> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/xdm-fields-for-mapping-network-events/advanced-network-mapping-deep-dives.md). # Advanced network mapping: deep dives Learn more about technical conventions for complex network scenarios in Cortex XSIAM. This section provides technical conventions for complex network scenarios, including how to handle asymmetric flows and vendor-specific logging dialects. ### Implementation order of operations 1. **MAP**: Directly use the source field if it carries the value. 2. **DERIVE**: Construct the value from other fields (e.g., deriving `is_internal_ip` from the IPv4). 3. **PAD**: Use semantically empty placeholders only if derivation is impossible. Never pad a specific protocol (like `TCP`) if you aren't certain. ### Topology and identity * **Directionality**: Invert topology is a common error. Always confirm which end initiated the flow. A device logging traffic *through* itself is the `xdm.observer`, while the endpoints are the `source` and `target`. * **Double-logging**: Some products (e.g., OS and Application layers) log one session twice. Model both, but note this in the dataset metadata so analytical queries can deduplicate on session IDs. ### Vendor-specific modeling rules #### FortiGate Native Key=Value FortiOS emits native logs where field names like `srcip`, `sentbyte`, and `rcvdbyte` do not overlap with CEF formats. * **Action vocabulary**: FortiGate actions like `timeout` or `server-rst` should map to `OUTCOME_SUCCESS` (policy permitted) rather than `FAILED`. * **Observer ID**: The `devid` is the appliance serial number and belongs in `xdm.observer.unique_identifier`, not the client device ID. #### Cisco IOS-XE Mnemonics * **ACL logging**: Mnemonics like `SEC-6-IPACCESSLOGP` indicate which fields (ports, protocols) are present. Use these suffixes to determine which fields can be mapped vs. padded. * **Firewall findings**: Records like `FW-5-IMAP_NON_SECURE_LOGIN` are cleartext credential exposures. Map these as network flows first and treat the captured text as an alert. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/xdm-fields-for-mapping-network-events/advanced-network-mapping-deep-dives.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.