> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/log-format-for-ioc-and-bioc-issues.md).

# Log format for IOC and BIOC issues

Cortex Cloud logs IOC and BIOC issues. If you configure Cortex Cloud to forward logs in the legacy format, when issue logs are forwarded from Cortex Cloud, each log record has the following format:

* **Email account:** Each field is labeled, one line per field.

  ```
  edrData/action_country: 
  edrData/action_download: 
  edrData/action_external_hostname: 
  edrData/action_external_port: 
  edrData/action_file_extension: pdf
  edrData/action_file_md5: null
  edrData/action_file_name: XORXOR2614081980.pdf
  ...
  xdr_sub_type: BIOC - Credential Access
  bioc_category_enum_key: null
  alert_action_status: null
  agent_data_collection_status: null
  attempt_counter: null
  case_id: null
  global_content_version_id: 
  global_rule_id: 
  is_whitelisted: false
  ```

  <br>
* **Syslog format**

  ```
  "/edrData/action_country","/edrData/action_download","/edrData/action_external_hostname","/edrData/action_external_port","/edrData/action_file_extension","/edrData/action_file_md5","/edrData/action_file_name","/edrData/action_file_path","/edrData/action_file_previous_file_extension","/edrData/action_file_previous_file_name","/edrData/action_file_previous_file_path","/edrData/action_file_sha256","/edrData/action_file_size","/edrData/action_file_remote_ip","/edrData/action_file_remote_port","/edrData/action_is_injected_thread","/edrData/action_local_ip","/edrData/action_local_port","/edrData/action_module_base_address","/edrData/action_module_image_size","/edrData/action_module_is_remote","/edrData/action_module_is_replay","/edrData/action_module_path","/edrData/action_module_process_causality_id","/edrData/action_module_process_image_command_line","/edrData/action_module_process_image_extension","/edrData/action_module_process_image_md5","/edrData/action_module_process_image_name","/edrData/action_module_process_image_path","/edrData/action_module_process_image_sha256","/edrData/action_module_process_instance_id","/edrData/action_module_process_is_causality_root","/edrData/action_module_process_os_pid","/edrData/action_module_process_signature_product","/edrData/action_module_process_signature_status","/edrData/action_module_process_signature_vendor","/edrData/action_network_connection_id","/edrData/action_network_creation_time","/edrData/action_network_is_ipv6","/edrData/action_process_causality_id","/edrData/action_process_image_command_line","/edrData/action_process_image_extension","/edrData/action_process_image_md5","/edrData/action_process_image_name","/edrData/action_process_image_path","/edrData/action_process_image_sha256","/edrData/action_process_instance_id","/edrData/action_process_integrity_level","/edrData/action_process_is_causality_root","/edrData/action_process_is_replay","/edrData/action_process_is_special","/edrData/action_process_os_pid","/edrData/action_process_signature_product","/edrData/action_process_signature_status","/edrData/action_process_signature_vendor","/edrData/action_proxy","/edrData/action_registry_data","/edrData/action_registry_file_path","/edrData/action_registry_key_name","/edrData/action_registry_value_name","/edrData/action_registry_value_type","/edrData/action_remote_ip","/edrData/action_remote_port","/edrData/action_remote_process_causality_id","/edrData/action_remote_process_image_command_line","/edrData/action_remote_process_image_extension","/edrData/action_remote_process_image_md5","/edrData/action_remote_process_image_name","/edrData/action_remote_process_image_path","/edrData/action_remote_process_image_sha256","/edrData/action_remote_process_is_causality_root","/edrData/action_remote_process_os_pid","/edrData/action_remote_process_signature_product","/edrData/action_remote_process_signature_status","/edrData/action_remote_process_signature_vendor","/edrData/action_remote_process_thread_id","/edrData/action_remote_process_thread_start_address","/edrData/action_thread_thread_id","/edrData/action_total_download","/edrData/action_total_upload","/edrData/action_upload","/edrData/action_user_status","/edrData/action_username","/edrData/actor_causality_id","/edrData/actor_effective_user_sid","/edrData/actor_effective_username","/edrData/actor_is_injected_thread","/edrData/actor_primary_user_sid","/edrData/actor_primary_username","/edrData/actor_process_causality_id","/edrData/actor_process_command_line","/edrData/actor_process_execution_time","/edrData/actor_process_image_command_line","/edrData/actor_process_image_extension","/edrData/actor_process_image_md5","/edrData/actor_process_image_name","/edrData/actor_process_image_path","/edrData/actor_process_image_sha256","/edrData/actor_process_instance_id","/edrData/actor_process_integrity_level","/edrData/actor_process_is_special","/edrData/actor_process_os_pid","/edrData/actor_process_signature_product","/edrData/actor_process_signature_status","/edrData/actor_process_signature_vendor","/edrData/actor_thread_thread_id","/edrData/agent_content_version","/edrData/agent_host_boot_time","/edrData/agent_hostname","/edrData/agent_id","/edrData/agent_ip_addresses","/edrData/agent_is_vdi","/edrData/agent_os_sub_type","/edrData/agent_os_type","/edrData/agent_session_start_time","/edrData/agent_version","/edrData/causality_actor_causality_id","/edrData/causality_actor_effective_user_sid","/edrData/causality_actor_effective_username","/edrData/causality_actor_primary_user_sid","/edrData/causality_actor_primary_username","/edrData/causality_actor_process_causality_id","/edrData/causality_actor_process_command_line","/edrData/causality_actor_process_execution_time","/edrData/causality_actor_process_image_command_line","/edrData/causality_actor_process_image_extension","/edrData/causality_actor_process_image_md5","/edrData/causality_actor_process_image_name","/edrData/causality_actor_process_image_path","/edrData/causality_actor_process_image_sha256","/edrData/causality_actor_process_instance_id","/edrData/causality_actor_process_integrity_level","/edrData/causality_actor_process_is_special","/edrData/causality_actor_process_os_pid","/edrData/causality_actor_process_signature_product","/edrData/causality_actor_process_signature_status","/edrData/causality_actor_process_signature_vendor","/edrData/event_id","/edrData/event_is_simulated","/edrData/event_sub_type","/edrData/event_timestamp","/edrData/event_type","/edrData/event_utc_diff_minutes","/edrData/event_version","/edrData/host_metadata_hostname","/edrData/missing_action_remote_process_instance_id","/facility","/generatedTime","/recordType","/recsize","/trapsId","/uuid","/xdr_unique_id","/meta_internal_id","/external_id","/is_visible","/is_secdo_event","/severity","/alert_source","/internal_id","/matching_status","/local_insert_ts","/source_insert_ts","/alert_name","/alert_category","/alert_description","/bioc_indicator","/matching_service_rule_id","/external_url","/xdr_sub_type","/bioc_category_enum_key","/alert_action_status","/agent_data_collection_status","/attempt_counter","/case_id","/global_content_version_id","/global_rule_id","/is_whitelisted"
  ```

<details>

<summary>Field prefixes for BIOC and IOC issue logs</summary>

| Field Name                        | Description                                                                                                                                                |
| --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| /edrData/action\_file\*           | Fields that begin with this prefix describe attributes of a file for which Traps reported activity.                                                        |
| edrData/action\_module\*          | Fields that begin with this prefix describe attributes of a module for which Traps reported module loading activity.                                       |
| edrData/action\_module\_process\* | Fields that begin with this prefix describe attributes and activity related to processes reported by Traps that load modules such as DLLs on the endpoint. |
| edrData/action\_process\_image\*  | Fields that begin with this prefix describe attributes of a process image for which Traps reported activity.                                               |
| edrData/action\_registry\*        | Fields that begin with this prefix describe registry activity and attributes such as key name, data, and previous value for which Traps reported activity. |
| edrData/action\_network           | Fields that begin with this prefix describe network attributes for which Traps reported activity.                                                          |
| edrData/action\_remote\_process\* | Fields that begin with this prefix describe attributes of remote processes for which Traps reported activity.                                              |
| edrData/actor\*                   | Fields that begin with this prefix describe attributes about the acting user that initiated the activity on the endpoint.                                  |
| edrData/agent\*                   | Fields that begin with this prefix describe attributes about the Traps agent deployed on the endpoint.                                                     |
| edrData/causality\_actor\*        | Fields that begin with this prefix describe attributes about the causality group owner.                                                                    |

</details>

<details>

<summary>Additional fields for BIOC and IOC issue logs</summary>

<table data-header-hidden><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>Field Name</td><td>Description</td></tr><tr><td>/severity</td><td><p>Severity assigned to the issue:</p><ul><li>SEV_010_INFO</li><li>SEV_020_LOW</li><li>SEV_030_MEDIUM</li><li>SEV_040_HIGH</li><li>SEV_090_UNKNOWN</li></ul></td></tr><tr><td>/alert_source</td><td>Source of the issue: BIOC or IOC</td></tr><tr><td>/local_insert_ts</td><td>Date and time when Cortex XDR – Investigation and Response ingested the app.</td></tr><tr><td>/source_insert_ts</td><td>Date and time the issue was reported by the issue source.</td></tr><tr><td>/alert_name</td><td>If the issue was generated by Cortex XDR – Investigation and Response, the issue name will be the specific Cortex XDR rule that created the issue (BIOC or IOC rule name). If from an external system, it will carry the name assigned to it by Cortex XDR .</td></tr><tr><td>/alert_category</td><td><p>Issue category based on the issue source.</p><ul><li><p>BIOC issue categories:</p><ul><li>OTHER</li><li>PERSISTENCE</li><li>EVASION</li><li>TAMPERING</li><li>FILE_TYPE_OBFUSCATION</li><li>PRIVILEGE_ESCALATION</li><li>CREDENTIAL_ACCESS</li><li>LATERAL_MOVEMENT</li><li>EXECUTION</li><li>COLLECTION</li><li>EXFILTRATION</li><li>INFILTRATION</li><li>DROPPER</li><li>FILE_PRIVILEGE_MANIPULATION</li><li>RECONNAISSANCE</li></ul></li><li><p>IOC issue categories:</p><ul><li>HASH</li><li>IP</li><li>PATH</li><li>DOMAIN_NAME</li><li>FILENAME</li><li>MIXED</li></ul></li></ul></td></tr><tr><td>/alert_description</td><td>Text summary of the event including the issue source, issue name, severity, and file path. For alerts generated by BIOC and IOC rules, Cortex XDR displays detailed information about the rule.</td></tr><tr><td>/bioc_indicator</td><td><p>A JSON representation of the rule characteristics. For example:</p><pre><code>[{""pretty_name"":""File"",""data_type"":null,
""render_type"":""entity"",""entity_map"":null},
{""pretty_name"":""action type"",
""data_type"":null,""render_type"":""attribute"",
""entity_map"":null},{""pretty_name"":""="",
""data_type"":null,""render_type"":""operator"",
""entity_map"":null},{""pretty_name"":""all"",
""data_type"":null,""render_type"":""value"",
""entity_map"":null},{""pretty_name"":""AND"",
""data_type"":null,""render_type"":""connector"",
""entity_map"":null},{""pretty_name"":""name"",
""data_type"":""TEXT"",
""render_type"":""attribute"",
""entity_map"":""attributes""},
{""pretty_name"":""="",""data_type"":null,
""render_type"":""operator"",
""entity_map"":""attributes""},
{""pretty_name"":""*.pdf"",""data_type"":null,
""render_type"":""value"",
""entity_map"":""attributes""}]"
</code></pre></td></tr><tr><td>/bioc_category_enum_key</td><td>Issue category based on the issue source. An example of a BIOC issue category is Evasion. An example of a Traps issue category is Exploit Modules.</td></tr><tr><td>/alert_action_status</td><td><p>Action taken by the issue sensor with action status displayed in parenthesis:</p><ul><li>Detected</li><li>Detected (Download)</li><li>Detected (Post Detected)</li><li>Detected (Prompt Allow)</li><li>Detected (Reported)</li><li>Detected (Scanned)</li><li>Prevented (Blocked)</li><li>Prevented (Prompt Block)</li></ul></td></tr><tr><td>/case_id</td><td>Unique identifier for the incident.</td></tr><tr><td>/global_content_version_id</td><td>Unique identifier for the content version in which a Palo Alto Networks global BIOC rule was released.</td></tr><tr><td>/global_rule_id</td><td>Unique identifier for an issue generated by a Palo Alto Networks global BIOC rule.</td></tr><tr><td>/is_whitelisted</td><td>Boolean indicating whether the issue is excluded or not.</td></tr></tbody></table>

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/post-deployment-steps/set-up-your-environment/data-and-log-forwarding/data-and-log-notification-formats/log-format-for-ioc-and-bioc-issues.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.