Palo Alto Cortex XDR OTLP Capture Guide For Unified aiFObserve

Best Capture Source

Use Traffic logs as the primary source because they contain session direction, bytes, packets, ports, policy, application, and user fields. Use URL logs, Threat logs, and AI Security logs as optional enrichment, not as replacements for Traffic logs.

Basic Logging

On the security policy rules that allow outbound SaaS and AI traffic:

1. Enable Traffic logging.
2. Use Log At Session End as the default.
3. Add Log At Session Start only for short-lived API calls, long-lived sessions, or troubleshooting where early visibility is worth the volume.
4. Forward logs to Strata Logging Service, Panorama, HTTPS forwarding, or syslog.

Minimum fields to export:

• session_id
• session_start_time
• time_generated or time_generated_high_res
• source_ip, dest_ip
• source_port, dest_port
• protocol
• bytes_sent, bytes_received
• packets_sent, packets_received
• action
• app
• rule_matched
• source_user
• url_category

Extended Logging

• ai_traffic
• ai_fwd_error
• app_category
• app_sub_category
• device_name, vsys, zone, src_zone, dst_zone
• src_location, dst_location
• http2_connection, link_change_count, session_owner
• URL log fields such as host, URL, category, and user
• AI Security or Threat subtype fields for detected prompt injection, data leakage, unsafe content, or model endpoint policy events

User And App Identity

• source_user
• GlobalProtect user fields
• User-ID mapped usernames
• URL/SaaS visibility tenant or account fields
• app, app_category, app_sub_category
• host, SNI, or URL from URL logs

The _user_app_id converter emits an identity evidence table that records whether user, tenant, app, and provider values came from native fields, headers, app fields, host/URL inference, or vendor fallback.

AI Provider And Location Evidence

Keep destination IP, destination country, URL host, SNI, application, tenant, and region/location fields. The unified compliance evidence builder uses these to report AI providers, detected locations, and data boundary checks.

Practical Policy Pattern

Create separate security rules for sanctioned AI applications and AI API destinations. Apply Traffic logging, URL logging, SaaS visibility, and AI Runtime Security profiles to those rules. This makes the converted sessions cleaner and improves recommendation quality.

Notes

Traffic logs are the best source for session volume and packet counters. AI Security logs are event-centric and are most useful as incident evidence.

Sources Used By The Original Firewall Guide

• Strata Logging Service Network Traffic Log
• Network Traffic Syslog Fields
• Network Traffic HTTPS Fields
• Session Logging Considerations