProtect.GatewaySelectionType | unknown | Gateway selection method i.e., automatic, preferred, or manual. |
| SLS.Logging.GlobalProtect.GPGatewayLocation | unknown | Location of the GlobalProtect gateway. |
| SLS.Logging.GlobalProtect.HostID | unknown | Unique identifier GlobalProtect has assigned to the host. |
| SLS.Logging.GlobalProtect.IsDuplicateLog | unknown | Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector. |
| SLS.Logging.GlobalProtect.IsExported | unknown | Indicates if this log was exported from the firewall using the firewall's log export function. |
| SLS.Logging.GlobalProtect.IsForwarded | unknown | Internal use field that indicates if the log is being forwarded. |
| SLS.Logging.GlobalProtect.IsPrismaBranch | unknown | Internal use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise. |
| SLS.Logging.GlobalProtect.IsPrismaMobile | unknown | Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise. |
| SLS.Logging.GlobalProtect.LogSource | unknown | Identifies the origin of the data. |
| SLS.Logging.GlobalProtect.LogSourceID | unknown | ID that uniquely identifies the source of the log. |
| SLS.Logging.GlobalProtect.LogSourceName | unknown | Name of the source of the log. |
| SLS.Logging.GlobalProtect.LogTime | unknown | Time the log was received in Strata Logging Service XSOAR Connector. |
| SLS.Logging.GlobalProtect.LogType | unknown | Identifies the log type. |
| SLS.Logging.GlobalProtect.LoginDuration | unknown | Duration for which the connected user was logged on. |
| SLS.Logging.GlobalProtect.Opaque | unknown | Additional information regarding the event. |
| SLS.Logging.GlobalProtect.PanoramaSN | unknown | Panorama Serial associated with SLS. |
| SLS.Logging.GlobalProtect.PlatformType | unknown | The platform type. |
| SLS.Logging.GlobalProtect.Portal | unknown | GlobalProtect portal or gateway that the user connected to. |
| SLS.Logging.GlobalProtect.PrivateIPv4 | unknown | Private IP address \(v4\) of the user that connected. |
| SLS.Logging.GlobalProtect.PrivateIPv6 | unknown | Private IP address \(v6\) of the user that connected. |
| SLS.Logging.GlobalProtect.ProjectName | unknown | Project name. |
| SLS.Logging.GlobalProtect.PublicIPv4 | unknown | Public IP address \(v4\) of the user that connected. |
| SLS.Logging.GlobalProtect.PublicIPv6 | unknown | Public IP address \(v6\) of the user that connected. |
| SLS.Logging.GlobalProtect.QuarantineReason | unknown | Quarantine reason. |
| SLS.Logging.GlobalProtect.SequenceNo | unknown | The log entry identifier, which is incremented sequentially. |
| SLS.Logging.GlobalProtect.SourceRegion | unknown | Region of the gateway \(or user\) that connected. |
| SLS.Logging.GlobalProtect.SourceUser | unknown | The username that connected. |
| SLS.Logging.GlobalProtect.SourceUserDomain | unknown | Domain to which the source user belongs. |
| SLS.Logging.GlobalProtect.SourceUserName | unknown | The source user username. |
| SLS.Logging.GlobalProtect.SourceUserUUID | unknown | Unique identifier assigned to the source user. |
| SLS.Logging.GlobalProtect.SSLResponseTime | unknown | SSL response time in milliseconds. |
| SLS.Logging.GlobalProtect.Stage | unknown | Name of the stage in the GlobalProtect connection workflow. |
| SLS.Logging.GlobalProtect.EventStatus | unknown | The status \(success or failure\) of the event. |
| SLS.Logging.GlobalProtect.Subtype | unknown | The log subtype. |
| SLS.Logging.GlobalProtect.TimeGenerated | unknown | Time when the log was generated on the firewall's data plane. |
| SLS.Logging.GlobalProtect.TunnelType | unknown | Tunnel type i.e., SSL or VPN. |
| SLS.Logging.GlobalProtect.VendorName | unknown | The vendor that produced the data. |

##### Command Example

```!sls-query-gp-logs time_range="10 days" limit="1"```

##### Context Example

{
“SLS.Logging.GlobalProtect”: [
{
“AttemptedGateways”: “gateway1,500,1;”,
“AuthMethod”: “SAML”,
“ConnectionErrorID”: “”,
“ConnectionErrorValue”: “”,
“CountOfRepeats”: 1,
“CustomerID”: “117270019”,
“EndpointDeviceName”: “device1”,
“EndpointGPVersion”: “328198”,
“EndpointOSType”: “Windows”,
“EndpointOSVersion”: “”,
“EventID”: “gateway-auth”,
“Gateway”: “gateway1”,
“GatewayPriority”: “1”,
“GatewaySelectionType”: “automatic”,
“HostID”: “12341234-1234-1234-1234-123412341234”,
“IsDuplicateLog”: false,
“IsExported”: false,
“IsForwarded”: false,
“IsPrismaBranch”: false,
“IsPrismaMobile”: false,
“LogSource”: “gw”,
“LogSourceID”: “007251000070976”,
“LogSourceName”: “gw1”,
“LogTime”: “2025-03-10T20:58:12”,
“LogType”: “globalprotect”,
“LoginDuration”: 1000,
“Opaque”: “”,
“PlatformType”: “”,
“Portal”: “portal1”,
“PrivateIPv4”: “10.0.0.1”,
“PrivateIPv6”: “”,
“ProjectName”: “”,
“PublicIPv4”: “206.116.22.23”,
“PublicIPv6”: “”,
“QuarantineReason”: “”,
“SequenceNo”: 123,
“SourceRegion”: “US”,
“SourceUser”: “user1”,
“SourceUserDomain”: “domain1”,
“SourceUserName”: “user1”,
“SSLResponseTime”: 500,
“Stage”: “login”,
“EventStatus”: “success”,
“Subtype”: “globalprotect”,
“TimeGenerated”: “2025-03-10T20:58:11”,
“TunnelType”: “IPSec”,
“VendorName”: “Palo Alto Networks”
}
]
}
```

Human Readable Output

Logs globalprotect table

AttemptedGateways	AuthMethod	ConnectionErrorID	ConnectionErrorValue	CountOfRepeats	CustomerID	EndpointDeviceName	EndpointGPVersion	EndpointOSType	EndpointOSVersion	EventID	Gateway	GatewayPriority	GatewaySelectionType	HostID	IsDuplicateLog	IsExported	IsForwarded	IsPrismaBranch	IsPrismaMobile	LogSource	LogSourceID	LogSourceName	LogTime	LogType	LoginDuration	Opaque	PlatformType	Portal	PrivateIPv4	PrivateIPv6	ProjectName	PublicIPv4	PublicIPv6	QuarantineReason	SequenceNo	SourceRegion	SourceUser	SourceUserDomain	SourceUserName	SSLResponseTime	Stage	EventStatus	Subtype	TimeGenerated	TunnelType	VendorName
gateway1,500,1;	SAML			1	117270019	device1	328198	Windows		gateway-auth	gateway1	1	automatic	12341234-1234-1234-1234-123412341234	false	false	false	false	false	gw	007251000070976	gw1	2025-03-10T20	globalprotect	1000			portal1	10.0.0.1			206.116.22.23			123	US	user1	domain1	user1	500	login	success	globalprotect	2025-03-10T20	IPSec	Palo Alto Networks

Additional Information

In the documented CDL v2, You must now specify the customer’s instance ID when you identify the log type that you want to query
against. That is, log types must be fully qualified and the instance ID is a part of the fully qualified name:
<instanceID>.firewall.traffic
However in this integration the instance ID is added automatically to the query so the name firewall.traffic is a valid table name
The SQL syntax supported for queries is csql
The provided authentication items (configuration step 4) can only be used once for each Strata Logging Service XSOAR Connector tenant (but can be shared for different Cortex XSOAR instances). Trying to re-generate those items will revoke any previously generated set of authentication items.

Configuration parameters

refresh_token — Token
reg_id — ID
auth_key — Key
credentials_auth_key —
credentials_refresh_token —
credentials_reg_id —
credentials_client_secret —
isFetch — Fetch incidents
first_fetch_timestamp — First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
fetch_table — Fetch Table
firewall_severity — Severity of events to fetch (Firewall)
firewall_subtype — Subtype of events to fetch (Firewall)
fetch_fields — Fetch Fields
filter_query — Fetch Filter
incidentType — Incident type
limit — Max. number of incidents fetched per query
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
incidentFetchInterval — Incidents Fetch Interval

Commands (19)

cdl-get-critical-threat-logs
Runs a query on the threat table according to preset queries.
cdl-get-social-applications
Runs a query on traffic table where app_sub_category = "social networking".
cdl-query-file-data
Searches the Cortex firewall.file_data table.
cdl-query-gp-logs
Searches the GlobalProtect VPN log table.
cdl-query-logs
Runs a query on any table or field.
cdl-query-threat-logs
Searches the Cortex panw.threat table, which is the threat logs table for PAN-OS/Panorama.
cdl-query-traffic-logs
Searches the Cortex firewall.traffic table. Traffic logs contain entries for the end of each network session.
cdl-query-url-logs
Searches the URL log table.
cdl-reset-authentication-timeout
Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.
cdl-search-by-file-hash
Runs a query on the threat table with the query 'SELECT * FROM `firewall.threat` WHERE file_sha_256 = <file_hash>'.
sls-get-critical-threat-logs
Runs a query on the threat table according to preset queries.
sls-get-social-applications
Runs a query on traffic table where app_sub_category = "social networking".
sls-query-file-data
Searches the Cortex firewall.file_data table.
sls-query-gp-logs
Searches the GlobalProtect VPN log table.
sls-query-logs
Runs a query on any table or field.
sls-query-threat-logs
Searches the Cortex panw.threat table, which is the threat logs table for PAN-OS/Panorama.
sls-query-traffic-logs
Searches the Cortex firewall.traffic table. Traffic logs contain entries for the end of each network session.
sls-query-url-logs
Searches the URL log table.
sls-search-by-file-hash
Runs a query on the threat table with the query 'SELECT * FROM `firewall.threat` WHERE file_sha_256 = <file_hash>'.

Source

CortexDataLake.py CortexDataLake_test.py CortexDataLake.yml CortexDataLake_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: Palo Alto Networks
sectionorder:
- Connect
- Collect
commonfields:
  id: Cortex Data Lake
  version: -1
configuration:
- display: Token
  name: refresh_token
  type: 4
  hidden: true
  required: false
  section: Connect
- display: ID
  name: reg_id
  type: 4
  hidden: true
  required: false
  section: Connect
- display: Key
  name: auth_key
  type: 4
  hidden: true
  required: false
  section: Connect
- displaypassword: Encryption Key
  name: credentials_auth_key
  hiddenusername: true
  type: 9
  required: false
  display: ""
  section: Connect
- displaypassword: Authentication Token
  additionalinfo: The API key used for OProxy authentication.
  name: credentials_refresh_token
  hiddenusername: true
  type: 9
  required: false
  display: ""
  section: Connect
- displaypassword: Registration ID
  name: credentials_reg_id
  type: 9
  hiddenusername: true
  section: Connect
  required: false
  display: ""
- displaypassword: Client Secret
  additionalinfo: The client secret used for Cortex GW SCM authentication.
  name: credentials_client_secret
  hiddenusername: true
  type: 9
  required: false
  display: ""
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- defaultvalue: 24 hours
  display: First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  name: first_fetch_timestamp
  type: 0
  required: false
  section: Collect
- additionalinfo: Choose which table incidents will be fetched from.
  defaultvalue: firewall.threat
  display: Fetch Table
  name: fetch_table
  options:
  - firewall.threat
  - firewall.file_data
  - firewall.auth
  - firewall.decryption
  - firewall.extpcap
  - firewall.globalprotect
  - firewall.hipmatch
  - firewall.iptag
  - firewall.traffic
  - firewall.url
  - firewall.userid
  - log.system
  - log.config
  type: 15
  required: false
  section: Collect
- display: Severity of events to fetch (Firewall)
  name: firewall_severity
  options:
  - all
  - Critical
  - High
  - Medium
  - Low
  - Informational
  - Unused
  type: 16
  required: false
  section: Collect
- display: Subtype of events to fetch (Firewall)
  name: firewall_subtype
  options:
  - all
  - attack
  - url
  - virus
  - spyware
  - vulnerability
  - file
  - scan
  - flood
  - packet
  - resource
  - data
  - url-content
  - wildfire
  - extpcap
  - wildfire-virus
  - http-hdr-insert
  - http-hdr
  - email-hdr
  - spyware-dns
  - spyware-wildfire-dns
  - spyware-wpc-dns
  - spyware-custom-dns
  - spyware-cloud-dns
  - spyware-raven
  - spyware-wildfire-raven
  - spyware-wpc-raven
  - wpc-virus
  - sctp
  type: 16
  required: false
  section: Collect
- additionalinfo: Comma-separated fields that will be fetched with every incident, e.g., "pcap,session_id". Enter "*" for all possible fields.
  defaultvalue: '*'
  display: Fetch Fields
  name: fetch_fields
  type: 12
  required: false
  section: Collect
- additionalinfo: 'Filter the fetched incidents according to the given query. Query example: "source_ip.value LIKE `192.168.1.*` AND dst = `192.168.1.12`" Note: Can not be used in combination with `Severity` and `Subtype` parameters.'
  display: Fetch Filter
  name: filter_query
  type: 12
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- additionalinfo: "The maximum number of incidents to fetch per query.\t\nCaution: A large number could create overload. Default is 10."
  defaultvalue: '10'
  display: Max. number of incidents fetched per query
  name: limit
  type: 0
  required: false
  section: Collect
- defaultvalue: 'false'
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- defaultvalue: "1"
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  required: false
  type: 19
  section: Collect
description: Palo Alto Networks Strata Logging Service XSOAR Connector provides cloud-based, centralized log storage and aggregation for your organization on premise, virtual (private cloud and public cloud) firewalls, for Prisma Access, and for cloud-delivered services such as Cortex XDR.
display: Strata Logging Service XSOAR Connector
name: Cortex Data Lake
script:
  commands:
  - arguments:
    - defaultValue: SELECT * FROM `firewall.traffic`
      description: |-
        A free-text SQL query. For example, query="SELECT * FROM `firewall.traffic`".
        There are multiple tables in Loggings, for example: threat, traffic, and so on.
        Refer to the Cortex Logging service schema reference for the full list.
      name: query
    - defaultValue: '10'
      description: The maximum number of logs to return. Default is 10.
      name: limit
    - auto: PREDEFINED
      defaultValue: 'true'
      description: If set to false, query results are not mapped into the standard command context. Default is "true".
      name: transform_results
      predefined:
      - 'true'
      - 'false'
    - name: page
      description: Page to return.
    - name: page_size
      description: Number of entries per page. Defaults to 50 (in case only page was provided).
    description: Runs a query on  any table or field.
    execution: true
    name: cdl-query-logs
    outputs:
    - contextPath: CDL.Logging.Action
      description: Identifies the action that the firewall took for the network traffic.
      type: String
    - contextPath: CDL.Logging.App
      description: Application associated with the network traffic.
      type: String
    - contextPath: CDL.Logging.Protocol
      description: IP protocol associated with the session.
      type: String
    - contextPath: CDL.Logging.DestinationIP
      description: Original destination IP address.
      type: String
    - contextPath: CDL.Logging.RuleMatched
      description: Name of the security policy rule that the network traffic matched.
      type: String
    - contextPath: CDL.Logging.CharacteristicOfApp
      description: Identifies the behavioral characteristic of the application associated with the network traffic.
      type: Number
    - contextPath: CDL.Logging.LogSourceName
      description: Name of the source of the log.
      type: String
    - contextPath: CDL.Logging.IsNat
      description: Indicates if the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1.
      type: Boolean
    - contextPath: CDL.Logging.NatDestinationPort
      description: Post-NAT destination port.
      type: Number
    - contextPath: CDL.Logging.NatDestination
      description: If destination NAT was performed, the post-NAT destination IP address.
      type: String
    - contextPath: CDL.Logging.NatSource
      description: If source NAT was performed, the post-NAT source IP address.
      type: String
    - contextPath: CDL.Logging.SourceIP
      description: Original source IP address.
      type: String
    - contextPath: CDL.Logging.AppCategory
      description: Identifies the high-level family of the application.
      type: String
    - contextPath: CDL.Logging.SourceLocation
      description: Source country or internal region for private addresses.
      type: String
    - contextPath: CDL.Logging.DestinationLocation
      description: Destination country or internal region for private addresses.
      type: String
    - contextPath: CDL.Logging.FileSHA256
      description: The binary hash (SHA256) of the file sent for virus analysis.
      type: String
    - contextPath: CDL.Logging.FileName
      description: The name of the infected file.
      type: String
    - contextPath: CDL.Logging.TimeGenerated
      description: Time when the log was generated on the firewall's data plane.
      type: Date
  - arguments:
    - defaultValue: '''1970-01-01 00:00:00'''
      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
      name: start_time
    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
      name: end_time
    - defaultValue: '10'
      description: The maximum number of logs to return. Default is 10.
      name: limit
    - description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
      name: time_range
    - auto: PREDEFINED
      defaultValue: 'true'
      description: If set to false, query results are not mapped into the standard command context. Default is "true".
      name: transform_results
      predefined:
      - 'true'
      - 'false'
    - name: page
      description: Page to return.
    - name: page_size
      description: Number of entries per page. Defaults to 50 (in case only page was provided).
    description: Runs a query on the threat table according to preset queries.
    name: cdl-get-critical-threat-logs
    outputs:
    - contextPath: CDL.Logging.Threat.SessionID
      description: Identifies the firewall's internal identifier for a specific network session.
      type: String
    - contextPath: CDL.Logging.Threat.Action
      description: Identifies the action that the firewall took for the network traffic.
      type: String
    - contextPath: CDL.Logging.Threat.App
      description: Application associated with the network traffic.
      type: String
    - contextPath: CDL.Logging.Threat.IsNat
      description: Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1.
      type: Boolean
    - contextPath: CDL.Logging.Threat.SubcategoryOfApp
      description: Identifies the application's subcategory. The subcategory is related to the application's category, which is identified in category_of_app.
      type: String
    - contextPath: CDL.Logging.Threat.PcapID
      description: Packet capture (pcap) ID. This is used to correlate threat pcap files with extended pcaps taken as a part of the session flow. All threat logs will contain either a pcap_id of 0 (no associated pcap), or an ID referencing the extended pcap file.
      type: String
    - contextPath: CDL.Logging.Threat.NatDestination
      description: If destination NAT is performed, the post-NAT destination IP address. The IP address is an IPv4/IPv6 address in hex format.
      type: String
    - contextPath: CDL.Logging.Threat.Flags
      description: Bit field which provides details on the session, such as whether the session use IPv6, whether the session was denied due to a URL filtering rule, and/or whether the log corresponds to a transaction within an HTTP proxy session.
      type: String
    - contextPath: CDL.Logging.Threat.DestinationPort
      description: Network traffic's destination port. If this value is 0, then the app is using its standard port.
      type: String
    - contextPath: CDL.Logging.Threat.ThreatID
      description: Numerical identifier for the threat type. All threats encountered by Palo Alto Networks firewalls are assigned a unique identifier.
      type: String
    - contextPath: CDL.Logging.Threat.NatSource
      description: If source NAT was performed, the post-NAT source IP address. The IP address is an IPv4/IPv6 address in hex format.
      type: String
    - contextPath: CDL.Logging.Threat.IsURLDenied
      description: Indicates whether the session was denied due to a URL filtering rule.
      type: Boolean
    - contextPath: CDL.Logging.Threat.Users
      description: Source/Destination user. If neither is available, source_ip is used.
      type: String
    - contextPath: CDL.Logging.Threat.TimeGenerated
      description: Time when the log was generated on the firewall's data plane.
      type: Date
    - contextPath: CDL.Logging.Threat.IsPhishing
      description: Indicates whether enterprise credentials were submitted by an end user.
      type: Boolean
    - contextPath: CDL.Logging.Threat.AppCategory
      description: Identifies the high-level family of the application.
      type: String
    - contextPath: CDL.Logging.Threat.SourceLocation
      description: Source country or internal region for private addresses.
      type: String
    - contextPath: CDL.Logging.Threat.DestinationLocation
      description: Destination country or internal region for private addresses.
      type: String
    - contextPath: CDL.Logging.Threat.ToZone
      description: Networking zone to which the traffic was sent.
      type: String
    - contextPath: CDL.Logging.Threat.RiskOfApp
      description: Indicates how risky the application is from a network security perspective.
      type: Number
    - contextPath: CDL.Logging.Threat.NatSourcePort
      description: Post-NAT source port.
      type: Number
    - contextPath: CDL.Logging.Threat.CharacteristicOfApp
      description: Identifies the behavioral characteristic of the application associated with the network traffic.
      type: Unknown
    - contextPath: CDL.Logging.Threat.FromZone
      description: The networking zone from which the traffic originated.
      type: String
    - contextPath: CDL.Logging.Threat.Vsys
      description: String representation of the unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: String
    - contextPath: CDL.Logging.Threat.Protocol
      description: IP protocol associated with the session.
      type: String
    - contextPath: CDL.Logging.Threat.NatDestinationPort
      description: Post-NAT destination port.
      type: Number
    - contextPath: CDL.Logging.Threat.DestinationIP
      description: Original destination IP address.
      type: String
    - contextPath: CDL.Logging.Threat.SourceIP
      description: Original source IP address.
      type: String
    - contextPath: CDL.Logging.Threat.RuleMatched
      description: Name of the security policy rule that the network traffic matched.
      type: String
    - contextPath: CDL.Logging.Threat.ThreatCategory
      description: Threat category of the detected threat.
      type: String
    - contextPath: CDL.Logging.Threat.ThreatName
      description: Threat name of the detected threat.
      type: String
    - contextPath: CDL.Logging.Threat.LogSourceName
      description: Name of the source of the log.
      type: String
    - contextPath: CDL.Logging.Threat.Subtype
      description: Identifies the log subtype.
      type: String
    - contextPath: CDL.Logging.Threat.Direction
      description: Indicates the direction of the attack.
      type: String
    - contextPath: CDL.Logging.Threat.FileName
      description: The name of the file that is blocked.
      type: String
    - contextPath: CDL.Logging.Threat.VendorSeverity
      description: Severity associated with the event.
      type: String
    - contextPath: CDL.Logging.Threat.LogTime
      description: Time the log was received in Strata Logging Service XSOAR Connector.
      type: String
    - contextPath: CDL.Logging.Threat.LogSourceID
      description: ID that uniquely identifies the source of the log. If the source is a firewall, then it is its serial number.
      type: String
    - contextPath: CDL.Logging.Threat.VsysID
      description: A unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: Number
    - contextPath: CDL.Logging.Threat.URLDomain
      description: The name of the internet domain that was visited in this session.
      type: String
    - contextPath: CDL.Logging.Threat.URLCategory
      description: The URL category.
      type: String
    - contextPath: CDL.Logging.Threat.SourcePort
      description: Source port utilized by the session.
      type: Number
  - arguments:
    - defaultValue: '''1970-01-01 00:00:00'''
      description: Query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
      name: start_time
    - description: Query end time. For example, end_time="2018-04-26 00:00:00".
      name: end_time
    - defaultValue: '10'
      description: The maximum number of logs to return. Default is 10.
      name: limit
    - description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
      name: time_range
    - name: page
      description: Page to return.
    - name: page_size
      description: Number of entries per page. Defaults to 50 (in case only page was provided).
    description: Runs a query on traffic table where app_sub_category = "social networking".
    name: cdl-get-social-applications
    outputs:
    - contextPath: CDL.Logging.Traffic.Action
      description: Identifies the action that the firewall took for the network traffic.
      type: String
    - contextPath: CDL.Logging.Traffic.RiskOfApp
      description: Indicates how risky the application is from a network security perspective.
      type: String
    - contextPath: CDL.Logging.Traffic.NatSourcePort
      description: Post-NAT source port.
      type: Number
    - contextPath: CDL.Logging.Traffic.SessionID
      description: Identifies the firewall's internal identifier for a specific network session.
      type: String
    - contextPath: CDL.Logging.Traffic.Packets
      description: Number of total packets (transmit and receive) seen for the session.
      type: String
    - contextPath: CDL.Logging.Traffic.CharacteristicOfApp
      description: Identifies the behavioral characteristic of the application associated with the network traffic.
      type: String
    - contextPath: CDL.Logging.Traffic.App
      description: Application associated with the network traffic.
      type: String
    - contextPath: CDL.Logging.Traffic.Vsys
      description: Virtual system associated with the network traffic.
      type: String
    - contextPath: CDL.Logging.Traffic.IsNat
      description: Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1, otherwise it is 0.
      type: Boolean
    - contextPath: CDL.Logging.Traffic.LogTime
      description: Time the log was received in Strata Logging Service XSOAR Connector.
      type: date
    - contextPath: CDL.Logging.Traffic.SubcategoryOfApp
      description: Identifies the application's subcategory. The subcategory is related to the application's category.
      type: String
    - contextPath: CDL.Logging.Traffic.Protocol
      description: IP protocol associated with the session.
      type: String
    - contextPath: CDL.Logging.Traffic.NatDestinationPort
      description: Post-NAT destination port.
      type: String
    - contextPath: CDL.Logging.Traffic.DestinationIP
      description: Original destination IP address.
      type: String
    - contextPath: CDL.Logging.Traffic.NatDestination
      description: If destination NAT performed, the post-NAT destination IP address.
      type: String
    - contextPath: CDL.Logging.Traffic.RuleMatched
      description: Name of the security policy rule that the network traffic matched.
      type: String
    - contextPath: CDL.Logging.Traffic.DestinationPort
      description: Network traffic's destination port. If this value is 0, then the app is using its standard port.
      type: String
    - contextPath: CDL.Logging.Traffic.TotalTimeElapsed
      description: Total time for the network session to complete.
      type: String
    - contextPath: CDL.Logging.Traffic.LogSourceName
      description: Device name of the source of the log.
      type: String
    - contextPath: CDL.Logging.Traffic.Subtype
      description: The log sub type.
      type: String
    - contextPath: CDL.Logging.Traffic.Users
      description: Source/Destination user. If neither is available, source_ip is used.
      type: String
    - contextPath: CDL.Logging.Traffic.TunneledApp
      description: Whether the app is tunneled.
      type: String
    - contextPath: CDL.Logging.Traffic.IsPhishing
      description: Indicates whether enterprise credentials were submitted by an end user.
      type: String
    - contextPath: CDL.Logging.Traffic.SessionEndReason
      description: The reason a session terminated.
      type: String
    - contextPath: CDL.Logging.Traffic.NatSource
      description: If source NAT was performed, the post-NAT source IP address.
      type: String
    - contextPath: CDL.Logging.Traffic.SourceIP
      description: Original source IP address.
      type: String
    - contextPath: CDL.Logging.Traffic.SessionStartIP
      description: Time when the session was established.
      type: date
    - contextPath: CDL.Logging.Traffic.TimeGenerated
      description: Time when the log was generated on the firewall's data plane.
      type: date
    - contextPath: CDL.Logging.Traffic.AppCategory
      description: Identifies the high-level family of the application.
      type: String
    - contextPath: CDL.Logging.Traffic.SourceLocation
      description: Source country or internal region for private addresses.
      type: String
    - contextPath: CDL.Logging.Traffic.DestinationLocation
      description: Destination country or internal region for private addresses.
      type: String
    - contextPath: CDL.Logging.Traffic.LogSourceID
      description: ID that uniquely identifies the source of the log. If the source is a firewall, then it is its serial number.
      type: String
    - contextPath: CDL.Logging.Traffic.TotalBytes
      description: Number of total bytes (transmit and receive).
      type: String
    - contextPath: CDL.Logging.Traffic.VsysID
      description: A unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: String
    - contextPath: CDL.Logging.Traffic.ToZone
      description: Networking zone to which the traffic was sent.
      type: String
    - contextPath: CDL.Logging.Traffic.URLCategory
      description: The URL category.
      type: String
    - contextPath: CDL.Logging.Traffic.SourcePort
      description: Source port utilized by the session.
      type: String
    - contextPath: CDL.Logging.Traffic.Tunnel
      description: Type of tunnel.
      type: String
  - arguments:
    - defaultValue: '''1970-01-01 00:00:00'''
      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
      name: start_time
    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
      name: end_time
    - defaultValue: '10'
      description: The maximum number of logs to return. Default is 10.
      name: limit
    - description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
      name: time_range
    - description: The SHA256 hash of the file for the query. For example, SHA256="503ca1a4fc0d48b18c0336f544ba0f0abf305ae3a3f49b3c2b86b8645d6572dc" would return all logs associated with this file.
      name: SHA256
      required: true
    - name: page
      description: Page to return.
    - name: page_size
      description: Number of entries per page. Defaults to 50 (in case only page was provided).
    description: Runs a query on the threat table with the query 'SELECT * FROM `firewall.threat` WHERE file_sha_256 = <file_hash>'.
    name: cdl-search-by-file-hash
    outputs:
    - contextPath: CDL.Logging.Threat.SessionID
      description: Identifies the firewall's internal identifier for a specific network session.
      type: String
    - contextPath: CDL.Logging.Threat.Action
      description: Identifies the action that the firewall took for the network traffic.
      type: String
    - contextPath: CDL.Logging.Threat.App
      description: Application associated with the network traffic.
      type: String
    - contextPath: CDL.Logging.Threat.IsNat
      description: Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1, otherwise it is 0.
      type: Boolean
    - contextPath: CDL.Logging.Threat.SubcategoryOfApp
      description: Identifies the application's subcategory. The subcategory is related to the application's category, which is identified in category_of_app.
      type: String
    - contextPath: CDL.Logging.Threat.PcapID
      description: Packet capture (pcap) ID. This is used to correlate threat pcap files with extended pcaps taken as a part of the session flow. All threat logs will contain either a pcap_id of 0 (no associated pcap) , or an ID referencing the extended pcap file.
      type: String
    - contextPath: CDL.Logging.Threat.NatDestination
      description: If destination NAT performed, the post-NAT destination IP address. The IP address is an IPv4/IPv6 address in hex format.
      type: String
    - contextPath: CDL.Logging.Threat.Flags
      description: Bit field which provides details on the session, such as whether the session use IPv6, whether the session was denied due to a URL filtering rule, and/or whether the log corresponds to a transaction within an HTTP proxy session.
      type: String
    - contextPath: CDL.Logging.Threat.DestinationPort
      description: Network traffic's destination port. If this value is 0, then the app is using its standard port.
      type: String
    - contextPath: CDL.Logging.Threat.ThreatID
      description: Numerical identifier for the threat type. All threats encountered by Palo Alto Networks firewalls are assigned a unique identifier.
      type: String
    - contextPath: CDL.Logging.Threat.NatSource
      description: If source NAT was performed, the post-NAT source IP address. The IP address is an IPv4/IPv6 address in hex format.
      type: String
    - contextPath: CDL.Logging.Threat.IsURLDenied
      description: Indicates whether the session was denied due to a URL filtering rule.
      type: Boolean
    - contextPath: CDL.Logging.Threat.Users
      description: Source/Destination user. If neither is available, source_ip is used.
      type: String
    - contextPath: CDL.Logging.Threat.TimeGenerated
      description: Time when the log was generated on the firewall's data plane.
      type: Date
    - contextPath: CDL.Logging.Threat.IsPhishing
      description: Indicates whether enterprise credentials were submitted by an end user.
      type: Boolean
    - contextPath: CDL.Logging.Threat.AppCategory
      description: Identifies the high-level family of the application.
      type: String
    - contextPath: CDL.Logging.Threat.SourceLocation
      description: Source country or internal region for private addresses.
      type: String
    - contextPath: CDL.Logging.Threat.DestinationLocation
      description: Destination country or internal region for private addresses.
      type: String
    - contextPath: CDL.Logging.Threat.ToZone
      description: Networking zone to which the traffic was sent.
      type: String
    - contextPath: CDL.Logging.Threat.RiskOfApp
      description: Indicates how risky the application is from a network security perspective.
      type: Number
    - contextPath: CDL.Logging.Threat.NatSourcePort
      description: Post-NAT source port.
      type: Number
    - contextPath: CDL.Logging.Threat.CharacteristicOfApp
      description: Identifies the behavioral characteristic of the application associated with the network traffic.
      type: Unknown
    - contextPath: CDL.Logging.Threat.FromZone
      description: The networking zone from which the traffic originated.
      type: String
    - contextPath: CDL.Logging.Threat.Vsys
      description: String representation of the unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: String
    - contextPath: CDL.Logging.Threat.Protocol
      description: IP protocol associated with the session.
      type: String
    - contextPath: CDL.Logging.Threat.NatDestinationPort
      description: Post-NAT destination port.
      type: Number
    - contextPath: CDL.Logging.Threat.DestinationIP
      description: Original destination IP address.
      type: String
    - contextPath: CDL.Logging.Threat.SourceIP
      description: Original source IP address.
      type: String
    - contextPath: CDL.Logging.Threat.RuleMatched
      description: Unique identifier for the security policy rule that the network traffic matched.
      type: String
    - contextPath: CDL.Logging.Threat.ThreatCategory
      description: Threat category of the detected threat.
      type: String
    - contextPath: CDL.Logging.Threat.LogSourceName
      description: Name of the source of the log.
      type: String
    - contextPath: CDL.Logging.Threat.Subtype
      description: Identifies the log subtype.
      type: String
    - contextPath: CDL.Logging.Threat.Direction
      description: Indicates the direction of the attack.
      type: String
    - contextPath: CDL.Logging.Threat.FileName
      description: The name of the file that is blocked.
      type: String
    - contextPath: CDL.Logging.Threat.VendorSeverity
      description: Severity associated with the event.
      type: String
    - contextPath: CDL.Logging.Threat.LogTime
      description: Time the log was received in Strata Logging Service XSOAR Connector.
      type: String
    - contextPath: CDL.Logging.Threat.LogSourceID
      description: ID that uniquely identifies the source of the log. If the source is a firewall, then it is its serial number.
      type: String
    - contextPath: CDL.Logging.Threat.VsysID
      description: A unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: Number
    - contextPath: CDL.Logging.Threat.URLDomain
      description: The name of the internet domain that was visited in this session.
      type: String
    - contextPath: CDL.Logging.Threat.URLCategory
      description: The URL category.
      type: String
    - contextPath: CDL.Logging.Threat.SourcePort
      description: Source port utilized by the session.
      type: Number
  - arguments:
    - description: A source IP address or an array of source IPs addresses for which to search, for example 1.1.1.1,2.2.2.2.
      name: source_ip
    - description: A rule name or an array of rule names to search.
      name: rule
    - description: A source zone name or an array of source zone names to search.
      name: from_zone
    - description: A destination zone name or an array of zone names to search.
      name: to_zone
    - description: Source port utilized by the session. Can be a port number or an array of destination port numbers to search. For example '443' or '443,445'.
      name: source_port
    - description: An action name or an array of action names to search.
      name: action
    - description: A free-text query for which to search. This forms the WHERE part of the query, for example, !cdl-query-traffic-logs query="source_ip.value LIKE '192.168.1.*' AND dest_ip.value='8.8.8.8' And dest_port=1234".
      name: query
    - auto: PREDEFINED
      defaultValue: all
      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
      name: fields
      predefined:
      - all
      - vendor_name
      - log_source
      - log_source_id
      - log_source_name
      - customer_id
      - log_time
      - log_source_tz_offset
      - log_type
      - sub_type
      - source_ip
      - source_port
      - dest_ip
      - dest_port
      - protocol
      - action_source
      - bytes_total
      - bytes_received
      - bytes_sent
      - ep_assoc_id
      - chunks_total
      - chunks_received
      - chunks_sent
      - packets_total
      - packets_received
      - packets_sent
      - session_start_time
      - total_time_elapsed
      - session_end_reason
      - traffic_flags
      - url_category
      - action
      - action_flags
      - app
      - app_category
      - characteristics_of_app
      - container_of_app
      - dg_hier_level_1
      - dg_hier_level_2
      - dg_hier_level_3
      - dg_hier_level_4
      - dest_uuid
      - dest_location
      - dest_user
      - dest_user_info
      - is_exported
      - is_forwarded
      - from_zone
      - http2_connection
      - inbound_if
      - inbound_if_details
      - is_saas_app
      - is_dup_log
      - is_prisma_branch
      - is_prisma_mobile
      - log_set
      - monitor_tag_imei
      - nat_dest_port
      - nat_dest
      - nat_source_port
      - nat_source
      - non_standard_dest_port
      - outbound_if
      - outbound_if_details
      - parent_session_id
      - parent_start_time
      - count_of_repeats
      - risk_of_app
      - rule_matched
      - rule_matched_uuid
      - sanctioned_state_of_app
      - sequence_no
      - session_id
      - source_uuid
      - source_location
      - source_user
      - source_user_info
      - app_sub_category
      - technology_of_app
      - time_generated
      - to_zone
      - tunnel
      - tunneled_app
      - tunnelid_imsi
      - users
      - vsys_id
      - vsys
      - vsys_name
      - flags
      - is_decrypt_mirror
      - is_sym_return
      - is_container
      - is_server_to_client
      - is_client_to_server
      - is_transaction
      - is_non_std_dest_port
      - is_captive_portal
      - is_nat
      - is_proxy
      - is_packet_capture
      - is_phishing
      - is_mptcp_on
      - is_recon_excluded
      - is_url_denied
      - is_tunnel_inspected
      - is_source_x_fwded
      - is_ipv6
      - is_decrypted_payload_fwded
      - is_decryption_log
      - is_l7_inspection_b4_session
      - sess_owner_rt_midx
      - session_tracker
      - container_id
      - pod_namespace
      - pod_name
      - source_device_class
      - source_device_vendor
      - source_device_model
      - source_device_os
      - source_device_mac
      - dest_device_class
      - dest_device_vendor
      - dest_device_model
      - dest_device_os
      - dest_device_mac
      - link_change_count
      - policy_id
      - link_switches
      - sdwan_cluster
      - sdwan_device_type
      - sdwan_cluster_type
      - sdwan_site
      - dynusergroup_name
      - ingestion_time
      - record_size
      - source_device_host
      - dest_device_host
    - defaultValue: '''1970-01-01 00:00:00'''
      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
      name: start_time
    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
      name: end_time
    - description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
      name: time_range
    - defaultValue: '5'
      description: The maximum number of logs to return. Default is 5.
      name: limit
    - name: page
      description: Page to return.
    - name: page_size
      description: Number of entries per page. Defaults to 50 (in case only page was provided).
    - description: A destination IP address or an array of destination IPs addresses for which to search, for example 1.1.1.1,2.2.2.2.
      name: dest_ip
    - description: Destination port utilized by the session. Can be port number or an array of destination port numbers to search. For example '443' or '443,445'.
      name: dest_port
    - description: An IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2. Used instead of the source/destination IP address.
      name: ip
    - description: A port or array of ports to search. Used instead of the source/destination port.
      name: port
    description: Searches the Cortex firewall.traffic table. Traffic logs contain entries for the end of each network session.
    name: cdl-query-traffic-logs
    outputs:
    - contextPath: CDL.Logging.Traffic.Action
      description: Identifies the action that the firewall took for the network traffic.
      type: String
    - contextPath: CDL.Logging.Traffic.RiskOfApp
      description: Indicates how risky the application is from a network security perspective.
      type: String
    - contextPath: CDL.Logging.Traffic.NatSourcePort
      description: Post-NAT source port.
      type: Number
    - contextPath: CDL.Logging.Traffic.SessionID
      description: Identifies the firewall's internal identifier for a specific network session.
      type: String
    - contextPath: CDL.Logging.Traffic.Packets
      description: Number of total packets (transmit and receive) seen for the session.
      type: String
    - contextPath: CDL.Logging.Traffic.CharacteristicOfApp
      description: Identifies the behavioral characteristic of the application associated with the network traffic.
      type: String
    - contextPath: CDL.Logging.Traffic.App
      description: Application associated with the network traffic.
      type: String
    - contextPath: CDL.Logging.Traffic.Vsys
      description: Virtual system associated with the network traffic.
      type: String
    - contextPath: CDL.Logging.Traffic.IsNat
      description: Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1, otherwise it is 0.
      type: Boolean
    - contextPath: CDL.Logging.Traffic.LogTime
      description: Time the log was received in Strata Logging Service XSOAR Connector.
      type: date
    - contextPath: CDL.Logging.Traffic.SubcategoryOfApp
      description: Identifies the application's subcategory. The subcategory is related to the application's category.
      type: String
    - contextPath: CDL.Logging.Traffic.Protocol
      description: IP protocol associated with the session.
      type: String
    - contextPath: CDL.Logging.Traffic.NatDestinationPort
      description: Post-NAT destination port.
      type: String
    - contextPath: CDL.Logging.Traffic.DestinationIP
      description: Original destination IP address.
      type: String
    - contextPath: CDL.Logging.Traffic.NatDestination
      description: If destination NAT performed, the post-NAT destination IP address.
      type: String
    - contextPath: CDL.Logging.Traffic.RuleMatched
      description: Name of the security policy rule that the network traffic matched.
      type: String
    - contextPath: CDL.Logging.Traffic.DestinationPort
      description: Network traffic's destination port. If this value is 0, then the app is using its standard port.
      type: String
    - contextPath: CDL.Logging.Traffic.TotalTimeElapsed
      description: Total time for the network session to complete.
      type: String
    - contextPath: CDL.Logging.Traffic.LogSourceName
      description: Device name of the source of the log.
      type: String
    - contextPath: CDL.Logging.Traffic.Subtype
      description: The log sub type.
      type: String
    - contextPath: CDL.Logging.Traffic.Users
      description: Source/Destination user. If neither is available, source_ip is used.
      type: String
    - contextPath: CDL.Logging.Traffic.TunneledApp
      description: Whether the app is tunneled.
      type: String
    - contextPath: CDL.Logging.Traffic.IsPhishing
      description: Indicates whether enterprise credentials were submitted by an end user.
      type: String
    - contextPath: CDL.Logging.Traffic.SessionEndReason
      description: The reason a session terminated.
      type: String
    - contextPath: CDL.Logging.Traffic.NatSource
      description: If source NAT was performed, the post-NAT source IP address.
      type: String
    - contextPath: CDL.Logging.Traffic.SourceIP
      description: Original source IP address.
      type: String
    - contextPath: CDL.Logging.Traffic.SessionStartIP
      description: Time when the session was established.
      type: date
    - contextPath: CDL.Logging.Traffic.TimeGenerated
      description: Time when the log was generated on the firewall's data plane.
      type: date
    - contextPath: CDL.Logging.Traffic.AppCategory
      description: Identifies the high-level family of the application.
      type: String
    - contextPath: CDL.Logging.Traffic.SourceLocation
      description: Source country or internal region for private addresses.
      type: String
    - contextPath: CDL.Logging.Traffic.DestinationLocation
      description: Destination country or internal region for private addresses.
      type: String
    - contextPath: CDL.Logging.Traffic.LogSourceID
      description: ID that uniquely identifies the source of the log. If the source is a firewall, then it is its serial number.
      type: String
    - contextPath: CDL.Logging.Traffic.TotalBytes
      description: Number of total bytes (transmit and receive).
      type: String
    - contextPath: CDL.Logging.Traffic.VsysID
      description: A unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: String
    - contextPath: CDL.Logging.Traffic.ToZone
      description: Networking zone to which the traffic was sent.
      type: String
    - contextPath: CDL.Logging.Traffic.URLCategory
      description: The URL category.
      type: String
    - contextPath: CDL.Logging.Traffic.SourcePort
      description: Source port utilized by the session.
      type: String
    - contextPath: CDL.Logging.Traffic.Tunnel
      description: Type of tunnel.
      type: String
    - contextPath: CDL.Logging.Traffic.SourceDeviceHost
      description: Hostname of the device from which the session originated.
      type: String
    - contextPath: CDL.Logging.Traffic.DestDeviceHost
      description: Hostname of the device session destination.
      type: String
  - arguments:
    - description: Original source IP address. Enter an IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2.
      name: source_ip
    - description: Original destination IP address. Enter an IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2.
      name: dest_ip
    - description: Name of the security policy rule that the network traffic matched. Enter a rule name or array of rule names to search.
      name: rule_matched
    - description: The networking zone from which the traffic originated. Enter the zone or array of zones to search.
      name: from_zone
    - description: The networking zone to which the traffic was sent. Enter the zone or array of zones to search.
      name: to_zone
    - description: Source port utilized by the session. Enter a port or array of ports to search.
      name: source_port
    - description: Network traffic's destination port. Enter a port or array of ports to search.
      name: dest_port
    - auto: PREDEFINED
      description: The action that the firewall took for the network traffic. Enter an action or array of actions to search.
      name: action
      predefined:
      - unknown
      - n-a
      - aged-out
      - decoder
      - tcp-reuse
      - resources-unavailable
      - tcp-fin
      - tcp-rst-from-server
      - tcp-rst-from-client
      - policy-deny
      - threat
      - decrypt-error
      - decrypt-unsupport-param
      - decrypt-cert-validation
      - request-timeout
      - shutdown-from-endpoint
      - abort-from-endpoint
      - split-tunnel
    - description: The binary hash (SHA256) of the file. Enter a SHA256 hash or array of SHA256 hashes to search.
      name: file_sha_256
    - description: The name of the file that is blocked. Enter a file name or array of file names to search.
      name: file_name
    - description: Free input query to search. This is the WHERE part of the query. so an example will be !cdl-query-traffic-logs query="source_ip.value LIKE '192.168.1.*' AND dest_ip.value = '192.168.1.12'".
      name: query
    - auto: PREDEFINED
      defaultValue: all
      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
      isArray: true
      name: fields
      predefined:
      - vendor_name
      - log_source
      - log_source_id
      - log_source_name
      - customer_id
      - log_time
      - log_source_tz_offset
      - log_type
      - sub_type
      - source_ip
      - source_port
      - dest_ip
      - dest_port
      - protocol
      - threat_id
      - threat_name
      - threat_category
      - cloud_hostname
      - direction_of_attack
      - url_domain
      - url_idx
      - file_name
      - cloud
      - file_sha_256
      - file_type
      - sender_of_virus
      - recipient_of_virus
      - subject_of_email
      - report_id
      - verdict
      - vendor_severity
      - severity
      - pcap
      - pcap_id
      - sig_flags
      - url_category
      - action
      - action_flags
      - app
      - app_category
      - characteristics_of_app
      - container_of_app
      - dg_hier_level_1
      - dg_hier_level_2
      - dg_hier_level_3
      - dg_hier_level_4
      - dest_uuid
      - dest_location
      - dest_user
      - dest_user_info
      - is_exported
      - is_forwarded
      - from_zone
      - http2_connection
      - inbound_if
      - inbound_if_details
      - is_saas_app
      - is_dup_log
      - is_prisma_branch
      - is_prisma_mobile
      - log_set
      - monitor_tag_imei
      - nat_dest_port
      - nat_dest
      - nat_source_port
      - nat_source
      - non_standard_dest_port
      - outbound_if
      - outbound_if_details
      - parent_session_id
      - parent_start_time
      - count_of_repeats
      - risk_of_app
      - rule_matched
      - rule_matched_uuid
      - sanctioned_state_of_app
      - sequence_no
      - session_id
      - source_uuid
      - source_location
      - source_user
      - source_user_info
      - app_sub_category
      - technology_of_app
      - time_generated
      - to_zone
      - tunnel
      - tunneled_app
      - tunnelid_imsi
      - users
      - vsys_id
      - vsys
      - vsys_name
      - flags
      - is_decrypt_mirror
      - is_sym_return
      - is_container
      - is_server_to_client
      - is_client_to_server
      - is_transaction
      - is_non_std_dest_port
      - is_captive_portal
      - is_nat
      - is_proxy
      - is_packet_capture
      - is_phishing
      - is_mptcp_on
      - is_recon_excluded
      - is_url_denied
      - is_tunnel_inspected
      - is_source_x_fwded
      - is_ipv6
      - container_id
      - pod_namespace
      - pod_name
      - source_device_class
      - source_device_vendor
      - source_device_model
      - source_device_os
      - source_device_mac
      - dest_device_class
      - dest_device_vendor
      - dest_device_model
      - dest_device_os
      - dest_device_mac
      - content_version
      - dynusergroup_name
      - ingestion_time
      - record_size
      - source_device_host
      - dest_device_host
    - defaultValue: '''1970-01-01 00:00:00'''
      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
      name: start_time
    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
      name: end_time
    - description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
      name: time_range
    - defaultValue: '5'
      description: The maximum number of logs to return. Default is 5.
      name: limit
    - name: page
      description: Page to return.
    - name: page_size
      description: Number of entries per page. Defaults to 50 (in case only page was provided).
    - description: The IP address or an array of IP addresses for which to search. For example 1.1.1.1,2.2.2.2. Used instead of the source/destination IP address.
      name: ip
    - description: The port or array of ports to search. Used instead of the source/destination port.
      name: port
    description: Searches the Cortex panw.threat table, which is the threat logs table for PAN-OS/Panorama.
    name: cdl-query-threat-logs
    outputs:
    - contextPath: CDL.Logging.Threat.SessionID
      description: Identifies the firewall's internal identifier for a specific network session.
      type: String
    - contextPath: CDL.Logging.Threat.Action
      description: Identifies the action that the firewall took for the network traffic.
      type: String
    - contextPath: CDL.Logging.Threat.App
      description: Application associated with the network traffic.
      type: String
    - contextPath: CDL.Logging.Threat.IsNat
      description: Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1, otherwise it is 0.
      type: Boolean
    - contextPath: CDL.Logging.Threat.SubcategoryOfApp
      description: Identifies the application's subcategory. The subcategory is related to the application's category, which is identified in category_of_app.
      type: String
    - contextPath: CDL.Logging.Threat.PcapID
      description: Packet capture (pcap) ID. This is used to correlate threat pcap files with extended pcaps taken as a part of the session flow. All threat logs will contain either a pcap_id of 0 (no associated pcap) , or an ID referencing the extended pcap file.
      type: String
    - contextPath: CDL.Logging.Threat.NatDestination
      description: If destination NAT performed, the post-NAT destination IP address. The IP address is an IPv4/IPv6 address in hex format.
      type: String
    - contextPath: CDL.Logging.Threat.Flags
      description: Bit field which provides details on the session, such as whether the session use IPv6, whether the session was denied due to a URL filtering rule, and/or whether the log corresponds to a transaction within an HTTP proxy session.
      type: String
    - contextPath: CDL.Logging.Threat.DestinationPort
      description: Network traffic's destination port. If this value is 0, then the app is using its standard port.
      type: String
    - contextPath: CDL.Logging.Threat.ThreatID
      description: Numerical identifier for the threat type. All threats encountered by Palo Alto Networks firewalls are assigned a unique identifier.
      type: String
    - contextPath: CDL.Logging.Threat.NatSource
      description: If source NAT was performed, the post-NAT source IP address. The IP address is an IPv4/IPv6 address in hex format.
      type: String
    - contextPath: CDL.Logging.Threat.IsURLDenied
      description: Indicates whether the session was denied due to a URL filtering rule.
      type: Boolean
    - contextPath: CDL.Logging.Threat.Users
      description: Source/Destination user. If neither is available, source_ip is used.
      type: String
    - contextPath: CDL.Logging.Threat.TimeGenerated
      description: Time when the log was generated on the firewall's data plane.
      type: Date
    - contextPath: CDL.Logging.Threat.IsPhishing
      description: Indicates whether enterprise credentials were submitted by an end user.
      type: Boolean
    - contextPath: CDL.Logging.Threat.AppCategory
      description: Identifies the high-level family of the application.
      type: String
    - contextPath: CDL.Logging.Threat.SourceLocation
      description: Source country or internal region for private addresses.
      type: String
    - contextPath: CDL.Logging.Threat.DestinationLocation
      description: Destination country or internal region for private addresses.
      type: String
    - contextPath: CDL.Logging.Threat.ToZone
      description: Networking zone to which the traffic was sent.
      type: String
    - contextPath: CDL.Logging.Threat.RiskOfApp
      description: Indicates how risky the application is from a network security perspective.
      type: Number
    - contextPath: CDL.Logging.Threat.NatSourcePort
      description: Post-NAT source port.
      type: Number
    - contextPath: CDL.Logging.Threat.CharacteristicOfApp
      description: Identifies the behavioral characteristic of the application associated with the network traffic.
      type: Unknown
    - contextPath: CDL.Logging.Threat.FromZone
      description: The networking zone from which the traffic originated.
      type: String
    - contextPath: CDL.Logging.Threat.Vsys
      description: String representation of the unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: String
    - contextPath: CDL.Logging.Threat.Protocol
      description: IP protocol associated with the session.
      type: String
    - contextPath: CDL.Logging.Threat.NatDestinationPort
      description: Post-NAT destination port.
      type: Number
    - contextPath: CDL.Logging.Threat.DestinationIP
      description: Original destination IP address.
      type: String
    - contextPath: CDL.Logging.Threat.SourceIP
      description: Original source IP address.
      type: String
    - contextPath: CDL.Logging.Threat.RuleMatched
      description: Unique identifier for the security policy rule that the network traffic matched.
      type: String
    - contextPath: CDL.Logging.Threat.ThreatCategory
      description: Threat category of the detected threat.
      type: String
    - contextPath: CDL.Logging.Threat.ThreatName
      description: Threat name of the detected threat.
      type: String
    - contextPath: CDL.Logging.Threat.LogSourceName
      description: Name of the source of the log.
      type: String
    - contextPath: CDL.Logging.Threat.Subtype
      description: Identifies the log subtype.
      type: String
    - contextPath: CDL.Logging.Threat.Direction
      description: Indicates the direction of the attack.
      type: String
    - contextPath: CDL.Logging.Threat.FileName
      description: The name of the file that is blocked.
      type: String
    - contextPath: CDL.Logging.Threat.VendorSeverity
      description: Severity associated with the event.
      type: String
    - contextPath: CDL.Logging.Threat.LogTime
      description: Time the log was received in Strata Logging Service XSOAR Connector.
      type: String
    - contextPath: CDL.Logging.Threat.LogSourceID
      description: ID that uniquely identifies the source of the log. If the source is a firewall, then it is its serial number.
      type: String
    - contextPath: CDL.Logging.Threat.VsysID
      description: A unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: Number
    - contextPath: CDL.Logging.Threat.URLDomain
      description: The name of the internet domain that was visited in this session.
      type: String
    - contextPath: CDL.Logging.Threat.URLCategory
      description: The URL category.
      type: String
    - contextPath: CDL.Logging.Threat.SourcePort
      description: Source port utilized by the session.
      type: Number
    - contextPath: CDL.Logging.Threat.SourceDeviceHost
      description: Hostname of the device from which the session originated.
      type: String
    - contextPath: CDL.Logging.Threat.DestDeviceHost
      description: Hostname of the device session destination.
      type: String
  - arguments:
    - description: A source IP address or an array of IP addresses for which to search. For example, 1.1.1.1,2.2.2.2.
      name: source_ip
    - description: A destination IP address or an array of IP addresses for which to search. For example, 1.1.1.1,2.2.2.2.
      name: dest_ip
    - description: The name of the security policy rule or an array of rule names to search.
      name: rule_matched
    - description: The networking zone or array of zones to search.
      name: from_zone
    - description: The networking zone or array of zones to search.
      name: to_zone
    - description: The source port or array of ports to search.
      name: source_port
    - description: The network traffic's destination port or array of ports to search.
      name: dest_port
    - auto: PREDEFINED
      description: The action or array of actions that the firewall undertook to search.
      name: action
      predefined:
      - unknown
      - n-a
      - aged-out
      - decoder
      - tcp-reuse
      - resources-unavailable
      - tcp-fin
      - tcp-rst-from-server
      - tcp-rst-from-client
      - policy-deny
      - threat
      - decrypt-error
      - decrypt-unsupport-param
      - decrypt-cert-validation
      - request-timeout
      - shutdown-from-endpoint
      - abort-from-endpoint
      - split-tunnel
    - description: Free input query to search. This is the WHERE part of the query. For example, !cdl-query-url-logs query="source_ip.value LIKE '192.168.1.*' AND dest_ip.value = '192.168.1.12'".
      name: query
    - auto: PREDEFINED
      defaultValue: all
      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
      isArray: true
      name: fields
      predefined:
      - vendor_name
      - log_source
      - log_source_id
      - log_source_name
      - customer_id
      - log_time
      - log_source_tz_offset
      - log_type
      - sub_type
      - source_ip
      - source_port
      - dest_ip
      - dest_port
      - protocol
      - threat_id
      - threat_name
      - threat_category
      - cloud_hostname
      - direction_of_attack
      - url_domain
      - url_idx
      - file_name
      - cloud
      - file_sha_256
      - file_type
      - sender_of_virus
      - recipient_of_virus
      - subject_of_email
      - report_id
      - verdict
      - vendor_severity
      - severity
      - pcap
      - pcap_id
      - sig_flags
      - url_category
      - action
      - action_flags
      - app
      - app_category
      - characteristics_of_app
      - container_of_app
      - dg_hier_level_1
      - dg_hier_level_2
      - dg_hier_level_3
      - dg_hier_level_4
      - dest_uuid
      - dest_location
      - dest_user
      - dest_user_info
      - is_exported
      - is_forwarded
      - from_zone
      - http2_connection
      - inbound_if
      - inbound_if_details
      - is_saas_app
      - is_dup_log
      - is_prisma_branch
      - is_prisma_mobile
      - log_set
      - monitor_tag_imei
      - nat_dest_port
      - nat_dest
      - nat_source_port
      - nat_source
      - non_standard_dest_port
      - outbound_if
      - outbound_if_details
      - parent_session_id
      - parent_start_time
      - count_of_repeats
      - risk_of_app
      - rule_matched
      - rule_matched_uuid
      - sanctioned_state_of_app
      - sequence_no
      - session_id
      - source_uuid
      - source_location
      - source_user
      - source_user_info
      - app_sub_category
      - technology_of_app
      - time_generated
      - to_zone
      - tunnel
      - tunneled_app
      - tunnelid_imsi
      - users
      - vsys_id
      - vsys
      - vsys_name
      - flags
      - is_decrypt_mirror
      - is_sym_return
      - is_container
      - is_server_to_client
      - is_client_to_server
      - is_transaction
      - is_non_std_dest_port
      - is_captive_portal
      - is_nat
      - is_proxy
      - is_packet_capture
      - is_phishing
      - is_mptcp_on
      - is_recon_excluded
      - is_url_denied
      - is_tunnel_inspected
      - is_source_x_fwded
      - is_ipv6
      - container_id
      - pod_namespace
      - pod_name
      - source_device_class
      - source_device_vendor
      - source_device_model
      - source_device_os
      - source_device_mac
      - dest_device_class
      - dest_device_vendor
      - dest_device_model
      - dest_device_os
      - dest_device_mac
      - content_version
      - dynusergroup_name
      - ingestion_time
      - record_size
      - source_device_host
      - dest_device_host
    - defaultValue: '''1970-01-01 00:00:00'''
      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
      name: start_time
    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
      name: end_time
    - description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
      name: time_range
    - description: The maximum number of logs to return. Default is 5.
      name: limit
    - name: page
      description: Page to return.
    - name: page_size
      description: Number of entries per page. Defaults to 50 (in case only page was provided).
    - description: The IP address or an array of IP addresses for which to search. For example 1.1.1.1,2.2.2.2. Used instead of the source/destination IP address.
      name: ip
    - description: The port or array of ports to search. Used instead of the source/destination port.
      name: port
    - description: "This argument allows to perform a LIKE search of the specified values on the URL and URI fields. \nAn example value will be paloaltonetworks.com, demisto\twhich will provide results like https://apps.paloaltonetworks.com and https://demisto.com."
      name: url
    description: Searches the URL log table.
    name: cdl-query-url-logs
    outputs:
    - contextPath: CDL.Logging.URL.SessionID
      description: Identifies the firewall's internal identifier for a specific network session.
      type: String
    - contextPath: CDL.Logging.URL.Action
      description: Identifies the action that the firewall took for the network traffic.
      type: String
    - contextPath: CDL.Logging.URL.App
      description: The application associated with the network traffic.
      type: String
    - contextPath: CDL.Logging.URL.PcapID
      description: Packet capture (pcap) ID. Used to correlate threat pcap files with extended pcaps taken as a part of the session flow. All threat logs contain either a pcap_id of 0 (no associated pcap), or an ID referencing the extended pcap file.
      type: String
    - contextPath: CDL.Logging.URL.DestinationPort
      description: The network traffic's destination port. If this value is 0, then the app is using its standard port.
      type: String
    - contextPath: CDL.Logging.URL.AppCategory
      description: Identifies the high-level family of the application.
      type: String
    - contextPath: CDL.Logging.URL.AppSubCategory
      description: Identifies the application's subcategory. The subcategory is related to the application's category, which is identified in category_of_app.
      type: String
    - contextPath: CDL.Logging.URL.SourceLocation
      description: The source country or internal region for private addresses.
      type: String
    - contextPath: CDL.Logging.URL.DestinationLocation
      description: The destination country or internal region for private addresses.
      type: String
    - contextPath: CDL.Logging.URL.ToZone
      description: The networking zone to which the traffic was sent.
      type: String
    - contextPath: CDL.Logging.URL.FromZone
      description: The networking zone from which the traffic originated.
      type: String
    - contextPath: CDL.Logging.URL.Protocol
      description: The IP protocol associated with the session.
      type: String
    - contextPath: CDL.Logging.URL.DestinationIP
      description: The original destination IP address.
      type: String
    - contextPath: CDL.Logging.URL.SourceIP
      description: The original source IP address.
      type: String
    - contextPath: CDL.Logging.URL.RuleMatched
      description: The unique identifier for the security policy rule that the network traffic matched.
      type: String
    - contextPath: CDL.Logging.URL.ThreatCategory
      description: The category of the detected threat.
      type: String
    - contextPath: CDL.Logging.URL.ThreatName
      description: The name of the detected threat.
      type: String
    - contextPath: CDL.Logging.URL.Subtype
      description: Identifies the log subtype.
      type: String
    - contextPath: CDL.Logging.URL.LogTime
      description: The time the log was received in Strata Logging Service XSOAR Connector.
      type: String
    - contextPath: CDL.Logging.URL.LogSourceName
      description: The name of the source of the log.
      type: String
    - contextPath: CDL.Logging.URL.Denied
      description: Indicates whether the session was denied due to a URL filtering rule.
      type: Boolean
    - contextPath: CDL.Logging.URL.Category
      description: The category of the URL.
      type: String
    - contextPath: CDL.Logging.URL.SourcePort
      description: The source port utilized by the session.
      type: Number
    - contextPath: CDL.Logging.URL.Url
      description: The name of the internet domain that was visited in this session.
      type: String
    - contextPath: CDL.Logging.URL.Uri
      description: The address of the URI.
      type: String
    - contextPath: CDL.Logging.URL.ContentType
      description: The content type of the HTTP response data.
      type: String
    - contextPath: CDL.Logging.URL.HTTPMethod
      description: |-
        The HTTP Method used
        in the web request.
      type: String
    - contextPath: CDL.Logging.URL.Severity
      description: The severity associated with the event.
      type: String
    - contextPath: CDL.Logging.URL.UserAgent
      description: |-
        The web browser that the user
        used to access the URL.
      type: String
    - contextPath: CDL.Logging.URL.RefererProtocol
      description: The protocol used in the HTTP Referer header field.
      type: Number
    - contextPath: CDL.Logging.URL.RefererPort
      description: The port used in the HTTP Referer header field.
      type: Number
    - contextPath: CDL.Logging.URL.RefererFQDN
      description: |-
        The full domain name used in the HTTP Referer
        header field.
      type: String
    - contextPath: CDL.Logging.URL.RefererURL
      description: The URL used in the HTTP Referer header field.
      type: String
    - contextPath: CDL.Logging.URL.SrcUser
      description: The username that initiated the network traffic.
      type: String
    - contextPath: CDL.Logging.URL.SrcUserInfo
      description: The information for the initiated user.
      type: String
    - contextPath: CDL.Logging.URL.DstUser
      description: The username to which the network traffic was destined.
      type: String
    - contextPath: CDL.Logging.URL.DstUserInfo
      description: The destination user information.
      type: String
    - contextPath: CDL.Logging.URL.TechnologyOfApp
      description: The networking technology used by the identified application.
      type: String
    - contextPath: CDL.Logging.URL.SourceDeviceHost
      description: Hostname of the device from which the session originated.
      type: String
    - contextPath: CDL.Logging.URL.DestDeviceHost
      description: Hostname of the device session destination.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: Identifies the action that the firewall took for the network traffic.
      name: action
      predefined:
      - unknown
      - n-a
      - aged-out
      - decoder
      - tcp-reuse
      - resources-unavailable
      - tcp-fin
      - tcp-rst-from-server
      - tcp-rst-from-client
      - policy-deny
      - threat
      - decrypt-error
      - decrypt-unsupport-param
      - decrypt-cert-validation
      - request-timeout
      - shutdown-from-endpoint
      - abort-from-endpoint
      - split-tunnel
    - description: Application associated with the network traffic.
      name: app
    - description: Identifies the high-level family of the application.
      name: app_category
    - description: Hostname of the device to which the session was directed.
      name: dest_device_host
    - description: Original destination IP address.
      name: dest_ip
    - description: The name of the external dynamic list that contains the destination IP address of the traffic.
      name: dest_edl
    - description: The dynamic address group that Device-ID identifies as the destination for the traffic.
      name: dest_dynamic_address_group
    - description: Destination country or internal region for private addresses.
      name: dest_location
    - description: |-
        Network traffic's destination port. If this value is 0, then the app is using
        its standard port.
      name: dest_port
    - description: The username to which the network traffic was destined.
      name: dest_user
    - description: The name of the file that is blocked.
      name: file_name
    - description: The binary hash (SHA256) of the file. Enter a SHA256 hash or array of SHA256 hashes to search.
      name: file_sha_256
    - description: Palo Alto Networks textual identifier for the threat.
      name: file_type
    - description: The networking zone from which the traffic originated.
      name: from_zone
    - description: Indicates if the direction of traffic is from server to client.
      name: is_server_to_client
    - description: Indicates whether the session was denied due to a URL filtering rule.
      name: is_url_denied
    - auto: PREDEFINED
      description: Identifies the log type.
      name: log_type
      predefined:
      - traffic
      - config
      - system
      - threat
      - appstat
      - trsum
      - thsum
      - event
      - alarm
      - hipmatch
      - userid
      - iptag
      - mdm
      - extpcap
      - urlsum
      - gtp
      - gtpsum
      - auth
      - panflex
      - extflex
      - sctp
      - sctpsum
      - analytics
      - action
      - scan
      - sam
    - description: If destination NAT performed, the post-NAT destination IP address.
      name: nat_dest
    - description: Post-NAT destination port.
      name: nat_dest_port
    - description: If source NAT was performed, the post-NAT source IP address.
      name: nat_source
    - description: Post-NAT source port.
      name: nat_source_port
    - description: Name of the security policy rule that the network traffic matched.
      name: rule_matched
    - description: Unique identifier for the security policy rule that the network traffic matched.
      name: rule_matched_uuid
    - description: Severity as defined by the platform.
      name: severity
    - description: Hostname of the device from which the session originated.
      name: source_device_host
    - description: Original source IP address.
      name: source_ip
    - description: The name of the external dynamic list that contains the source IP address of the traffic.
      name: source_edl
    - description: The dynamic address group that Device-ID identifies as the source of the traffic.
      name: source_dynamic_address_group
    - description: Source country or internal region for private addresses.
      name: source_location
    - description: Source port utilized by the session.
      name: source_port
    - description: The username that initiated the network traffic.
      name: source_user
    - auto: PREDEFINED
      description: Identifies the log subtype.
      name: sub_type
      predefined:
      - attack
      - url
      - virus
      - spyware
      - vulnerability
      - file
      - scan
      - flood
      - packet
      - resource
      - data
      - url-content
      - wildfire
      - extpcap
      - wildfire-virus
      - http-hdr-insert
      - http-hdr
      - email-hdr
      - spyware-dns
      - spyware-wildfire-dns
      - spyware-wpc-dns
      - spyware-custom-dns
      - spyware-cloud-dns
      - spyware-raven
      - spyware-wildfire-raven
      - spyware-wpc-raven
      - wpc-virus
      - sctp
    - description: The URL category.
      name: url_category
    - description: The name of the internet domain that was visited in this session.
      name: url_domain
    - defaultValue: '''1970-01-01 00:00:00'''
      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
      name: start_time
    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
      name: end_time
    - description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
      name: time_range
    - defaultValue: '5'
      description: The maximum number of logs to return. Default is 5.
      name: limit
    - name: page
      description: Page to return.
    - name: page_size
      description: Number of entries per page. Defaults to 50 (in case only page was provided).
    description: Searches the Cortex firewall.file_data table.
    name: cdl-query-file-data
    outputs:
    - contextPath: CDL.Logging.File.App
      description: Application associated with the network traffic.
      type: String
    - contextPath: CDL.Logging.File.TimeGenerated
      description: Time when the log was generated on the firewall's data plane.
      type: Date
    - contextPath: CDL.Logging.File.SourceIP
      description: Original source IP address.
      type: String
    - contextPath: CDL.Logging.File.DestinationLocation
      description: Destination country or internal region for private addresses.
      type: String
    - contextPath: CDL.Logging.File.FileSHA256
      description: The binary hash (SHA256) of the file.
      type: String
    - contextPath: CDL.Logging.File.FileName
      description: The name of the file that is blocked.
      type: String
    - contextPath: CDL.Logging.File.RuleMatched
      description: Name of the security policy rule that the network traffic matched.
      type: String
    - contextPath: CDL.Logging.File.LogSourceName
      description: Name of the source of the log. The hostname of the firewall that logged the network traffic.
      type: String
    - contextPath: CDL.Logging.File.NatDestination
      description: If destination NAT performed, the post-NAT destination IP address.
      type: String
    - contextPath: CDL.Logging.File.NatDestinationPort
      description: Post-NAT destination port.
      type: Number
    - contextPath: CDL.Logging.File.CharacteristicOfApp
      description: Identifies the behavioral characteristic of the application associated with the network traffic.
      type: String
    - contextPath: CDL.Logging.File.SourceLocation
      description: Source country or internal region for private addresses.
      type: String
    - contextPath: CDL.Logging.File.DestinationIP
      description: Original destination IP address.
      type: String
    - contextPath: CDL.Logging.File.Action
      description: Identifies the action that the firewall took for the network traffic.
      type: String
    - contextPath: CDL.Logging.File.IsNat
      description: Indicates if the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1, otherwise it is 0.
      type: Boolean
    - contextPath: CDL.Logging.File.Protocol
      description: IP protocol associated with the session.
      type: String
    - contextPath: CDL.Logging.File.NatSource
      description: If source NAT was performed, the post-NAT source IP address.
      type: String
    - contextPath: CDL.Logging.File.AppCategory
      description: Identifies the high-level family of the application.
      type: String
    - contextPath: CDL.Logging.File.IsUrlDenied
      description: Indicates whether the session was denied due to a URL filtering rule.
      type: Boolean
    - contextPath: CDL.Logging.File.IsTunnelInspected
      description: Indicates whether the payload for the outer tunnel was inspected.
      type: Boolean
    - contextPath: CDL.Logging.File.SequenceNo
      description: The log entry identifier, which is incremented sequentially.
      type: Number
    - contextPath: CDL.Logging.File.IsDecryptMirror
      description: Indicates whether decrypted traffic was sent out in clear text through a mirror port.
      type: Boolean
    - contextPath: CDL.Logging.File.IsNonStdDestPort
      description: Indicates if the destination port is non-standard.
      type: Boolean
    - contextPath: CDL.Logging.File.RuleMatchedUuid
      description: Unique identifier for the security policy rule that the network traffic matched.
      type: String
    - contextPath: CDL.Logging.File.IsProxy
      description: Indicates whether the SSL session is decrypted (SSL Proxy).
      type: Boolean
    - contextPath: CDL.Logging.File.VendorSeverity
      description: Severity associated with the event.
      type: String
    - contextPath: CDL.Logging.File.IsPhishing
      description: Indicates whether enterprise credentials were submitted by an end user.
      type: Boolean
    - contextPath: CDL.Logging.File.ToZone
      description: Networking zone to which the traffic was sent.
      type: String
    - contextPath: CDL.Logging.File.Flags
      description: Bit field which provides details on the session, such as whether the session use IPv6.
      type: Number
    - contextPath: CDL.Logging.File.Tunnel
      description: Type of tunnel.
      type: String
    - contextPath: CDL.Logging.File.CloudHostname
      description: The hostname in which the VM-series firewall is running.
      type: String
    - contextPath: CDL.Logging.File.Http2Connection
      description: Parent session ID for an HTTP/2 connection. If the traffic is not using HTTP/2, this field is set to 0.
      type: Number
    - contextPath: CDL.Logging.File.IsPrismaBranch
      description: Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.
      type: Boolean
    - contextPath: CDL.Logging.File.OutboundIf
      description: Interface to which the network traffic was destined.
      type: String
    - contextPath: CDL.Logging.File.IsSymReturn
      description: Indicates whether symmetric return was used to forward traffic for this session.
      type: Boolean
    - contextPath: CDL.Logging.File.URLCategory
      description: The URL category.
      type: String
    - contextPath: CDL.Logging.File.IsReconExcluded
      description: Indicates whether the source for the flow is on the firewall allow list and not subject to recon protection.
      type: Boolean
    - contextPath: CDL.Logging.File.SanctionedStateOfApp
      description: Indicates whether the application has been flagged as sanctioned by the firewall administrator.
      type: Boolean
    - contextPath: CDL.Logging.File.ReportID
      description: Identifies the analysis requested from the sandbox (cloud or appliance).
      type: Number
    - contextPath: CDL.Logging.File.DestinationPort
      description: |-
        Network traffic's destination port. If this value is 0, then the app is using
        its standard port.
      type: Number
    - contextPath: CDL.Logging.File.IsDupLog
      description: Indicates whether this log data is available in multiple locations, such as from Strata Logging Service XSOAR Connector as well as from an on-premise log collector.
      type: Boolean
    - contextPath: CDL.Logging.File.LogTime
      description: Time the log was received in Strata Logging Service XSOAR Connector.
      type: Date
    - contextPath: CDL.Logging.File.SessionID
      description: Identifies the firewall's internal identifier for a specific network session.
      type: Number
    - contextPath: CDL.Logging.File.RecordSize
      description: The size of the record.
      type: Number
    - contextPath: CDL.Logging.File.IngestionTime
      description: Ingestion time of the log.
      type: Date
    - contextPath: CDL.Logging.File.CountOfRepeats
      description: Number of sessions with the same source IP, destination IP, application, and content/threat type seen for the summary interval.
      type: Number
    - contextPath: CDL.Logging.File.VsysID
      description: A unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: Number
    - contextPath: CDL.Logging.File.VendorName
      description: Identifies the vendor that produced the data.
      type: String
    - contextPath: CDL.Logging.File.IsMptcpOn
      description: Indicates whether the option is enabled on the next-generation firewall that allows a client to use multiple paths to connect to a destination host.
      type: Boolean
    - contextPath: CDL.Logging.File.IsClientToServer
      description: Indicates if the direction of traffic is from client to server.
      type: Boolean
    - contextPath: CDL.Logging.File.IsServerToClient
      description: Indicates if the direction of traffic is from server to client.
      type: Boolean
    - contextPath: CDL.Logging.File.IsPacketCapture
      description: Indicates whether the session has a packet capture (PCAP).
      type: Boolean
    - contextPath: CDL.Logging.File.IsTransaction
      description: Indicates whether the log corresponds to a transaction within an HTTP proxy session (Proxy Transaction).
      type: Boolean
    - contextPath: CDL.Logging.File.InboundIf
      description: Interface from which the network traffic was sourced.
      type: String
    - contextPath: CDL.Logging.File.FromZone
      description: The networking zone from which the traffic originated.
      type: String
    - contextPath: CDL.Logging.File.FileType
      description: Palo Alto Networks textual identifier for the threat.
      type: String
    - contextPath: CDL.Logging.File.IsPrismaMobile
      description: If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise. (For internal use only.)
      type: Boolean
    - contextPath: CDL.Logging.File.IsContainer
      description: Indicates if the session is a container page access (Container Page).
      type: Boolean
    - contextPath: CDL.Logging.File.IsSaasApp
      description: Indicates whether the application associated with this network traffic is a SAAS application. (For internal use only.)
      type: Boolean
    - contextPath: CDL.Logging.File.Vsys
      description: Unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: String
    - contextPath: CDL.Logging.File.FileID
      description: Numerical identifier for the threat type.
      type: Number
    - contextPath: CDL.Logging.File.IsCaptivePortal
      description: Indicates if user information for the session was captured through Captive Portal.
      type: Boolean
    - contextPath: CDL.Logging.File.Protocol
      description: IP protocol associated with the session.
      type: String
    - contextPath: CDL.Logging.File.CustomerID
      description: The ID that uniquely identifies the Strata Logging Service XSOAR Connector instance which received this log record.
      type: Number
    - contextPath: CDL.Logging.File.Subtype
      description: Identifies the log subtype.
      type: String
    - contextPath: CDL.Logging.File.TunneledApp
      description: Tunneled app (For internal use only).
      type: String
    - contextPath: CDL.Logging.File.LogSourceID
      description: ID that uniquely identifies the source of the log. If the source is a firewall, then it is its serial number.
      type: String
    - contextPath: CDL.Logging.File.IsForwarded
      description: Indicates if the log is being forwarded. (For internal use only.)
      type: Boolean
    - contextPath: CDL.Logging.File.RiskOfApp
      description: Indicates how risky the application is from a network security perspective.
      type: Number
    - contextPath: CDL.Logging.File.PcapID
      description: Packet capture ID.
      type: Number
    - contextPath: CDL.Logging.File.AppSubcategory
      description: Identifies the application's subcategory.
      type: String
    - contextPath: CDL.Logging.File.IsExported
      description: Indicates if this log was exported from the firewall using the firewall's log export function.
      type: Boolean
    - contextPath: CDL.Logging.File.Severity
      description: Severity as defined by the platform.
      type: String
    - contextPath: CDL.Logging.File.NatSourcePort
      description: Post-NAT source port.
      type: Number
    - contextPath: CDL.Logging.File.LogType
      description: Identifies the log type.
      type: String
    - contextPath: CDL.Logging.File.LogSet
      description: Log forwarding profile name that was applied to the session. This name was defined by the firewall's administrator.
      type: String
    - contextPath: CDL.Logging.File.TechnologyOfApp
      description: The networking technology used by the identified application.
      type: String
    - contextPath: CDL.Logging.File.DirectionOfAttack
      description: Indicates the direction of the attack.
      type: String
    - contextPath: CDL.Logging.File.LogSource
      description: Identifies the origin of the data (the system that produced the data.
      type: String
  - description: Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.
    name: cdl-reset-authentication-timeout
    arguments: []
  - arguments:
    - defaultValue: "10"
      description: The maximum number of logs to return.
      name: limit
    - description: Page to return.
      name: page
    - description: Number of entries per page. Defaults to 50 (in case only page was provided).
      name: page_size
    - auto: PREDEFINED
      defaultValue: "true"
      description: If set to false, query results are not mapped into the standard command context.
      name: transform_results
      predefined:
      - "true"
      - "false"
    - defaultValue: all
      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
      name: fields
    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
      name: end_time
    - defaultValue: '''1970-01-01 00:00:00'''
      description: The query start time. For example, start_time="2018-04-26 00:00:00".
      name: start_time
    - description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
      name: time_range
    - description: Event name for which to search.
      name: event_name
    - description: GlobalProtect gateway for which to search.
      name: gateway
    - description: Private IP address (v4) of the user that connected for which to search.
      name: private_ipv4
    - description: Private IP address (v6) of the user that connected for which to search.
      name: private_ipv6
    - description: Public IP address (v4) of the user that connected for which to search.
      name: public_ipv4
    - description: Public IP address (v6) of the user that connected for which to search.
      name: public_ipv6
    - description: The source username for which to search.
      name: source_user
    - description: Event status (success or failure) for which to search.
      name: event_status
    - description: GlobalProtect portal for which to search.
      name: portal
    - description: Name of the stage in the GlobalProtect connection workflow for which to search.
      name: stage
    description: Searches the GlobalProtect VPN log table.
    name: cdl-query-gp-logs
    outputs:
    - contextPath: CDL.Logging.GlobalProtect.AttemptedGateways
      description: All gateways that were available and attempted for the client location.
    - contextPath: CDL.Logging.GlobalProtect.AuthMethod
      description: Authentication method used for the GlobalProtect connection.
    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorID
      description: Enumeration integer assigned to the connection_error field value.
    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorValue
      description: Error information for unsuccessful connection.
    - contextPath: CDL.Logging.GlobalProtect.CountOfRepeats
      description: Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.
    - contextPath: CDL.Logging.GlobalProtect.CustomerID
      description: The ID that uniquely identifies the Cortex Data Lake instance which received this log record.
    - contextPath: CDL.Logging.GlobalProtect.EndpointDeviceName
      description: Name of the device that the user used for the connection.
    - contextPath: CDL.Logging.GlobalProtect.EndpointGPVersion
      description: GlobalProtect client version number.
    - contextPath: CDL.Logging.GlobalProtect.EndpointOSType
      description: OS type of the endpoint on which the GlobalProtect client is deployed.
    - contextPath: CDL.Logging.GlobalProtect.EndpointOSVersion
      description: OS version of the endpoint on which the GlobalProtect client is deployed.
    - contextPath: CDL.Logging.GlobalProtect.EventID
      description: The name of the event.
    - contextPath: CDL.Logging.GlobalProtect.Gateway
      description: Gateway for the connection.
    - contextPath: CDL.Logging.GlobalProtect.GatewayPriority
      description: Priority of the gateway.
    - contextPath: CDL.Logging.GlobalProtect.GatewaySelectionType
      description: Gateway selection method,  i.e., automatic, preferred, or manual.
    - contextPath: CDL.Logging.GlobalProtect.HostID
      description: Unique identifier GlobalProtect has assigned to the host.
    - contextPath: CDL.Logging.GlobalProtect.IsDuplicateLog
      description: Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector.
    - contextPath: CDL.Logging.GlobalProtect.IsExported
      description: Indicates if this log was exported from the firewall using the firewall's log export function.
    - contextPath: CDL.Logging.GlobalProtect.IsForwarded
      description: Internal use field that indicates if the log is being forwarded.
    - contextPath: CDL.Logging.GlobalProtect.IsPrismaBranch
      description: Internal use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.
    - contextPath: CDL.Logging.GlobalProtect.IsPrismaMobile
      description: Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise.
    - contextPath: CDL.Logging.GlobalProtect.LogSource
      description: Identifies the origin of the data.
    - contextPath: CDL.Logging.GlobalProtect.LogSourceID
      description: ID that uniquely identifies the source of the log.
    - contextPath: CDL.Logging.GlobalProtect.LogSourceName
      description: Name of the source of the log.
    - contextPath: CDL.Logging.GlobalProtect.LogTime
      description: Time the log was received in Strata Logging Service XSOAR Connector.
    - contextPath: CDL.Logging.GlobalProtect.LogType
      description: Identifies the log type.
    - contextPath: CDL.Logging.GlobalProtect.LoginDuration
      description: Duration for which the connected user was logged on.
    - contextPath: CDL.Logging.GlobalProtect.Opaque
      description: Additional information regarding the event.
    - contextPath: CDL.Logging.GlobalProtect.PlatformType
      description: The platform type.
    - contextPath: CDL.Logging.GlobalProtect.Portal
      description: GlobalProtect portal or gateway that the user connected to.
    - contextPath: CDL.Logging.GlobalProtect.PrivateIPv4
      description: Private IP address (v4) of the user that connected.
    - contextPath: CDL.Logging.GlobalProtect.PrivateIPv6
      description: Private IP address (v6) of the user that connected.
    - contextPath: CDL.Logging.GlobalProtect.ProjectName
      description: Project name.
    - contextPath: CDL.Logging.GlobalProtect.PublicIPv4
      description: Public IP address (v4) of the user that connected.
    - contextPath: CDL.Logging.GlobalProtect.PublicIPv6
      description: Public IP address (v6) of the user that connected.
    - contextPath: CDL.Logging.GlobalProtect.QuarantineReason
      description: Quarantine reason.
    - contextPath: CDL.Logging.GlobalProtect.SequenceNo
      description: The log entry identifier, which is incremented sequentially.
    - contextPath: CDL.Logging.GlobalProtect.SourceRegion
      description: Region of the gateway (or user) that connected.
    - contextPath: CDL.Logging.GlobalProtect.SourceUser
      description: The username that connected.
    - contextPath: CDL.Logging.GlobalProtect.SourceUserDomain
      description: Domain to which the source user belongs.
    - contextPath: CDL.Logging.GlobalProtect.SourceUserName
      description: The source user username.
    - contextPath: CDL.Logging.GlobalProtect.SSLResponseTime
      description: SSL response time in milliseconds.
    - contextPath: CDL.Logging.GlobalProtect.Stage
      description: Name of the stage in the GlobalProtect connection workflow.
    - contextPath: CDL.Logging.GlobalProtect.EventStatus
      description: The status (success or failure) of the event.
    - contextPath: CDL.Logging.GlobalProtect.Subtype
      description: The log subtype.
    - contextPath: CDL.Logging.GlobalProtect.TimeGenerated
      description: Time when the log was generated on the firewall's data plane.
    - contextPath: CDL.Logging.GlobalProtect.TunnelType
      description: Tunnel type i.e., SSL or VPN.
    - contextPath: CDL.Logging.GlobalProtect.VendorName
      description: The vendor that produced the data.
  - name: sls-query-logs
    arguments:
    - name: query
      description: "A free-text SQL query. For example, query=\"SELECT * FROM `firewall.traffic`\".\nThere are multiple tables in Loggings, for example: threat, traffic, and so on.\nRefer to the Cortex Logging service schema reference for the full list."
      defaultValue: SELECT * FROM `firewall.traffic`
    - name: limit
      description: The maximum number of logs to return. Default is 10.
      defaultValue: '10'
    - name: transform_results
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: If set to false, query results are not mapped into the standard command context. Default is "true".
      defaultValue: 'true'
    - name: page
      description: Page to return.
    - name: page_size
      description: Number of entries per page. Defaults to 50 (in case only page was provided).
    outputs:
    - contextPath: SLS.Logging.Action
      description: Identifies the action that the firewall took for the network traffic.
      type: String
    - contextPath: SLS.Logging.App
      description: Application associated with the network traffic.
      type: String
    - contextPath: SLS.Logging.Protocol
      description: IP protocol associated with the session.
      type: String
    - contextPath: SLS.Logging.DestinationIP
      description: Original destination IP address.
      type: String
    - contextPath: SLS.Logging.RuleMatched
      description: Name of the security policy rule that the network traffic matched.
      type: String
    - contextPath: SLS.Logging.CharacteristicOfApp
      description: Identifies the behavioral characteristic of the application associated with the network traffic.
      type: Number
    - contextPath: SLS.Logging.LogSourceName
      description: Name of the source of the log.
      type: String
    - contextPath: SLS.Logging.IsNat
      description: Indicates if the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1.
      type: Boolean
    - contextPath: SLS.Logging.NatDestinationPort
      description: Post-NAT destination port.
      type: Number
    - contextPath: SLS.Logging.NatDestination
      description: If destination NAT was performed, the post-NAT destination IP address.
      type: String
    - contextPath: SLS.Logging.NatSource
      description: If source NAT was performed, the post-NAT source IP address.
      type: String
    - contextPath: SLS.Logging.SourceIP
      description: Original source IP address.
      type: String
    - contextPath: SLS.Logging.AppCategory
      description: Identifies the high-level family of the application.
      type: String
    - contextPath: SLS.Logging.SourceLocation
      description: Source country or internal region for private addresses.
      type: String
    - contextPath: SLS.Logging.DestinationLocation
      description: Destination country or internal region for private addresses.
      type: String
    - contextPath: SLS.Logging.FileSHA256
      description: The binary hash (SHA256) of the file sent for virus analysis.
      type: String
    - contextPath: SLS.Logging.FileName
      description: The name of the infected file.
      type: String
    - contextPath: SLS.Logging.TimeGenerated
      description: Time when the log was generated on the firewall's data plane.
      type: Date
    description: Runs a query on  any table or field.
    execution: true
  - name: sls-get-critical-threat-logs
    arguments:
    - name: start_time
      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
      defaultValue: "'1970-01-01 00:00:00'"
    - name: end_time
      description: The query end time. For example, end_time="2018-04-26 00:00:00".
    - name: limit
      description: The maximum number of logs to return. Default is 10.
      defaultValue: '10'
    - name: time_range
      description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
    - name: transform_results
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: If set to false, query results are not mapped into the standard command context. Default is "true".
      defaultValue: 'true'
    - name: page
      description: Page to return.
    - name: page_size
      description: Number of entries per page. Defaults to 50 (in case only page was provided).
    outputs:
    - contextPath: SLS.Logging.Threat.SessionID
      description: Identifies the firewall's internal identifier for a specific network session.
      type: String
    - contextPath: SLS.Logging.Threat.Action
      description: Identifies the action that the firewall took for the network traffic.
      type: String
    - contextPath: SLS.Logging.Threat.App
      description: Application associated with the network traffic.
      type: String
    - contextPath: SLS.Logging.Threat.IsNat
      description: Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1.
      type: Boolean
    - contextPath: SLS.Logging.Threat.SubcategoryOfApp
      description: Identifies the application's subcategory. The subcategory is related to the application's category, which is identified in category_of_app.
      type: String
    - contextPath: SLS.Logging.Threat.PcapID
      description: Packet capture (pcap) ID. This is used to correlate threat pcap files with extended pcaps taken as a part of the session flow. All threat logs will contain either a pcap_id of 0 (no associated pcap), or an ID referencing the extended pcap file.
      type: String
    - contextPath: SLS.Logging.Threat.NatDestination
      description: If destination NAT is performed, the post-NAT destination IP address. The IP address is an IPv4/IPv6 address in hex format.
      type: String
    - contextPath: SLS.Logging.Threat.Flags
      description: Bit field which provides details on the session, such as whether the session use IPv6, whether the session was denied due to a URL filtering rule, and/or whether the log corresponds to a transaction within an HTTP proxy session.
      type: String
    - contextPath: SLS.Logging.Threat.DestinationPort
      description: Network traffic's destination port. If this value is 0, then the app is using its standard port.
      type: String
    - contextPath: SLS.Logging.Threat.ThreatID
      description: Numerical identifier for the threat type. All threats encountered by Palo Alto Networks firewalls are assigned a unique identifier.
      type: String
    - contextPath: SLS.Logging.Threat.NatSource
      description: If source NAT was performed, the post-NAT source IP address. The IP address is an IPv4/IPv6 address in hex format.
      type: String
    - contextPath: SLS.Logging.Threat.IsURLDenied
      description: Indicates whether the session was denied due to a URL filtering rule.
      type: Boolean
    - contextPath: SLS.Logging.Threat.Users
      description: Source/Destination user. If neither is available, source_ip is used.
      type: String
    - contextPath: SLS.Logging.Threat.TimeGenerated
      description: Time when the log was generated on the firewall's data plane.
      type: Date
    - contextPath: SLS.Logging.Threat.IsPhishing
      description: Indicates whether enterprise credentials were submitted by an end user.
      type: Boolean
    - contextPath: SLS.Logging.Threat.AppCategory
      description: Identifies the high-level family of the application.
      type: String
    - contextPath: SLS.Logging.Threat.SourceLocation
      description: Source country or internal region for private addresses.
      type: String
    - contextPath: SLS.Logging.Threat.DestinationLocation
      description: Destination country or internal region for private addresses.
      type: String
    - contextPath: SLS.Logging.Threat.ToZone
      description: Networking zone to which the traffic was sent.
      type: String
    - contextPath: SLS.Logging.Threat.RiskOfApp
      description: Indicates how risky the application is from a network security perspective.
      type: Number
    - contextPath: SLS.Logging.Threat.NatSourcePort
      description: Post-NAT source port.
      type: Number
    - contextPath: SLS.Logging.Threat.CharacteristicOfApp
      description: Identifies the behavioral characteristic of the application associated with the network traffic.
      type: Unknown
    - contextPath: SLS.Logging.Threat.FromZone
      description: The networking zone from which the traffic originated.
      type: String
    - contextPath: SLS.Logging.Threat.Vsys
      description: String representation of the unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: String
    - contextPath: SLS.Logging.Threat.Protocol
      description: IP protocol associated with the session.
      type: String
    - contextPath: SLS.Logging.Threat.NatDestinationPort
      description: Post-NAT destination port.
      type: Number
    - contextPath: SLS.Logging.Threat.DestinationIP
      description: Original destination IP address.
      type: String
    - contextPath: SLS.Logging.Threat.SourceIP
      description: Original source IP address.
      type: String
    - contextPath: SLS.Logging.Threat.RuleMatched
      description: Name of the security policy rule that the network traffic matched.
      type: String
    - contextPath: SLS.Logging.Threat.ThreatCategory
      description: Threat category of the detected threat.
      type: String
    - contextPath: SLS.Logging.Threat.ThreatName
      description: Threat name of the detected threat.
      type: String
    - contextPath: SLS.Logging.Threat.LogSourceName
      description: Name of the source of the log.
      type: String
    - contextPath: SLS.Logging.Threat.Subtype
      description: Identifies the log subtype.
      type: String
    - contextPath: SLS.Logging.Threat.Direction
      description: Indicates the direction of the attack.
      type: String
    - contextPath: SLS.Logging.Threat.FileName
      description: The name of the file that is blocked.
      type: String
    - contextPath: SLS.Logging.Threat.VendorSeverity
      description: Severity associated with the event.
      type: String
    - contextPath: SLS.Logging.Threat.LogTime
      description: Time the log was received in Strata Logging Service XSOAR Connector.
      type: String
    - contextPath: SLS.Logging.Threat.LogSourceID
      description: ID that uniquely identifies the source of the log. If the source is a firewall, then it is its serial number.
      type: String
    - contextPath: SLS.Logging.Threat.VsysID
      description: A unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: Number
    - contextPath: SLS.Logging.Threat.URLDomain
      description: The name of the internet domain that was visited in this session.
      type: String
    - contextPath: SLS.Logging.Threat.URLCategory
      description: The URL category.
      type: String
    - contextPath: SLS.Logging.Threat.SourcePort
      description: Source port utilized by the session.
      type: Number
    description: Runs a query on the threat table according to preset queries.
  - name: sls-get-social-applications
    arguments:
    - name: start_time
      description: Query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
      defaultValue: "'1970-01-01 00:00:00'"
    - name: end_time
      description: Query end time. For example, end_time="2018-04-26 00:00:00".
    - name: limit
      description: The maximum number of logs to return. Default is 10.
      defaultValue: '10'
    - name: time_range
      description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
    - name: page
      description: Page to return.
    - name: page_size
      description: Number of entries per page. Defaults to 50 (in case only page was provided).
    outputs:
    - contextPath: SLS.Logging.Traffic.Action
      description: Identifies the action that the firewall took for the network traffic.
      type: String
    - contextPath: SLS.Logging.Traffic.RiskOfApp
      description: Indicates how risky the application is from a network security perspective.
      type: String
    - contextPath: SLS.Logging.Traffic.NatSourcePort
      description: Post-NAT source port.
      type: Number
    - contextPath: SLS.Logging.Traffic.SessionID
      description: Identifies the firewall's internal identifier for a specific network session.
      type: String
    - contextPath: SLS.Logging.Traffic.Packets
      description: Number of total packets (transmit and receive) seen for the session.
      type: String
    - contextPath: SLS.Logging.Traffic.CharacteristicOfApp
      description: Identifies the behavioral characteristic of the application associated with the network traffic.
      type: String
    - contextPath: SLS.Logging.Traffic.App
      description: Application associated with the network traffic.
      type: String
    - contextPath: SLS.Logging.Traffic.Vsys
      description: Virtual system associated with the network traffic.
      type: String
    - contextPath: SLS.Logging.Traffic.IsNat
      description: Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1, otherwise it is 0.
      type: Boolean
    - contextPath: SLS.Logging.Traffic.LogTime
      description: Time the log was received in Strata Logging Service XSOAR Connector.
      type: date
    - contextPath: SLS.Logging.Traffic.SubcategoryOfApp
      description: Identifies the application's subcategory. The subcategory is related to the application's category.
      type: String
    - contextPath: SLS.Logging.Traffic.Protocol
      description: IP protocol associated with the session.
      type: String
    - contextPath: SLS.Logging.Traffic.NatDestinationPort
      description: Post-NAT destination port.
      type: String
    - contextPath: SLS.Logging.Traffic.DestinationIP
      description: Original destination IP address.
      type: String
    - contextPath: SLS.Logging.Traffic.NatDestination
      description: If destination NAT performed, the post-NAT destination IP address.
      type: String
    - contextPath: SLS.Logging.Traffic.RuleMatched
      description: Name of the security policy rule that the network traffic matched.
      type: String
    - contextPath: SLS.Logging.Traffic.DestinationPort
      description: Network traffic's destination port. If this value is 0, then the app is using its standard port.
      type: String
    - contextPath: SLS.Logging.Traffic.TotalTimeElapsed
      description: Total time for the network session to complete.
      type: String
    - contextPath: SLS.Logging.Traffic.LogSourceName
      description: Device name of the source of the log.
      type: String
    - contextPath: SLS.Logging.Traffic.Subtype
      description: The log sub type.
      type: String
    - contextPath: SLS.Logging.Traffic.Users
      description: Source/Destination user. If neither is available, source_ip is used.
      type: String
    - contextPath: SLS.Logging.Traffic.TunneledApp
      description: Whether the app is tunneled.
      type: String
    - contextPath: SLS.Logging.Traffic.IsPhishing
      description: Indicates whether enterprise credentials were submitted by an end user.
      type: String
    - contextPath: SLS.Logging.Traffic.SessionEndReason
      description: The reason a session terminated.
      type: String
    - contextPath: SLS.Logging.Traffic.NatSource
      description: If source NAT was performed, the post-NAT source IP address.
      type: String
    - contextPath: SLS.Logging.Traffic.SourceIP
      description: Original source IP address.
      type: String
    - contextPath: SLS.Logging.Traffic.SessionStartIP
      description: Time when the session was established.
      type: date
    - contextPath: SLS.Logging.Traffic.TimeGenerated
      description: Time when the log was generated on the firewall's data plane.
      type: date
    - contextPath: SLS.Logging.Traffic.AppCategory
      description: Identifies the high-level family of the application.
      type: String
    - contextPath: SLS.Logging.Traffic.SourceLocation
      description: Source country or internal region for private addresses.
      type: String
    - contextPath: SLS.Logging.Traffic.DestinationLocation
      description: Destination country or internal region for private addresses.
      type: String
    - contextPath: SLS.Logging.Traffic.LogSourceID
      description: ID that uniquely identifies the source of the log. If the source is a firewall, then it is its serial number.
      type: String
    - contextPath: SLS.Logging.Traffic.TotalBytes
      description: Number of total bytes (transmit and receive).
      type: String
    - contextPath: SLS.Logging.Traffic.VsysID
      description: A unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: String
    - contextPath: SLS.Logging.Traffic.ToZone
      description: Networking zone to which the traffic was sent.
      type: String
    - contextPath: SLS.Logging.Traffic.URLCategory
      description: The URL category.
      type: String
    - contextPath: SLS.Logging.Traffic.SourcePort
      description: Source port utilized by the session.
      type: String
    - contextPath: SLS.Logging.Traffic.Tunnel
      description: Type of tunnel.
      type: String
    description: Runs a query on traffic table where app_sub_category = "social networking".
  - name: sls-search-by-file-hash
    arguments:
    - name: start_time
      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
      defaultValue: "'1970-01-01 00:00:00'"
    - name: end_time
      description: The query end time. For example, end_time="2018-04-26 00:00:00".
    - name: limit
      description: The maximum number of logs to return. Default is 10.
      defaultValue: '10'
    - name: time_range
      description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
    - name: SHA256
      required: true
      description: The SHA256 hash of the file for the query. For example, SHA256="503ca1a4fc0d48b18c0336f544ba0f0abf305ae3a3f49b3c2b86b8645d6572dc" would return all logs associated with this file.
    - name: page
      description: Page to return.
    - name: page_size
      description: Number of entries per page. Defaults to 50 (in case only page was provided).
    outputs:
    - contextPath: SLS.Logging.Threat.SessionID
      description: Identifies the firewall's internal identifier for a specific network session.
      type: String
    - contextPath: SLS.Logging.Threat.Action
      description: Identifies the action that the firewall took for the network traffic.
      type: String
    - contextPath: SLS.Logging.Threat.App
      description: Application associated with the network traffic.
      type: String
    - contextPath: SLS.Logging.Threat.IsNat
      description: Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1, otherwise it is 0.
      type: Boolean
    - contextPath: SLS.Logging.Threat.SubcategoryOfApp
      description: Identifies the application's subcategory. The subcategory is related to the application's category, which is identified in category_of_app.
      type: String
    - contextPath: SLS.Logging.Threat.PcapID
      description: Packet capture (pcap) ID. This is used to correlate threat pcap files with extended pcaps taken as a part of the session flow. All threat logs will contain either a pcap_id of 0 (no associated pcap) , or an ID referencing the extended pcap file.
      type: String
    - contextPath: SLS.Logging.Threat.NatDestination
      description: If destination NAT performed, the post-NAT destination IP address. The IP address is an IPv4/IPv6 address in hex format.
      type: String
    - contextPath: SLS.Logging.Threat.Flags
      description: Bit field which provides details on the session, such as whether the session use IPv6, whether the session was denied due to a URL filtering rule, and/or whether the log corresponds to a transaction within an HTTP proxy session.
      type: String
    - contextPath: SLS.Logging.Threat.DestinationPort
      description: Network traffic's destination port. If this value is 0, then the app is using its standard port.
      type: String
    - contextPath: SLS.Logging.Threat.ThreatID
      description: Numerical identifier for the threat type. All threats encountered by Palo Alto Networks firewalls are assigned a unique identifier.
      type: String
    - contextPath: SLS.Logging.Threat.NatSource
      description: If source NAT was performed, the post-NAT source IP address. The IP address is an IPv4/IPv6 address in hex format.
      type: String
    - contextPath: SLS.Logging.Threat.IsURLDenied
      description: Indicates whether the session was denied due to a URL filtering rule.
      type: Boolean
    - contextPath: SLS.Logging.Threat.Users
      description: Source/Destination user. If neither is available, source_ip is used.
      type: String
    - contextPath: SLS.Logging.Threat.TimeGenerated
      description: Time when the log was generated on the firewall's data plane.
      type: Date
    - contextPath: SLS.Logging.Threat.IsPhishing
      description: Indicates whether enterprise credentials were submitted by an end user.
      type: Boolean
    - contextPath: SLS.Logging.Threat.AppCategory
      description: Identifies the high-level family of the application.
      type: String
    - contextPath: SLS.Logging.Threat.SourceLocation
      description: Source country or internal region for private addresses.
      type: String
    - contextPath: SLS.Logging.Threat.DestinationLocation
      description: Destination country or internal region for private addresses.
      type: String
    - contextPath: SLS.Logging.Threat.ToZone
      description: Networking zone to which the traffic was sent.
      type: String
    - contextPath: SLS.Logging.Threat.RiskOfApp
      description: Indicates how risky the application is from a network security perspective.
      type: Number
    - contextPath: SLS.Logging.Threat.NatSourcePort
      description: Post-NAT source port.
      type: Number
    - contextPath: SLS.Logging.Threat.CharacteristicOfApp
      description: Identifies the behavioral characteristic of the application associated with the network traffic.
      type: Unknown
    - contextPath: SLS.Logging.Threat.FromZone
      description: The networking zone from which the traffic originated.
      type: String
    - contextPath: SLS.Logging.Threat.Vsys
      description: String representation of the unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: String
    - contextPath: SLS.Logging.Threat.Protocol
      description: IP protocol associated with the session.
      type: String
    - contextPath: SLS.Logging.Threat.NatDestinationPort
      description: Post-NAT destination port.
      type: Number
    - contextPath: SLS.Logging.Threat.DestinationIP
      description: Original destination IP address.
      type: String
    - contextPath: SLS.Logging.Threat.SourceIP
      description: Original source IP address.
      type: String
    - contextPath: SLS.Logging.Threat.RuleMatched
      description: Unique identifier for the security policy rule that the network traffic matched.
      type: String
    - contextPath: SLS.Logging.Threat.ThreatCategory
      description: Threat category of the detected threat.
      type: String
    - contextPath: SLS.Logging.Threat.LogSourceName
      description: Name of the source of the log.
      type: String
    - contextPath: SLS.Logging.Threat.Subtype
      description: Identifies the log subtype.
      type: String
    - contextPath: SLS.Logging.Threat.Direction
      description: Indicates the direction of the attack.
      type: String
    - contextPath: SLS.Logging.Threat.FileName
      description: The name of the file that is blocked.
      type: String
    - contextPath: SLS.Logging.Threat.VendorSeverity
      description: Severity associated with the event.
      type: String
    - contextPath: SLS.Logging.Threat.LogTime
      description: Time the log was received in Strata Logging Service XSOAR Connector.
      type: String
    - contextPath: SLS.Logging.Threat.LogSourceID
      description: ID that uniquely identifies the source of the log. If the source is a firewall, then it is its serial number.
      type: String
    - contextPath: SLS.Logging.Threat.VsysID
      description: A unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: Number
    - contextPath: SLS.Logging.Threat.URLDomain
      description: The name of the internet domain that was visited in this session.
      type: String
    - contextPath: SLS.Logging.Threat.URLCategory
      description: The URL category.
      type: String
    - contextPath: SLS.Logging.Threat.SourcePort
      description: Source port utilized by the session.
      type: Number
    description: Runs a query on the threat table with the query 'SELECT * FROM `firewall.threat` WHERE file_sha_256 = <file_hash>'.
  - name: sls-query-traffic-logs
    arguments:
    - name: source_ip
      description: A source IP address or an array of source IPs addresses for which to search, for example 1.1.1.1,2.2.2.2.
    - name: rule
      description: A rule name or an array of rule names to search.
    - name: from_zone
      description: A source zone name or an array of source zone names to search.
    - name: to_zone
      description: A destination zone name or an array of zone names to search.
    - name: source_port
      description: Source port utilized by the session. Can be a port number or an array of destination port numbers to search. For example '443' or '443,445'.
    - name: action
      description: An action name or an array of action names to search.
    - name: query
      description: A free-text query for which to search. This forms the WHERE part of the query, for example, !sls-query-traffic-logs query="source_ip.value LIKE '192.168.1.*' AND dest_ip.value='8.8.8.8' And dest_port=1234".
    - name: fields
      auto: PREDEFINED
      predefined:
      - all
      - vendor_name
      - log_source
      - log_source_id
      - log_source_name
      - customer_id
      - log_time
      - log_source_tz_offset
      - log_type
      - sub_type
      - source_ip
      - source_port
      - dest_ip
      - dest_port
      - protocol
      - action_source
      - bytes_total
      - bytes_received
      - bytes_sent
      - ep_assoc_id
      - chunks_total
      - chunks_received
      - chunks_sent
      - packets_total
      - packets_received
      - packets_sent
      - session_start_time
      - total_time_elapsed
      - session_end_reason
      - traffic_flags
      - url_category
      - action
      - action_flags
      - app
      - app_category
      - characteristics_of_app
      - container_of_app
      - dg_hier_level_1
      - dg_hier_level_2
      - dg_hier_level_3
      - dg_hier_level_4
      - dest_uuid
      - dest_location
      - dest_user
      - dest_user_info
      - is_exported
      - is_forwarded
      - from_zone
      - http2_connection
      - inbound_if
      - inbound_if_details
      - is_saas_app
      - is_dup_log
      - is_prisma_branch
      - is_prisma_mobile
      - log_set
      - monitor_tag_imei
      - nat_dest_port
      - nat_dest
      - nat_source_port
      - nat_source
      - non_standard_dest_port
      - outbound_if
      - outbound_if_details
      - parent_session_id
      - parent_start_time
      - count_of_repeats
      - risk_of_app
      - rule_matched
      - rule_matched_uuid
      - sanctioned_state_of_app
      - sequence_no
      - session_id
      - source_uuid
      - source_location
      - source_user
      - source_user_info
      - app_sub_category
      - technology_of_app
      - time_generated
      - to_zone
      - tunnel
      - tunneled_app
      - tunnelid_imsi
      - users
      - vsys_id
      - vsys
      - vsys_name
      - flags
      - is_decrypt_mirror
      - is_sym_return
      - is_container
      - is_server_to_client
      - is_client_to_server
      - is_transaction
      - is_non_std_dest_port
      - is_captive_portal
      - is_nat
      - is_proxy
      - is_packet_capture
      - is_phishing
      - is_mptcp_on
      - is_recon_excluded
      - is_url_denied
      - is_tunnel_inspected
      - is_source_x_fwded
      - is_ipv6
      - is_decrypted_payload_fwded
      - is_decryption_log
      - is_l7_inspection_b4_session
      - sess_owner_rt_midx
      - session_tracker
      - container_id
      - pod_namespace
      - pod_name
      - source_device_class
      - source_device_vendor
      - source_device_model
      - source_device_os
      - source_device_mac
      - dest_device_class
      - dest_device_vendor
      - dest_device_model
      - dest_device_os
      - dest_device_mac
      - link_change_count
      - policy_id
      - link_switches
      - sdwan_cluster
      - sdwan_device_type
      - sdwan_cluster_type
      - sdwan_site
      - dynusergroup_name
      - ingestion_time
      - record_size
      - source_device_host
      - dest_device_host
      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
      defaultValue: all
    - name: start_time
      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
      defaultValue: "'1970-01-01 00:00:00'"
    - name: end_time
      description: The query end time. For example, end_time="2018-04-26 00:00:00".
    - name: time_range
      description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
    - name: limit
      description: The maximum number of logs to return. Default is 5.
      defaultValue: '5'
    - name: page
      description: Page to return.
    - name: page_size
      description: Number of entries per page. Defaults to 50 (in case only page was provided).
    - name: dest_ip
      description: A destination IP address or an array of destination IPs addresses for which to search, for example 1.1.1.1,2.2.2.2.
    - name: dest_port
      description: Destination port utilized by the session. Can be port number or an array of destination port numbers to search. For example '443' or '443,445'.
    - name: ip
      description: An IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2. Used instead of the source/destination IP address.
    - name: port
      description: A port or array of ports to search. Used instead of the source/destination port.
    outputs:
    - contextPath: SLS.Logging.Traffic.Action
      description: Identifies the action that the firewall took for the network traffic.
      type: String
    - contextPath: SLS.Logging.Traffic.RiskOfApp
      description: Indicates how risky the application is from a network security perspective.
      type: String
    - contextPath: SLS.Logging.Traffic.NatSourcePort
      description: Post-NAT source port.
      type: Number
    - contextPath: SLS.Logging.Traffic.SessionID
      description: Identifies the firewall's internal identifier for a specific network session.
      type: String
    - contextPath: SLS.Logging.Traffic.Packets
      description: Number of total packets (transmit and receive) seen for the session.
      type: String
    - contextPath: SLS.Logging.Traffic.CharacteristicOfApp
      description: Identifies the behavioral characteristic of the application associated with the network traffic.
      type: String
    - contextPath: SLS.Logging.Traffic.App
      description: Application associated with the network traffic.
      type: String
    - contextPath: SLS.Logging.Traffic.Vsys
      description: Virtual system associated with the network traffic.
      type: String
    - contextPath: SLS.Logging.Traffic.IsNat
      description: Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1, otherwise it is 0.
      type: Boolean
    - contextPath: SLS.Logging.Traffic.LogTime
      description: Time the log was received in Strata Logging Service XSOAR Connector.
      type: date
    - contextPath: SLS.Logging.Traffic.SubcategoryOfApp
      description: Identifies the application's subcategory. The subcategory is related to the application's category.
      type: String
    - contextPath: SLS.Logging.Traffic.Protocol
      description: IP protocol associated with the session.
      type: String
    - contextPath: SLS.Logging.Traffic.NatDestinationPort
      description: Post-NAT destination port.
      type: String
    - contextPath: SLS.Logging.Traffic.DestinationIP
      description: Original destination IP address.
      type: String
    - contextPath: SLS.Logging.Traffic.NatDestination
      description: If destination NAT performed, the post-NAT destination IP address.
      type: String
    - contextPath: SLS.Logging.Traffic.RuleMatched
      description: Name of the security policy rule that the network traffic matched.
      type: String
    - contextPath: SLS.Logging.Traffic.DestinationPort
      description: Network traffic's destination port. If this value is 0, then the app is using its standard port.
      type: String
    - contextPath: SLS.Logging.Traffic.TotalTimeElapsed
      description: Total time for the network session to complete.
      type: String
    - contextPath: SLS.Logging.Traffic.LogSourceName
      description: Device name of the source of the log.
      type: String
    - contextPath: SLS.Logging.Traffic.Subtype
      description: The log sub type.
      type: String
    - contextPath: SLS.Logging.Traffic.Users
      description: Source/Destination user. If neither is available, source_ip is used.
      type: String
    - contextPath: SLS.Logging.Traffic.TunneledApp
      description: Whether the app is tunneled.
      type: String
    - contextPath: SLS.Logging.Traffic.IsPhishing
      description: Indicates whether enterprise credentials were submitted by an end user.
      type: String
    - contextPath: SLS.Logging.Traffic.SessionEndReason
      description: The reason a session terminated.
      type: String
    - contextPath: SLS.Logging.Traffic.NatSource
      description: If source NAT was performed, the post-NAT source IP address.
      type: String
    - contextPath: SLS.Logging.Traffic.SourceIP
      description: Original source IP address.
      type: String
    - contextPath: SLS.Logging.Traffic.SessionStartIP
      description: Time when the session was established.
      type: date
    - contextPath: SLS.Logging.Traffic.TimeGenerated
      description: Time when the log was generated on the firewall's data plane.
      type: date
    - contextPath: SLS.Logging.Traffic.AppCategory
      description: Identifies the high-level family of the application.
      type: String
    - contextPath: SLS.Logging.Traffic.SourceLocation
      description: Source country or internal region for private addresses.
      type: String
    - contextPath: SLS.Logging.Traffic.DestinationLocation
      description: Destination country or internal region for private addresses.
      type: String
    - contextPath: SLS.Logging.Traffic.LogSourceID
      description: ID that uniquely identifies the source of the log. If the source is a firewall, then it is its serial number.
      type: String
    - contextPath: SLS.Logging.Traffic.TotalBytes
      description: Number of total bytes (transmit and receive).
      type: String
    - contextPath: SLS.Logging.Traffic.VsysID
      description: A unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: String
    - contextPath: SLS.Logging.Traffic.ToZone
      description: Networking zone to which the traffic was sent.
      type: String
    - contextPath: SLS.Logging.Traffic.URLCategory
      description: The URL category.
      type: String
    - contextPath: SLS.Logging.Traffic.SourcePort
      description: Source port utilized by the session.
      type: String
    - contextPath: SLS.Logging.Traffic.Tunnel
      description: Type of tunnel.
      type: String
    - contextPath: SLS.Logging.Traffic.SourceDeviceHost
      description: Hostname of the device from which the session originated.
      type: String
    - contextPath: SLS.Logging.Traffic.DestDeviceHost
      description: Hostname of the device session destination.
      type: String
    description: Searches the Cortex firewall.traffic table. Traffic logs contain entries for the end of each network session.
  - name: sls-query-threat-logs
    arguments:
    - name: source_ip
      description: Original source IP address. Enter an IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2.
    - name: dest_ip
      description: Original destination IP address. Enter an IP address or an array of IP addresses for which to search, for example 1.1.1.1,2.2.2.2.
    - name: rule_matched
      description: Name of the security policy rule that the network traffic matched. Enter a rule name or array of rule names to search.
    - name: from_zone
      description: The networking zone from which the traffic originated. Enter the zone or array of zones to search.
    - name: to_zone
      description: The networking zone to which the traffic was sent. Enter the zone or array of zones to search.
    - name: source_port
      description: Source port utilized by the session. Enter a port or array of ports to search.
    - name: dest_port
      description: Network traffic's destination port. Enter a port or array of ports to search.
    - name: action
      auto: PREDEFINED
      predefined:
      - unknown
      - n-a
      - aged-out
      - decoder
      - tcp-reuse
      - resources-unavailable
      - tcp-fin
      - tcp-rst-from-server
      - tcp-rst-from-client
      - policy-deny
      - threat
      - decrypt-error
      - decrypt-unsupport-param
      - decrypt-cert-validation
      - request-timeout
      - shutdown-from-endpoint
      - abort-from-endpoint
      - split-tunnel
      description: The action that the firewall took for the network traffic. Enter an action or array of actions to search.
    - name: file_sha_256
      description: The binary hash (SHA256) of the file. Enter a SHA256 hash or array of SHA256 hashes to search.
    - name: file_name
      description: The name of the file that is blocked. Enter a file name or array of file names to search.
    - name: query
      description: Free input query to search. This is the WHERE part of the query. so an example will be !sls-query-traffic-logs query="source_ip.value LIKE '192.168.1.*' AND dest_ip.value = '192.168.1.12'".
    - name: fields
      auto: PREDEFINED
      predefined:
      - vendor_name
      - log_source
      - log_source_id
      - log_source_name
      - customer_id
      - log_time
      - log_source_tz_offset
      - log_type
      - sub_type
      - source_ip
      - source_port
      - dest_ip
      - dest_port
      - protocol
      - threat_id
      - threat_name
      - threat_category
      - cloud_hostname
      - direction_of_attack
      - url_domain
      - url_idx
      - file_name
      - cloud
      - file_sha_256
      - file_type
      - sender_of_virus
      - recipient_of_virus
      - subject_of_email
      - report_id
      - verdict
      - vendor_severity
      - severity
      - pcap
      - pcap_id
      - sig_flags
      - url_category
      - action
      - action_flags
      - app
      - app_category
      - characteristics_of_app
      - container_of_app
      - dg_hier_level_1
      - dg_hier_level_2
      - dg_hier_level_3
      - dg_hier_level_4
      - dest_uuid
      - dest_location
      - dest_user
      - dest_user_info
      - is_exported
      - is_forwarded
      - from_zone
      - http2_connection
      - inbound_if
      - inbound_if_details
      - is_saas_app
      - is_dup_log
      - is_prisma_branch
      - is_prisma_mobile
      - log_set
      - monitor_tag_imei
      - nat_dest_port
      - nat_dest
      - nat_source_port
      - nat_source
      - non_standard_dest_port
      - outbound_if
      - outbound_if_details
      - parent_session_id
      - parent_start_time
      - count_of_repeats
      - risk_of_app
      - rule_matched
      - rule_matched_uuid
      - sanctioned_state_of_app
      - sequence_no
      - session_id
      - source_uuid
      - source_location
      - source_user
      - source_user_info
      - app_sub_category
      - technology_of_app
      - time_generated
      - to_zone
      - tunnel
      - tunneled_app
      - tunnelid_imsi
      - users
      - vsys_id
      - vsys
      - vsys_name
      - flags
      - is_decrypt_mirror
      - is_sym_return
      - is_container
      - is_server_to_client
      - is_client_to_server
      - is_transaction
      - is_non_std_dest_port
      - is_captive_portal
      - is_nat
      - is_proxy
      - is_packet_capture
      - is_phishing
      - is_mptcp_on
      - is_recon_excluded
      - is_url_denied
      - is_tunnel_inspected
      - is_source_x_fwded
      - is_ipv6
      - container_id
      - pod_namespace
      - pod_name
      - source_device_class
      - source_device_vendor
      - source_device_model
      - source_device_os
      - source_device_mac
      - dest_device_class
      - dest_device_vendor
      - dest_device_model
      - dest_device_os
      - dest_device_mac
      - content_version
      - dynusergroup_name
      - ingestion_time
      - record_size
      - source_device_host
      - dest_device_host
      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
      isArray: true
      defaultValue: all
    - name: start_time
      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
      defaultValue: "'1970-01-01 00:00:00'"
    - name: end_time
      description: The query end time. For example, end_time="2018-04-26 00:00:00".
    - name: time_range
      description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
    - name: limit
      description: The maximum number of logs to return. Default is 5.
      defaultValue: '5'
    - name: page
      description: Page to return.
    - name: page_size
      description: Number of entries per page. Defaults to 50 (in case only page was provided).
    - name: ip
      description: The IP address or an array of IP addresses for which to search. For example 1.1.1.1,2.2.2.2. Used instead of the source/destination IP address.
    - name: port
      description: The port or array of ports to search. Used instead of the source/destination port.
    outputs:
    - contextPath: SLS.Logging.Threat.SessionID
      description: Identifies the firewall's internal identifier for a specific network session.
      type: String
    - contextPath: SLS.Logging.Threat.Action
      description: Identifies the action that the firewall took for the network traffic.
      type: String
    - contextPath: SLS.Logging.Threat.App
      description: Application associated with the network traffic.
      type: String
    - contextPath: SLS.Logging.Threat.IsNat
      description: Indicates whether the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1, otherwise it is 0.
      type: Boolean
    - contextPath: SLS.Logging.Threat.SubcategoryOfApp
      description: Identifies the application's subcategory. The subcategory is related to the application's category, which is identified in category_of_app.
      type: String
    - contextPath: SLS.Logging.Threat.PcapID
      description: Packet capture (pcap) ID. This is used to correlate threat pcap files with extended pcaps taken as a part of the session flow. All threat logs will contain either a pcap_id of 0 (no associated pcap) , or an ID referencing the extended pcap file.
      type: String
    - contextPath: SLS.Logging.Threat.NatDestination
      description: If destination NAT performed, the post-NAT destination IP address. The IP address is an IPv4/IPv6 address in hex format.
      type: String
    - contextPath: SLS.Logging.Threat.Flags
      description: Bit field which provides details on the session, such as whether the session use IPv6, whether the session was denied due to a URL filtering rule, and/or whether the log corresponds to a transaction within an HTTP proxy session.
      type: String
    - contextPath: SLS.Logging.Threat.DestinationPort
      description: Network traffic's destination port. If this value is 0, then the app is using its standard port.
      type: String
    - contextPath: SLS.Logging.Threat.ThreatID
      description: Numerical identifier for the threat type. All threats encountered by Palo Alto Networks firewalls are assigned a unique identifier.
      type: String
    - contextPath: SLS.Logging.Threat.NatSource
      description: If source NAT was performed, the post-NAT source IP address. The IP address is an IPv4/IPv6 address in hex format.
      type: String
    - contextPath: SLS.Logging.Threat.IsURLDenied
      description: Indicates whether the session was denied due to a URL filtering rule.
      type: Boolean
    - contextPath: SLS.Logging.Threat.Users
      description: Source/Destination user. If neither is available, source_ip is used.
      type: String
    - contextPath: SLS.Logging.Threat.TimeGenerated
      description: Time when the log was generated on the firewall's data plane.
      type: Date
    - contextPath: SLS.Logging.Threat.IsPhishing
      description: Indicates whether enterprise credentials were submitted by an end user.
      type: Boolean
    - contextPath: SLS.Logging.Threat.AppCategory
      description: Identifies the high-level family of the application.
      type: String
    - contextPath: SLS.Logging.Threat.SourceLocation
      description: Source country or internal region for private addresses.
      type: String
    - contextPath: SLS.Logging.Threat.DestinationLocation
      description: Destination country or internal region for private addresses.
      type: String
    - contextPath: SLS.Logging.Threat.ToZone
      description: Networking zone to which the traffic was sent.
      type: String
    - contextPath: SLS.Logging.Threat.RiskOfApp
      description: Indicates how risky the application is from a network security perspective.
      type: Number
    - contextPath: SLS.Logging.Threat.NatSourcePort
      description: Post-NAT source port.
      type: Number
    - contextPath: SLS.Logging.Threat.CharacteristicOfApp
      description: Identifies the behavioral characteristic of the application associated with the network traffic.
      type: Unknown
    - contextPath: SLS.Logging.Threat.FromZone
      description: The networking zone from which the traffic originated.
      type: String
    - contextPath: SLS.Logging.Threat.Vsys
      description: String representation of the unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: String
    - contextPath: SLS.Logging.Threat.Protocol
      description: IP protocol associated with the session.
      type: String
    - contextPath: SLS.Logging.Threat.NatDestinationPort
      description: Post-NAT destination port.
      type: Number
    - contextPath: SLS.Logging.Threat.DestinationIP
      description: Original destination IP address.
      type: String
    - contextPath: SLS.Logging.Threat.SourceIP
      description: Original source IP address.
      type: String
    - contextPath: SLS.Logging.Threat.RuleMatched
      description: Unique identifier for the security policy rule that the network traffic matched.
      type: String
    - contextPath: SLS.Logging.Threat.ThreatCategory
      description: Threat category of the detected threat.
      type: String
    - contextPath: SLS.Logging.Threat.ThreatName
      description: Threat name of the detected threat.
      type: String
    - contextPath: SLS.Logging.Threat.LogSourceName
      description: Name of the source of the log.
      type: String
    - contextPath: SLS.Logging.Threat.Subtype
      description: Identifies the log subtype.
      type: String
    - contextPath: SLS.Logging.Threat.Direction
      description: Indicates the direction of the attack.
      type: String
    - contextPath: SLS.Logging.Threat.FileName
      description: The name of the file that is blocked.
      type: String
    - contextPath: SLS.Logging.Threat.VendorSeverity
      description: Severity associated with the event.
      type: String
    - contextPath: SLS.Logging.Threat.LogTime
      description: Time the log was received in Strata Logging Service XSOAR Connector.
      type: String
    - contextPath: SLS.Logging.Threat.LogSourceID
      description: ID that uniquely identifies the source of the log. If the source is a firewall, then it is its serial number.
      type: String
    - contextPath: SLS.Logging.Threat.VsysID
      description: A unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: Number
    - contextPath: SLS.Logging.Threat.URLDomain
      description: The name of the internet domain that was visited in this session.
      type: String
    - contextPath: SLS.Logging.Threat.URLCategory
      description: The URL category.
      type: String
    - contextPath: SLS.Logging.Threat.SourcePort
      description: Source port utilized by the session.
      type: Number
    - contextPath: SLS.Logging.Threat.SourceDeviceHost
      description: Hostname of the device from which the session originated.
      type: String
    - contextPath: SLS.Logging.Threat.DestDeviceHost
      description: Hostname of the device session destination.
      type: String
    description: Searches the Cortex panw.threat table, which is the threat logs table for PAN-OS/Panorama.
  - name: sls-query-url-logs
    arguments:
    - name: source_ip
      description: A source IP address or an array of IP addresses for which to search. For example, 1.1.1.1,2.2.2.2.
    - name: dest_ip
      description: A destination IP address or an array of IP addresses for which to search. For example, 1.1.1.1,2.2.2.2.
    - name: rule_matched
      description: The name of the security policy rule or an array of rule names to search.
    - name: from_zone
      description: The networking zone or array of zones to search.
    - name: to_zone
      description: The networking zone or array of zones to search.
    - name: source_port
      description: The source port or array of ports to search.
    - name: dest_port
      description: The network traffic's destination port or array of ports to search.
    - name: action
      auto: PREDEFINED
      predefined:
      - unknown
      - n-a
      - aged-out
      - decoder
      - tcp-reuse
      - resources-unavailable
      - tcp-fin
      - tcp-rst-from-server
      - tcp-rst-from-client
      - policy-deny
      - threat
      - decrypt-error
      - decrypt-unsupport-param
      - decrypt-cert-validation
      - request-timeout
      - shutdown-from-endpoint
      - abort-from-endpoint
      - split-tunnel
      description: The action or array of actions that the firewall undertook to search.
    - name: query
      description: Free input query to search. This is the WHERE part of the query. For example, !sls-query-url-logs query="source_ip.value LIKE '192.168.1.*' AND dest_ip.value = '192.168.1.12'".
    - name: fields
      auto: PREDEFINED
      predefined:
      - vendor_name
      - log_source
      - log_source_id
      - log_source_name
      - customer_id
      - log_time
      - log_source_tz_offset
      - log_type
      - sub_type
      - source_ip
      - source_port
      - dest_ip
      - dest_port
      - protocol
      - threat_id
      - threat_name
      - threat_category
      - cloud_hostname
      - direction_of_attack
      - url_domain
      - url_idx
      - file_name
      - cloud
      - file_sha_256
      - file_type
      - sender_of_virus
      - recipient_of_virus
      - subject_of_email
      - report_id
      - verdict
      - vendor_severity
      - severity
      - pcap
      - pcap_id
      - sig_flags
      - url_category
      - action
      - action_flags
      - app
      - app_category
      - characteristics_of_app
      - container_of_app
      - dg_hier_level_1
      - dg_hier_level_2
      - dg_hier_level_3
      - dg_hier_level_4
      - dest_uuid
      - dest_location
      - dest_user
      - dest_user_info
      - is_exported
      - is_forwarded
      - from_zone
      - http2_connection
      - inbound_if
      - inbound_if_details
      - is_saas_app
      - is_dup_log
      - is_prisma_branch
      - is_prisma_mobile
      - log_set
      - monitor_tag_imei
      - nat_dest_port
      - nat_dest
      - nat_source_port
      - nat_source
      - non_standard_dest_port
      - outbound_if
      - outbound_if_details
      - parent_session_id
      - parent_start_time
      - count_of_repeats
      - risk_of_app
      - rule_matched
      - rule_matched_uuid
      - sanctioned_state_of_app
      - sequence_no
      - session_id
      - source_uuid
      - source_location
      - source_user
      - source_user_info
      - app_sub_category
      - technology_of_app
      - time_generated
      - to_zone
      - tunnel
      - tunneled_app
      - tunnelid_imsi
      - users
      - vsys_id
      - vsys
      - vsys_name
      - flags
      - is_decrypt_mirror
      - is_sym_return
      - is_container
      - is_server_to_client
      - is_client_to_server
      - is_transaction
      - is_non_std_dest_port
      - is_captive_portal
      - is_nat
      - is_proxy
      - is_packet_capture
      - is_phishing
      - is_mptcp_on
      - is_recon_excluded
      - is_url_denied
      - is_tunnel_inspected
      - is_source_x_fwded
      - is_ipv6
      - container_id
      - pod_namespace
      - pod_name
      - source_device_class
      - source_device_vendor
      - source_device_model
      - source_device_os
      - source_device_mac
      - dest_device_class
      - dest_device_vendor
      - dest_device_model
      - dest_device_os
      - dest_device_mac
      - content_version
      - dynusergroup_name
      - ingestion_time
      - record_size
      - source_device_host
      - dest_device_host
      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
      isArray: true
      defaultValue: all
    - name: start_time
      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
      defaultValue: "'1970-01-01 00:00:00'"
    - name: end_time
      description: The query end time. For example, end_time="2018-04-26 00:00:00".
    - name: time_range
      description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
    - name: limit
      description: The maximum number of logs to return. Default is 5.
    - name: page
      description: Page to return.
    - name: page_size
      description: Number of entries per page. Defaults to 50 (in case only page was provided).
    - name: ip
      description: The IP address or an array of IP addresses for which to search. For example 1.1.1.1,2.2.2.2. Used instead of the source/destination IP address.
    - name: port
      description: The port or array of ports to search. Used instead of the source/destination port.
    - name: url
      description: "This argument allows to perform a LIKE search of the specified values on the URL and URI fields. \nAn example value will be paloaltonetworks.com, demisto\twhich will provide results like https://apps.paloaltonetworks.com and https://demisto.com."
    outputs:
    - contextPath: SLS.Logging.URL.SessionID
      description: Identifies the firewall's internal identifier for a specific network session.
      type: String
    - contextPath: SLS.Logging.URL.Action
      description: Identifies the action that the firewall took for the network traffic.
      type: String
    - contextPath: SLS.Logging.URL.App
      description: The application associated with the network traffic.
      type: String
    - contextPath: SLS.Logging.URL.PcapID
      description: Packet capture (pcap) ID. Used to correlate threat pcap files with extended pcaps taken as a part of the session flow. All threat logs contain either a pcap_id of 0 (no associated pcap), or an ID referencing the extended pcap file.
      type: String
    - contextPath: SLS.Logging.URL.DestinationPort
      description: The network traffic's destination port. If this value is 0, then the app is using its standard port.
      type: String
    - contextPath: SLS.Logging.URL.AppCategory
      description: Identifies the high-level family of the application.
      type: String
    - contextPath: SLS.Logging.URL.AppSubCategory
      description: Identifies the application's subcategory. The subcategory is related to the application's category, which is identified in category_of_app.
      type: String
    - contextPath: SLS.Logging.URL.SourceLocation
      description: The source country or internal region for private addresses.
      type: String
    - contextPath: SLS.Logging.URL.DestinationLocation
      description: The destination country or internal region for private addresses.
      type: String
    - contextPath: SLS.Logging.URL.ToZone
      description: The networking zone to which the traffic was sent.
      type: String
    - contextPath: SLS.Logging.URL.FromZone
      description: The networking zone from which the traffic originated.
      type: String
    - contextPath: SLS.Logging.URL.Protocol
      description: The IP protocol associated with the session.
      type: String
    - contextPath: SLS.Logging.URL.DestinationIP
      description: The original destination IP address.
      type: String
    - contextPath: SLS.Logging.URL.SourceIP
      description: The original source IP address.
      type: String
    - contextPath: SLS.Logging.URL.RuleMatched
      description: The unique identifier for the security policy rule that the network traffic matched.
      type: String
    - contextPath: SLS.Logging.URL.ThreatCategory
      description: The category of the detected threat.
      type: String
    - contextPath: SLS.Logging.URL.ThreatName
      description: The name of the detected threat.
      type: String
    - contextPath: SLS.Logging.URL.Subtype
      description: Identifies the log subtype.
      type: String
    - contextPath: SLS.Logging.URL.LogTime
      description: The time the log was received in Strata Logging Service XSOAR Connector.
      type: String
    - contextPath: SLS.Logging.URL.LogSourceName
      description: The name of the source of the log.
      type: String
    - contextPath: SLS.Logging.URL.Denied
      description: Indicates whether the session was denied due to a URL filtering rule.
      type: Boolean
    - contextPath: SLS.Logging.URL.Category
      description: The category of the URL.
      type: String
    - contextPath: SLS.Logging.URL.SourcePort
      description: The source port utilized by the session.
      type: Number
    - contextPath: SLS.Logging.URL.Url
      description: The name of the internet domain that was visited in this session.
      type: String
    - contextPath: SLS.Logging.URL.Uri
      description: The address of the URI.
      type: String
    - contextPath: SLS.Logging.URL.ContentType
      description: The content type of the HTTP response data.
      type: String
    - contextPath: SLS.Logging.URL.HTTPMethod
      description: "The HTTP Method used\nin the web request."
      type: String
    - contextPath: SLS.Logging.URL.Severity
      description: The severity associated with the event.
      type: String
    - contextPath: SLS.Logging.URL.UserAgent
      description: "The web browser that the user\nused to access the URL."
      type: String
    - contextPath: SLS.Logging.URL.RefererProtocol
      description: The protocol used in the HTTP Referer header field.
      type: Number
    - contextPath: SLS.Logging.URL.RefererPort
      description: The port used in the HTTP Referer header field.
      type: Number
    - contextPath: SLS.Logging.URL.RefererFQDN
      description: "The full domain name used in the HTTP Referer\nheader field."
      type: String
    - contextPath: SLS.Logging.URL.RefererURL
      description: The URL used in the HTTP Referer header field.
      type: String
    - contextPath: SLS.Logging.URL.SrcUser
      description: The username that initiated the network traffic.
      type: String
    - contextPath: SLS.Logging.URL.SrcUserInfo
      description: The information for the initiated user.
      type: String
    - contextPath: SLS.Logging.URL.DstUser
      description: The username to which the network traffic was destined.
      type: String
    - contextPath: SLS.Logging.URL.DstUserInfo
      description: The destination user information.
      type: String
    - contextPath: SLS.Logging.URL.TechnologyOfApp
      description: The networking technology used by the identified application.
      type: String
    - contextPath: SLS.Logging.URL.SourceDeviceHost
      description: Hostname of the device from which the session originated.
      type: String
    - contextPath: SLS.Logging.URL.DestDeviceHost
      description: Hostname of the device session destination.
      type: String
    description: Searches the URL log table.
  - name: sls-query-file-data
    arguments:
    - name: action
      auto: PREDEFINED
      predefined:
      - unknown
      - n-a
      - aged-out
      - decoder
      - tcp-reuse
      - resources-unavailable
      - tcp-fin
      - tcp-rst-from-server
      - tcp-rst-from-client
      - policy-deny
      - threat
      - decrypt-error
      - decrypt-unsupport-param
      - decrypt-cert-validation
      - request-timeout
      - shutdown-from-endpoint
      - abort-from-endpoint
      - split-tunnel
      description: Identifies the action that the firewall took for the network traffic.
    - name: app
      description: Application associated with the network traffic.
    - name: app_category
      description: Identifies the high-level family of the application.
    - name: dest_device_host
      description: Hostname of the device to which the session was directed.
    - name: dest_ip
      description: Original destination IP address.
    - name: dest_edl
      description: The name of the external dynamic list that contains the destination IP address of the traffic.
    - name: dest_dynamic_address_group
      description: The dynamic address group that Device-ID identifies as the destination for the traffic.
    - name: dest_location
      description: Destination country or internal region for private addresses.
    - name: dest_port
      description: "Network traffic's destination port. If this value is 0, then the app is using\nits standard port."
    - name: dest_user
      description: The username to which the network traffic was destined.
    - name: file_name
      description: The name of the file that is blocked.
    - name: file_sha_256
      description: The binary hash (SHA256) of the file. Enter a SHA256 hash or array of SHA256 hashes to search.
    - name: file_type
      description: Palo Alto Networks textual identifier for the threat.
    - name: from_zone
      description: The networking zone from which the traffic originated.
    - name: is_server_to_client
      description: Indicates if the direction of traffic is from server to client.
    - name: is_url_denied
      description: Indicates whether the session was denied due to a URL filtering rule.
    - name: log_type
      auto: PREDEFINED
      predefined:
      - traffic
      - config
      - system
      - threat
      - appstat
      - trsum
      - thsum
      - event
      - alarm
      - hipmatch
      - userid
      - iptag
      - mdm
      - extpcap
      - urlsum
      - gtp
      - gtpsum
      - auth
      - panflex
      - extflex
      - sctp
      - sctpsum
      - analytics
      - action
      - scan
      - sam
      description: Identifies the log type.
    - name: nat_dest
      description: If destination NAT performed, the post-NAT destination IP address.
    - name: nat_dest_port
      description: Post-NAT destination port.
    - name: nat_source
      description: If source NAT was performed, the post-NAT source IP address.
    - name: nat_source_port
      description: Post-NAT source port.
    - name: rule_matched
      description: Name of the security policy rule that the network traffic matched.
    - name: rule_matched_uuid
      description: Unique identifier for the security policy rule that the network traffic matched.
    - name: severity
      description: Severity as defined by the platform.
    - name: source_device_host
      description: Hostname of the device from which the session originated.
    - name: source_ip
      description: Original source IP address.
    - name: source_edl
      description: The name of the external dynamic list that contains the source IP address of the traffic.
    - name: source_dynamic_address_group
      description: The dynamic address group that Device-ID identifies as the source of the traffic.
    - name: source_location
      description: Source country or internal region for private addresses.
    - name: source_port
      description: Source port utilized by the session.
    - name: source_user
      description: The username that initiated the network traffic.
    - name: sub_type
      auto: PREDEFINED
      predefined:
      - attack
      - url
      - virus
      - spyware
      - vulnerability
      - file
      - scan
      - flood
      - packet
      - resource
      - data
      - url-content
      - wildfire
      - extpcap
      - wildfire-virus
      - http-hdr-insert
      - http-hdr
      - email-hdr
      - spyware-dns
      - spyware-wildfire-dns
      - spyware-wpc-dns
      - spyware-custom-dns
      - spyware-cloud-dns
      - spyware-raven
      - spyware-wildfire-raven
      - spyware-wpc-raven
      - wpc-virus
      - sctp
      description: Identifies the log subtype.
    - name: url_category
      description: The URL category.
    - name: url_domain
      description: The name of the internet domain that was visited in this session.
    - name: start_time
      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
      defaultValue: "'1970-01-01 00:00:00'"
    - name: end_time
      description: The query end time. For example, end_time="2018-04-26 00:00:00".
    - name: time_range
      description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
    - name: limit
      description: The maximum number of logs to return. Default is 5.
      defaultValue: '5'
    - name: page
      description: Page to return.
    - name: page_size
      description: Number of entries per page. Defaults to 50 (in case only page was provided).
    outputs:
    - contextPath: SLS.Logging.File.App
      description: Application associated with the network traffic.
      type: String
    - contextPath: SLS.Logging.File.TimeGenerated
      description: Time when the log was generated on the firewall's data plane.
      type: Date
    - contextPath: SLS.Logging.File.SourceIP
      description: Original source IP address.
      type: String
    - contextPath: SLS.Logging.File.DestinationLocation
      description: Destination country or internal region for private addresses.
      type: String
    - contextPath: SLS.Logging.File.FileSHA256
      description: The binary hash (SHA256) of the file.
      type: String
    - contextPath: SLS.Logging.File.FileName
      description: The name of the file that is blocked.
      type: String
    - contextPath: SLS.Logging.File.RuleMatched
      description: Name of the security policy rule that the network traffic matched.
      type: String
    - contextPath: SLS.Logging.File.LogSourceName
      description: Name of the source of the log. The hostname of the firewall that logged the network traffic.
      type: String
    - contextPath: SLS.Logging.File.NatDestination
      description: If destination NAT performed, the post-NAT destination IP address.
      type: String
    - contextPath: SLS.Logging.File.NatDestinationPort
      description: Post-NAT destination port.
      type: Number
    - contextPath: SLS.Logging.File.CharacteristicOfApp
      description: Identifies the behavioral characteristic of the application associated with the network traffic.
      type: String
    - contextPath: SLS.Logging.File.SourceLocation
      description: Source country or internal region for private addresses.
      type: String
    - contextPath: SLS.Logging.File.DestinationIP
      description: Original destination IP address.
      type: String
    - contextPath: SLS.Logging.File.Action
      description: Identifies the action that the firewall took for the network traffic.
      type: String
    - contextPath: SLS.Logging.File.IsNat
      description: Indicates if the firewall is performing network address translation (NAT) for the logged traffic. If it is, this value is 1, otherwise it is 0.
      type: Boolean
    - contextPath: SLS.Logging.File.Protocol
      description: IP protocol associated with the session.
      type: String
    - contextPath: SLS.Logging.File.NatSource
      description: If source NAT was performed, the post-NAT source IP address.
      type: String
    - contextPath: SLS.Logging.File.AppCategory
      description: Identifies the high-level family of the application.
      type: String
    - contextPath: SLS.Logging.File.IsUrlDenied
      description: Indicates whether the session was denied due to a URL filtering rule.
      type: Boolean
    - contextPath: SLS.Logging.File.IsTunnelInspected
      description: Indicates whether the payload for the outer tunnel was inspected.
      type: Boolean
    - contextPath: SLS.Logging.File.SequenceNo
      description: The log entry identifier, which is incremented sequentially.
      type: Number
    - contextPath: SLS.Logging.File.IsDecryptMirror
      description: Indicates whether decrypted traffic was sent out in clear text through a mirror port.
      type: Boolean
    - contextPath: SLS.Logging.File.IsNonStdDestPort
      description: Indicates if the destination port is non-standard.
      type: Boolean
    - contextPath: SLS.Logging.File.RuleMatchedUuid
      description: Unique identifier for the security policy rule that the network traffic matched.
      type: String
    - contextPath: SLS.Logging.File.IsProxy
      description: Indicates whether the SSL session is decrypted (SSL Proxy).
      type: Boolean
    - contextPath: SLS.Logging.File.VendorSeverity
      description: Severity associated with the event.
      type: String
    - contextPath: SLS.Logging.File.IsPhishing
      description: Indicates whether enterprise credentials were submitted by an end user.
      type: Boolean
    - contextPath: SLS.Logging.File.ToZone
      description: Networking zone to which the traffic was sent.
      type: String
    - contextPath: SLS.Logging.File.Flags
      description: Bit field which provides details on the session, such as whether the session use IPv6.
      type: Number
    - contextPath: SLS.Logging.File.Tunnel
      description: Type of tunnel.
      type: String
    - contextPath: SLS.Logging.File.CloudHostname
      description: The hostname in which the VM-series firewall is running.
      type: String
    - contextPath: SLS.Logging.File.Http2Connection
      description: Parent session ID for an HTTP/2 connection. If the traffic is not using HTTP/2, this field is set to 0.
      type: Number
    - contextPath: SLS.Logging.File.IsPrismaBranch
      description: Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.
      type: Boolean
    - contextPath: SLS.Logging.File.OutboundIf
      description: Interface to which the network traffic was destined.
      type: String
    - contextPath: SLS.Logging.File.IsSymReturn
      description: Indicates whether symmetric return was used to forward traffic for this session.
      type: Boolean
    - contextPath: SLS.Logging.File.URLCategory
      description: The URL category.
      type: String
    - contextPath: SLS.Logging.File.IsReconExcluded
      description: Indicates whether the source for the flow is on the firewall allow list and not subject to recon protection.
      type: Boolean
    - contextPath: SLS.Logging.File.SanctionedStateOfApp
      description: Indicates whether the application has been flagged as sanctioned by the firewall administrator.
      type: Boolean
    - contextPath: SLS.Logging.File.ReportID
      description: Identifies the analysis requested from the sandbox (cloud or appliance).
      type: Number
    - contextPath: SLS.Logging.File.DestinationPort
      description: "Network traffic's destination port. If this value is 0, then the app is using\nits standard port."
      type: Number
    - contextPath: SLS.Logging.File.IsDupLog
      description: Indicates whether this log data is available in multiple locations, such as from Strata Logging Service XSOAR Connector as well as from an on-premise log collector.
      type: Boolean
    - contextPath: SLS.Logging.File.LogTime
      description: Time the log was received in Strata Logging Service XSOAR Connector.
      type: Date
    - contextPath: SLS.Logging.File.SessionID
      description: Identifies the firewall's internal identifier for a specific network session.
      type: Number
    - contextPath: SLS.Logging.File.RecordSize
      description: The size of the record.
      type: Number
    - contextPath: SLS.Logging.File.IngestionTime
      description: Ingestion time of the log.
      type: Date
    - contextPath: SLS.Logging.File.CountOfRepeats
      description: Number of sessions with the same source IP, destination IP, application, and content/threat type seen for the summary interval.
      type: Number
    - contextPath: SLS.Logging.File.VsysID
      description: A unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: Number
    - contextPath: SLS.Logging.File.VendorName
      description: Identifies the vendor that produced the data.
      type: String
    - contextPath: SLS.Logging.File.IsMptcpOn
      description: Indicates whether the option is enabled on the next-generation firewall that allows a client to use multiple paths to connect to a destination host.
      type: Boolean
    - contextPath: SLS.Logging.File.IsClientToServer
      description: Indicates if the direction of traffic is from client to server.
      type: Boolean
    - contextPath: SLS.Logging.File.IsServerToClient
      description: Indicates if the direction of traffic is from server to client.
      type: Boolean
    - contextPath: SLS.Logging.File.IsPacketCapture
      description: Indicates whether the session has a packet capture (PCAP).
      type: Boolean
    - contextPath: SLS.Logging.File.IsTransaction
      description: Indicates whether the log corresponds to a transaction within an HTTP proxy session (Proxy Transaction).
      type: Boolean
    - contextPath: SLS.Logging.File.InboundIf
      description: Interface from which the network traffic was sourced.
      type: String
    - contextPath: SLS.Logging.File.FromZone
      description: The networking zone from which the traffic originated.
      type: String
    - contextPath: SLS.Logging.File.FileType
      description: Palo Alto Networks textual identifier for the threat.
      type: String
    - contextPath: SLS.Logging.File.IsPrismaMobile
      description: If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise. (For internal use only.)
      type: Boolean
    - contextPath: SLS.Logging.File.IsContainer
      description: Indicates if the session is a container page access (Container Page).
      type: Boolean
    - contextPath: SLS.Logging.File.IsSaasApp
      description: Indicates whether the application associated with this network traffic is a SAAS application. (For internal use only.)
      type: Boolean
    - contextPath: SLS.Logging.File.Vsys
      description: Unique identifier for a virtual system on a Palo Alto Networks firewall.
      type: String
    - contextPath: SLS.Logging.File.FileID
      description: Numerical identifier for the threat type.
      type: Number
    - contextPath: SLS.Logging.File.IsCaptivePortal
      description: Indicates if user information for the session was captured through Captive Portal.
      type: Boolean
    - contextPath: SLS.Logging.File.Protocol
      description: IP protocol associated with the session.
      type: String
    - contextPath: SLS.Logging.File.CustomerID
      description: The ID that uniquely identifies the Strata Logging Service XSOAR Connector instance which received this log record.
      type: Number
    - contextPath: SLS.Logging.File.Subtype
      description: Identifies the log subtype.
      type: String
    - contextPath: SLS.Logging.File.TunneledApp
      description: Tunneled app (For internal use only).
      type: String
    - contextPath: SLS.Logging.File.LogSourceID
      description: ID that uniquely identifies the source of the log. If the source is a firewall, then it is its serial number.
      type: String
    - contextPath: SLS.Logging.File.IsForwarded
      description: Indicates if the log is being forwarded. (For internal use only.)
      type: Boolean
    - contextPath: SLS.Logging.File.RiskOfApp
      description: Indicates how risky the application is from a network security perspective.
      type: Number
    - contextPath: SLS.Logging.File.PcapID
      description: Packet capture ID.
      type: Number
    - contextPath: SLS.Logging.File.AppSubcategory
      description: Identifies the application's subcategory.
      type: String
    - contextPath: SLS.Logging.File.IsExported
      description: Indicates if this log was exported from the firewall using the firewall's log export function.
      type: Boolean
    - contextPath: SLS.Logging.File.Severity
      description: Severity as defined by the platform.
      type: String
    - contextPath: SLS.Logging.File.NatSourcePort
      description: Post-NAT source port.
      type: Number
    - contextPath: SLS.Logging.File.LogType
      description: Identifies the log type.
      type: String
    - contextPath: SLS.Logging.File.LogSet
      description: Log forwarding profile name that was applied to the session. This name was defined by the firewall's administrator.
      type: String
    - contextPath: SLS.Logging.File.TechnologyOfApp
      description: The networking technology used by the identified application.
      type: String
    - contextPath: SLS.Logging.File.DirectionOfAttack
      description: Indicates the direction of the attack.
      type: String
    - contextPath: SLS.Logging.File.LogSource
      description: Identifies the origin of the data (the system that produced the data.
      type: String
    description: Searches the Cortex firewall.file_data table.
  - name: sls-query-gp-logs
    arguments:
    - name: limit
      description: The maximum number of logs to return.
      defaultValue: '10'
    - name: page
      description: Page to return.
    - name: page_size
      description: Number of entries per page. Defaults to 50 (in case only page was provided).
    - name: transform_results
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: If set to false, query results are not mapped into the standard command context.
      defaultValue: 'true'
    - name: fields
      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
      defaultValue: all
    - name: end_time
      description: The query end time. For example, end_time="2018-04-26 00:00:00".
    - name: start_time
      description: The query start time. For example, start_time="2018-04-26 00:00:00".
      defaultValue: "'1970-01-01 00:00:00'"
    - name: time_range
      description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
    - name: event_name
      description: Event name for which to search.
    - name: gateway
      description: GlobalProtect gateway for which to search.
    - name: private_ipv4
      description: Private IP address (v4) of the user that connected for which to search.
    - name: private_ipv6
      description: Private IP address (v6) of the user that connected for which to search.
    - name: public_ipv4
      description: Public IP address (v4) of the user that connected for which to search.
    - name: public_ipv6
      description: Public IP address (v6) of the user that connected for which to search.
    - name: source_user
      description: The source username for which to search.
    - name: event_status
      description: Event status (success or failure) for which to search.
    - name: portal
      description: GlobalProtect portal for which to search.
    - name: stage
      description: Name of the stage in the GlobalProtect connection workflow for which to search.
    outputs:
    - contextPath: SLS.Logging.GlobalProtect.AttemptedGateways
      description: All gateways that were available and attempted for the client location.
    - contextPath: SLS.Logging.GlobalProtect.AuthMethod
      description: Authentication method used for the GlobalProtect connection.
    - contextPath: SLS.Logging.GlobalProtect.ConnectionErrorID
      description: Enumeration integer assigned to the connection_error field value.
    - contextPath: SLS.Logging.GlobalProtect.ConnectionErrorValue
      description: Error information for unsuccessful connection.
    - contextPath: SLS.Logging.GlobalProtect.CountOfRepeats
      description: Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.
    - contextPath: SLS.Logging.GlobalProtect.CustomerID
      description: The ID that uniquely identifies the Cortex Data Lake instance which received this log record.
    - contextPath: SLS.Logging.GlobalProtect.EndpointDeviceName
      description: Name of the device that the user used for the connection.
    - contextPath: SLS.Logging.GlobalProtect.EndpointGPVersion
      description: GlobalProtect client version number.
    - contextPath: SLS.Logging.GlobalProtect.EndpointOSType
      description: OS type of the endpoint on which the GlobalProtect client is deployed.
    - contextPath: SLS.Logging.GlobalProtect.EndpointOSVersion
      description: OS version of the endpoint on which the GlobalProtect client is deployed.
    - contextPath: SLS.Logging.GlobalProtect.EventID
      description: The name of the event.
    - contextPath: SLS.Logging.GlobalProtect.Gateway
      description: Gateway for the connection.
    - contextPath: SLS.Logging.GlobalProtect.GatewayPriority
      description: Priority of the gateway.
    - contextPath: SLS.Logging.GlobalProtect.GatewaySelectionType
      description: Gateway selection method,  i.e., automatic, preferred, or manual.
    - contextPath: SLS.Logging.GlobalProtect.HostID
      description: Unique identifier GlobalProtect has assigned to the host.
    - contextPath: SLS.Logging.GlobalProtect.IsDuplicateLog
      description: Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector.
    - contextPath: SLS.Logging.GlobalProtect.IsExported
      description: Indicates if this log was exported from the firewall using the firewall's log export function.
    - contextPath: SLS.Logging.GlobalProtect.IsForwarded
      description: Internal use field that indicates if the log is being forwarded.
    - contextPath: SLS.Logging.GlobalProtect.IsPrismaBranch
      description: Internal use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.
    - contextPath: SLS.Logging.GlobalProtect.IsPrismaMobile
      description: Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise.
    - contextPath: SLS.Logging.GlobalProtect.LogSource
      description: Identifies the origin of the data.
    - contextPath: SLS.Logging.GlobalProtect.LogSourceID
      description: ID that uniquely identifies the source of the log.
    - contextPath: SLS.Logging.GlobalProtect.LogSourceName
      description: Name of the source of the log.
    - contextPath: SLS.Logging.GlobalProtect.LogTime
      description: Time the log was received in Strata Logging Service XSOAR Connector.
    - contextPath: SLS.Logging.GlobalProtect.LogType
      description: Identifies the log type.
    - contextPath: SLS.Logging.GlobalProtect.LoginDuration
      description: Duration for which the connected user was logged on.
    - contextPath: SLS.Logging.GlobalProtect.Opaque
      description: Additional information regarding the event.
    - contextPath: SLS.Logging.GlobalProtect.PlatformType
      description: The platform type.
    - contextPath: SLS.Logging.GlobalProtect.Portal
      description: GlobalProtect portal or gateway that the user connected to.
    - contextPath: SLS.Logging.GlobalProtect.PrivateIPv4
      description: Private IP address (v4) of the user that connected.
    - contextPath: SLS.Logging.GlobalProtect.PrivateIPv6
      description: Private IP address (v6) of the user that connected.
    - contextPath: SLS.Logging.GlobalProtect.ProjectName
      description: Project name.
    - contextPath: SLS.Logging.GlobalProtect.PublicIPv4
      description: Public IP address (v4) of the user that connected.
    - contextPath: SLS.Logging.GlobalProtect.PublicIPv6
      description: Public IP address (v6) of the user that connected.
    - contextPath: SLS.Logging.GlobalProtect.QuarantineReason
      description: Quarantine reason.
    - contextPath: SLS.Logging.GlobalProtect.SequenceNo
      description: The log entry identifier, which is incremented sequentially.
    - contextPath: SLS.Logging.GlobalProtect.SourceRegion
      description: Region of the gateway (or user) that connected.
    - contextPath: SLS.Logging.GlobalProtect.SourceUser
      description: The username that connected.
    - contextPath: SLS.Logging.GlobalProtect.SourceUserDomain
      description: Domain to which the source user belongs.
    - contextPath: SLS.Logging.GlobalProtect.SourceUserName
      description: The source user username.
    - contextPath: SLS.Logging.GlobalProtect.SSLResponseTime
      description: SSL response time in milliseconds.
    - contextPath: SLS.Logging.GlobalProtect.Stage
      description: Name of the stage in the GlobalProtect connection workflow.
    - contextPath: SLS.Logging.GlobalProtect.EventStatus
      description: The status (success or failure) of the event.
    - contextPath: SLS.Logging.GlobalProtect.Subtype
      description: The log subtype.
    - contextPath: SLS.Logging.GlobalProtect.TimeGenerated
      description: Time when the log was generated on the firewall's data plane.
    - contextPath: SLS.Logging.GlobalProtect.TunnelType
      description: Tunnel type i.e., SSL or VPN.
    - contextPath: SLS.Logging.GlobalProtect.VendorName
      description: The vendor that produced the data.
    description: Searches the GlobalProtect VPN log table.
  dockerimage: demisto/python_pancloud_v2:1.0.0.11206988
  isfetch: true
  runonce: false
  script: ''
  subtype: python3
  type: python
tests:
- Cortex Data Lake Test
fromversion: 5.0.0