Log format for IOC and BIOC issues - An email account or a syslog receiver are the notification channels through which IOC and BIOC issues are communicated. - Administrator Guide - Cortex XSIAM - Cortex XDR - Cortex

Log format for IOC and BIOC issues - An email account or a syslog receiver are the notification channels through which IOC and BIOC issues are communicated. - Administrator Guide - Cortex XSIAM - Cortex XDR - Cortex - Security Operations

Cortex XDR 5.x Documentation

Product

Cortex XDR

License

XDR + Cloud

Creation date

2025-07-13

Last date published

2026-06-11

Category

Administrator Guide

Abstract

An email account or a syslog receiver are the notification channels through which IOC and BIOC issues are communicated.

Cortex XDR logs IOC and BIOC issues. If you configure Cortex XDR to forward logs in the legacy format, when issue logs are forwarded from Cortex XDR, each log record has the following format:

Email account: Each field is labeled, one line per field.

Example 14.

edrData/action_country: 
edrData/action_download: 
edrData/action_external_hostname: 
edrData/action_external_port: 
edrData/action_file_extension: pdf
edrData/action_file_md5: null
edrData/action_file_name: XORXOR2614081980.pdf
...
xdr_sub_type: BIOC - Credential Access
bioc_category_enum_key: null
alert_action_status: null
agent_data_collection_status: null
attempt_counter: null
case_id: null
global_content_version_id: 
global_rule_id: 
is_whitelisted: false

Syslog format

Example 15.

"/edrData/action_country","/edrData/action_download","/edrData/action_external_hostname","/edrData/action_external_port","/edrData/action_file_extension","/edrData/action_file_md5","/edrData/action_file_name","/edrData/action_file_path","/edrData/action_file_previous_file_extension","/edrData/action_file_previous_file_name","/edrData/action_file_previous_file_path","/edrData/action_file_sha256","/edrData/action_file_size","/edrData/action_file_remote_ip","/edrData/action_file_remote_port","/edrData/action_is_injected_thread","/edrData/action_local_ip","/edrData/action_local_port","/edrData/action_module_base_address","/edrData/action_module_image_size","/edrData/action_module_is_remote","/edrData/action_module_is_replay","/edrData/action_module_path","/edrData/action_module_process_causality_id","/edrData/action_module_process_image_command_line","/edrData/action_module_process_image_extension","/edrData/action_module_process_image_md5","/edrData/action_module_process_image_name","/edrData/action_module_process_image_path","/edrData/action_module_process_image_sha256","/edrData/action_module_process_instance_id","/edrData/action_module_process_is_causality_root","/edrData/action_module_process_os_pid","/edrData/action_module_process_signature_product","/edrData/action_module_process_signature_status","/edrData/action_module_process_signature_vendor","/edrData/action_network_connection_id","/edrData/action_network_creation_time","/edrData/action_network_is_ipv6","/edrData/action_process_causality_id","/edrData/action_process_image_command_line","/edrData/action_process_image_extension","/edrData/action_process_image_md5","/edrData/action_process_image_name","/edrData/action_process_image_path","/edrData/action_process_image_sha256","/edrData/action_process_instance_id","/edrData/action_process_integrity_level","/edrData/action_process_is_causality_root","/edrData/action_process_is_replay","/edrData/action_process_is_special","/edrData/action_process_os_pid","/edrData/action_process_signature_product","/edrData/action_process_signature_status","/edrData/action_process_signature_vendor","/edrData/action_proxy","/edrData/action_registry_data","/edrData/action_registry_file_path","/edrData/action_registry_key_name","/edrData/action_registry_value_name","/edrData/action_registry_value_type","/edrData/action_remote_ip","/edrData/action_remote_port","/edrData/action_remote_process_causality_id","/edrData/action_remote_process_image_command_line","/edrData/action_remote_process_image_extension","/edrData/action_remote_process_image_md5","/edrData/action_remote_process_image_name","/edrData/action_remote_process_image_path","/edrData/action_remote_process_image_sha256","/edrData/action_remote_process_is_causality_root","/edrData/action_remote_process_os_pid","/edrData/action_remote_process_signature_product","/edrData/action_remote_process_signature_status","/edrData/action_remote_process_signature_vendor","/edrData/action_remote_process_thread_id","/edrData/action_remote_process_thread_start_address","/edrData/action_thread_thread_id","/edrData/action_total_download","/edrData/action_total_upload","/edrData/action_upload","/edrData/action_user_status","/edrData/action_username","/edrData/actor_causality_id","/edrData/actor_effective_user_sid","/edrData/actor_effective_username","/edrData/actor_is_injected_thread","/edrData/actor_primary_user_sid","/edrData/actor_primary_username","/edrData/actor_process_causality_id","/edrData/actor_process_command_line","/edrData/actor_process_execution_time","/edrData/actor_process_image_command_line","/edrData/actor_process_image_extension","/edrData/actor_process_image_md5","/edrData/actor_process_image_name","/edrData/actor_process_image_path","/edrData/actor_process_image_sha256","/edrData/actor_process_instance_id","/edrData/actor_process_integrity_level","/edrData/actor_process_is_special","/edrData/actor_process_os_pid","/edrData/actor_process_signature_product","/edrData/actor_process_signature_status","/edrData/actor_process_signature_vendor","/edrData/actor_thread_thread_id","/edrData/agent_content_version","/edrData/agent_host_boot_time","/edrData/agent_hostname","/edrData/agent_id","/edrData/agent_ip_addresses","/edrData/agent_is_vdi","/edrData/agent_os_sub_type","/edrData/agent_os_type","/edrData/agent_session_start_time","/edrData/agent_version","/edrData/causality_actor_causality_id","/edrData/causality_actor_effective_user_sid","/edrData/causality_actor_effective_username","/edrData/causality_actor_primary_user_sid","/edrData/causality_actor_primary_username","/edrData/causality_actor_process_causality_id","/edrData/causality_actor_process_command_line","/edrData/causality_actor_process_execution_time","/edrData/causality_actor_process_image_command_line","/edrData/causality_actor_process_image_extension","/edrData/causality_actor_process_image_md5","/edrData/causality_actor_process_image_name","/edrData/causality_actor_process_image_path","/edrData/causality_actor_process_image_sha256","/edrData/causality_actor_process_instance_id","/edrData/causality_actor_process_integrity_level","/edrData/causality_actor_process_is_special","/edrData/causality_actor_process_os_pid","/edrData/causality_actor_process_signature_product","/edrData/causality_actor_process_signature_status","/edrData/causality_actor_process_signature_vendor","/edrData/event_id","/edrData/event_is_simulated","/edrData/event_sub_type","/edrData/event_timestamp","/edrData/event_type","/edrData/event_utc_diff_minutes","/edrData/event_version","/edrData/host_metadata_hostname","/edrData/missing_action_remote_process_instance_id","/facility","/generatedTime","/recordType","/recsize","/trapsId","/uuid","/xdr_unique_id","/meta_internal_id","/external_id","/is_visible","/is_secdo_event","/severity","/alert_source","/internal_id","/matching_status","/local_insert_ts","/source_insert_ts","/alert_name","/alert_category","/alert_description","/bioc_indicator","/matching_service_rule_id","/external_url","/xdr_sub_type","/bioc_category_enum_key","/alert_action_status","/agent_data_collection_status","/attempt_counter","/case_id","/global_content_version_id","/global_rule_id","/is_whitelisted"

Field Name	Description
/edrData/action_file*	Fields that begin with this prefix describe attributes of a file for which Traps reported activity.
edrData/action_module*	Fields that begin with this prefix describe attributes of a module for which Traps reported module loading activity.
edrData/action_module_process*	Fields that begin with this prefix describe attributes and activity related to processes reported by Traps that load modules such as DLLs on the endpoint.
edrData/action_process_image*	Fields that begin with this prefix describe attributes of a process image for which Traps reported activity.
edrData/action_registry*	Fields that begin with this prefix describe registry activity and attributes such as key name, data, and previous value for which Traps reported activity.
edrData/action_network	Fields that begin with this prefix describe network attributes for which Traps reported activity.
edrData/action_remote_process*	Fields that begin with this prefix describe attributes of remote processes for which Traps reported activity.
edrData/actor*	Fields that begin with this prefix describe attributes about the acting user that initiated the activity on the endpoint.
edrData/agent*	Fields that begin with this prefix describe attributes about the Traps agent deployed on the endpoint.
edrData/causality_actor*	Fields that begin with this prefix describe attributes about the causality group owner.

Field Name	Description
/severity	Severity assigned to the issue: SEV_010_INFO SEV_020_LOW SEV_030_MEDIUM SEV_040_HIGH SEV_090_UNKNOWN
/alert_source	Source of the issue: BIOC or IOC
/local_insert_ts	Date and time when Cortex XDR – Investigation and Response ingested the app.
/source_insert_ts	Date and time the issue was reported by the issue source.
/alert_name	If the issue was generated by Cortex XDR – Investigation and Response, the issue name will be the specific Cortex XDR rule that created the issue (BIOC or IOC rule name). If from an external system, it will carry the name assigned to it by Cortex XDR .
/alert_category	Issue category based on the issue source. BIOC issue categories: OTHER PERSISTENCE EVASION TAMPERING FILE_TYPE_OBFUSCATION PRIVILEGE_ESCALATION CREDENTIAL_ACCESS LATERAL_MOVEMENT EXECUTION COLLECTION EXFILTRATION INFILTRATION DROPPER FILE_PRIVILEGE_MANIPULATION RECONNAISSANCE IOC issue categories: HASH IP PATH DOMAIN_NAME FILENAME MIXED
/alert_description	Text summary of the event including the issue source, issue name, severity, and file path. For alerts generated by BIOC and IOC rules, Cortex XDR displays detailed information about the rule.
/bioc_indicator	A JSON representation of the rule characteristics. For example: [{""pretty_name"":""File"",""data_type"":null, ""render_type"":""entity"",""entity_map"":null}, {""pretty_name"":""action type"", ""data_type"":null,""render_type"":""attribute"", ""entity_map"":null},{""pretty_name"":""="", ""data_type"":null,""render_type"":""operator"", ""entity_map"":null},{""pretty_name"":""all"", ""data_type"":null,""render_type"":""value"", ""entity_map"":null},{""pretty_name"":""AND"", ""data_type"":null,""render_type"":""connector"", ""entity_map"":null},{""pretty_name"":""name"", ""data_type"":""TEXT"", ""render_type"":""attribute"", ""entity_map"":""attributes""}, {""pretty_name"":""="",""data_type"":null, ""render_type"":""operator"", ""entity_map"":""attributes""}, {""pretty_name"":""*.pdf"",""data_type"":null, ""render_type"":""value"", ""entity_map"":""attributes""}]"
/bioc_category_enum_key	Issue category based on the issue source. An example of a BIOC issue category is Evasion. An example of a Traps issue category is Exploit Modules.
/alert_action_status	Action taken by the issue sensor with action status displayed in parenthesis: Detected Detected (Download) Detected (Post Detected) Detected (Prompt Allow) Detected (Reported) Detected (Scanned) Prevented (Blocked) Prevented (Prompt Block)
/case_id	Unique identifier for the incident.
/global_content_version_id	Unique identifier for the content version in which a Palo Alto Networks global BIOC rule was released.
/global_rule_id	Unique identifier for an issue generated by a Palo Alto Networks global BIOC rule.
/is_whitelisted	Boolean indicating whether the issue is excluded or not.