The type of event on which the alert was triggered: File Event, Injection Event, Load Image Event, Network Event, Process Execution, Registry Event
Core Alert Fields
- Details
- Content
- Dependencies
- Version History
This Content Pack will provide you with the core alert fields.
Name | Description |
---|---|
Event Type | |
OS Parent ID | OS parent thread ID. |
FW Serial Number | The serial number of the firewall that raised the firewall alert. |
CGO SHA256 | The SHA256 value of the CGO that initiated the alert. |
Image Name | |
Email Sender | The email sender value of a firewall alerts triggered on a the content of a malicious email. |
Domain | The domain on which an alert was triggered. |
Contains Featured User | |
Excluded | Whether the alert is excluded by an exclusion configuration |
Initiator PID | Process ID (PID) of the initiating process. |
Host FQDN | The fully qualified domain name (FQDN) of the Windows endpoint or server on which this alert triggered. |
User Risk Level | The risk level associated with the risky user. Can be LOW, MED or HIGH. |
Contains Featured IP Address | |
Source Zone Name | The source zone name of the connection for firewall alerts. |
File path | When the alert triggered on a file (the Event Type is File) this is the path to the file on the endpoint. If not, then N/A. |
Contains Featured Host | |
File SHA256 | SHA256 hash value of the file. |
Country | |
User name | The name of the user that initiated the behavior that triggered the alert. If the user is a domain user account, this field also identifies the domain. Any alert triggered based on network, authentication, or login events, displays the User Name in the follow standardized format in the Alerts and Incidents pages.<company domain>\<username> |
File MD5 | MD5 hash value of the file. |
DNS Query Name | The domain name queried in the DNS request. |
Process execution signer | Signer of the process that triggered the alert. |
CGO CMD | Command-line arguments of the Causality Group Owner. |
Initiator signature | Signing status of the process that initiated the activity: Unsigned, Signed, Invalid Signature, Unknown. |
OS Parent SHA256 | Parent operating system SHA256 hash value |
Module | For XDR Agent alerts, this field identifies the protection module that triggered the alert. |
Cloud Operation Type | |
NGFW Vsys Name | Name of the virtual system for the Palo Alto Networks firewall that triggered an alert |
Initiator TID | Thread ID (TID) of the initiating process. |
CGO MD5 | The MD5 value of the CGO that initiated the alert. |
Mitre ATT&CK Tactic | Displays the type of MITRE ATT&CK tactic on which the alert was triggered. |
App Technology | APP-ID technology name associated with a firewall alert |
Host Risk Reasons | The descriptions of the reasons that contributed to the host's risk level. |
File Macro SHA256 | SHA256 hash value of an Microsoft Office file macro |
Host Risk Level | The risk level associated with the risky host. Can be LOW, MED, or HIGH |
CGO signature | Signing status of the CGO: Unsigned, Signed, Invalid Signature, Unknown. |
Cloud Provider | The name of the cloud provider where the alert occurred: AWS/GCP/Azure/etc |
Rule ID | The ID that matches the rule that triggered the alert |
Category Name | Alert category based on the alert source. An example of an XDR Agent alert category is Exploit Modules. |
XFF | The firewall rule ID that triggered the firewall alert |
Initiator path | Path of the initiating process. |
appsubcategory | APP-ID Sub category name associated with a firewall alert |
File Name | |
Action | Action taken by the alert sensor, either Detected or Prevented with action status displayed in parenthesis. |
Initiator CMD | Command-line used to initiate the process including any arguments. |
App-id | Related App-ID for an alert. App-ID is a traffic classification system that determines what an application is irrespective of port, protocol, encryption (SSH or SSL) or any other evasive tactic used by the application. When known, you can also pivot to the Palo Alto Networks Applipedia entry that describes the detected application. |
URL | The URL destination address of the domain triggering the firewall alert. |
Initiator signer | Signer of the process that triggered the alert. |
Alert Search Results | |
FW Rule ID | The firewall rule ID that triggered the firewall alert |
CGO signer | The name of the software publishing vendor that signed the file in the causality chain that led up to the alert. |
Registry Full Key | If the alert triggered on registry modifications (the Event Type is Registry) this is the full registry key that triggered the alert. If not, then N/A. |
CID | Unique identifier of the causality instance generated by Cortex XDR |
Cloud Identity Type | Classification used to map identity type that initiated an operation which triggered an alert. For example, Service, Application and Temporary Credentials |
Destination Zone Name | The destination zone of the connection for firewall alerts. |
CGO path | |
Remote Agent Hostname | |
OS Parent Name | |
Container ID | |
Registry Data | If the alert triggered on registry modifications (the Event Type is Registry) this is the registry data that triggered the alert. If not, then N/A |
FW Rule Name | The firewall rule name that matches the network traffic that triggered the firewall alert. |
Hostname | The hostname of the endpoint or server on which this alert triggered. The hostname is generally available for XDR agent alerts or alerts that are stitched with EDR data. When the hostname is unknown, this field is blank. |
Misc | Miscellaneous information about the alert. |
Cloud Identity Sub Type | A more specific classification of the identity initiated operation. For example, for Identity Type: Temporary Credentials the sub type could be Assumed Role |
User Agent | |
Target process name | The name of the process whose creation triggered the alert. |
CGO name | The name of the process that started the causality chain based on Cortex XDR causality logic. |
Timestamp | The date and time when the alert was triggered. Right-click to Show rows 30 days prior or 30 days after the selected timestamp field value |
Cluster Name | |
Host Mac Address | MAC address of the endpoint or server on which this alert triggered. |
Email Recipient | The email recipient value of a firewall alerts triggered on a the content of a malicious email. |
Agent Id | A unique identifier per agent. |
Cloud Project | Represents the cloud provider folders or projects. For example, AWS Accounts and Azure Subscriptions |
Email Subject | The email subject value of a firewall alerts triggered on a the content of a malicious email. |
Process execution signature | Signature status of the process that triggered the alert: Unsigned, Signed, Invalid Signature, Unknown. |
Initiator MD5 | The MD5 value of the process which initiated the alert. |
Host OS | Action taken by the alert sensor, either Detected or Prevented with action status displayed in parenthesis. |
Is Phishing | Indicates whether a firewall alert is classified as phishing |
Remote Host | If the alert triggered on network activity (the Event Type is Network Connection) this is the the remote host name that triggered the alert. If not, then N/A. |
Initiator SHA256 | The SHA256 hash value of the initiator. |
OS Parent PID | OS parent process ID |
Remote Port | The remote port of a network operation that triggered the alert. |
Initiated By | The name of the process that initiated an activity such as a network connection or registry change. |
Target process SHA256 | The SHA256 hash vale of an external DLL file that triggered the alert. |
User Risk Reasons | The descriptions of the reasons that contributed to the user's risk level. |
Local IP | If the alert triggered on network activity (the Event Type is Network Connection) this is the IP address of the host that triggered the alert. If not, then N/A. |
Target process CMD | The command-line of the process whose creation triggered the alert. |
Host IP | IP address of the endpoint or server on which this alert triggered. |
FW Name | Name of firewall on which a firewall alert was raised. |
OS Parent Signer | Parent operating system signer |
OS Parent User Name | Name of the user associated with the parent operating system |
Agent OS Sub Type | The operating system subtype of the agent from which the alert was triggered. |
Cloud Resource Sub-type | A more specific classification used to map the types of resources. For example, DISK,VPC, Subnet are all mapped to Compute |
Local Port | If the alert triggered on network activity (the Event Type is Network Connection) this is the port on the endpoint that triggered the alert. If not, then N/A. |
Mitre ATT&CK Technique | Displays the type of MITRE ATT&CK technique and sub-technique on which the alert was triggered. |
Cloud Resource Type | Classifications used to map similar types of resources across different cloud providers. For example, EC2, Google Compute Engine, and Microsoft Compute are all mapped to Compute |
Cloud Referenced Resource | Represents the resources that are referenced in the alert log. In most cases, the referred resource will be where the operation was initiated on |
Starred | Whether the alert is starred by starring configuration |
App Category | APP-ID category name associated with a firewall alert |
Remote IP | The remote IP address of a network operation that triggered the alert. |
OS Parent CMD | Command-line used to by the parent operating system to initiate the process including any arguments |
OS Parent Signature | Signing status of the operating system of the activity |
Core Alert Fields
- Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.
- 34804
Core Alert Fields
- Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.
- 34212
Core Alert Fields
- Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.
- 32331
Incident Fields
- New: User Risk Reasons
- New: User Risk Level
- New: Host Risk Reasons
- New: Host Risk Level
- 30105
CoreAlertFields
- Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.
- 29466
CoreAlertFields
- Locked dependencies of the pack to ensure stability for versioned core packs. No changes in this release.
- 28753
PUBLISHER
![Cortex](https://storage.googleapis.com/marketplace-v2-dist/content/packs/Base/Author_image.png)
PLATFORMS
INFO
Certification | Certified | Read more |
Supported By | Cortex | |
Created | February 2, 2022 | |
Last Release | July 1, 2024 |