---
title: "cef0.paloAltoNetworks"
canonical: "https://docs.devo.com/space/latest/211583019/cef0.paloAltoNetworks"
format: markdown
---
> Macro (toc)

## Introduction

The tags beginning with `cef0.paloAltoNetworks` identify events in CEF format generated by [Palo Alto](https://www.paloaltonetworks.com/).

## Tag structure

Events in CEF format don’t have a specific tag structure, as explained in [Technologies supported in CEF syslog format.](https://docs.devo.com/space/latest/94666383) They are always sent to a table with the structure **cef0**.*deviceVendor*.*deviceProduct*.

In this case, the valid data tables are:

| **Tags** | **Data tables** |
| --- | --- |
| `cef0.paloAltoNetworks.cortexXdr` | `cef0.paloAltoNetworks.cortexXdr` |
| `cef0.paloAltoNetworks.cortexXdrAgent` | `cef0.paloAltoNetworks.cortexXdrAgent` |
| `cef0.paloAltoNetworks.cortexXsoar` | `cef0.paloAltoNetworks.cortexXsoar` |
| `cef0.paloAltoNetworks.lf` | `cef0.paloAltoNetworks.lf` |
| `cef0.paloAltoNetworks.paloAltoNetworksCortexXsoar` | `cef0.paloAltoNetworks.paloAltoNetworksCortexXsoar` |
| `cef0.paloAltoNetworks.panOs` | `cef0.paloAltoNetworks.panOs` |
| `cef0.paloaltonetworks.panwiot` | `cef0.paloaltonetworks.panwiot` |

## How is the data sent to Devo?

CEF data can be sent directly to Devo or by using a relay. To use the [CEF default relay rule](https://devodocs.atlassian.net/wiki/spaces/latest/pages/96469422), send to the relay’s port 13000.  Learn more about CEF syslog format and how Devo tags these events in [Technologies supported in CEF syslog format](https://docs.devo.com/space/latest/94666383).

## Table structure

These are the fields displayed in this table:

- [cef0.paloAltoNetworks.cortexXdr](#tag1)
- [cef0.paloAltoNetworks.cortexXdrAgent](#tag2)
- [cef0.paloAltoNetworks.cortexXsoar](#tag25)
- [cef0.paloAltoNetworks.lf](#tag3)
- [cef0.paloAltoNetworks.paloAltoNetworksCortexXsoar](#tag4)
- [cef0.paloAltoNetworks.panOs](#tag5)
- [cef0.paloaltonetworks.panwiot](#tag6)

### > Macro (anchor)

cef0.paloAltoNetworks.cortexXdr

| **Field** | **Type** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *hostname* | `str` |  |  |
| *priorityCode* | `str` |  |  |
| *cefTag* | `str` |  |  |
| *cefVersion* | `str` |  |  |
| *embDeviceVendor* | `str` |  |  |
| *embDeviceProduct* | `str` |  |  |
| *deviceVersion* | `str` |  |  |
| *signatureID* | `str` |  |  |
| *name* | `str` |  |  |
| *severity* | `str` |  |  |
| *_cefVer* | `str` |  |  |
| *act* | `str` |  |  |
| *app* | `str` |  |  |
| *cat* | `str` |  |  |
| *cs1Label* | `str` |  |  |
| *cs1* | `str` |  |  |
| *cs2Label* | `str` |  |  |
| *cs2* | `str` |  |  |
| *cs3Label* | `str` |  |  |
| *cs3* | `str` |  |  |
| *cs4Label* | `str` |  |  |
| *cs4* | `str` |  |  |
| *cs5Label* | `str` |  |  |
| *cs5* | `str` |  |  |
| *cs6Label* | `str` |  |  |
| *cs6* | `str` |  |  |
| *dst* | `ip4` |  |  |
| *dpt* | `str` |  |  |
| *end* | `timestamp` |  |  |
| *deviceFacility* | `str` |  |  |
| *externalId* | `int8` |  |  |
| *fileHash* | `str` |  |  |
| *filePath* | `str` |  |  |
| *request* | `str` |  |  |
| *shost* | `str` |  |  |
| *src* | `ip4` |  |  |
| *spt* | `int4` |  |  |
| *suser* | `str` |  |  |
| *CSPaccountname* | `str` |  |  |
| *cgoSha256* | `str` |  |  |
| *incident* | `str` |  |  |
| *initiatorPath* | `str` |  |  |
| *initiatorSha256* | `str` |  |  |
| *osParentCmd* | `str` |  |  |
| *osParentName* | `str` |  |  |
| *osParentSha256* | `str` |  |  |
| *osParentSignature* | `str` |  |  |
| *osParentSigner* | `str` |  |  |
| *targetprocesscmd* | `str` |  |  |
| *targetprocessname* | `str` |  |  |
| *targetprocesssha256* | `str` |  |  |
| *targetprocesssignature* | `str` |  |  |
| *tenantCDLid* | `str` |  |  |
| *tenantname* | `str` |  |  |
| *hostchain* | `str` |  | **✓** |
| *tag* | `str` | *cefTag* | **✓** |
| *rawMessage* | `str` |  | **✓** |

### > Macro (anchor)

cef0.paloAltoNetworks.cortexXdrAgent

| **Field** | **Type** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *hostname* | `str` |  |  |
| *priorityCode* | `str` |  |  |
| *cefTag* | `str` |  |  |
| *cefVersion* | `str` |  |  |
| *embDeviceVendor* | `str` |  |  |
| *embDeviceProduct* | `str` |  |  |
| *deviceVersion* | `str` |  |  |
| *signatureID* | `str` |  |  |
| *name* | `str` |  |  |
| *severity* | `str` |  |  |
| *dvchost* | `str` |  |  |
| *shost* | `str` |  |  |
| *cat* | `str` |  |  |
| *end* | `timestamp` |  |  |
| *rt* | `timestamp` |  |  |
| *cs1Label* | `str` |  |  |
| *cs1* | `str` |  |  |
| *cs2Label* | `str` |  |  |
| *cs2* | `str` |  |  |
| *cs3Label* | `str` |  |  |
| *cs3* | `str` |  |  |
| *cs4Label* | `str` |  |  |
| *cs4* | `str` |  |  |
| *msg* | `str` |  |  |
| *tenantname* | `str` |  |  |
| *tenantCDLid* | `str` |  |  |
| *CSPaccountname* | `str` |  |  |
| *hostchain* | `str` |  | **✓** |
| *tag* | `str` | *cefTag* | **✓** |
| *rawMessage* | `str` |  | **✓** |

### > Macro (anchor)

cef0.paloAltoNetworks.cortexXsoar

| **Field** | **Type** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *machine* | `str` |  |  |
| *priority_code* | `str` |  |  |
| *cef_tag* | `str` |  |  |
| *cef_version* | `str` |  |  |
| *emb_device_vendor* | `str` |  |  |
| *emb_device_product* | `str` |  |  |
| *device_version* | `str` |  |  |
| *signature_id* | `str` |  |  |
| *name* | `str` |  |  |
| *severity* | `str` |  |  |
| *device_custom_string_1_label* | `str` |  |  |
| *device_custom_string_1* | `str` |  |  |
| *device_custom_string_2_label* | `str` |  |  |
| *device_custom_string_2* | `str` |  |  |
| *device_custom_string_3_label* | `str` |  |  |
| *device_custom_string_3* | `str` |  |  |
| *device_custom_string_4_label* | `str` |  |  |
| *device_custom_string_4* | `str` |  |  |
| *end* | `timestamp` |  |  |
| *external_id* | `int8` |  |  |
| *message* | `str` |  |  |
| *source_username* | `str` |  |  |
| *cs_paccountname* | `str` |  |  |
| *tenant_cd_lid* | `str` |  |  |
| *tenantname* | `str` |  |  |
| *hostchain* | `str` |  | **✓** |
| *tag* | `str` | *cef_tag* | **✓** |
| *rawMessage* | `str` |  | **✓** |

### > Macro (anchor)

cef0.paloAltoNetworks.lf

| **Field** | **Type** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *hostname* | `str` |  |  |
| *priorityCode* | `str` |  |  |
| *cefTag* | `str` |  |  |
| *cefVersion* | `str` |  |  |
| *embDeviceVendor* | `str` |  |  |
| *embDeviceProduct* | `str` |  |  |
| *deviceVersion* | `str` |  |  |
| *signatureID* | `str` |  |  |
| *name* | `str` |  |  |
| *severity* | `str` |  |  |
| *_cefVer* | `str` |  |  |
| *act* | `str` |  |  |
| *app* | `str` |  |  |
| *cat* | `str` |  |  |
| *c6a1Label* | `str` |  |  |
| *c6a1* | `str` |  |  |
| *cn1Label* | `str` |  |  |
| *cn1* | `int8` |  |  |
| *cn2Label* | `str` |  |  |
| *cn2* | `int8` |  |  |
| *cn3Label* | `str` |  |  |
| *cn3* | `int8` |  |  |
| *cnt* | `int4` |  |  |
| *cs1Label* | `str` |  |  |
| *cs1* | `str` |  |  |
| *cs2Label* | `str` |  |  |
| *cs2* | `str` |  |  |
| *cs3Label* | `str` |  |  |
| *cs3* | `str` |  |  |
| *cs4Label* | `str` |  |  |
| *cs4* | `str` |  |  |
| *cs5Label* | `str` |  |  |
| *cs5* | `str` |  |  |
| *cs6Label* | `str` |  |  |
| *cs6* | `str` |  |  |
| *destinationServiceName* | `str` |  |  |
| *destinationTranslatedAddress* | `ip4` |  |  |
| *destinationTranslatedPort* | `int4` |  |  |
| *deviceExternalId* | `str` |  |  |
| *deviceInboundInterface* | `str` |  |  |
| *deviceOutboundInterface* | `str` |  |  |
| *dhost* | `str` |  |  |
| *dst* | `ip4` |  |  |
| *dpt* | `int4` |  |  |
| *duser* | `str` |  |  |
| *dvchost* | `str` |  |  |
| *end* | `timestamp` |  |  |
| *externalId* | `int8` |  |  |
| *fileId* | `str` |  |  |
| *fname* | `str` |  |  |
| *in* | `int8` |  |  |
| *msg* | `str` |  |  |
| *out* | `int8` |  |  |
| *proto* | `str` |  |  |
| *reason* | `str` |  |  |
| *requestClientApplication* | `str` |  |  |
| *requestMethod* | `str` |  |  |
| *requestContext* | `str` |  |  |
| *request* | `str` |  |  |
| *rt* | `timestamp` |  |  |
| *dtz* | `str` |  |  |
| *shost* | `str` |  |  |
| *sourceTranslatedAddress* | `ip4` |  |  |
| *sourceTranslatedPort* | `int4` |  |  |
| *src* | `ip4` |  |  |
| *spt* | `int4` |  |  |
| *start* | `timestamp` |  |  |
| *suser* | `str` |  |  |
| *flexString2* | `str` |  |  |
| *flexString2Label* | `str` |  |  |
| *PanOSAttemptedGateways* | `str` |  |  |
| *PanOSAuthMethod* | `str` |  |  |
| *PanOSBytes* | `str` |  |  |
| *PanOSChunksReceived* | `str` |  |  |
| *PanOSChunksSent* | `str` |  |  |
| *PanOSChunksTotal* | `str` |  |  |
| *PanOSConfigVersion* | `str` |  |  |
| *PanOSConnectionError* | `str` |  |  |
| *PanOSConnectionErrorID* | `str` |  |  |
| *PanOSConnectionMethod* | `str` |  |  |
| *PanOSContainerID* | `str` |  |  |
| *PanOSContainerName* | `str` |  |  |
| *PanOSContainerNameSpace* | `str` |  |  |
| *PanOSContentVersion* | `str` |  |  |
| *PanOSCountOfRepeats* | `str` |  |  |
| *PanOSDescription* | `str` |  |  |
| *PanOSDestinationDeviceCategory* | `str` |  |  |
| *PanOSDestinationDeviceHost* | `str` |  |  |
| *PanOSDestinationDeviceMac* | `str` |  |  |
| *PanOSDestinationDeviceModel* | `str` |  |  |
| *PanOSDestinationDeviceOSFamily* | `str` |  |  |
| *PanOSDestinationDeviceOSVersion* | `str` |  |  |
| *PanOSDestinationDeviceProfile* | `str` |  |  |
| *PanOSDestinationDeviceVendor* | `str` |  |  |
| *PanOSDestinationDynamicAddressGroup* | `str` |  |  |
| *PanOSDestinationEDL* | `str` |  |  |
| *PanOSDestinationLocation* | `str` |  |  |
| *PanOSDestinationUUID* | `str` |  |  |
| *PanOSDeviceGroup* | `str` |  |  |
| *PanOSDeviceName* | `str` |  |  |
| *PanOSDeviceSN* | `str` |  |  |
| *PanOSDGHierarchyLevel1* | `str` |  |  |
| *PanOSDGHierarchyLevel2* | `str` |  |  |
| *PanOSDGHierarchyLevel3* | `str` |  |  |
| *PanOSDGHierarchyLevel4* | `str` |  |  |
| *PanOSDynamicUserGroupName* | `str` |  |  |
| *PanOSEndpointAssociationID* | `str` |  |  |
| *PanOSEndpointDeviceName* | `str` |  |  |
| *PanOSEndpointOSType* | `str` |  |  |
| *PanOSEndpointOSVersion* | `str` |  |  |
| *PanOSEndpointSerialNumber* | `str` |  |  |
| *PanOSEndpointSN* | `str` |  |  |
| *PanOSEventDescription* | `str` |  |  |
| *PanOSEventIDValue* | `str` |  |  |
| *PanOSEventResult* | `str` |  |  |
| *PanOSEventStatus* | `str` |  |  |
| *PanOSEventTime* | `timestamp` |  |  |
| *PanOSGateway* | `str` |  |  |
| *PanOSGatewayPriority* | `str` |  |  |
| *PanOSGatewaySelectionType* | `str` |  |  |
| *PanOSGlobalProtectClientVersion* | `str` |  |  |
| *PanOSGlobalProtectGatewayLocation* | `str` |  |  |
| *PanOSGPHostID* | `str` |  |  |
| *PanOSHASessionOwner* | `str` |  |  |
| *PanOSHipMatchType* | `str` |  |  |
| *PanOSHostID* | `str` |  |  |
| *PanOSHTTP2Connection* | `str` |  |  |
| *PanOSHTTPHeaders* | `str` |  |  |
| *PanOSIMEI* | `str` |  |  |
| *PanOSIMSI* | `str` |  |  |
| *PanOSInlineMLVerdict* | `str` |  |  |
| *PanOSLinkChangeCount* | `str` |  |  |
| *PanOSLinkSwitches* | `str` |  |  |
| *PanOSLoginDuration* | `str` |  |  |
| *PanOSNSSAINetworkSliceDifferentiator* | `str` |  |  |
| *PanOSNSSAINetworkSliceType* | `str` |  |  |
| *PanOSPacketsReceived* | `str` |  |  |
| *PanOSPacketsSent* | `str` |  |  |
| *PanOSParentSessionID* | `str` |  |  |
| *PanOSParentStarttime* | `timestamp` |  |  |
| *PanOSPortal* | `str` |  |  |
| *PanOSPrivateIPv4* | `ip4` |  |  |
| *PanOSPrivateIPv6* | `str` |  |  |
| *PanOSPublicIPv4* | `ip4` |  |  |
| *PanOSPublicIPv6* | `str` |  |  |
| *PanOSQuarantineReason* | `str` |  |  |
| *PanOSReferer* | `str` |  |  |
| *PanOSRuleUUID* | `str` |  |  |
| *PanOSSDWANCluster* | `str` |  |  |
| *PanOSSDWANClusterType* | `str` |  |  |
| *PanOSSDWANDeviceType* | `str` |  |  |
| *PanOSSDWANPolicyName* | `str` |  |  |
| *PanOSSDWANSite* | `str` |  |  |
| *PanOSSequenceNo* | `str` |  |  |
| *PanOSSessionStartTime* | `timestamp` |  |  |
| *PanOSSigFlags* | `str` |  |  |
| *PanOSSource* | `str` |  |  |
| *PanOSSourceDeviceCategory* | `str` |  |  |
| *PanOSSourceDeviceHost* | `str` |  |  |
| *PanOSSourceDeviceMac* | `str` |  |  |
| *PanOSSourceDeviceModel* | `str` |  |  |
| *PanOSSourceDeviceOSFamily* | `str` |  |  |
| *PanOSSourceDeviceOSVersion* | `str` |  |  |
| *PanOSSourceDeviceProfile* | `str` |  |  |
| *PanOSSourceDeviceVendor* | `str` |  |  |
| *PanOSSourceDynamicAddressGroup* | `str` |  |  |
| *PanOSSourceEDL* | `str` |  |  |
| *PanOSSourceLocation* | `str` |  |  |
| *PanOSSourceRegion* | `str` |  |  |
| *PanOSSourceUser* | `str` |  |  |
| *PanOSSourceUserName* | `str` |  |  |
| *PanOSSourceUUID* | `str` |  |  |
| *PanOSSSLResponseTime* | `str` |  |  |
| *PanOSStage* | `str` |  |  |
| *PanOSTag* | `str` |  |  |
| *PanOSTemplate* | `str` |  |  |
| *PanOSThreatID* | `str` |  |  |
| *PanOSThreatCategory* | `str` |  |  |
| *PanOSTimeGeneratedHighResolution* | `str` |  |  |
| *PanOSTimestampDeviceIdentification* | `str` |  |  |
| *PanOSTunnel* | `str` |  |  |
| *PanOSTunnelType* | `str` |  |  |
| *PanOSUGFlags* | `str` |  |  |
| *PanOSURLCategoryList* | `str` |  |  |
| *PanOSURLCounter* | `str` |  |  |
| *PanOSUserIdentifiedBySource* | `str` |  |  |
| *PanOSVirtualSystem* | `str` |  |  |
| *PanOSVirtualSystemID* | `str` |  |  |
| *PanOSVirtualSystemName* | `str` |  |  |
| *PanOSXForwardedFor* | `str` |  |  |
| *PanOSXForwardedForIP* | `ip4` |  |  |
| *hostchain* | `str` |  | **✓** |
| *tag* | `str` | *cefTag* | **✓** |
| *rawMessage* | `str` |  | **✓** |

### > Macro (anchor)

cef0.paloAltoNetworks.paloAltoNetworksCortexXsoar

| **Field** | **Type** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *hostname* | `str` |  |  |
| *priorityCode* | `str` |  |  |
| *cefTag* | `str` |  |  |
| *cefVersion* | `str` |  |  |
| *embDeviceVendor* | `str` |  |  |
| *embDeviceProduct* | `str` |  |  |
| *deviceVersion* | `str` |  |  |
| *signatureID* | `str` |  |  |
| *name* | `str` |  |  |
| *severity* | `str` |  |  |
| *_cefVer* | `str` |  |  |
| *cs1Label* | `str` |  |  |
| *cs1* | `str` |  |  |
| *cs2Label* | `str` |  |  |
| *cs2* | `str` |  |  |
| *suser* | `str` |  |  |
| *startTime* | `timestamp` |  |  |
| *hostchain* | `str` |  | **✓** |
| *tag* | `str` | *cefTag* | **✓** |
| *rawMessage* | `str` |  | **✓** |

### > Macro (anchor)

cef0.paloAltoNetworks.panOs

| **Field** | **Type** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *hostname* | `str` |  |  |
| *priorityCode* | `str` |  |  |
| *cefTag* | `str` |  |  |
| *cefVersion* | `str` |  |  |
| *embDeviceVendor* | `str` |  |  |
| *embDeviceProduct* | `str` |  |  |
| *deviceVersion* | `str` |  |  |
| *signatureID* | `str` |  |  |
| *name* | `str` |  |  |
| *severity* | `str` |  |  |
| *_cefVer* | `str` |  |  |
| *act* | `str` |  |  |
| *app* | `str` |  |  |
| *cat* | `str` |  |  |
| *cn1Label* | `str` |  |  |
| *cn1* | `int8` |  |  |
| *cn2Label* | `str` |  |  |
| *cn2* | `int8` |  |  |
| *cn3Label* | `str` |  |  |
| *cn3* | `int8` |  |  |
| *cnt* | `int4` |  |  |
| *cs1Label* | `str` |  |  |
| *cs1* | `str` |  |  |
| *cs2Label* | `str` |  |  |
| *cs2* | `str` |  |  |
| *cs3Label* | `str` |  |  |
| *cs3* | `str` |  |  |
| *cs4Label* | `str` |  |  |
| *cs4* | `str` |  |  |
| *cs5Label* | `str` |  |  |
| *cs5* | `str` |  |  |
| *cs6Label* | `str` |  |  |
| *cs6* | `str` |  |  |
| *destinationTranslatedAddress* | `ip4` |  |  |
| *destinationTranslatedPort* | `int4` |  |  |
| *deviceExternalId* | `str` |  |  |
| *deviceInboundInterface* | `str` |  |  |
| *deviceOutboundInterface* | `str` |  |  |
| *dst* | `ip4` |  |  |
| *duser* | `str` |  |  |
| *dvchost* | `str` |  |  |
| *dvc* | `ip4` |  |  |
| *externalId* | `str` |  |  |
| *filePath* | `str` |  |  |
| *fileType* | `str` |  |  |
| *fname* | `str` |  |  |
| *in* | `int8` |  |  |
| *msg* | `str` |  |  |
| *out* | `int8` |  |  |
| *proto* | `str` |  |  |
| *request* | `str` |  |  |
| *rt* | `timestamp` |  |  |
| *sourceTranslatedAddress* | `ip4` |  |  |
| *sourceTranslatedPort* | `int4` |  |  |
| *spt* | `int4` |  |  |
| *src* | `ip4` |  |  |
| *start* | `timestamp` |  |  |
| *suser* | `str` |  |  |
| *agt* | `ip4` |  |  |
| *ahost* | `str` |  |  |
| *aid* | `str` |  |  |
| *arcSightEventPath* | `str` |  |  |
| *art* | `str` |  |  |
| *assetCriticality* | `int4` |  |  |
| *at* | `str` |  |  |
| *atz* | `str` |  |  |
| *av* | `str` |  |  |
| *catdt* | `str` |  |  |
| *categoryBehavior* | `str` |  |  |
| *categoryDeviceGroup* | `str` |  |  |
| *categoryObject* | `str` |  |  |
| *categoryOutcome* | `str` |  |  |
| *customerID* | `str` |  |  |
| *customerURI* | `str` |  |  |
| *destinationAssetId* | `str` |  |  |
| *destinationGeoCountryCode* | `str` |  |  |
| *destinationGeoLocationInfo* | `str` |  |  |
| *destinationGeoPostalCode* | `str` |  |  |
| *destinationGeoRegionCode* | `str` |  |  |
| *destinationZoneExternalID* | `str` |  |  |
| *destinationZoneID* | `str` |  |  |
| *destinationZoneURI* | `str` |  |  |
| *deviceAssetId* | `str` |  |  |
| *deviceFacility* | `str` |  |  |
| *deviceSeverity* | `str` |  |  |
| *deviceZoneID* | `str` |  |  |
| *deviceZoneURI* | `str` |  |  |
| *dlat* | `float8` |  |  |
| *dlong* | `float8` |  |  |
| *dpt* | `int4` |  |  |
| *dtz* | `str` |  |  |
| *eventAnnotationAuditTrail* | `str` |  |  |
| *eventAnnotationEndTime* | `timestamp` |  |  |
| *eventAnnotationEventId* | `str` |  |  |
| *eventAnnotationFlags* | `str` |  |  |
| *eventAnnotationManagerReceiptTime* | `timestamp` |  |  |
| *eventAnnotationModificationTime* | `timestamp` |  |  |
| *eventAnnotationStageID* | `str` |  |  |
| *eventAnnotationStageUpdateTime* | `timestamp` |  |  |
| *eventAnnotationStageURI* | `str` |  |  |
| *eventAnnotationVersion* | `int4` |  |  |
| *eventId* | `str` |  |  |
| *flexNumber1* | `int4` |  |  |
| *flexNumber1Label* | `str` |  |  |
| *flexString1* | `str` |  |  |
| *flexString1Label* | `str` |  |  |
| *flexString2* | `str` |  |  |
| *flexString2Label* | `str` |  |  |
| *generatorID* | `str` |  |  |
| *locality* | `int4` |  |  |
| *modelConfidence* | `int4` |  |  |
| *mrt* | `timestamp` |  |  |
| *priority* | `int4` |  |  |
| *relevance* | `int4` |  |  |
| *slat* | `float8` |  |  |
| *slong* | `float8` |  |  |
| *sourceAssetId* | `str` |  |  |
| *sourceGeoCountryCode* | `str` |  |  |
| *sourceGeoLocationInfo* | `str` |  |  |
| *sourceGeoPostalCode* | `str` |  |  |
| *sourceGeoRegionCode* | `str` |  |  |
| *sourceTranslatedZoneExternalID* | `str` |  |  |
| *sourceTranslatedZoneID* | `str` |  |  |
| *sourceTranslatedZoneURI* | `str` |  |  |
| *sourceZoneExternalID* | `str` |  |  |
| *sourceZoneID* | `str` |  |  |
| *sourceZoneURI* | `str` |  |  |
| *type* | `int4` |  |  |
| *tag* | `str` | *cefTag* | **✓** |
| *rawMessage* | `str` |  | **✓** |
| *hostchain* | `str` |  | **✓** |

### > Macro (anchor)

cef0.paloaltonetworks.panwiot

| **Field** | **Type** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |
| *hostname* | `str` |  |  |
| *priority_code* | `str` |  |  |
| *cef_tag* | `str` |  |  |
| *cef_version* | `str` |  |  |
| *emb_device_vendor* | `str` |  |  |
| *emb_device_product* | `str` |  |  |
| *device_version* | `str` |  |  |
| *signature_id* | `str` |  |  |
| *name* | `str` |  |  |
| *severity* | `str` |  |  |
| *device_custom_string_1_label* | `str` |  |  |
| *device_custom_string_1* | `str` |  |  |
| *device_custom_string_2_label* | `str` |  |  |
| *device_custom_string_2* | `str` |  |  |
| *device_custom_string_3_label* | `str` |  |  |
| *device_custom_string_3* | `str` |  |  |
| *device_custom_string_4_label* | `str` |  |  |
| *device_custom_string_4* | `str` |  |  |
| *device_hostname* | `str` |  |  |
| *device_ip* | `ip4` |  |  |
| *device_mac* | `str` |  |  |
| *device_custom_string_10* | `str` |  |  |
| *device_custom_string_10_label* | `str` |  |  |
| *device_custom_string_15* | `str` |  |  |
| *device_custom_string_15_label* | `str` |  |  |
| *device_custom_string_16* | `str` |  |  |
| *device_custom_string_16_label* | `str` |  |  |
| *device_custom_string_17* | `str` |  |  |
| *device_custom_string_17_label* | `str` |  |  |
| *device_custom_string_22* | `str` |  |  |
| *device_custom_string_22_label* | `str` |  |  |
| *device_custom_string_44* | `str` |  |  |
| *device_custom_string_44_label* | `str` |  |  |
| *device_custom_string_7* | `str` |  |  |
| *device_custom_string_7_label* | `str` |  |  |
| *device_custom_string_8* | `str` |  |  |
| *device_custom_string_8_label* | `str` |  |  |
| *device_custom_string_9* | `str` |  |  |
| *device_custom_string_9_label* | `str` |  |  |
| *hostchain* | `str` |  | **✓** |
| *tag* | `str` | *cef_tag* | **✓** |
| *rawMessage* | `str` |  | **✓** |