Core Alert Fields | Marketplace

Details
Content
Dependencies
Version History

This Content Pack will provide you with the core alert fields.

Incident Fields

Name	Description
Mitre ATT&CK Tactic	Displays the type of MITRE ATT&CK tactic on which the alert was triggered.
Email Subject	The email subject value of a firewall alerts triggered on a the content of a malicious email.
Actor Process Instance ID	Unique identifier of the Actor Process instance generated by Cortex XDR
Cloud Resource Type	Classifications used to map similar types of resources across different cloud providers. For example, EC2, Google Compute Engine, and Microsoft Compute are all mapped to Compute
Registry Data	If the alert triggered on registry modifications (the Event Type is Registry) this is the registry data that triggered the alert. If not, then N/A
Initiator TID	Thread ID (TID) of the initiating process.
FW Rule Name	The firewall rule name that matches the network traffic that triggered the firewall alert.
CGO signer	The name of the software publishing vendor that signed the file in the causality chain that led up to the alert.
appsubcategory	APP-ID Sub category name associated with a firewall alert
OS Parent Signer	Parent operating system signer
Remote Host	If the alert triggered on network activity (the Event Type is Network Connection) this is the the remote host name that triggered the alert. If not, then N/A.
Remote Agent Hostname
Category Name	Alert category based on the alert source. An example of an XDR Agent alert category is Exploit Modules.
Action	Action taken by the alert sensor, either Detected or Prevented with action status displayed in parenthesis.
NGFW Vsys Name	Name of the virtual system for the Palo Alto Networks firewall that triggered an alert
CGO MD5	The MD5 value of the CGO that initiated the alert.
Local IP	If the alert triggered on network activity (the Event Type is Network Connection) this is the IP address of the host that triggered the alert. If not, then N/A.
Host IP	IP address of the endpoint or server on which this alert triggered.
Contains Featured Host
Rule ID	The ID that matches the rule that triggered the alert
Container ID
Host FQDN	The fully qualified domain name (FQDN) of the Windows endpoint or server on which this alert triggered.
File MD5	MD5 hash value of the file.
Cloud Project	Represents the cloud provider folders or projects. For example, AWS Accounts and Azure Subscriptions
OS Parent User Name	Name of the user associated with the parent operating system
OS Parent ID	OS parent thread ID.
XFF	The firewall rule ID that triggered the firewall alert
Cluster Name
Destination Zone Name	The destination zone of the connection for firewall alerts.
Contains Featured IP Address
App Technology	APP-ID technology name associated with a firewall alert
CGO SHA256	The SHA256 value of the CGO that initiated the alert.
App-id	Related App-ID for an alert. App-ID is a traffic classification system that determines what an application is irrespective of port, protocol, encryption (SSH or SSL) or any other evasive tactic used by the application. When known, you can also pivot to the Palo Alto Networks Applipedia entry that describes the detected application.
CGO path
CID	Unique identifier of the causality instance generated by Cortex XDR
User Agent
Hostname	The hostname of the endpoint or server on which this alert triggered. The hostname is generally available for XDR agent alerts or alerts that are stitched with EDR data. When the hostname is unknown, this field is blank.
Initiator MD5	The MD5 value of the process which initiated the alert.
FW Rule ID	The firewall rule ID that triggered the firewall alert
User Risk Reasons	The descriptions of the reasons that contributed to the user's risk level.
Host OS	Action taken by the alert sensor, either Detected or Prevented with action status displayed in parenthesis.
Domain	The domain on which an alert was triggered.
Timestamp	The date and time when the alert was triggered. Right-click to Show rows 30 days prior or 30 days after the selected timestamp field value
Remote Port	The remote port of a network operation that triggered the alert.
Cloud Operation Type
Host Risk Reasons	The descriptions of the reasons that contributed to the host's risk level.
Excluded	Whether the alert is excluded by an exclusion configuration
Mitre ATT&CK Technique	Displays the type of MITRE ATT&CK technique and sub-technique on which the alert was triggered.
URL	The URL destination address of the domain triggering the firewall alert.
Initiator SHA256	The SHA256 hash value of the initiator.
Cloud Resource Sub-type	A more specific classification used to map the types of resources. For example, DISK,VPC, Subnet are all mapped to Compute
OS Parent Name
Initiator path	Path of the initiating process.
Initiator PID	Process ID (PID) of the initiating process.
Module	For XDR Agent alerts, this field identifies the protection module that triggered the alert.
Target process CMD	The command-line of the process whose creation triggered the alert.
OS Parent PID	OS parent process ID
Host Risk Level	The risk level associated with the risky host. Can be LOW, MED, or HIGH
Email Sender	The email sender value of a firewall alerts triggered on a the content of a malicious email.
Action Process Instance ID	Unique identifier of the Action Process instance generated by Cortex XDR
Cloud Identity Type	Classification used to map identity type that initiated an operation which triggered an alert. For example, Service, Application and Temporary Credentials
OS Parent SHA256	Parent operating system SHA256 hash value
Target process SHA256	The SHA256 hash vale of an external DLL file that triggered the alert.
CGO CMD	Command-line arguments of the Causality Group Owner.
CGO name	The name of the process that started the causality chain based on Cortex XDR causality logic.
Host Mac Address	MAC address of the endpoint or server on which this alert triggered.
Initiator signer	Signer of the process that triggered the alert.
Image Name
Registry Full Key	If the alert triggered on registry modifications (the Event Type is Registry) this is the full registry key that triggered the alert. If not, then N/A.
Cloud Referenced Resource	Represents the resources that are referenced in the alert log. In most cases, the referred resource will be where the operation was initiated on
File Name
Cloud Provider	The name of the cloud provider where the alert occurred: AWS/GCP/Azure/etc
Agent OS Sub Type	The operating system subtype of the agent from which the alert was triggered.
Target process name	The name of the process whose creation triggered the alert.
User name	The name of the user that initiated the behavior that triggered the alert. If the user is a domain user account, this field also identifies the domain. Any alert triggered based on network, authentication, or login events, displays the User Name in the follow standardized format in the Alerts and Incidents pages.<company domain>\<username>
FW Name	Name of firewall on which a firewall alert was raised.
File Macro SHA256	SHA256 hash value of an Microsoft Office file macro
DNS Query Name	The domain name queried in the DNS request.
Country
Source Zone Name	The source zone name of the connection for firewall alerts.
Process execution signature	Signature status of the process that triggered the alert: Unsigned, Signed, Invalid Signature, Unknown.
User Risk Level	The risk level associated with the risky user. Can be LOW, MED or HIGH.
Email Recipient	The email recipient value of a firewall alerts triggered on a the content of a malicious email.
File SHA256	SHA256 hash value of the file.
Initiator CMD	Command-line used to initiate the process including any arguments.
Local Port	If the alert triggered on network activity (the Event Type is Network Connection) this is the port on the endpoint that triggered the alert. If not, then N/A.
Is Phishing	Indicates whether a firewall alert is classified as phishing
Alert Search Results
App Category	APP-ID category name associated with a firewall alert
Misc	Miscellaneous information about the alert.
Event Type	The type of event on which the alert was triggered: File Event, Injection Event, Load Image Event, Network Event, Process Execution, Registry Event
File path	When the alert triggered on a file (the Event Type is File) this is the path to the file on the endpoint. If not, then N/A.
OS Parent CMD	Command-line used to by the parent operating system to initiate the process including any arguments
Initiated By	The name of the process that initiated an activity such as a network connection or registry change.
Cloud Identity Sub Type	A more specific classification of the identity initiated operation. For example, for Identity Type: Temporary Credentials the sub type could be Assumed Role
Contains Featured User
Agent Id	A unique identifier per agent.
FW Serial Number	The serial number of the firewall that raised the firewall alert.
OS Parent Signature	Signing status of the operating system of the activity
CGO signature	Signing status of the CGO: Unsigned, Signed, Invalid Signature, Unknown.
Initiator signature	Signing status of the process that initiated the activity: Unsigned, Signed, Invalid Signature, Unknown.
Starred	Whether the alert is starred by starring configuration
Remote IP	The remote IP address of a network operation that triggered the alert.
Process execution signer	Signer of the process that triggered the alert.

PUBLISHER

PLATFORMS

Cortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	February 2, 2022
Last Release	October 23, 2025

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise.