What does it mean Stage and Event GlobalProtect Fields?

[rennersf]

Dear, we are doing a large and hard troubleshooting to forensic analysis into our company, so we need know more information about the "GlobalProtect Stages and Events columns Logs Monitor".

Example: what it means the stages: before-login, tunnel, host-info, login and configuration. What it means the events: gateway-tunnel-latency, gateway-logout, portal-prelogin, portal-getconfig, portal-auth and gateway-auth.

PS: we have not found anything about this into Palo Alto's official doc.

Thanks a lot for help us.

[jdelio]

@rennersf 

Please take a look at this part of the GlobalProtect Admin guide and let me know if this helps at all.. 

https://docs.paloaltonetworks.com/globalprotect/10-0/globalprotect-admin/globalprotect-app-log-colle...

[rennersf]

Dear @jdelio . I appreciate your help. But it's still not what we're looking for. We need to thoroughly understand each of the GlobalProtect stages and events.

[MP18]

@rennersf 

Please check with your SE if he can get you this info.

Regards

[William-Wu]

This looks like what you are looking for: 
https://docs.paloaltonetworks.com/globalprotect/10-0/globalprotect-admin/logging-for-globalprotect-i...

Example: 

gateway-tunnel-latency

Indicates GlobalProtect gateway latency provided by a GlobalProtect client. Refer to description for latency reported information, such as Pre-tunnel latency: 10ms or Post-tunnel latency: 1ms

gateway-logout

Indicates a GlobalProtect gateway event for a GlobalProtect client logout.