Palo Alto Networks · Schema
WildfireLogPayload
Schema for a forwarded PAN-OS WildFire submission log entry. WildFire logs record the results of file analysis by the WildFire cloud-based sandbox malware analysis service, providing verdicts and analysis report links for detected threats.
Cloud SecurityCybersecurityFirewallNetwork SecuritySASESOARThreat IntelligenceXDR
Properties
| Name | Type | Description |
|---|---|---|
| receive_time | string | Timestamp when the WildFire log entry was received by Strata Logging Service. |
| serial | string | Serial number of the Palo Alto Networks device that submitted the file to WildFire and generated this log entry. |
| type | string | Log type identifier, always WILDFIRE for WildFire log entries. |
| src | string | Source IP address of the session from which the file was captured. |
| dst | string | Destination IP address of the session from which the file was captured. |
| app | string | Application identified by App-ID in the session from which the file was captured. |
| filename | string | Name of the file that was submitted to WildFire for analysis. |
| filetype | string | File type of the submitted file (e.g., PE, PDF, APK, Adobe Flash, Microsoft Office, script, Java Applet). |
| file_hash | string | SHA-256 cryptographic hash of the submitted file, used as the unique file identifier in the WildFire cloud database. |
| file_size | integer | Size of the submitted file in bytes. |
| verdict | string | WildFire analysis verdict for the submitted file indicating whether it is benign, malicious malware, potentially unwanted grayware, a phishing document, or pending analysis completion. |
| action | string | Action applied to the file by the WildFire security profile based on the analysis verdict. |
| report_url | string | URL to the full WildFire analysis report in the Palo Alto Networks WildFire portal, providing detailed behavioral analysis results. |
| src_user | string | Source user identity if User-ID is enabled. |
| rule_name | string | Name of the security policy rule under which the file was captured and submitted to WildFire. |
| device_name | string | Hostname of the firewall that captured the file and generated this WildFire log entry. |
| vsys | string | Virtual system name or identifier on the firewall. |
| log_forwarding_profile | string | Name of the log forwarding profile that forwarded this log entry. |
| output_format | string | Output format in which this log entry was forwarded. |