> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/xdm-fields-for-mapping-network-events/advanced-network-mapping-deep-dives.md). # Advanced network mapping: deep dives Learn more about technical conventions for complex network scenarios in Cortex XSIAM. This section provides technical conventions for complex network scenarios, including how to handle asymmetric flows and vendor-specific logging dialects. ### Implementation order of operations 1. **MAP**: Directly use the source field if it carries the value. 2. **DERIVE**: Construct the value from other fields (e.g., deriving `is_internal_ip` from the IPv4). 3. **PAD**: Use semantically empty placeholders only if derivation is impossible. Never pad a specific protocol (like `TCP`) if you aren't certain. ### Topology and identity * **Directionality**: Invert topology is a common error. Always confirm which end initiated the flow. A device logging traffic *through* itself is the `xdm.observer`, while the endpoints are the `source` and `target`. * **Double-logging**: Some products (e.g., OS and Application layers) log one session twice. Model both, but note this in the dataset metadata so analytical queries can deduplicate on session IDs. ### Vendor-specific modeling rules #### FortiGate Native Key=Value FortiOS emits native logs where field names like `srcip`, `sentbyte`, and `rcvdbyte` do not overlap with CEF formats. * **Action vocabulary**: FortiGate actions like `timeout` or `server-rst` should map to `OUTCOME_SUCCESS` (policy permitted) rather than `FAILED`. * **Observer ID**: The `devid` is the appliance serial number and belongs in `xdm.observer.unique_identifier`, not the client device ID. #### Cisco IOS-XE Mnemonics * **ACL logging**: Mnemonics like `SEC-6-IPACCESSLOGP` indicate which fields (ports, protocols) are present. Use these suffixes to determine which fields can be mapped vs. padded. * **Firewall findings**: Records like `FW-5-IMAP_NON_SECURE_LOGIN` are cleartext credential exposures. Map these as network flows first and treat the captured text as an alert. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/xdm-fields-for-mapping-network-events/advanced-network-mapping-deep-dives.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.