I have syslogs coming to my SIEM from the device with PanOS V9.0. The number of fields i am receiving and the number of fields specified in the documentation doesnot match.
For example, in TRAFFIC logs,
1,2019/05/09 15:09:20,xxxxxxxxxxxx,TRAFFIC,end,2304,2019/05/09 15:09:20,xx.xx.xx.xx,xx.xx.xx.xx,xx.xx.xx.xx,xx.xx.xx.xx,Allow all,,,ocsp,vsys1,Internal Wireless,Internet,ethernetxx,ethernetxx,SIEM,2019/05/09 15:09:20,18812,1,53613,80,40642,80,0x400000,tcp,allow,2322,769,1553,20,2019/05/09 15:02:41,279,computer-and-internet-info,0,192113874,0x0,xx.xx.xx.xx-xx.xx.xx.xx,xxxxx,0,6,14,aged-out,0,0,0,0,,XX-XX,from-policy,,,0,,0,,N/A,0,0,0,0,75a0f003-007b-4ae1-85f2-ede4fa21ea14,0
There are total 67 fields.
However, according to documentation, the fields should be:
FUTURE_USE, Receive Time, Serial Number, Type, Threat/Content Type, FUTURE_USE, Generated Time, Source Address, Destination Address, NAT Source IP, NAT Destination IP, Rule Name, Source User, Destination User, Application, Virtual System, Source Zone, Destination Zone, Inbound Interface, Outbound Interface, Log Action, FUTURE_USE, Session ID, Repeat Count, Source Port, Destination Port, NAT Source Port, NAT Destination Port, Flags, Protocol, Action, URL/Filename, Threat ID, Category, Severity, Direction, Sequence Number, Action Flags, Source Location, Destination Location, FUTURE_USE, Content Type, PCAP_ID, File Digest, Cloud, URL Index, User Agent, File Type, X-Forwarded-For, Referer, Sender, Subject, Recipient, Report ID, Device Group Hierarchy Level 1, Device Group Hierarchy Level 2, Device Group Hierarchy Level 3, Device Group Hierarchy Level 4, Virtual System Name, Device Name, FUTURE_USE, Source VM UUID, Destination VM UUID, HTTP Method, Tunnel ID/IMSI, Monitor Tag/IMEI, Parent Session ID, Parent Start Time, Tunnel Type, Threat Category, Content Version, FUTURE_USE, SCTP Association ID, Payload Protocol ID, HTTP Headers, UUID for rule
which is 66 fields.
I am getting an extra '0' field at the end. According to documentation, the log should end at UUID for rule, which has value 75a0f003-007b-4ae1-85f2-ede4fa21ea14.
Similarly, I am getting more fields in THREAT Logs.
Can anyone explain me what is causing this?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!