Authentication ASIM parser for Palo Alto PAN-OS GlobalProtect

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to ASIM Index

---

Parser Information

Property	Value
Parser Name	ASimAuthenticationPaloAltoGlobalProtect
Built-in Parser	_ASim_Authentication_PaloAltoGlobalProtect
Schema	Authentication
Schema Version	0.1.4
Parser Type	🔌 Source (product-specific)
Product	Palo Alto PAN-OS GlobalProtect
Parser Version	0.1.1 (version history)
Last Updated	Jun 02, 2026
Unifying Parser	ASimAuthentication
Source File	Parsers\ASimAuthentication\Parsers\ASimAuthenticationPaloAltoGlobalProtect.yaml

Description

This ASIM parser supports normalizing Palo Alto PAN-OS GlobalProtect authentication logs from the CommonSecurityLog table to the ASIM Authentication normalized schema. GlobalProtect events include VPN gateway and portal authentication events.

Source Tables

This parser reads from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
CommonSecurityLog	DeviceEventClassID == "GLOBALPROTECT" DeviceProduct == "PAN-OS" DeviceVendor == "Palo Alto Networks"	✓	✓	✓

Parameters

Name	Type	Default
disabled	bool	False
pack	bool	False

Associated Connectors

The following connectors provide data for this parser:

Connector	Solution
CefAma	Common Event Format
VirtualMetricDirectorProxy	VirtualMetric DataStream
VirtualMetricMSSentinelConnector	VirtualMetric DataStream
VirtualMetricMSSentinelDataLakeConnector	VirtualMetric DataStream

Solutions: Common Event Format, VirtualMetric DataStream

References

• ASIM Authentication Schema
• ASIM
• Palo Alto GlobalProtect CEF Fields

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to ASIM Index