Repository: demisto/content
Pull request #38876: Add command to query GP logs to SLS integration
Author: login: ali-sawyer
Labels: name: Contribution
description: Thank you! Contributions are always welcome!
name: docs-approved
name: Contribution Form Filled
description: Whether contribution form filled or not.
name: Community
name: Xsoar Support Level
description: Indicates that the contribution is for XSOAR supported pack
name: External PR
Created: 2025-03-03T20:28:33Z | Merged: 2025-04-02T15:03:13Z

<!-- REMINDER: THIS IS A PUBLIC REPO DO NOT POST HERE SECRETS/SENSITIVE DATA -->
## Contributing to Cortex XSOAR Content
Make sure to register your contribution by filling the [contribution registration form](https://forms.gle/XDfxU4E61ZwEESSMA)

**The Pull Request will be reviewed only after the contribution registration form is filled.**

## Status
- [ ] In Progress
- [x] Ready
- [ ] In Hold - (Reason for hold)

## Related Issues
[CIAC-12191](https://jira-dc.paloaltonetworks.com/browse/CIAC-12191)

## Description
Add a dedicated command specifically for querying GP VPN logs to make these logs easier to query via the integration.

## Must have
- [ ] Tests
- [ ] Documentation 



Diff:
diff --git a/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.py b/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.py
index f611f0457a78..e3f3d15c095d 100644
--- a/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.py
+++ b/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.py
@@ -670,6 +670,68 @@ def files_context_transformer(row_content: dict) -> dict:
     }
 
 
+def gp_context_transformer(row_content: dict) -> dict:
+    """
+        This function retrieves data from a row of raw data into context path locations.
+        Documentation: https://docs.paloaltonetworks.com/strata-logging-service/log-reference/network-logs/network-globalprotect-log
+
+        Args:
+            row_content: a dict representing raw data of a row
+
+        Returns:
+            a dict with context paths and their corresponding value
+        """
+    return {
+        'AttemptedGateways': row_content.get('attempted_gateways'),
+        'AuthMethod': row_content.get('auth_method'),
+        'ConnectionErrorID': row_content.get('connection_error', {}).get('id'),
+        'ConnectionErrorValue': row_content.get('connection_error', {}).get('value'),
+        'CountOfRepeats': row_content.get('count_of_repeats'),
+        'CustomerID': row_content.get('customer_id'),
+        'EndpointDeviceName': row_content.get('endpoint_device_name'),
+        'EndpointGPVersion': row_content.get('endpoint_gp_version'),
+        'EndpointOSType': row_content.get('endpoint_os_type'),
+        'EndpointOSVersion': row_content.get('endpoint_os_version'),
+        'EventID': row_content.get('event_id', {}).get('value'),
+        'Gateway': row_content.get('gateway'),
+        'GatewayPriority': row_content.get('gateway_priority', {}).get('value'),
+        'GatewaySelectionType': row_content.get('gateway_selection_type'),
+        'HostID': row_content.get('host_id'),
+        'IsDuplicateLog': row_content.get('is_dup_log'),
+        'IsExported': row_content.get('is_exported'),
+        'IsForwarded': row_content.get('is_forwarded'),
+        'IsPrismaBranch': row_content.get('is_prisma_branch'),
+        'IsPrismaMobile': row_content.get('is_prisma_mobile'),
+        'LogSource': row_content.get('log_source'),
+        'LogSourceID': row_content.get('log_source_id'),
+        'LogSourceName': row_content.get('log_source_name'),
+        'LogTime': human_readable_time_from_epoch_time(row_content.get('log_time', 0)),
+        'LogType': row_content.get('log_type', {}).get('value'),
+        'LoginDuration': row_content.get('login_duration'),
+        'Opaque': row_content.get('opaque'),
+        'PlatformType': row_content.get('platform_type'),
+        'Portal': row_content.get('portal'),
+        'PrivateIPv4': row_content.get('private_ip', {}).get('value'),
+        'PrivateIPv6': row_content.get('private_ipv6', {}).get('value'),
+        'ProjectName': row_content.get('project_name'),
+        'PublicIPv4': row_content.get('public_ip', {}).get('value'),
+        'PublicIPv6': row_content.get('public_ipv6', {}).get('value'),
+        'QuarantineReason': row_content.get('quarantine_reason'),
+        'SequenceNo': row_content.get('sequence_no'),
+        'SourceRegion': row_content.get('source_region'),
+        'SourceUser': row_content.get('source_user'),
+        'SourceUserDomain': row_content.get('source_user_info', {}).get('domain'),
+        'SourceUserName': row_content.get('source_user_info', {}).get('name'),
+        'SSLResponseTime': row_content.get('ssl_response_time'),
+        'Stage': row_content.get('stage'),
+        'EventStatus': row_content.get('status', {}).get('value'),
+        'Subtype': row_content.get('sub_type', {}).get('value'),
+        'TimeGenerated': human_readable_time_from_epoch_time(row_content.get('time_generated', 0)),
+        'TunnelType': row_content.get('tunnel'),
+        'VendorName': row_content.get('vendor_name'),
+    }
+
+
 def records_to_human_readable_output(fields: str, table_name: str, results: list) -> str:
     """
     This function gets all relevant data for the human readable output of a specific table.
@@ -690,15 +752,26 @@ def records_to_human_readable_output(fields: str, table_name: str, results: list
     if fields == "*":
         for result in results:
             filtered_result = {
-                "Source Address": result.get("source_ip", {}).get("value"),
-                "Destination Address": result.get("dest_ip", {}).get("value"),
-                "Application": result.get("app"),
-                "Action": result.get("action", {}).get("value"),
-                "RuleMatched": result.get("rule_matched"),
-                "TimeGenerated": human_readable_time_from_epoch_time(result.get("time_generated")),
-                "FileID": result.get("file_id"),
-                "FileName": result.get("file_name"),
-                "FileType": result.get("file_type"),
+                'Source Address': result.get('source_ip', {}).get('value'),
+                'Public IP': result.get('public_ip', {}).get('value'),
+                'Public IPv6': result.get('public_ipv6', {}).get('value'),
+                'Destination Address': result.get('dest_ip', {}).get('value'),
+                'Private IP': result.get('private_ip', {}).get('value'),
+                'Private IPv6': result.get('private_ipv6', {}).get('value'),
+                'Application': result.get('app'),
+                'Action': result.get('action', {}).get('value'),
+                'Stage': result.get('stage'),
+                'Status': result.get('status', {}).get('value'),
+                'Connection Error': result.get('connection_error').get('value'),
+                'RuleMatched': result.get('rule_matched'),
+                'TimeGenerated': human_readable_time_from_epoch_time(result.get('time_generated')),
+                'FileID': result.get('file_id'),
+                'FileName': result.get('file_name'),
+                'FileType': result.get('file_type'),
+                'Source User': result.get('source_user'),
+                'Source Region': result.get('source_region'),
+                'Gateway': result.get('gateway'),
+                'Portal': result.get('portal'),
             }
             filtered_results.append(filtered_result)
     else:
@@ -760,42 +833,51 @@ def build_where_clause(args: dict) -> str:
         A string represents the where part of a SQL query
     """
     args_dict = {
-        "source_ip": "source_ip.value",
-        "dest_ip": "dest_ip.value",
-        "rule_matched": "rule_matched",
-        "from_zone": "from_zone",
-        "to_zone": "to_zone",
-        "source_port": "source_port",
-        "dest_port": "dest_port",
-        "action": "action.value",
-        "file_sha_256": "file_sha_256",
-        "file_name": "file_name",
-        "app": "app",
-        "app_category": "app_category",
-        "dest_device_port": "dest_device_port",
-        "dest_edl": "dest_edl",
-        "dest_dynamic_address_group": "dest_dynamic_address_group",
-        "dest_location": "dest_location",
-        "dest_user": "dest_user",
-        "file_type": "file_type",
-        "is_server_to_client": "is_server_to_client",
-        "is_url_denied": "is_url_denied",
-        "log_type": "log_type",
-        "nat_dest": "nat_dest",
-        "nat_dest_port": "nat_dest_port",
-        "nat_source": "nat_source",
-        "nat_source_port": "nat_source_port",
-        "rule_matched_uuid": "rule_matched_uuid",
-        "severity": "severity",
-        "source_device_host": "source_device_host",
-        "source_edl": "source_edl",
-        "source_dynamic_address_group": "source_dynamic_address_group",
-        "source_location": "source_location",
-        "source_user": "source_user",
-        "sub_type": "sub_type.value",
-        "time_generated": "time_generated",
-        "url_category": "url_category",
-        "url_domain": "url_domain",
+        'source_ip': 'source_ip.value',
+        'dest_ip': 'dest_ip.value',
+        'rule_matched': 'rule_matched',
+        'from_zone': 'from_zone',
+        'to_zone': 'to_zone',
+        'source_port': 'source_port',
+        'dest_port': 'dest_port',
+        'action': 'action.value',
+        'file_sha_256': 'file_sha_256',
+        'file_name': 'file_name',
+        'app': 'app',
+        'app_category': 'app_category',
+        'dest_device_port': 'dest_device_port',
+        'dest_edl': 'dest_edl',
+        'dest_dynamic_address_group': 'dest_dynamic_address_group',
+        'dest_location': 'dest_location',
+        'dest_user': 'dest_user',
+        'file_type': 'file_type',
+        'is_server_to_client': 'is_server_to_client',
+        'is_url_denied': 'is_url_denied',
+        'log_type': 'log_type',
+        'nat_dest': 'nat_dest',
+        'nat_dest_port': 'nat_dest_port',
+        'nat_source': 'nat_source',
+        'nat_source_port': 'nat_source_port',
+        'rule_matched_uuid': 'rule_matched_uuid',
+        'severity': 'severity',
+        'source_device_host': 'source_device_host',
+        'source_edl': 'source_edl',
+        'source_dynamic_address_group': 'source_dynamic_address_group',
+        'source_location': 'source_location',
+        'source_user': 'source_user',
+        'sub_type': 'sub_type.value',
+        'time_generated': 'time_generated',
+        'url_category': 'url_category',
+        'url_domain': 'url_domain',
+        'event_name': 'event_id.value',
+        'gateway': 'gateway',
+        'private_ipv4': 'private_ip.value',
+        'private_ipv6': 'private_ipv6.value',
+        'public_ipv4': 'public_ip.value',
+        'public_ipv6': 'public_ipv6.value',
+        'event_status': 'status.value',
+        'portal': 'portal',
+        'stage': 'stage',
     }
     if args.get("ip") and (args.get("source_ip") or args.get("dest_ip")):
         raise DemistoException('Error: "ip" argument cannot appear with either "source_ip" nor "dest_ip"')
@@ -1120,9 +1202,23 @@ def query_file_data_command(args: dict, client: Client) -> tuple[str, dict, list
     return query_table_logs(args, client, query_table_name, context_transformer_function, table_context_path)
 
 
-def query_table_logs(
-    args: dict, client: Client, table_name: str, context_transformer_function: Callable[[dict], dict], table_context_path: str
-) -> tuple[str, dict, list[dict[str, Any]]]:
+def query_gp_logs_command(args: dict, client: Client):
+    """
+    The function of the command that queries firewall.globalprotect table
+
+        Returns: a Demisto's entry with all the parsed data
+    """
+    table_name: str = 'globalprotect'
+    context_transformer_function = gp_context_transformer
+    table_context_path: str = 'CDL.Logging.GlobalProtect'
+    return query_table_logs(args, client, table_name, context_transformer_function, table_context_path)
+
+
+def query_table_logs(args: dict,
+                     client: Client,
+                     table_name: str,
+                     context_transformer_function: Callable[[dict], dict],
+                     table_context_path: str) -> tuple[str, dict, list[dict[str, Any]]]:
     """
     This function is a generic function that get's all the data needed for a specific table of Cortex and acts as a
     regular command function
@@ -1265,13 +1361,15 @@ def main():
             return_outputs(*query_url_logs_command(args, client))
         elif command == "cdl-query-file-data":
             return_outputs(*query_file_data_command(args, client))
-        elif command == "fetch-incidents":
-            first_fetch_timestamp = params.get("first_fetch_timestamp", "24 hours").strip()
-            fetch_severity = params.get("firewall_severity")
-            fetch_table = params.get("fetch_table")
-            fetch_fields = params.get("fetch_fields") or "*"
-            fetch_subtype = params.get("firewall_subtype")
-            fetch_limit = params.get("limit")
+        elif command == 'cdl-query-gp-logs':
+            return_outputs(*query_gp_logs_command(args, client))
+        elif command == 'fetch-incidents':
+            first_fetch_timestamp = params.get('first_fetch_timestamp', '24 hours').strip()
+            fetch_severity = params.get('firewall_severity')
+            fetch_table = params.get('fetch_table')
+            fetch_fields = params.get('fetch_fields') or '*'
+            fetch_subtype = params.get('firewall_subtype')
+            fetch_limit = params.get('limit')
             last_run = demisto.getLastRun()
             fetch_filter = params.get("filter_query", "")
             next_run, incidents = fetch_incidents(
diff --git a/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml b/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
index 3e81baee20af..0c30e518608c 100644
--- a/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
+++ b/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
@@ -1,4 +1,7 @@
 category: Analytics & SIEM
+sectionorder:
+- Connect
+- Collect
 commonfields:
   id: Cortex Data Lake
   version: -1
@@ -8,42 +11,52 @@ configuration:
   type: 4
   hidden: true
   required: false
+  section: Connect
 - display: ID
   name: reg_id
   type: 4
   hidden: true
   required: false
+  section: Connect
 - display: Key
   name: auth_key
   type: 4
   hidden: true
   required: false
+  section: Connect
 - displaypassword: Encryption Key
   name: credentials_auth_key
   hiddenusername: true
   type: 9
   required: false
+  display: ""
+  section: Connect
 - displaypassword: Authentication Token
   additionalinfo: The API Key to use for connection
   name: credentials_refresh_token
   hiddenusername: true
   type: 9
   required: false
+  display: ""
+  section: Connect
 - displaypassword: Registration ID
   name: credentials_reg_id
   type: 9
   hiddenusername: true
   section: Connect
   required: false
+  display: ""
 - display: Fetch incidents
   name: isFetch
   type: 8
   required: false
+  section: Collect
 - defaultvalue: 24 hours
   display: First fetch time (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
   name: first_fetch_timestamp
   type: 0
   required: false
+  section: Collect
 - additionalinfo: Choose which table incidents will be fetched from.
   defaultvalue: firewall.threat
   display: Fetch Table
@@ -64,6 +77,7 @@ configuration:
   - log.config
   type: 15
   required: false
+  section: Collect
 - display: Severity of events to fetch (Firewall)
   name: firewall_severity
   options:
@@ -76,6 +90,7 @@ configuration:
   - Unused
   type: 16
   required: false
+  section: Collect
 - display: Subtype of events to fetch (Firewall)
   name: firewall_subtype
   options:
@@ -110,37 +125,50 @@ configuration:
   - sctp
   type: 16
   required: false
+  section: Collect
 - additionalinfo: Comma-separated fields that will be fetched with every incident, e.g., "pcap,session_id". Enter "*" for all possible fields.
   defaultvalue: '*'
   display: Fetch Fields
   name: fetch_fields
   type: 12
   required: false
+  section: Collect
 - additionalinfo: 'Filter the fetched incidents according to the given query. Query example: "source_ip.value LIKE `192.168.1.*` AND dst = `192.168.1.12`" Note: Can not be used in combination with `Severity` and `Subtype` parameters.'
   display: Fetch Filter
   name: filter_query
   type: 12
   required: false
+  section: Collect
 - display: Incident type
   name: incidentType
   type: 13
   required: false
+  section: Collect
 - additionalinfo: "The maximum number of incidents to fetch per query.\t\nCaution: A large number could create overload. Default is 10."
   defaultvalue: '10'
   display: Max. number of incidents fetched per query
   name: limit
   type: 0
   required: false
+  section: Collect
 - defaultvalue: 'false'
   display: Use system proxy settings
   name: proxy
   type: 8
   required: false
+  section: Connect
 - defaultvalue: 'false'
   display: Trust any certificate (not secure)
   name: insecure
   type: 8
   required: false
+  section: Connect
+- defaultvalue: "1"
+  display: Incidents Fetch Interval
+  name: incidentFetchInterval
+  required: false
+  type: 19
+  section: Collect
 description: Palo Alto Networks Strata Logging Service XSOAR Connector provides cloud-based, centralized log storage and aggregation for your organization on premise, virtual (private cloud and public cloud) firewalls, for Prisma Access, and for cloud-delivered services such as Cortex XDR.
 display: Strata Logging Service XSOAR Connector
 name: Cortex Data Lake
@@ -164,17 +192,9 @@ script:
       - 'true'
       - 'false'
     - name: page
-      isArray: false
       description: Page to return.
-      required: false
-      secret: false
-      default: false
     - name: page_size
-      isArray: false
       description: Number of entries per page. Defaults to 50 (in case only page was provided).
-      required: false
-      secret: false
-      default: false
     description: Runs a query on  any table or field.
     execution: true
     name: cdl-query-logs
@@ -242,8 +262,7 @@ script:
     - defaultValue: '10'
       description: The maximum number of logs to return. Default is 10.
       name: limit
-    - auto: PREDEFINED
-      description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
+    - description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
       name: time_range
     - auto: PREDEFINED
       defaultValue: 'true'
@@ -253,17 +272,9 @@ script:
       - 'true'
       - 'false'
     - name: page
-      isArray: false
       description: Page to return.
-      required: false
-      secret: false
-      default: false
     - name: page_size
-      isArray: false
       description: Number of entries per page. Defaults to 50 (in case only page was provided).
-      required: false
-      secret: false
-      default: false
     description: Runs a query on the threat table according to preset queries.
     name: cdl-get-critical-threat-logs
     outputs:
@@ -402,21 +413,12 @@ script:
     - defaultValue: '10'
       description: The maximum number of logs to return. Default is 10.
       name: limit
-    - auto: PREDEFINED
-      description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
+    - description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
       name: time_range
     - name: page
-      isArray: false
       description: Page to return.
-      required: false
-      secret: false
-      default: false
     - name: page_size
-      isArray: false
       description: Number of entries per page. Defaults to 50 (in case only page was provided).
-      required: false
-      secret: false
-      default: false
     description: Runs a query on traffic table where app_sub_category = "social networking".
     name: cdl-get-social-applications
     outputs:
@@ -543,24 +545,15 @@ script:
     - defaultValue: '10'
       description: The maximum number of logs to return. Default is 10.
       name: limit
-    - auto: PREDEFINED
-      description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
+    - description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
       name: time_range
     - description: The SHA256 hash of the file for the query. For example, SHA256="503ca1a4fc0d48b18c0336f544ba0f0abf305ae3a3f49b3c2b86b8645d6572dc" would return all logs associated with this file.
       name: SHA256
       required: true
     - name: page
-      isArray: false
       description: Page to return.
-      required: false
-      secret: false
-      default: false
     - name: page_size
-      isArray: false
       description: Number of entries per page. Defaults to 50 (in case only page was provided).
-      required: false
-      secret: false
-      default: false
     description: Runs a query on the threat table with the query 'SELECT * FROM `firewall.threat` WHERE file_sha_256 = <file_hash>'.
     name: cdl-search-by-file-hash
     outputs:
@@ -849,24 +842,15 @@ script:
       name: start_time
     - description: The query end time. For example, end_time="2018-04-26 00:00:00".
       name: end_time
-    - auto: PREDEFINED
-      description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
+    - description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
       name: time_range
     - defaultValue: '5'
       description: The maximum number of logs to return. Default is 5.
       name: limit
     - name: page
-      isArray: false
       description: Page to return.
-      required: false
-      secret: false
-      default: false
     - name: page_size
-      isArray: false
       description: Number of entries per page. Defaults to 50 (in case only page was provided).
-      required: false
-      secret: false
-      default: false
     - description: A destination IP address or an array of destination IPs addresses for which to search, for example 1.1.1.1,2.2.2.2.
       name: dest_ip
     - description: Destination port utilized by the session. Can be port number or an array of destination port numbers to search. For example '443' or '443,445'.
@@ -1043,7 +1027,7 @@ script:
       name: query
     - auto: PREDEFINED
       defaultValue: all
-      description: The fields that are selected in the query. Selection can be "all" (same as *) or or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
+      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
       isArray: true
       name: fields
       predefined:
@@ -1183,24 +1167,15 @@ script:
       name: start_time
     - description: The query end time. For example, end_time="2018-04-26 00:00:00".
       name: end_time
-    - auto: PREDEFINED
-      description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
+    - description: First log time (<number> <time unit>, e.g., 12 minutes, 7 days, 3 weeks).
       name: time_range
     - defaultValue: '5'
       description: The maximum number of logs to return. Default is 5.
       name: limit
     - name: page
-      isArray: false
       description: Page to return.
-      required: false
-      secret: false
-      default: false
     - name: page_size
-      isArray: false
       description: Number of entries per page. Defaults to 50 (in case only page was provided).
-      required: false
-      secret: false
-      default: false
     - description: The IP address or an array of IP addresses for which to search. For example 1.1.1.1,2.2.2.2. Used instead of the source/destination IP address.
       name: ip
     - description: The port or array of ports to search. Used instead of the source/destination port.
@@ -1381,7 +1356,7 @@ script:
       name: query
     - auto: PREDEFINED
       defaultValue: all
-      description: The fields that are selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. List of fields can be found after viewing all the outputted fields with "all".
+      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
       isArray: true
       name: fields
       predefined:
@@ -1521,23 +1496,14 @@ script:
       name: start_time
     - description: The query end time. For example, end_time="2018-04-26 00:00:00".
       name: end_time
-    - auto: PREDEFINED
-      description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
+    - description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
       name: time_range
     - description: The maximum number of logs to return. Default is 5.
       name: limit
     - name: page
-      isArray: false
       description: Page to return.
-      required: false
-      secret: false
-      default: false
     - name: page_size
-      isArray: false
       description: Number of entries per page. Defaults to 50 (in case only page was provided).
-      required: false
-      secret: false
-      default: false
     - description: The IP address or an array of IP addresses for which to search. For example 1.1.1.1,2.2.2.2. Used instead of the source/destination IP address.
       name: ip
     - description: The port or array of ports to search. Used instead of the source/destination port.
@@ -1833,17 +1799,9 @@ script:
       description: The maximum number of logs to return. Default is 5.
       name: limit
     - name: page
-      isArray: false
       description: Page to return.
-      required: false
-      secret: false
-      default: false
     - name: page_size
-      isArray: false
       description: Number of entries per page. Defaults to 50 (in case only page was provided).
-      required: false
-      secret: false
-      default: false
     description: Searches the Cortex firewall.file_data table.
     name: cdl-query-file-data
     outputs:
@@ -2088,7 +2046,151 @@ script:
       type: String
   - description: Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.
     name: cdl-reset-authentication-timeout
-  dockerimage: demisto/python_pancloud_v2:1.0.0.117311
+    arguments: []
+  - arguments:
+    - defaultValue: "10"
+      description: The maximum number of logs to return.
+      name: limit
+    - description: Page to return.
+      name: page
+    - description: Number of entries per page. Defaults to 50 (in case only page was provided).
+      name: page_size
+    - auto: PREDEFINED
+      defaultValue: "true"
+      description: If set to false, query results are not mapped into the standard command context.
+      name: transform_results
+      predefined:
+      - "true"
+      - "false"
+    - defaultValue: all
+      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
+      name: fields
+    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
+      name: end_time
+    - defaultValue: '''1970-01-01 00:00:00'''
+      description: The query start time. For example, start_time="2018-04-26 00:00:00".
+      name: start_time
+    - description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
+      name: time_range
+    - description: Event name for which to search.
+      name: event_name
+    - description: GlobalProtect gateway for which to search.
+      name: gateway
+    - description: Private IP address (v4) of the user that connected for which to search.
+      name: private_ipv4
+    - description: Private IP address (v6) of the user that connected for which to search.
+      name: private_ipv6
+    - description: Public IP address (v4) of the user that connected for which to search.
+      name: public_ipv4
+    - description: Public IP address (v6) of the user that connected for which to search.
+      name: public_ipv6
+    - description: The source username for which to search.
+      name: source_user
+    - description: Event status (success or failure) for which to search.
+      name: event_status
+    - description: GlobalProtect portal for which to search.
+      name: portal
+    - description: Name of the stage in the GlobalProtect connection workflow for
+        which to search.
+      name: stage
+    description: Searches the GlobalProtect VPN log table.
+    name: cdl-query-gp-logs
+    outputs:
+    - contextPath: CDL.Logging.GlobalProtect.AttemptedGateways
+      description: All gateways that were available and attempted for the client location.
+    - contextPath: CDL.Logging.GlobalProtect.AuthMethod
+      description: Authentication method used for the GlobalProtect connection.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorID
+      description: Enumeration integer assigned to the connection_error field value.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorValue
+      description: Error information for unsuccessful connection.
+    - contextPath: CDL.Logging.GlobalProtect.CountOfRepeats
+      description: Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.
+    - contextPath: CDL.Logging.GlobalProtect.CustomerID
+      description: The ID that uniquely identifies the Cortex Data Lake instance which received this log record.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointDeviceName
+      description: Name of the device that the user used for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointGPVersion
+      description: GlobalProtect client version number.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSType
+      description: OS type of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSVersion
+      description: OS version of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EventID
+      description: The name of the event.
+    - contextPath: CDL.Logging.GlobalProtect.Gateway
+      description: Gateway for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.GatewayPriority
+      description: Priority of the gateway.
+    - contextPath: CDL.Logging.GlobalProtect.GatewaySelectionType
+      description: Gateway selection method,  i.e., automatic, preferred, or manual.
+    - contextPath: CDL.Logging.GlobalProtect.HostID
+      description: Unique identifier GlobalProtect has assigned to the host.
+    - contextPath: CDL.Logging.GlobalProtect.IsDuplicateLog
+      description: Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector.
+    - contextPath: CDL.Logging.GlobalProtect.IsExported
+      description: Indicates if this log was exported from the firewall using the firewall's log export function.
+    - contextPath: CDL.Logging.GlobalProtect.IsForwarded
+      description: Internal use field that indicates if the log is being forwarded.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaBranch
+      description: Internal use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaMobile
+      description: Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise.
+    - contextPath: CDL.Logging.GlobalProtect.LogSource
+      description: Identifies the origin of the data.
+    - contextPath: CDL.Logging.GlobalProtect.LogSourceID
+      description: ID that uniquely identifies the source of the log.
+    - contextPath: CDL.Logging.GlobalProtect.LogSourceName
+      description: Name of the source of the log.
+    - contextPath: CDL.Logging.GlobalProtect.LogTime
+      description: Time the log was received in Strata Logging Service XSOAR Connector.
+    - contextPath: CDL.Logging.GlobalProtect.LogType
+      description: Identifies the log type.
+    - contextPath: CDL.Logging.GlobalProtect.LoginDuration
+      description: Duration for which the connected user was logged on.
+    - contextPath: CDL.Logging.GlobalProtect.Opaque
+      description: Additional information regarding the event.
+    - contextPath: CDL.Logging.GlobalProtect.PlatformType
+      description: The platform type.
+    - contextPath: CDL.Logging.GlobalProtect.Portal
+      description: GlobalProtect portal or gateway that the user connected to.
+    - contextPath: CDL.Logging.GlobalProtect.PrivateIPv4
+      description: Private IP address (v4) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.PrivateIPv6
+      description: Private IP address (v6) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.ProjectName
+      description: Project name.
+    - contextPath: CDL.Logging.GlobalProtect.PublicIPv4
+      description: Public IP address (v4) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.PublicIPv6
+      description: Public IP address (v6) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.QuarantineReason
+      description: Quarantine reason.
+    - contextPath: CDL.Logging.GlobalProtect.SequenceNo
+      description: The log entry identifier, which is incremented sequentially.
+    - contextPath: CDL.Logging.GlobalProtect.SourceRegion
+      description: Region of the gateway (or user) that connected.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUser
+      description: The username that connected.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUserDomain
+      description: Domain to which the source user belongs.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUserName
+      description: The source user username.
+    - contextPath: CDL.Logging.GlobalProtect.SSLResponseTime
+      description: SSL response time in milliseconds.
+    - contextPath: CDL.Logging.GlobalProtect.Stage
+      description: Name of the stage in the GlobalProtect connection workflow.
+    - contextPath: CDL.Logging.GlobalProtect.EventStatus
+      description: The status (success or failure) of the event.
+    - contextPath: CDL.Logging.GlobalProtect.Subtype
+      description: The log subtype.
+    - contextPath: CDL.Logging.GlobalProtect.TimeGenerated
+      description: Time when the log was generated on the firewall's data plane.
+    - contextPath: CDL.Logging.GlobalProtect.TunnelType
+      description: Tunnel type i.e., SSL or VPN.
+    - contextPath: CDL.Logging.GlobalProtect.VendorName
+      description: The vendor that produced the data.
+  dockerimage: demisto/python_pancloud_v2:1.0.0.2027056
   isfetch: true
   runonce: false
   script: '-'
diff --git a/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake_test.py b/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake_test.py
index febbf939aeb8..1dccacd7241a 100644
--- a/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake_test.py
+++ b/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake_test.py
@@ -236,6 +236,29 @@ def query_loggings(self, query, page_number=None, page_size=None):
     assert results_xform == {"CDL.Logging": cdl_records_xform}
 
 
+def test_query_gp_logs_command():
+    """
+    Given:
+        - a list of CDL query results from the firewall.globalprotect table.
+    When
+        - running query_gp_logs_command function
+    Then
+        - the CDL query results from the firewall.globalprotect table should be transformed to the GP log context format.
+    """
+    from CortexDataLake import query_gp_logs_command
+
+    cdl_records = load_test_data('./test_data/test_query_logs_command_transform_results_gp_logs.json')
+    cdl_records_xform = load_test_data('./test_data/test_query_logs_command_transform_results_gp_logs_xformed.json')
+
+    class MockClient():
+        def query_loggings(self, query, page_number=None, page_size=None):
+            return cdl_records, []
+
+    _, results_xform, _ = query_gp_logs_command({'limit': '1', 'start_time': '1970-01-01 00:00:00'}, MockClient())
+
+    assert results_xform == {'CDL.Logging.GlobalProtect': cdl_records_xform}
+
+
 class TestPagination:
     """
     A class to test the pagination mechanism in the Cortex Data Lake integration
@@ -249,18 +272,16 @@ def query_loggings(self, query, page_number=None, page_size=None):
             assert page_number is not None
             return [], []
 
-    @pytest.mark.parametrize(
-        "command_function",
-        [
-            "query_logs_command",
-            "get_critical_logs_command",
-            "get_social_applications_command",
-            "search_by_file_hash_command",
-            "query_threat_logs_command",
-            "query_url_logs_command",
-            "query_file_data_command",
-        ],
-    )
+    @pytest.mark.parametrize("command_function", [
+        "query_logs_command",
+        "get_critical_logs_command",
+        "get_social_applications_command",
+        "search_by_file_hash_command",
+        "query_threat_logs_command",
+        "query_url_logs_command",
+        "query_file_data_command",
+        "query_gp_logs_command"
+    ])
     def test_command_pagination(self, command_function):
         """
         Given:
diff --git a/Packs/CortexDataLake/Integrations/CortexDataLake/README.md b/Packs/CortexDataLake/Integrations/CortexDataLake/README.md
index b20177247383..8979cabf9581 100644
--- a/Packs/CortexDataLake/Integrations/CortexDataLake/README.md
+++ b/Packs/CortexDataLake/Integrations/CortexDataLake/README.md
@@ -1320,3 +1320,155 @@ against. That is, log types must be fully qualified and the instance ID is a par
 However in this integration the instance ID is added automatically to the query so the name `firewall.traffic` is a valid table name
 * The SQL syntax supported for queries is `csql`
 * The provided authentication items ([configuration step 4](#configure-cortex-data-lake-on-cortex-xsoar)) can only be used once for each Strata Logging Service XSOAR Connector tenant (but can be shared for different Cortex XSOAR instances). Trying to re-generate those items will revoke any previously generated set of authentication items.
+
+### cdl-query-gp-logs
+***
+Searches the GlobalProtect VPN log table.
+
+#### Base Command
+
+`cdl-query-gp-logs`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| limit | The maximum number of logs to return. Default is 10. | Optional | 
+| page | Page to return. | Optional | 
+| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional | 
+| transform_results | If set to false, query results are not mapped into the standard command context. Possible values are: true, false. Default is true. | Optional | 
+| fields | The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all". Default is all. | Optional | 
+| end_time | The query end time. For example, end_time="2018-04-26 00:00:00". | Optional | 
+| start_time | The query start time. For example, start_time="2018-04-26 00:00:00". Default is '1970-01-01 00:00:00'. | Optional | 
+| time_range | First log time (&lt;number&gt; &lt;time unit&gt;. For example, 12 minutes, 7 days, 3 weeks). | Optional | 
+| event_name | Event name for which to search. | Optional | 
+| gateway | GlobalProtect gateway for which to search. | Optional | 
+| private_ipv4 | Private IP address (v4) of the user that connected for which to search. | Optional | 
+| private_ipv6 | Private IP address (v6) of the user that connected for which to search. | Optional | 
+| public_ipv4 | Public IP address (v4) of the user that connected for which to search. | Optional | 
+| public_ipv6 | Public IP address (v6) of the user that connected for which to search. | Optional | 
+| source_user | The source username for which to search. | Optional | 
+| event_status | Event status (success or failure) for which to search. | Optional | 
+| portal | GlobalProtect portal for which to search. | Optional | 
+
+#### Context Output
+
+| **Path** | **Type** | **Description** |
+| --- | --- | --- |
+| CDL.Logging.GlobalProtect.AttemptedGateways | unknown | All gateways that were available and attempted for the client location. | 
+| CDL.Logging.GlobalProtect.AuthMethod | unknown | Authentication method used for the GlobalProtect connection. | 
+| CDL.Logging.GlobalProtect.ConnectMethod | unknown | Identifies how the GlobalProtect app connected to the the Gateway. | 
+| CDL.Logging.GlobalProtect.ConnectionErrorID | unknown | Enumeration integer assigned to the connection_error field value. | 
+| CDL.Logging.GlobalProtect.ConnectionErrorValue | unknown | Error information for unsuccessful connection. | 
+| CDL.Logging.GlobalProtect.CountOfRepeats | unknown | Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval. | 
+| CDL.Logging.GlobalProtect.CustomerID | unknown | The ID that uniquely identifies the Cortex Data Lake instance which received this log record. | 
+| CDL.Logging.GlobalProtect.EndpointDeviceName | unknown | Name of the device that the user used for the connection. | 
+| CDL.Logging.GlobalProtect.EndpointGPVersion | unknown | GlobalProtect client version number. | 
+| CDL.Logging.GlobalProtect.EndpointOSType | unknown | OS type of the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EndpointOSVersion | unknown | OS version of the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EndpointSN | unknown | ID that uniquely identifies the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EventID | unknown | The name of the event. | 
+| CDL.Logging.GlobalProtect.Gateway | unknown | Gateway for the connection. | 
+| CDL.Logging.GlobalProtect.GatewayPriority | unknown | Priority of the gateway. | 
+| CDL.Logging.GlobalProtect.GatewaySelectionType | unknown | Gateway selection method i.e., automatic, preferred, or manual. | 
+| CDL.Logging.GlobalProtect.GPGatewayLocation | unknown | Location of the GlobalProtect gateway. | 
+| CDL.Logging.GlobalProtect.HostID | unknown | Unique identifier GlobalProtect has assigned to the host. | 
+| CDL.Logging.GlobalProtect.IsDuplicateLog | unknown | Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector. | 
+| CDL.Logging.GlobalProtect.IsExported | unknown | Indicates if this log was exported from the firewall using the firewall's log export function. | 
+| CDL.Logging.GlobalProtect.IsForwarded | unknown | Internal use field that indicates if the log is being forwarded. | 
+| CDL.Logging.GlobalProtect.IsPrismaBranch | unknown | Internal use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise. | 
+| CDL.Logging.GlobalProtect.IsPrismaMobile | unknown | Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise. | 
+| CDL.Logging.GlobalProtect.LogSource | unknown | Identifies the origin of the data. | 
+| CDL.Logging.GlobalProtect.LogSourceID | unknown | ID that uniquely identifies the source of the log. | 
+| CDL.Logging.GlobalProtect.LogSourceName | unknown | Name of the source of the log. | 
+| CDL.Logging.GlobalProtect.LogTime | unknown | Time the log was received in Strata Logging Service XSOAR Connector. | 
+| CDL.Logging.GlobalProtect.LogType | unknown | Identifies the log type. | 
+| CDL.Logging.GlobalProtect.LoginDuration | unknown | Duration for which the connected user was logged on. | 
+| CDL.Logging.GlobalProtect.Opaque | unknown | Additional information regarding the event. | 
+| CDL.Logging.GlobalProtect.PanoramaSN | unknown | Panorama Serial associated with CDL. | 
+| CDL.Logging.GlobalProtect.PlatformType | unknown | The platform type. | 
+| CDL.Logging.GlobalProtect.Portal | unknown | GlobalProtect portal or gateway that the user connected to. | 
+| CDL.Logging.GlobalProtect.PrivateIPv4 | unknown | Private IP address \(v4\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.PrivateIPv6 | unknown | Private IP address \(v6\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.ProjectName | unknown | Project name. | 
+| CDL.Logging.GlobalProtect.PublicIPv4 | unknown | Public IP address \(v4\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.PublicIPv6 | unknown | Public IP address \(v6\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.QuarantineReason | unknown | Quarantine reason. | 
+| CDL.Logging.GlobalProtect.SequenceNo | unknown | The log entry identifier, which is incremented sequentially. | 
+| CDL.Logging.GlobalProtect.SourceRegion | unknown | Region of the gateway \(or user\) that connected. | 
+| CDL.Logging.GlobalProtect.SourceUser | unknown | The username that connected. | 
+| CDL.Logging.GlobalProtect.SourceUserDomain | unknown | Domain to which the source user belongs. | 
+| CDL.Logging.GlobalProtect.SourceUserName | unknown | The source user username. | 
+| CDL.Logging.GlobalProtect.SourceUserUUID | unknown | Unique identifier assigned to the source user. | 
+| CDL.Logging.GlobalProtect.SSLResponseTime | unknown | SSL response time in milliseconds. | 
+| CDL.Logging.GlobalProtect.Stage | unknown | Name of the stage in the GlobalProtect connection workflow. | 
+| CDL.Logging.GlobalProtect.EventStatus | unknown | The status \(success or failure\) of the event. | 
+| CDL.Logging.GlobalProtect.Subtype | unknown | The log subtype. | 
+| CDL.Logging.GlobalProtect.TimeGenerated | unknown | Time when the log was generated on the firewall's data plane. | 
+| CDL.Logging.GlobalProtect.TunnelType | unknown | Tunnel type i.e., SSL or VPN. | 
+| CDL.Logging.GlobalProtect.VendorName | unknown | The vendor that produced the data. | 
+
+##### Command Example
+```!cdl-query-gp-logs time_range="10 days" limit="1"```
+
+##### Context Example
+```
+{
+  "CDL.Logging.GlobalProtect": [
+    {
+      "AttemptedGateways": "gateway1,500,1;",
+      "AuthMethod": "SAML",
+      "ConnectionErrorID": "",
+      "ConnectionErrorValue": "",
+      "CountOfRepeats": 1,
+      "CustomerID": "117270019",
+      "EndpointDeviceName": "device1",
+      "EndpointGPVersion": "328198",
+      "EndpointOSType": "Windows",
+      "EndpointOSVersion": "",
+      "EventID": "gateway-auth",
+      "Gateway": "gateway1",
+      "GatewayPriority": "1",
+      "GatewaySelectionType": "automatic",
+      "HostID": "12341234-1234-1234-1234-123412341234",
+      "IsDuplicateLog": false,
+      "IsExported": false,
+      "IsForwarded": false,
+      "IsPrismaBranch": false,
+      "IsPrismaMobile": false,
+      "LogSource": "gw",
+      "LogSourceID": "007251000070976",
+      "LogSourceName": "gw1",
+      "LogTime": "2025-03-10T20:58:12",
+      "LogType": "globalprotect",
+      "LoginDuration": 1000,
+      "Opaque": "",
+      "PlatformType": "",
+      "Portal": "portal1",
+      "PrivateIPv4": "10.0.0.1",
+      "PrivateIPv6": "",
+      "ProjectName": "",
+      "PublicIPv4": "206.116.22.23",
+      "PublicIPv6": "",
+      "QuarantineReason": "",
+      "SequenceNo": 123,
+      "SourceRegion": "US",
+      "SourceUser": "user1",
+      "SourceUserDomain": "domain1",
+      "SourceUserName": "user1",
+      "SSLResponseTime": 500,
+      "Stage": "login",
+      "EventStatus": "success",
+      "Subtype": "globalprotect",
+      "TimeGenerated": "2025-03-10T20:58:11",
+      "TunnelType": "IPSec",
+      "VendorName": "Palo Alto Networks"
+    }
+  ]
+}
+```
+##### Human Readable Output
+### Logs globalprotect table
+|AttemptedGateways|AuthMethod|ConnectionErrorID|ConnectionErrorValue|CountOfRepeats|CustomerID|EndpointDeviceName|EndpointGPVersion|EndpointOSType|EndpointOSVersion|EventID|Gateway|GatewayPriority|GatewaySelectionType|HostID|IsDuplicateLog|IsExported|IsForwarded|IsPrismaBranch|IsPrismaMobile|LogSource|LogSourceID|LogSourceName|LogTime|LogType|LoginDuration|Opaque|PlatformType|Portal|PrivateIPv4|PrivateIPv6|ProjectName|PublicIPv4|PublicIPv6|QuarantineReason|SequenceNo|SourceRegion|SourceUser|SourceUserDomain|SourceUserName|SSLResponseTime|Stage|EventStatus|Subtype|TimeGenerated|TunnelType|VendorName|
+|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
+| gateway1,500,1; | SAML |  |  | 1 | 117270019 | device1 | 328198 | Windows |  | gateway-auth | gateway1 | 1 | automatic | 12341234-1234-1234-1234-123412341234 | false | false | false | false | false | gw | 007251000070976 | gw1 | 2025-03-10T20 | globalprotect | 1000 |  |  | portal1 | 10.0.0.1 |  |  | 206.116.22.23 |  |  | 123 | US | user1 | domain1 | user1 | 500 | login | success | globalprotect | 2025-03-10T20 | IPSec | Palo Alto Networks |
diff --git a/Packs/CortexDataLake/Integrations/CortexDataLake/command_examples.txt b/Packs/CortexDataLake/Integrations/CortexDataLake/command_examples.txt
index c870dccc5882..aa6dbbf79417 100644
--- a/Packs/CortexDataLake/Integrations/CortexDataLake/command_examples.txt
+++ b/Packs/CortexDataLake/Integrations/CortexDataLake/command_examples.txt
@@ -6,4 +6,5 @@
 !cdl-query-threat-logs action="allow" fields="vendor_name,log_source,rule_matched,dest_location,log_time" time_range="10 days" limit="1"
 !cdl-query-url-logs action="alert" ip="1.1.1.1" limit="1"
 !cdl-query-file-data source_ip="10.10.10.101" time_range="6 months" limit="1"
-!cdl-reset-authentication-timeout
\ No newline at end of file
+!cdl-reset-authentication-timeout
+!cdl-query-gp-logs time_range="10 days" limit="1"
diff --git a/Packs/CortexDataLake/Integrations/CortexDataLake/test_data/test_query_logs_command_transform_results_gp_logs.json b/Packs/CortexDataLake/Integrations/CortexDataLake/test_data/test_query_logs_command_transform_results_gp_logs.json
new file mode 100644
index 000000000000..f34e7306460a
--- /dev/null
+++ b/Packs/CortexDataLake/Integrations/CortexDataLake/test_data/test_query_logs_command_transform_results_gp_logs.json
@@ -0,0 +1,52 @@
+[
+    {
+        "attempted_gateways": "gateway1,500,1;",
+        "auth_method": "SAML",
+        "connection_error": {"id": "", "value": ""},
+        "count_of_repeats": 1,
+        "customer_id": "117270019",
+        "endpoint_device_name": "device1",
+        "endpoint_gp_version": "328198",
+        "endpoint_os_type": "Windows",
+        "endpoint_os_version": "",
+        "event_id": {"value": "gateway-auth"},
+        "gateway": "gateway1",
+        "gateway_priority": {"value": "1"},
+        "gateway_selection_type": "automatic",
+        "host_id": "12341234-1234-1234-1234-123412341234",
+        "is_dup_log": false,
+        "is_exported": false,
+        "is_forwarded": false,
+        "is_prisma_branch": false,
+        "is_prisma_mobile": false,
+        "log_source": "gw",
+        "log_source_id": "007251000070976",
+        "log_source_name": "gw1",
+        "log_time": 2000000,
+        "log_type": {"value": "globalprotect"},
+        "login_duration": 1000,
+        "opaque": "",
+        "platform_type": "",
+        "portal": "portal1",
+        "private_ip": {"value": "10.0.0.1"},
+        "private_ipv6": {"value": ""},
+        "project_name": "",
+        "public_ip": {"value": "206.116.22.23"},
+        "public_ipv6": {"value": ""},
+        "quarantine_reason": "",
+        "sequence_no": 123,
+        "source_region": "US",
+        "source_user": "user1",
+        "source_user_info": {
+            "domain": "domain1",
+            "name": "user1"
+        },
+        "ssl_response_time": 500,
+        "stage": "login",
+        "status": {"value": "success"},
+        "sub_type": {"value": "globalprotect"},
+        "time_generated": 2000000,
+        "tunnel": "IPSec",
+        "vendor_name": "Palo Alto Networks"
+    }
+]
\ No newline at end of file
diff --git a/Packs/CortexDataLake/Integrations/CortexDataLake/test_data/test_query_logs_command_transform_results_gp_logs_xformed.json b/Packs/CortexDataLake/Integrations/CortexDataLake/test_data/test_query_logs_command_transform_results_gp_logs_xformed.json
new file mode 100644
index 000000000000..eea1b452c827
--- /dev/null
+++ b/Packs/CortexDataLake/Integrations/CortexDataLake/test_data/test_query_logs_command_transform_results_gp_logs_xformed.json
@@ -0,0 +1,51 @@
+[
+    {
+        "AttemptedGateways": "gateway1,500,1;",
+        "AuthMethod": "SAML",
+        "ConnectionErrorID": "",
+        "ConnectionErrorValue": "",
+        "CountOfRepeats": 1,
+        "CustomerID": "117270019",
+        "EndpointDeviceName": "device1",
+        "EndpointGPVersion": "328198",
+        "EndpointOSType": "Windows",
+        "EndpointOSVersion": "",
+        "EventID": "gateway-auth",
+        "Gateway": "gateway1",
+        "GatewayPriority": "1",
+        "GatewaySelectionType": "automatic",
+        "HostID": "12341234-1234-1234-1234-123412341234",
+        "IsDuplicateLog": false,
+        "IsExported": false,
+        "IsForwarded": false,
+        "IsPrismaBranch": false,
+        "IsPrismaMobile": false,
+        "LogSource": "gw",
+        "LogSourceID": "007251000070976",
+        "LogSourceName": "gw1",
+        "LogTime": "1970-01-01T00:00:02",
+        "LogType": "globalprotect",
+        "LoginDuration": 1000,
+        "Opaque": "",
+        "PlatformType": "",
+        "Portal": "portal1",
+        "PrivateIPv4": "10.0.0.1",
+        "PrivateIPv6": "",
+        "ProjectName": "",
+        "PublicIPv4": "206.116.22.23",
+        "PublicIPv6": "",
+        "QuarantineReason": "",
+        "SequenceNo": 123,
+        "SourceRegion": "US",
+        "SourceUser": "user1",
+        "SourceUserDomain": "domain1",
+        "SourceUserName": "user1",
+        "SSLResponseTime": 500,
+        "Stage": "login",
+        "EventStatus": "success",
+        "Subtype": "globalprotect",
+        "TimeGenerated": "1970-01-01T00:00:02",
+        "TunnelType": "IPSec",
+        "VendorName": "Palo Alto Networks"
+    }
+]
\ No newline at end of file
diff --git a/Packs/CortexDataLake/ReleaseNotes/1_4_18.md b/Packs/CortexDataLake/ReleaseNotes/1_4_18.md
new file mode 100644
index 000000000000..6a0f99bcb303
--- /dev/null
+++ b/Packs/CortexDataLake/ReleaseNotes/1_4_18.md
@@ -0,0 +1,7 @@
+
+#### Integrations
+
+##### Strata Logging Service XSOAR Connector
+
+- Added the command ***cdl-query-gp-logs*** command to query GlobalProtect VPN logs.
+- Updated the Docker image to: *demisto/python_pancloud_v2:1.0.0.2027056*.
diff --git a/Packs/CortexDataLake/pack_metadata.json b/Packs/CortexDataLake/pack_metadata.json
index 1fb98312db72..eb433782f321 100644
--- a/Packs/CortexDataLake/pack_metadata.json
+++ b/Packs/CortexDataLake/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "Strata Logging Service by Palo Alto Networks",
     "description": "Palo Alto Networks Strata Logging Service XSOAR Connector provides cloud-based, centralized log storage and aggregation for your on-premise, virtual (private cloud and public cloud) firewalls, for Prisma Access, and for cloud-delivered services such as Cortex XDR",
     "support": "xsoar",
-    "currentVersion": "1.4.17",
+    "currentVersion": "1.4.18",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",
@@ -19,4 +19,4 @@
     "marketplaces": [
         "xsoar"
     ]
-}
\ No newline at end of file
+}


Reviews:
user: login: inbalapt1
body: Hi @ali-sawyer ,

Thank you for your contribution! We really appreciate it. 🚀

I've left some comments—please review and address them.

Additionally, please add a command example to the README file, similar to other commands.

The pre-commit step fails with the following error:
Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml: [ST111] - Missing sectionorder key. Add sectionorder to the top of your YAML file and specify the order of the Connect, Collect, Optimize, Mirroring sections (at least one is required). (Please see [here](https://xsoar.pan.dev/docs/integrations/yaml-file#configurations-sections) how to fix it.)

Thanks!
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-06T09:39:04Z
user: login: ali-sawyer
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-06T18:27:25Z
user: login: ali-sawyer
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-06T18:30:36Z
user: login: inbalapt1
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-24T07:07:33Z
user: login: inbalapt1
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-27T07:10:25Z
user: login: inbalapt1
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-01T05:24:26Z
user: login: ShirleyDenkberg
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-01T08:00:09Z
user: login: inbalapt1
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-02T06:44:04Z

Review comments:
diff_hunk: @@ -671,6 +671,73 @@ def files_context_transformer(row_content: dict) -> dict:
     }
 
 
+def gp_context_transformer(row_content):
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.py
user: login: inbalapt1
body: 
```suggestion
def gp_context_transformer(row_content: dict) -> dict:
```
created_at: 2025-03-05T14:52:41Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1222,7 +1310,8 @@ def main():
     enc_key = params.get('credentials_auth_key', {}).get('password') or params.get('auth_key')
     if not enc_key or not refresh_token or not registration_id_and_url:
         raise DemistoException('Key, Token and ID must be provided.')
-    is_fr = ('federal.paloaltonetworks.com' in demisto.getLicenseCustomField('Http_Connector.url'))
+    # is_fr = ('federal.paloaltonetworks.com' in demisto.getLicenseCustomField('Http_Connector.url'))
+    is_fr = False
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.py
user: login: inbalapt1
body: Could you clarify this step?
created_at: 2025-03-05T14:55:07Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2088,10 +2026,161 @@ script:
       type: String
   - description: Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.
     name: cdl-reset-authentication-timeout
-  dockerimage: demisto/python_pancloud_v2:1.0.0.117311
+    arguments: []
+  - arguments:
+    - defaultValue: "10"
+      description: The maximum number of logs to return. Default is 10.
+      name: limit
+    - description: Page to return.
+      name: page
+    - description: Number of entries per page. Defaults to 50 (in case only page was provided).
+      name: page_size
+    - auto: PREDEFINED
+      defaultValue: "true"
+      description: If set to false, query results are not mapped into the standard command context. Default is "true".
+      name: transform_results
+      predefined:
+      - "true"
+      - "false"
+    - defaultValue: all
+      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
+      name: fields
+    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
+      name: end_time
+    - defaultValue: '''1970-01-01 00:00:00'''
+      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
+      name: start_time
+    - description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
+      name: time_range
+    - description: Event name for which to search.
+      name: event_name
+    - description: GlobalProtect gateway for which to search.
+      name: gateway
+    - description: Private IP address (v4) of the user that connected for which to search.
+      name: private_ipv4
+    - description: Private IP address (v6) of the user that connected for which to search.
+      name: private_ipv6
+    - description: Public IP address (v4) of the user that connected for which to search.
+      name: public_ipv4
+    - description: Public IP address (v6) of the user that connected for which to search.
+      name: public_ipv6
+    - description: The source username for which to search.
+      name: source_user
+    - description: Event status (success or failure) for which to search.
+      name: event_status
+    - description: GlobalProtect portal for which to search.
+      name: portal
+    description: Searches the GlobalProtect VPN log table.
+    name: cdl-query-gp-logs
+    outputs:
+    - contextPath: CDL.Logging.GlobalProtect.AttemptedGateways
+      description: All gateways that were available and attempted for the client location.
+    - contextPath: CDL.Logging.GlobalProtect.AuthMethod
+      description: Authentication method used for the GlobalProtect connection.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectMethod
+      description: Identifies how the GlobalProtect app connected to the the Gateway.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorID
+      description: Enumeration integer assigned to the connection_error field value.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorValue
+      description: Error information for unsuccessful connection.
+    - contextPath: CDL.Logging.GlobalProtect.CountOfRepeats
+      description: Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.
+    - contextPath: CDL.Logging.GlobalProtect.CustomerID
+      description: The ID that uniquely identifies the Cortex Data Lake instance which received this log record.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointDeviceName
+      description: Name of the device that the user used for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointGPVersion
+      description: GlobalProtect client version number.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSType
+      description: OS type of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSVersion
+      description: OS version of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointSN
+      description: ID that uniquely identifies the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EventID
+      description: The name of the event.
+    - contextPath: CDL.Logging.GlobalProtect.Gateway
+      description: Gateway for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.GatewayPriority
+      description: Priority of gateway.
+    - contextPath: CDL.Logging.GlobalProtect.GatewaySelectionType
+      description: Gateway Selection Method i.e automatic, preferred or manual.
+    - contextPath: CDL.Logging.GlobalProtect.GPGatewayLocation
+      description: Location of the Global Protect Gateway.
+    - contextPath: CDL.Logging.GlobalProtect.HostID
+      description: Unique identifier GlobalProtect has assigned to the host.
+    - contextPath: CDL.Logging.GlobalProtect.IsDuplicateLog
+      description: Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector.
+    - contextPath: CDL.Logging.GlobalProtect.IsExported
+      description: Indicates if this log was exported from the firewall using the firewall's log export function.
+    - contextPath: CDL.Logging.GlobalProtect.IsForwarded
+      description: Internal-use field that indicates if the log is being forwarded.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaBranch
+      description: Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaMobile
+      description: Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise.
+    - contextPath: CDL.Logging.GlobalProtect.LogSource
+      description: Identifies the origin of the data.
+    - contextPath: CDL.Logging.GlobalProtect.LogSourceID
+      description: ID that uniquely identifies the source of the log.
+    - contextPath: CDL.Logging.GlobalProtect.LogSourceName
+      description: Name of the source of the log.
+    - contextPath: CDL.Logging.GlobalProtect.LogTime
+      description: Time the log was received in Strata Logging Service XSOAR Connector.
+    - contextPath: CDL.Logging.GlobalProtect.LogType
+      description: Identifies the log type.
+    - contextPath: CDL.Logging.GlobalProtect.LoginDuration
+      description: Duration for which the connected user was logged on.
+    - contextPath: CDL.Logging.GlobalProtect.Opaque
+      description: Additional information regarding the event.
+    - contextPath: CDL.Logging.GlobalProtect.PanoramaSN
+      description: Panorama Serial associated with CDL.
+    - contextPath: CDL.Logging.GlobalProtect.PlatformType
+      description: The platform type.
+    - contextPath: CDL.Logging.GlobalProtect.Portal
+      description: Global Protect Portal or Gateway that the user connected to.
+    - contextPath: CDL.Logging.GlobalProtect.PrivateIPv4
+      description: Private IP address (v4) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.PrivateIPv6
+      description: Private IP address (v6) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.ProjectName
+      description: Project name.
+    - contextPath: CDL.Logging.GlobalProtect.PublicIPv4
+      description: Public IP address (v4) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.PublicIPv6
+      description: Public IP address (v6) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.QuarantineReason
+      description: Quarantine reason.
+    - contextPath: CDL.Logging.GlobalProtect.SequenceNo
+      description: The log entry identifier, which is incremented sequentially.
+    - contextPath: CDL.Logging.GlobalProtect.SourceRegion
+      description: Region of the Gateway (or User) that connected.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUser
+      description: The username that connected.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUserDomain
+      description: Domain to which the Source User belongs.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUserName
+      description: The Source User username.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUserUUID
+      description: Unique identifier assigned to the Source User.
+    - contextPath: CDL.Logging.GlobalProtect.SSLResponseTime
+      description: SSL Response Time in milliseconds.
+    - contextPath: CDL.Logging.GlobalProtect.Stage
+      description: Name of the stage in the GlobalProtect connection workflow.
+    - contextPath: CDL.Logging.GlobalProtect.EventStatus
+      description: The status (success or failure) of the event.
+    - contextPath: CDL.Logging.GlobalProtect.Subtype
+      description: The log subtype.
+    - contextPath: CDL.Logging.GlobalProtect.TimeGenerated
+      description: Time when the log was generated on the firewall's data plane.
+    - contextPath: CDL.Logging.GlobalProtect.TunnelType
+      description: Tunnel Type i.e. SSL or VPN.
+    - contextPath: CDL.Logging.GlobalProtect.VendorName
+      description: The vendor that produced the data.
+  dockerimage: demisto/python_pancloud_v2:1.0.0.2027056
   isfetch: true
   runonce: false
-  script: '-'
+  script: ''
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
user: login: inbalapt1
body: 
```suggestion
  script: '-'
```
created_at: 2025-03-05T15:27:11Z
author_association: CONTRIBUTOR
diff_hunk: @@ -141,8 +144,13 @@ configuration:
   name: insecure
   type: 8
   required: false
+- defaultvalue: "1"
+  display: Incidents Fetch Interval
+  name: incidentFetchInterval
+  required: false
+  type: 19
 description: Palo Alto Networks Strata Logging Service XSOAR Connector provides cloud-based, centralized log storage and aggregation for your organization on premise, virtual (private cloud and public cloud) firewalls, for Prisma Access, and for cloud-delivered services such as Cortex XDR.
-display: Strata Logging Service XSOAR Connector
+display: Cortex Data Lake
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
user: login: inbalapt1
body: Is there any reason to this change?
created_at: 2025-03-06T09:32:35Z
author_association: CONTRIBUTOR
diff_hunk: @@ -141,8 +144,13 @@ configuration:
   name: insecure
   type: 8
   required: false
+- defaultvalue: "1"
+  display: Incidents Fetch Interval
+  name: incidentFetchInterval
+  required: false
+  type: 19
 description: Palo Alto Networks Strata Logging Service XSOAR Connector provides cloud-based, centralized log storage and aggregation for your organization on premise, virtual (private cloud and public cloud) firewalls, for Prisma Access, and for cloud-delivered services such as Cortex XDR.
-display: Strata Logging Service XSOAR Connector
+display: Cortex Data Lake
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
user: login: ali-sawyer
body: Nope this was unintentional, will revert.
created_at: 2025-03-06T18:27:25Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1222,7 +1310,8 @@ def main():
     enc_key = params.get('credentials_auth_key', {}).get('password') or params.get('auth_key')
     if not enc_key or not refresh_token or not registration_id_and_url:
         raise DemistoException('Key, Token and ID must be provided.')
-    is_fr = ('federal.paloaltonetworks.com' in demisto.getLicenseCustomField('Http_Connector.url'))
+    # is_fr = ('federal.paloaltonetworks.com' in demisto.getLicenseCustomField('Http_Connector.url'))
+    is_fr = False
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.py
user: login: ali-sawyer
body: Oops, did not mean to leave this. This was just to avoid an error while testing because demisto.getLicenseCustomField() can only be used with OOTB content. Will revert.
created_at: 2025-03-06T18:30:35Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,49 +1,62 @@
 category: Analytics & SIEM
+sectionorder:
+- Connect
+- Collect
 commonfields:
-  id: Cortex Data Lake
+  id: Cortex Data Lake_20250320
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
user: login: inbalapt1
body: ```suggestion
  id: Cortex Data Lake
```
created_at: 2025-03-24T07:07:33Z
author_association: CONTRIBUTOR
diff_hunk: @@ -236,6 +236,29 @@ def query_loggings(self, query, page_number=None, page_size=None):
     assert results_xform == {"CDL.Logging": cdl_records_xform}
 
 
+def test_query_gp_logs_command():
+    """
+    Given:
+        - a list of CDL query results from the firewall.globalprotect table.
+    When
+        - running query_gp_logs_command function
+    Then
+        - the CDL query results from the firewall.globalprotect table should be transformed to the GP log context format.
+    """
+    from CortexDataLake import query_gp_logs_command
+
+    cdl_records = load_test_data('./test_data/test_query_logs_command_transform_results_gp_logs.json')
+    cdl_records_xform = load_test_data('./test_data/test_query_logs_command_transform_results_gp_logs_xformed.json')
+
+    class MockClient():
+        def query_loggings(self, query, page_number=None, page_size=None):
+            return cdl_records, []
+
+    _, results_xform, _ = query_gp_logs_command({'limit': '1', 'start_time': '1970-01-01 00:00:00'}, MockClient())
+
+    assert results_xform == {'CDL.Logging.GlobalProtect': cdl_records_xform}
+       
+    
 class TestPagination:
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake_test.py
user: login: inbalapt1
body: 
```suggestion
    assert results_xform == {'CDL.Logging.GlobalProtect': cdl_records_xform}


class TestPagination:
```
created_at: 2025-03-27T07:10:24Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2088,7 +2046,151 @@ script:
       type: String
   - description: Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.
     name: cdl-reset-authentication-timeout
-  dockerimage: demisto/python_pancloud_v2:1.0.0.117311
+    arguments: []
+  - arguments:
+    - defaultValue: "10"
+      description: The maximum number of logs to return. Default is 10.
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
user: login: ShirleyDenkberg
body: ```suggestion
      description: The maximum number of logs to return.
```
created_at: 2025-04-01T07:33:56Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2088,7 +2046,151 @@ script:
       type: String
   - description: Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.
     name: cdl-reset-authentication-timeout
-  dockerimage: demisto/python_pancloud_v2:1.0.0.117311
+    arguments: []
+  - arguments:
+    - defaultValue: "10"
+      description: The maximum number of logs to return. Default is 10.
+      name: limit
+    - description: Page to return.
+      name: page
+    - description: Number of entries per page. Defaults to 50 (in case only page was provided).
+      name: page_size
+    - auto: PREDEFINED
+      defaultValue: "true"
+      description: If set to false, query results are not mapped into the standard command context. Default is "true".
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
user: login: ShirleyDenkberg
body: ```suggestion
      description: If set to false, query results are not mapped into the standard command context.
```
created_at: 2025-04-01T07:34:18Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2088,7 +2046,151 @@ script:
       type: String
   - description: Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.
     name: cdl-reset-authentication-timeout
-  dockerimage: demisto/python_pancloud_v2:1.0.0.117311
+    arguments: []
+  - arguments:
+    - defaultValue: "10"
+      description: The maximum number of logs to return. Default is 10.
+      name: limit
+    - description: Page to return.
+      name: page
+    - description: Number of entries per page. Defaults to 50 (in case only page was provided).
+      name: page_size
+    - auto: PREDEFINED
+      defaultValue: "true"
+      description: If set to false, query results are not mapped into the standard command context. Default is "true".
+      name: transform_results
+      predefined:
+      - "true"
+      - "false"
+    - defaultValue: all
+      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
+      name: fields
+    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
+      name: end_time
+    - defaultValue: '''1970-01-01 00:00:00'''
+      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
user: login: ShirleyDenkberg
body: ```suggestion
      description: The query start time. For example, start_time="2018-04-26 00:00:00".
```
created_at: 2025-04-01T07:34:57Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2088,7 +2046,151 @@ script:
       type: String
   - description: Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.
     name: cdl-reset-authentication-timeout
-  dockerimage: demisto/python_pancloud_v2:1.0.0.117311
+    arguments: []
+  - arguments:
+    - defaultValue: "10"
+      description: The maximum number of logs to return. Default is 10.
+      name: limit
+    - description: Page to return.
+      name: page
+    - description: Number of entries per page. Defaults to 50 (in case only page was provided).
+      name: page_size
+    - auto: PREDEFINED
+      defaultValue: "true"
+      description: If set to false, query results are not mapped into the standard command context. Default is "true".
+      name: transform_results
+      predefined:
+      - "true"
+      - "false"
+    - defaultValue: all
+      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
+      name: fields
+    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
+      name: end_time
+    - defaultValue: '''1970-01-01 00:00:00'''
+      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
+      name: start_time
+    - description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
+      name: time_range
+    - description: Event name for which to search.
+      name: event_name
+    - description: GlobalProtect gateway for which to search.
+      name: gateway
+    - description: Private IP address (v4) of the user that connected for which to search.
+      name: private_ipv4
+    - description: Private IP address (v6) of the user that connected for which to search.
+      name: private_ipv6
+    - description: Public IP address (v4) of the user that connected for which to search.
+      name: public_ipv4
+    - description: Public IP address (v6) of the user that connected for which to search.
+      name: public_ipv6
+    - description: The source username for which to search.
+      name: source_user
+    - description: Event status (success or failure) for which to search.
+      name: event_status
+    - description: GlobalProtect portal for which to search.
+      name: portal
+    - description: Name of the stage in the GlobalProtect connection workflow for
+        which to search.
+      name: stage
+    description: Searches the GlobalProtect VPN log table.
+    name: cdl-query-gp-logs
+    outputs:
+    - contextPath: CDL.Logging.GlobalProtect.AttemptedGateways
+      description: All gateways that were available and attempted for the client location.
+    - contextPath: CDL.Logging.GlobalProtect.AuthMethod
+      description: Authentication method used for the GlobalProtect connection.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorID
+      description: Enumeration integer assigned to the connection_error field value.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorValue
+      description: Error information for unsuccessful connection.
+    - contextPath: CDL.Logging.GlobalProtect.CountOfRepeats
+      description: Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.
+    - contextPath: CDL.Logging.GlobalProtect.CustomerID
+      description: The ID that uniquely identifies the Cortex Data Lake instance which received this log record.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointDeviceName
+      description: Name of the device that the user used for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointGPVersion
+      description: GlobalProtect client version number.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSType
+      description: OS type of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSVersion
+      description: OS version of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EventID
+      description: The name of the event.
+    - contextPath: CDL.Logging.GlobalProtect.Gateway
+      description: Gateway for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.GatewayPriority
+      description: Priority of gateway.
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
user: login: ShirleyDenkberg
body: ```suggestion
      description: Priority of the gateway.
```
created_at: 2025-04-01T07:40:19Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2088,7 +2046,151 @@ script:
       type: String
   - description: Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.
     name: cdl-reset-authentication-timeout
-  dockerimage: demisto/python_pancloud_v2:1.0.0.117311
+    arguments: []
+  - arguments:
+    - defaultValue: "10"
+      description: The maximum number of logs to return. Default is 10.
+      name: limit
+    - description: Page to return.
+      name: page
+    - description: Number of entries per page. Defaults to 50 (in case only page was provided).
+      name: page_size
+    - auto: PREDEFINED
+      defaultValue: "true"
+      description: If set to false, query results are not mapped into the standard command context. Default is "true".
+      name: transform_results
+      predefined:
+      - "true"
+      - "false"
+    - defaultValue: all
+      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
+      name: fields
+    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
+      name: end_time
+    - defaultValue: '''1970-01-01 00:00:00'''
+      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
+      name: start_time
+    - description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
+      name: time_range
+    - description: Event name for which to search.
+      name: event_name
+    - description: GlobalProtect gateway for which to search.
+      name: gateway
+    - description: Private IP address (v4) of the user that connected for which to search.
+      name: private_ipv4
+    - description: Private IP address (v6) of the user that connected for which to search.
+      name: private_ipv6
+    - description: Public IP address (v4) of the user that connected for which to search.
+      name: public_ipv4
+    - description: Public IP address (v6) of the user that connected for which to search.
+      name: public_ipv6
+    - description: The source username for which to search.
+      name: source_user
+    - description: Event status (success or failure) for which to search.
+      name: event_status
+    - description: GlobalProtect portal for which to search.
+      name: portal
+    - description: Name of the stage in the GlobalProtect connection workflow for
+        which to search.
+      name: stage
+    description: Searches the GlobalProtect VPN log table.
+    name: cdl-query-gp-logs
+    outputs:
+    - contextPath: CDL.Logging.GlobalProtect.AttemptedGateways
+      description: All gateways that were available and attempted for the client location.
+    - contextPath: CDL.Logging.GlobalProtect.AuthMethod
+      description: Authentication method used for the GlobalProtect connection.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorID
+      description: Enumeration integer assigned to the connection_error field value.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorValue
+      description: Error information for unsuccessful connection.
+    - contextPath: CDL.Logging.GlobalProtect.CountOfRepeats
+      description: Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.
+    - contextPath: CDL.Logging.GlobalProtect.CustomerID
+      description: The ID that uniquely identifies the Cortex Data Lake instance which received this log record.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointDeviceName
+      description: Name of the device that the user used for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointGPVersion
+      description: GlobalProtect client version number.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSType
+      description: OS type of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSVersion
+      description: OS version of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EventID
+      description: The name of the event.
+    - contextPath: CDL.Logging.GlobalProtect.Gateway
+      description: Gateway for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.GatewayPriority
+      description: Priority of gateway.
+    - contextPath: CDL.Logging.GlobalProtect.GatewaySelectionType
+      description: Gateway Selection Method i.e automatic, preferred or manual.
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
user: login: ShirleyDenkberg
body: ```suggestion
      description: Gateway selection method,  i.e., automatic, preferred, or manual.
```
created_at: 2025-04-01T07:40:46Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2088,7 +2046,151 @@ script:
       type: String
   - description: Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.
     name: cdl-reset-authentication-timeout
-  dockerimage: demisto/python_pancloud_v2:1.0.0.117311
+    arguments: []
+  - arguments:
+    - defaultValue: "10"
+      description: The maximum number of logs to return. Default is 10.
+      name: limit
+    - description: Page to return.
+      name: page
+    - description: Number of entries per page. Defaults to 50 (in case only page was provided).
+      name: page_size
+    - auto: PREDEFINED
+      defaultValue: "true"
+      description: If set to false, query results are not mapped into the standard command context. Default is "true".
+      name: transform_results
+      predefined:
+      - "true"
+      - "false"
+    - defaultValue: all
+      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
+      name: fields
+    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
+      name: end_time
+    - defaultValue: '''1970-01-01 00:00:00'''
+      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
+      name: start_time
+    - description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
+      name: time_range
+    - description: Event name for which to search.
+      name: event_name
+    - description: GlobalProtect gateway for which to search.
+      name: gateway
+    - description: Private IP address (v4) of the user that connected for which to search.
+      name: private_ipv4
+    - description: Private IP address (v6) of the user that connected for which to search.
+      name: private_ipv6
+    - description: Public IP address (v4) of the user that connected for which to search.
+      name: public_ipv4
+    - description: Public IP address (v6) of the user that connected for which to search.
+      name: public_ipv6
+    - description: The source username for which to search.
+      name: source_user
+    - description: Event status (success or failure) for which to search.
+      name: event_status
+    - description: GlobalProtect portal for which to search.
+      name: portal
+    - description: Name of the stage in the GlobalProtect connection workflow for
+        which to search.
+      name: stage
+    description: Searches the GlobalProtect VPN log table.
+    name: cdl-query-gp-logs
+    outputs:
+    - contextPath: CDL.Logging.GlobalProtect.AttemptedGateways
+      description: All gateways that were available and attempted for the client location.
+    - contextPath: CDL.Logging.GlobalProtect.AuthMethod
+      description: Authentication method used for the GlobalProtect connection.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorID
+      description: Enumeration integer assigned to the connection_error field value.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorValue
+      description: Error information for unsuccessful connection.
+    - contextPath: CDL.Logging.GlobalProtect.CountOfRepeats
+      description: Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.
+    - contextPath: CDL.Logging.GlobalProtect.CustomerID
+      description: The ID that uniquely identifies the Cortex Data Lake instance which received this log record.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointDeviceName
+      description: Name of the device that the user used for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointGPVersion
+      description: GlobalProtect client version number.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSType
+      description: OS type of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSVersion
+      description: OS version of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EventID
+      description: The name of the event.
+    - contextPath: CDL.Logging.GlobalProtect.Gateway
+      description: Gateway for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.GatewayPriority
+      description: Priority of gateway.
+    - contextPath: CDL.Logging.GlobalProtect.GatewaySelectionType
+      description: Gateway Selection Method i.e automatic, preferred or manual.
+    - contextPath: CDL.Logging.GlobalProtect.HostID
+      description: Unique identifier GlobalProtect has assigned to the host.
+    - contextPath: CDL.Logging.GlobalProtect.IsDuplicateLog
+      description: Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector.
+    - contextPath: CDL.Logging.GlobalProtect.IsExported
+      description: Indicates if this log was exported from the firewall using the firewall's log export function.
+    - contextPath: CDL.Logging.GlobalProtect.IsForwarded
+      description: Internal-use field that indicates if the log is being forwarded.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaBranch
+      description: Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
user: login: ShirleyDenkberg
body: ```suggestion
      description: Internal use field that indicates if the log is being forwarded.
    - contextPath: CDL.Logging.GlobalProtect.IsPrismaBranch
      description: Internal use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.
```
created_at: 2025-04-01T07:41:46Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2088,7 +2046,151 @@ script:
       type: String
   - description: Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.
     name: cdl-reset-authentication-timeout
-  dockerimage: demisto/python_pancloud_v2:1.0.0.117311
+    arguments: []
+  - arguments:
+    - defaultValue: "10"
+      description: The maximum number of logs to return. Default is 10.
+      name: limit
+    - description: Page to return.
+      name: page
+    - description: Number of entries per page. Defaults to 50 (in case only page was provided).
+      name: page_size
+    - auto: PREDEFINED
+      defaultValue: "true"
+      description: If set to false, query results are not mapped into the standard command context. Default is "true".
+      name: transform_results
+      predefined:
+      - "true"
+      - "false"
+    - defaultValue: all
+      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
+      name: fields
+    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
+      name: end_time
+    - defaultValue: '''1970-01-01 00:00:00'''
+      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
+      name: start_time
+    - description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
+      name: time_range
+    - description: Event name for which to search.
+      name: event_name
+    - description: GlobalProtect gateway for which to search.
+      name: gateway
+    - description: Private IP address (v4) of the user that connected for which to search.
+      name: private_ipv4
+    - description: Private IP address (v6) of the user that connected for which to search.
+      name: private_ipv6
+    - description: Public IP address (v4) of the user that connected for which to search.
+      name: public_ipv4
+    - description: Public IP address (v6) of the user that connected for which to search.
+      name: public_ipv6
+    - description: The source username for which to search.
+      name: source_user
+    - description: Event status (success or failure) for which to search.
+      name: event_status
+    - description: GlobalProtect portal for which to search.
+      name: portal
+    - description: Name of the stage in the GlobalProtect connection workflow for
+        which to search.
+      name: stage
+    description: Searches the GlobalProtect VPN log table.
+    name: cdl-query-gp-logs
+    outputs:
+    - contextPath: CDL.Logging.GlobalProtect.AttemptedGateways
+      description: All gateways that were available and attempted for the client location.
+    - contextPath: CDL.Logging.GlobalProtect.AuthMethod
+      description: Authentication method used for the GlobalProtect connection.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorID
+      description: Enumeration integer assigned to the connection_error field value.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorValue
+      description: Error information for unsuccessful connection.
+    - contextPath: CDL.Logging.GlobalProtect.CountOfRepeats
+      description: Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.
+    - contextPath: CDL.Logging.GlobalProtect.CustomerID
+      description: The ID that uniquely identifies the Cortex Data Lake instance which received this log record.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointDeviceName
+      description: Name of the device that the user used for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointGPVersion
+      description: GlobalProtect client version number.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSType
+      description: OS type of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSVersion
+      description: OS version of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EventID
+      description: The name of the event.
+    - contextPath: CDL.Logging.GlobalProtect.Gateway
+      description: Gateway for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.GatewayPriority
+      description: Priority of gateway.
+    - contextPath: CDL.Logging.GlobalProtect.GatewaySelectionType
+      description: Gateway Selection Method i.e automatic, preferred or manual.
+    - contextPath: CDL.Logging.GlobalProtect.HostID
+      description: Unique identifier GlobalProtect has assigned to the host.
+    - contextPath: CDL.Logging.GlobalProtect.IsDuplicateLog
+      description: Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector.
+    - contextPath: CDL.Logging.GlobalProtect.IsExported
+      description: Indicates if this log was exported from the firewall using the firewall's log export function.
+    - contextPath: CDL.Logging.GlobalProtect.IsForwarded
+      description: Internal-use field that indicates if the log is being forwarded.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaBranch
+      description: Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaMobile
+      description: Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise.
+    - contextPath: CDL.Logging.GlobalProtect.LogSource
+      description: Identifies the origin of the data.
+    - contextPath: CDL.Logging.GlobalProtect.LogSourceID
+      description: ID that uniquely identifies the source of the log.
+    - contextPath: CDL.Logging.GlobalProtect.LogSourceName
+      description: Name of the source of the log.
+    - contextPath: CDL.Logging.GlobalProtect.LogTime
+      description: Time the log was received in Strata Logging Service XSOAR Connector.
+    - contextPath: CDL.Logging.GlobalProtect.LogType
+      description: Identifies the log type.
+    - contextPath: CDL.Logging.GlobalProtect.LoginDuration
+      description: Duration for which the connected user was logged on.
+    - contextPath: CDL.Logging.GlobalProtect.Opaque
+      description: Additional information regarding the event.
+    - contextPath: CDL.Logging.GlobalProtect.PlatformType
+      description: The platform type.
+    - contextPath: CDL.Logging.GlobalProtect.Portal
+      description: Global Protect Portal or Gateway that the user connected to.
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
user: login: ShirleyDenkberg
body: ```suggestion
      description: GlobalProtect portal or gateway that the user connected to.
```
created_at: 2025-04-01T07:42:54Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2088,7 +2046,151 @@ script:
       type: String
   - description: Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.
     name: cdl-reset-authentication-timeout
-  dockerimage: demisto/python_pancloud_v2:1.0.0.117311
+    arguments: []
+  - arguments:
+    - defaultValue: "10"
+      description: The maximum number of logs to return. Default is 10.
+      name: limit
+    - description: Page to return.
+      name: page
+    - description: Number of entries per page. Defaults to 50 (in case only page was provided).
+      name: page_size
+    - auto: PREDEFINED
+      defaultValue: "true"
+      description: If set to false, query results are not mapped into the standard command context. Default is "true".
+      name: transform_results
+      predefined:
+      - "true"
+      - "false"
+    - defaultValue: all
+      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
+      name: fields
+    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
+      name: end_time
+    - defaultValue: '''1970-01-01 00:00:00'''
+      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
+      name: start_time
+    - description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
+      name: time_range
+    - description: Event name for which to search.
+      name: event_name
+    - description: GlobalProtect gateway for which to search.
+      name: gateway
+    - description: Private IP address (v4) of the user that connected for which to search.
+      name: private_ipv4
+    - description: Private IP address (v6) of the user that connected for which to search.
+      name: private_ipv6
+    - description: Public IP address (v4) of the user that connected for which to search.
+      name: public_ipv4
+    - description: Public IP address (v6) of the user that connected for which to search.
+      name: public_ipv6
+    - description: The source username for which to search.
+      name: source_user
+    - description: Event status (success or failure) for which to search.
+      name: event_status
+    - description: GlobalProtect portal for which to search.
+      name: portal
+    - description: Name of the stage in the GlobalProtect connection workflow for
+        which to search.
+      name: stage
+    description: Searches the GlobalProtect VPN log table.
+    name: cdl-query-gp-logs
+    outputs:
+    - contextPath: CDL.Logging.GlobalProtect.AttemptedGateways
+      description: All gateways that were available and attempted for the client location.
+    - contextPath: CDL.Logging.GlobalProtect.AuthMethod
+      description: Authentication method used for the GlobalProtect connection.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorID
+      description: Enumeration integer assigned to the connection_error field value.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorValue
+      description: Error information for unsuccessful connection.
+    - contextPath: CDL.Logging.GlobalProtect.CountOfRepeats
+      description: Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.
+    - contextPath: CDL.Logging.GlobalProtect.CustomerID
+      description: The ID that uniquely identifies the Cortex Data Lake instance which received this log record.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointDeviceName
+      description: Name of the device that the user used for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointGPVersion
+      description: GlobalProtect client version number.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSType
+      description: OS type of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSVersion
+      description: OS version of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EventID
+      description: The name of the event.
+    - contextPath: CDL.Logging.GlobalProtect.Gateway
+      description: Gateway for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.GatewayPriority
+      description: Priority of gateway.
+    - contextPath: CDL.Logging.GlobalProtect.GatewaySelectionType
+      description: Gateway Selection Method i.e automatic, preferred or manual.
+    - contextPath: CDL.Logging.GlobalProtect.HostID
+      description: Unique identifier GlobalProtect has assigned to the host.
+    - contextPath: CDL.Logging.GlobalProtect.IsDuplicateLog
+      description: Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector.
+    - contextPath: CDL.Logging.GlobalProtect.IsExported
+      description: Indicates if this log was exported from the firewall using the firewall's log export function.
+    - contextPath: CDL.Logging.GlobalProtect.IsForwarded
+      description: Internal-use field that indicates if the log is being forwarded.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaBranch
+      description: Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaMobile
+      description: Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise.
+    - contextPath: CDL.Logging.GlobalProtect.LogSource
+      description: Identifies the origin of the data.
+    - contextPath: CDL.Logging.GlobalProtect.LogSourceID
+      description: ID that uniquely identifies the source of the log.
+    - contextPath: CDL.Logging.GlobalProtect.LogSourceName
+      description: Name of the source of the log.
+    - contextPath: CDL.Logging.GlobalProtect.LogTime
+      description: Time the log was received in Strata Logging Service XSOAR Connector.
+    - contextPath: CDL.Logging.GlobalProtect.LogType
+      description: Identifies the log type.
+    - contextPath: CDL.Logging.GlobalProtect.LoginDuration
+      description: Duration for which the connected user was logged on.
+    - contextPath: CDL.Logging.GlobalProtect.Opaque
+      description: Additional information regarding the event.
+    - contextPath: CDL.Logging.GlobalProtect.PlatformType
+      description: The platform type.
+    - contextPath: CDL.Logging.GlobalProtect.Portal
+      description: Global Protect Portal or Gateway that the user connected to.
+    - contextPath: CDL.Logging.GlobalProtect.PrivateIPv4
+      description: Private IP address (v4) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.PrivateIPv6
+      description: Private IP address (v6) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.ProjectName
+      description: Project name.
+    - contextPath: CDL.Logging.GlobalProtect.PublicIPv4
+      description: Public IP address (v4) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.PublicIPv6
+      description: Public IP address (v6) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.QuarantineReason
+      description: Quarantine reason.
+    - contextPath: CDL.Logging.GlobalProtect.SequenceNo
+      description: The log entry identifier, which is incremented sequentially.
+    - contextPath: CDL.Logging.GlobalProtect.SourceRegion
+      description: Region of the Gateway (or User) that connected.
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
user: login: ShirleyDenkberg
body: ```suggestion
      description: Region of the gateway (or user) that connected.
```
created_at: 2025-04-01T07:44:00Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2088,7 +2046,151 @@ script:
       type: String
   - description: Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.
     name: cdl-reset-authentication-timeout
-  dockerimage: demisto/python_pancloud_v2:1.0.0.117311
+    arguments: []
+  - arguments:
+    - defaultValue: "10"
+      description: The maximum number of logs to return. Default is 10.
+      name: limit
+    - description: Page to return.
+      name: page
+    - description: Number of entries per page. Defaults to 50 (in case only page was provided).
+      name: page_size
+    - auto: PREDEFINED
+      defaultValue: "true"
+      description: If set to false, query results are not mapped into the standard command context. Default is "true".
+      name: transform_results
+      predefined:
+      - "true"
+      - "false"
+    - defaultValue: all
+      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
+      name: fields
+    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
+      name: end_time
+    - defaultValue: '''1970-01-01 00:00:00'''
+      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
+      name: start_time
+    - description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
+      name: time_range
+    - description: Event name for which to search.
+      name: event_name
+    - description: GlobalProtect gateway for which to search.
+      name: gateway
+    - description: Private IP address (v4) of the user that connected for which to search.
+      name: private_ipv4
+    - description: Private IP address (v6) of the user that connected for which to search.
+      name: private_ipv6
+    - description: Public IP address (v4) of the user that connected for which to search.
+      name: public_ipv4
+    - description: Public IP address (v6) of the user that connected for which to search.
+      name: public_ipv6
+    - description: The source username for which to search.
+      name: source_user
+    - description: Event status (success or failure) for which to search.
+      name: event_status
+    - description: GlobalProtect portal for which to search.
+      name: portal
+    - description: Name of the stage in the GlobalProtect connection workflow for
+        which to search.
+      name: stage
+    description: Searches the GlobalProtect VPN log table.
+    name: cdl-query-gp-logs
+    outputs:
+    - contextPath: CDL.Logging.GlobalProtect.AttemptedGateways
+      description: All gateways that were available and attempted for the client location.
+    - contextPath: CDL.Logging.GlobalProtect.AuthMethod
+      description: Authentication method used for the GlobalProtect connection.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorID
+      description: Enumeration integer assigned to the connection_error field value.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorValue
+      description: Error information for unsuccessful connection.
+    - contextPath: CDL.Logging.GlobalProtect.CountOfRepeats
+      description: Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.
+    - contextPath: CDL.Logging.GlobalProtect.CustomerID
+      description: The ID that uniquely identifies the Cortex Data Lake instance which received this log record.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointDeviceName
+      description: Name of the device that the user used for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointGPVersion
+      description: GlobalProtect client version number.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSType
+      description: OS type of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSVersion
+      description: OS version of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EventID
+      description: The name of the event.
+    - contextPath: CDL.Logging.GlobalProtect.Gateway
+      description: Gateway for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.GatewayPriority
+      description: Priority of gateway.
+    - contextPath: CDL.Logging.GlobalProtect.GatewaySelectionType
+      description: Gateway Selection Method i.e automatic, preferred or manual.
+    - contextPath: CDL.Logging.GlobalProtect.HostID
+      description: Unique identifier GlobalProtect has assigned to the host.
+    - contextPath: CDL.Logging.GlobalProtect.IsDuplicateLog
+      description: Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector.
+    - contextPath: CDL.Logging.GlobalProtect.IsExported
+      description: Indicates if this log was exported from the firewall using the firewall's log export function.
+    - contextPath: CDL.Logging.GlobalProtect.IsForwarded
+      description: Internal-use field that indicates if the log is being forwarded.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaBranch
+      description: Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaMobile
+      description: Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise.
+    - contextPath: CDL.Logging.GlobalProtect.LogSource
+      description: Identifies the origin of the data.
+    - contextPath: CDL.Logging.GlobalProtect.LogSourceID
+      description: ID that uniquely identifies the source of the log.
+    - contextPath: CDL.Logging.GlobalProtect.LogSourceName
+      description: Name of the source of the log.
+    - contextPath: CDL.Logging.GlobalProtect.LogTime
+      description: Time the log was received in Strata Logging Service XSOAR Connector.
+    - contextPath: CDL.Logging.GlobalProtect.LogType
+      description: Identifies the log type.
+    - contextPath: CDL.Logging.GlobalProtect.LoginDuration
+      description: Duration for which the connected user was logged on.
+    - contextPath: CDL.Logging.GlobalProtect.Opaque
+      description: Additional information regarding the event.
+    - contextPath: CDL.Logging.GlobalProtect.PlatformType
+      description: The platform type.
+    - contextPath: CDL.Logging.GlobalProtect.Portal
+      description: Global Protect Portal or Gateway that the user connected to.
+    - contextPath: CDL.Logging.GlobalProtect.PrivateIPv4
+      description: Private IP address (v4) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.PrivateIPv6
+      description: Private IP address (v6) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.ProjectName
+      description: Project name.
+    - contextPath: CDL.Logging.GlobalProtect.PublicIPv4
+      description: Public IP address (v4) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.PublicIPv6
+      description: Public IP address (v6) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.QuarantineReason
+      description: Quarantine reason.
+    - contextPath: CDL.Logging.GlobalProtect.SequenceNo
+      description: The log entry identifier, which is incremented sequentially.
+    - contextPath: CDL.Logging.GlobalProtect.SourceRegion
+      description: Region of the Gateway (or User) that connected.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUser
+      description: The username that connected.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUserDomain
+      description: Domain to which the Source User belongs.
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
user: login: ShirleyDenkberg
body: ```suggestion
      description: Domain to which the source user belongs.
```
created_at: 2025-04-01T07:44:14Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2088,7 +2046,151 @@ script:
       type: String
   - description: Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.
     name: cdl-reset-authentication-timeout
-  dockerimage: demisto/python_pancloud_v2:1.0.0.117311
+    arguments: []
+  - arguments:
+    - defaultValue: "10"
+      description: The maximum number of logs to return. Default is 10.
+      name: limit
+    - description: Page to return.
+      name: page
+    - description: Number of entries per page. Defaults to 50 (in case only page was provided).
+      name: page_size
+    - auto: PREDEFINED
+      defaultValue: "true"
+      description: If set to false, query results are not mapped into the standard command context. Default is "true".
+      name: transform_results
+      predefined:
+      - "true"
+      - "false"
+    - defaultValue: all
+      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
+      name: fields
+    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
+      name: end_time
+    - defaultValue: '''1970-01-01 00:00:00'''
+      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
+      name: start_time
+    - description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
+      name: time_range
+    - description: Event name for which to search.
+      name: event_name
+    - description: GlobalProtect gateway for which to search.
+      name: gateway
+    - description: Private IP address (v4) of the user that connected for which to search.
+      name: private_ipv4
+    - description: Private IP address (v6) of the user that connected for which to search.
+      name: private_ipv6
+    - description: Public IP address (v4) of the user that connected for which to search.
+      name: public_ipv4
+    - description: Public IP address (v6) of the user that connected for which to search.
+      name: public_ipv6
+    - description: The source username for which to search.
+      name: source_user
+    - description: Event status (success or failure) for which to search.
+      name: event_status
+    - description: GlobalProtect portal for which to search.
+      name: portal
+    - description: Name of the stage in the GlobalProtect connection workflow for
+        which to search.
+      name: stage
+    description: Searches the GlobalProtect VPN log table.
+    name: cdl-query-gp-logs
+    outputs:
+    - contextPath: CDL.Logging.GlobalProtect.AttemptedGateways
+      description: All gateways that were available and attempted for the client location.
+    - contextPath: CDL.Logging.GlobalProtect.AuthMethod
+      description: Authentication method used for the GlobalProtect connection.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorID
+      description: Enumeration integer assigned to the connection_error field value.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorValue
+      description: Error information for unsuccessful connection.
+    - contextPath: CDL.Logging.GlobalProtect.CountOfRepeats
+      description: Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.
+    - contextPath: CDL.Logging.GlobalProtect.CustomerID
+      description: The ID that uniquely identifies the Cortex Data Lake instance which received this log record.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointDeviceName
+      description: Name of the device that the user used for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointGPVersion
+      description: GlobalProtect client version number.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSType
+      description: OS type of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSVersion
+      description: OS version of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EventID
+      description: The name of the event.
+    - contextPath: CDL.Logging.GlobalProtect.Gateway
+      description: Gateway for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.GatewayPriority
+      description: Priority of gateway.
+    - contextPath: CDL.Logging.GlobalProtect.GatewaySelectionType
+      description: Gateway Selection Method i.e automatic, preferred or manual.
+    - contextPath: CDL.Logging.GlobalProtect.HostID
+      description: Unique identifier GlobalProtect has assigned to the host.
+    - contextPath: CDL.Logging.GlobalProtect.IsDuplicateLog
+      description: Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector.
+    - contextPath: CDL.Logging.GlobalProtect.IsExported
+      description: Indicates if this log was exported from the firewall using the firewall's log export function.
+    - contextPath: CDL.Logging.GlobalProtect.IsForwarded
+      description: Internal-use field that indicates if the log is being forwarded.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaBranch
+      description: Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaMobile
+      description: Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise.
+    - contextPath: CDL.Logging.GlobalProtect.LogSource
+      description: Identifies the origin of the data.
+    - contextPath: CDL.Logging.GlobalProtect.LogSourceID
+      description: ID that uniquely identifies the source of the log.
+    - contextPath: CDL.Logging.GlobalProtect.LogSourceName
+      description: Name of the source of the log.
+    - contextPath: CDL.Logging.GlobalProtect.LogTime
+      description: Time the log was received in Strata Logging Service XSOAR Connector.
+    - contextPath: CDL.Logging.GlobalProtect.LogType
+      description: Identifies the log type.
+    - contextPath: CDL.Logging.GlobalProtect.LoginDuration
+      description: Duration for which the connected user was logged on.
+    - contextPath: CDL.Logging.GlobalProtect.Opaque
+      description: Additional information regarding the event.
+    - contextPath: CDL.Logging.GlobalProtect.PlatformType
+      description: The platform type.
+    - contextPath: CDL.Logging.GlobalProtect.Portal
+      description: Global Protect Portal or Gateway that the user connected to.
+    - contextPath: CDL.Logging.GlobalProtect.PrivateIPv4
+      description: Private IP address (v4) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.PrivateIPv6
+      description: Private IP address (v6) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.ProjectName
+      description: Project name.
+    - contextPath: CDL.Logging.GlobalProtect.PublicIPv4
+      description: Public IP address (v4) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.PublicIPv6
+      description: Public IP address (v6) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.QuarantineReason
+      description: Quarantine reason.
+    - contextPath: CDL.Logging.GlobalProtect.SequenceNo
+      description: The log entry identifier, which is incremented sequentially.
+    - contextPath: CDL.Logging.GlobalProtect.SourceRegion
+      description: Region of the Gateway (or User) that connected.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUser
+      description: The username that connected.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUserDomain
+      description: Domain to which the Source User belongs.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUserName
+      description: The Source User username.
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
user: login: ShirleyDenkberg
body: ```suggestion
      description: The source user username.
```
created_at: 2025-04-01T07:44:27Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2088,7 +2046,151 @@ script:
       type: String
   - description: Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.
     name: cdl-reset-authentication-timeout
-  dockerimage: demisto/python_pancloud_v2:1.0.0.117311
+    arguments: []
+  - arguments:
+    - defaultValue: "10"
+      description: The maximum number of logs to return. Default is 10.
+      name: limit
+    - description: Page to return.
+      name: page
+    - description: Number of entries per page. Defaults to 50 (in case only page was provided).
+      name: page_size
+    - auto: PREDEFINED
+      defaultValue: "true"
+      description: If set to false, query results are not mapped into the standard command context. Default is "true".
+      name: transform_results
+      predefined:
+      - "true"
+      - "false"
+    - defaultValue: all
+      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
+      name: fields
+    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
+      name: end_time
+    - defaultValue: '''1970-01-01 00:00:00'''
+      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
+      name: start_time
+    - description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
+      name: time_range
+    - description: Event name for which to search.
+      name: event_name
+    - description: GlobalProtect gateway for which to search.
+      name: gateway
+    - description: Private IP address (v4) of the user that connected for which to search.
+      name: private_ipv4
+    - description: Private IP address (v6) of the user that connected for which to search.
+      name: private_ipv6
+    - description: Public IP address (v4) of the user that connected for which to search.
+      name: public_ipv4
+    - description: Public IP address (v6) of the user that connected for which to search.
+      name: public_ipv6
+    - description: The source username for which to search.
+      name: source_user
+    - description: Event status (success or failure) for which to search.
+      name: event_status
+    - description: GlobalProtect portal for which to search.
+      name: portal
+    - description: Name of the stage in the GlobalProtect connection workflow for
+        which to search.
+      name: stage
+    description: Searches the GlobalProtect VPN log table.
+    name: cdl-query-gp-logs
+    outputs:
+    - contextPath: CDL.Logging.GlobalProtect.AttemptedGateways
+      description: All gateways that were available and attempted for the client location.
+    - contextPath: CDL.Logging.GlobalProtect.AuthMethod
+      description: Authentication method used for the GlobalProtect connection.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorID
+      description: Enumeration integer assigned to the connection_error field value.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorValue
+      description: Error information for unsuccessful connection.
+    - contextPath: CDL.Logging.GlobalProtect.CountOfRepeats
+      description: Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.
+    - contextPath: CDL.Logging.GlobalProtect.CustomerID
+      description: The ID that uniquely identifies the Cortex Data Lake instance which received this log record.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointDeviceName
+      description: Name of the device that the user used for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointGPVersion
+      description: GlobalProtect client version number.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSType
+      description: OS type of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSVersion
+      description: OS version of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EventID
+      description: The name of the event.
+    - contextPath: CDL.Logging.GlobalProtect.Gateway
+      description: Gateway for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.GatewayPriority
+      description: Priority of gateway.
+    - contextPath: CDL.Logging.GlobalProtect.GatewaySelectionType
+      description: Gateway Selection Method i.e automatic, preferred or manual.
+    - contextPath: CDL.Logging.GlobalProtect.HostID
+      description: Unique identifier GlobalProtect has assigned to the host.
+    - contextPath: CDL.Logging.GlobalProtect.IsDuplicateLog
+      description: Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector.
+    - contextPath: CDL.Logging.GlobalProtect.IsExported
+      description: Indicates if this log was exported from the firewall using the firewall's log export function.
+    - contextPath: CDL.Logging.GlobalProtect.IsForwarded
+      description: Internal-use field that indicates if the log is being forwarded.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaBranch
+      description: Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaMobile
+      description: Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise.
+    - contextPath: CDL.Logging.GlobalProtect.LogSource
+      description: Identifies the origin of the data.
+    - contextPath: CDL.Logging.GlobalProtect.LogSourceID
+      description: ID that uniquely identifies the source of the log.
+    - contextPath: CDL.Logging.GlobalProtect.LogSourceName
+      description: Name of the source of the log.
+    - contextPath: CDL.Logging.GlobalProtect.LogTime
+      description: Time the log was received in Strata Logging Service XSOAR Connector.
+    - contextPath: CDL.Logging.GlobalProtect.LogType
+      description: Identifies the log type.
+    - contextPath: CDL.Logging.GlobalProtect.LoginDuration
+      description: Duration for which the connected user was logged on.
+    - contextPath: CDL.Logging.GlobalProtect.Opaque
+      description: Additional information regarding the event.
+    - contextPath: CDL.Logging.GlobalProtect.PlatformType
+      description: The platform type.
+    - contextPath: CDL.Logging.GlobalProtect.Portal
+      description: Global Protect Portal or Gateway that the user connected to.
+    - contextPath: CDL.Logging.GlobalProtect.PrivateIPv4
+      description: Private IP address (v4) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.PrivateIPv6
+      description: Private IP address (v6) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.ProjectName
+      description: Project name.
+    - contextPath: CDL.Logging.GlobalProtect.PublicIPv4
+      description: Public IP address (v4) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.PublicIPv6
+      description: Public IP address (v6) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.QuarantineReason
+      description: Quarantine reason.
+    - contextPath: CDL.Logging.GlobalProtect.SequenceNo
+      description: The log entry identifier, which is incremented sequentially.
+    - contextPath: CDL.Logging.GlobalProtect.SourceRegion
+      description: Region of the Gateway (or User) that connected.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUser
+      description: The username that connected.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUserDomain
+      description: Domain to which the Source User belongs.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUserName
+      description: The Source User username.
+    - contextPath: CDL.Logging.GlobalProtect.SSLResponseTime
+      description: SSL Response Time in milliseconds.
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
user: login: ShirleyDenkberg
body: ```suggestion
      description: SSL response time in milliseconds.
```
created_at: 2025-04-01T07:44:43Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2088,7 +2046,151 @@ script:
       type: String
   - description: Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.
     name: cdl-reset-authentication-timeout
-  dockerimage: demisto/python_pancloud_v2:1.0.0.117311
+    arguments: []
+  - arguments:
+    - defaultValue: "10"
+      description: The maximum number of logs to return. Default is 10.
+      name: limit
+    - description: Page to return.
+      name: page
+    - description: Number of entries per page. Defaults to 50 (in case only page was provided).
+      name: page_size
+    - auto: PREDEFINED
+      defaultValue: "true"
+      description: If set to false, query results are not mapped into the standard command context. Default is "true".
+      name: transform_results
+      predefined:
+      - "true"
+      - "false"
+    - defaultValue: all
+      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
+      name: fields
+    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
+      name: end_time
+    - defaultValue: '''1970-01-01 00:00:00'''
+      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
+      name: start_time
+    - description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
+      name: time_range
+    - description: Event name for which to search.
+      name: event_name
+    - description: GlobalProtect gateway for which to search.
+      name: gateway
+    - description: Private IP address (v4) of the user that connected for which to search.
+      name: private_ipv4
+    - description: Private IP address (v6) of the user that connected for which to search.
+      name: private_ipv6
+    - description: Public IP address (v4) of the user that connected for which to search.
+      name: public_ipv4
+    - description: Public IP address (v6) of the user that connected for which to search.
+      name: public_ipv6
+    - description: The source username for which to search.
+      name: source_user
+    - description: Event status (success or failure) for which to search.
+      name: event_status
+    - description: GlobalProtect portal for which to search.
+      name: portal
+    - description: Name of the stage in the GlobalProtect connection workflow for
+        which to search.
+      name: stage
+    description: Searches the GlobalProtect VPN log table.
+    name: cdl-query-gp-logs
+    outputs:
+    - contextPath: CDL.Logging.GlobalProtect.AttemptedGateways
+      description: All gateways that were available and attempted for the client location.
+    - contextPath: CDL.Logging.GlobalProtect.AuthMethod
+      description: Authentication method used for the GlobalProtect connection.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorID
+      description: Enumeration integer assigned to the connection_error field value.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorValue
+      description: Error information for unsuccessful connection.
+    - contextPath: CDL.Logging.GlobalProtect.CountOfRepeats
+      description: Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.
+    - contextPath: CDL.Logging.GlobalProtect.CustomerID
+      description: The ID that uniquely identifies the Cortex Data Lake instance which received this log record.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointDeviceName
+      description: Name of the device that the user used for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointGPVersion
+      description: GlobalProtect client version number.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSType
+      description: OS type of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSVersion
+      description: OS version of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EventID
+      description: The name of the event.
+    - contextPath: CDL.Logging.GlobalProtect.Gateway
+      description: Gateway for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.GatewayPriority
+      description: Priority of gateway.
+    - contextPath: CDL.Logging.GlobalProtect.GatewaySelectionType
+      description: Gateway Selection Method i.e automatic, preferred or manual.
+    - contextPath: CDL.Logging.GlobalProtect.HostID
+      description: Unique identifier GlobalProtect has assigned to the host.
+    - contextPath: CDL.Logging.GlobalProtect.IsDuplicateLog
+      description: Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector.
+    - contextPath: CDL.Logging.GlobalProtect.IsExported
+      description: Indicates if this log was exported from the firewall using the firewall's log export function.
+    - contextPath: CDL.Logging.GlobalProtect.IsForwarded
+      description: Internal-use field that indicates if the log is being forwarded.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaBranch
+      description: Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaMobile
+      description: Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise.
+    - contextPath: CDL.Logging.GlobalProtect.LogSource
+      description: Identifies the origin of the data.
+    - contextPath: CDL.Logging.GlobalProtect.LogSourceID
+      description: ID that uniquely identifies the source of the log.
+    - contextPath: CDL.Logging.GlobalProtect.LogSourceName
+      description: Name of the source of the log.
+    - contextPath: CDL.Logging.GlobalProtect.LogTime
+      description: Time the log was received in Strata Logging Service XSOAR Connector.
+    - contextPath: CDL.Logging.GlobalProtect.LogType
+      description: Identifies the log type.
+    - contextPath: CDL.Logging.GlobalProtect.LoginDuration
+      description: Duration for which the connected user was logged on.
+    - contextPath: CDL.Logging.GlobalProtect.Opaque
+      description: Additional information regarding the event.
+    - contextPath: CDL.Logging.GlobalProtect.PlatformType
+      description: The platform type.
+    - contextPath: CDL.Logging.GlobalProtect.Portal
+      description: Global Protect Portal or Gateway that the user connected to.
+    - contextPath: CDL.Logging.GlobalProtect.PrivateIPv4
+      description: Private IP address (v4) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.PrivateIPv6
+      description: Private IP address (v6) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.ProjectName
+      description: Project name.
+    - contextPath: CDL.Logging.GlobalProtect.PublicIPv4
+      description: Public IP address (v4) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.PublicIPv6
+      description: Public IP address (v6) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.QuarantineReason
+      description: Quarantine reason.
+    - contextPath: CDL.Logging.GlobalProtect.SequenceNo
+      description: The log entry identifier, which is incremented sequentially.
+    - contextPath: CDL.Logging.GlobalProtect.SourceRegion
+      description: Region of the Gateway (or User) that connected.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUser
+      description: The username that connected.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUserDomain
+      description: Domain to which the Source User belongs.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUserName
+      description: The Source User username.
+    - contextPath: CDL.Logging.GlobalProtect.SSLResponseTime
+      description: SSL Response Time in milliseconds.
+    - contextPath: CDL.Logging.GlobalProtect.Stage
+      description: Name of the stage in the GlobalProtect connection workflow.
+    - contextPath: CDL.Logging.GlobalProtect.EventStatus
+      description: The status (success or failure) of the event.
+    - contextPath: CDL.Logging.GlobalProtect.Subtype
+      description: The log subtype.
+    - contextPath: CDL.Logging.GlobalProtect.TimeGenerated
+      description: Time when the log was generated on the firewall's data plane.
+    - contextPath: CDL.Logging.GlobalProtect.TunnelType
+      description: Tunnel Type i.e. SSL or VPN.
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
user: login: ShirleyDenkberg
body: ```suggestion
      description: Tunnel type i.e., SSL or VPN.
```
created_at: 2025-04-01T07:45:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1320,3 +1320,155 @@ against. That is, log types must be fully qualified and the instance ID is a par
 However in this integration the instance ID is added automatically to the query so the name `firewall.traffic` is a valid table name
 * The SQL syntax supported for queries is `csql`
 * The provided authentication items ([configuration step 4](#configure-cortex-data-lake-on-cortex-xsoar)) can only be used once for each Strata Logging Service XSOAR Connector tenant (but can be shared for different Cortex XSOAR instances). Trying to re-generate those items will revoke any previously generated set of authentication items.
+
+### cdl-query-gp-logs
+***
+Searches the GlobalProtect VPN log table.
+
+#### Base Command
+
+`cdl-query-gp-logs`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| limit | The maximum number of logs to return. Default is 10. Default is 10. | Optional | 
path: Packs/CortexDataLake/Integrations/CortexDataLake/README.md
user: login: ShirleyDenkberg
body: ```suggestion
| limit | The maximum number of logs to return. Default is 10. | Optional | 
```
created_at: 2025-04-01T07:54:31Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1320,3 +1320,155 @@ against. That is, log types must be fully qualified and the instance ID is a par
 However in this integration the instance ID is added automatically to the query so the name `firewall.traffic` is a valid table name
 * The SQL syntax supported for queries is `csql`
 * The provided authentication items ([configuration step 4](#configure-cortex-data-lake-on-cortex-xsoar)) can only be used once for each Strata Logging Service XSOAR Connector tenant (but can be shared for different Cortex XSOAR instances). Trying to re-generate those items will revoke any previously generated set of authentication items.
+
+### cdl-query-gp-logs
+***
+Searches the GlobalProtect VPN log table.
+
+#### Base Command
+
+`cdl-query-gp-logs`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| limit | The maximum number of logs to return. Default is 10. Default is 10. | Optional | 
+| page | Page to return. | Optional | 
+| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional | 
+| transform_results | If set to false, query results are not mapped into the standard command context. Default is "true". Possible values are: true, false. Default is true. | Optional | 
path: Packs/CortexDataLake/Integrations/CortexDataLake/README.md
user: login: ShirleyDenkberg
body: ```suggestion
| transform_results | If set to false, query results are not mapped into the standard command context. Possible values are: true, false. Default is true. | Optional | 
```
created_at: 2025-04-01T07:55:12Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1320,3 +1320,155 @@ against. That is, log types must be fully qualified and the instance ID is a par
 However in this integration the instance ID is added automatically to the query so the name `firewall.traffic` is a valid table name
 * The SQL syntax supported for queries is `csql`
 * The provided authentication items ([configuration step 4](#configure-cortex-data-lake-on-cortex-xsoar)) can only be used once for each Strata Logging Service XSOAR Connector tenant (but can be shared for different Cortex XSOAR instances). Trying to re-generate those items will revoke any previously generated set of authentication items.
+
+### cdl-query-gp-logs
+***
+Searches the GlobalProtect VPN log table.
+
+#### Base Command
+
+`cdl-query-gp-logs`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| limit | The maximum number of logs to return. Default is 10. Default is 10. | Optional | 
+| page | Page to return. | Optional | 
+| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional | 
+| transform_results | If set to false, query results are not mapped into the standard command context. Default is "true". Possible values are: true, false. Default is true. | Optional | 
+| fields | The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all". Default is all. | Optional | 
+| end_time | The query end time. For example, end_time="2018-04-26 00:00:00". | Optional | 
+| start_time | The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00. Default is '1970-01-01 00:00:00'. | Optional | 
path: Packs/CortexDataLake/Integrations/CortexDataLake/README.md
user: login: ShirleyDenkberg
body: ```suggestion
| start_time | The query start time. For example, start_time="2018-04-26 00:00:00". Default is '1970-01-01 00:00:00'. | Optional | 
```
created_at: 2025-04-01T07:55:33Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1320,3 +1320,155 @@ against. That is, log types must be fully qualified and the instance ID is a par
 However in this integration the instance ID is added automatically to the query so the name `firewall.traffic` is a valid table name
 * The SQL syntax supported for queries is `csql`
 * The provided authentication items ([configuration step 4](#configure-cortex-data-lake-on-cortex-xsoar)) can only be used once for each Strata Logging Service XSOAR Connector tenant (but can be shared for different Cortex XSOAR instances). Trying to re-generate those items will revoke any previously generated set of authentication items.
+
+### cdl-query-gp-logs
+***
+Searches the GlobalProtect VPN log table.
+
+#### Base Command
+
+`cdl-query-gp-logs`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| limit | The maximum number of logs to return. Default is 10. Default is 10. | Optional | 
+| page | Page to return. | Optional | 
+| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional | 
+| transform_results | If set to false, query results are not mapped into the standard command context. Default is "true". Possible values are: true, false. Default is true. | Optional | 
+| fields | The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all". Default is all. | Optional | 
+| end_time | The query end time. For example, end_time="2018-04-26 00:00:00". | Optional | 
+| start_time | The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00. Default is '1970-01-01 00:00:00'. | Optional | 
+| time_range | First log time (&lt;number&gt; &lt;time unit&gt;. For example, 12 minutes, 7 days, 3 weeks). | Optional | 
+| event_name | Event name for which to search. | Optional | 
+| gateway | GlobalProtect gateway for which to search. | Optional | 
+| private_ipv4 | Private IP address (v4) of the user that connected for which to search. | Optional | 
+| private_ipv6 | Private IP address (v6) of the user that connected for which to search. | Optional | 
+| public_ipv4 | Public IP address (v4) of the user that connected for which to search. | Optional | 
+| public_ipv6 | Public IP address (v6) of the user that connected for which to search. | Optional | 
+| source_user | The source username for which to search. | Optional | 
+| event_status | Event status (success or failure) for which to search. | Optional | 
+| portal | GlobalProtect portal for which to search. | Optional | 
+
+#### Context Output
+
+| **Path** | **Type** | **Description** |
+| --- | --- | --- |
+| CDL.Logging.GlobalProtect.AttemptedGateways | unknown | All gateways that were available and attempted for the client location. | 
+| CDL.Logging.GlobalProtect.AuthMethod | unknown | Authentication method used for the GlobalProtect connection. | 
+| CDL.Logging.GlobalProtect.ConnectMethod | unknown | Identifies how the GlobalProtect app connected to the the Gateway. | 
+| CDL.Logging.GlobalProtect.ConnectionErrorID | unknown | Enumeration integer assigned to the connection_error field value. | 
+| CDL.Logging.GlobalProtect.ConnectionErrorValue | unknown | Error information for unsuccessful connection. | 
+| CDL.Logging.GlobalProtect.CountOfRepeats | unknown | Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval. | 
+| CDL.Logging.GlobalProtect.CustomerID | unknown | The ID that uniquely identifies the Cortex Data Lake instance which received this log record. | 
+| CDL.Logging.GlobalProtect.EndpointDeviceName | unknown | Name of the device that the user used for the connection. | 
+| CDL.Logging.GlobalProtect.EndpointGPVersion | unknown | GlobalProtect client version number. | 
+| CDL.Logging.GlobalProtect.EndpointOSType | unknown | OS type of the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EndpointOSVersion | unknown | OS version of the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EndpointSN | unknown | ID that uniquely identifies the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EventID | unknown | The name of the event. | 
+| CDL.Logging.GlobalProtect.Gateway | unknown | Gateway for the connection. | 
+| CDL.Logging.GlobalProtect.GatewayPriority | unknown | Priority of gateway. | 
path: Packs/CortexDataLake/Integrations/CortexDataLake/README.md
user: login: ShirleyDenkberg
body: ```suggestion
| CDL.Logging.GlobalProtect.GatewayPriority | unknown | Priority of the gateway. | 
```
created_at: 2025-04-01T07:56:05Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1320,3 +1320,155 @@ against. That is, log types must be fully qualified and the instance ID is a par
 However in this integration the instance ID is added automatically to the query so the name `firewall.traffic` is a valid table name
 * The SQL syntax supported for queries is `csql`
 * The provided authentication items ([configuration step 4](#configure-cortex-data-lake-on-cortex-xsoar)) can only be used once for each Strata Logging Service XSOAR Connector tenant (but can be shared for different Cortex XSOAR instances). Trying to re-generate those items will revoke any previously generated set of authentication items.
+
+### cdl-query-gp-logs
+***
+Searches the GlobalProtect VPN log table.
+
+#### Base Command
+
+`cdl-query-gp-logs`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| limit | The maximum number of logs to return. Default is 10. Default is 10. | Optional | 
+| page | Page to return. | Optional | 
+| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional | 
+| transform_results | If set to false, query results are not mapped into the standard command context. Default is "true". Possible values are: true, false. Default is true. | Optional | 
+| fields | The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all". Default is all. | Optional | 
+| end_time | The query end time. For example, end_time="2018-04-26 00:00:00". | Optional | 
+| start_time | The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00. Default is '1970-01-01 00:00:00'. | Optional | 
+| time_range | First log time (&lt;number&gt; &lt;time unit&gt;. For example, 12 minutes, 7 days, 3 weeks). | Optional | 
+| event_name | Event name for which to search. | Optional | 
+| gateway | GlobalProtect gateway for which to search. | Optional | 
+| private_ipv4 | Private IP address (v4) of the user that connected for which to search. | Optional | 
+| private_ipv6 | Private IP address (v6) of the user that connected for which to search. | Optional | 
+| public_ipv4 | Public IP address (v4) of the user that connected for which to search. | Optional | 
+| public_ipv6 | Public IP address (v6) of the user that connected for which to search. | Optional | 
+| source_user | The source username for which to search. | Optional | 
+| event_status | Event status (success or failure) for which to search. | Optional | 
+| portal | GlobalProtect portal for which to search. | Optional | 
+
+#### Context Output
+
+| **Path** | **Type** | **Description** |
+| --- | --- | --- |
+| CDL.Logging.GlobalProtect.AttemptedGateways | unknown | All gateways that were available and attempted for the client location. | 
+| CDL.Logging.GlobalProtect.AuthMethod | unknown | Authentication method used for the GlobalProtect connection. | 
+| CDL.Logging.GlobalProtect.ConnectMethod | unknown | Identifies how the GlobalProtect app connected to the the Gateway. | 
+| CDL.Logging.GlobalProtect.ConnectionErrorID | unknown | Enumeration integer assigned to the connection_error field value. | 
+| CDL.Logging.GlobalProtect.ConnectionErrorValue | unknown | Error information for unsuccessful connection. | 
+| CDL.Logging.GlobalProtect.CountOfRepeats | unknown | Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval. | 
+| CDL.Logging.GlobalProtect.CustomerID | unknown | The ID that uniquely identifies the Cortex Data Lake instance which received this log record. | 
+| CDL.Logging.GlobalProtect.EndpointDeviceName | unknown | Name of the device that the user used for the connection. | 
+| CDL.Logging.GlobalProtect.EndpointGPVersion | unknown | GlobalProtect client version number. | 
+| CDL.Logging.GlobalProtect.EndpointOSType | unknown | OS type of the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EndpointOSVersion | unknown | OS version of the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EndpointSN | unknown | ID that uniquely identifies the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EventID | unknown | The name of the event. | 
+| CDL.Logging.GlobalProtect.Gateway | unknown | Gateway for the connection. | 
+| CDL.Logging.GlobalProtect.GatewayPriority | unknown | Priority of gateway. | 
+| CDL.Logging.GlobalProtect.GatewaySelectionType | unknown | Gateway Selection Method i.e automatic, preferred or manual. | 
+| CDL.Logging.GlobalProtect.GPGatewayLocation | unknown | Location of the Global Protect Gateway. | 
path: Packs/CortexDataLake/Integrations/CortexDataLake/README.md
user: login: ShirleyDenkberg
body: ```suggestion
| CDL.Logging.GlobalProtect.GatewaySelectionType | unknown | Gateway selection method i.e., automatic, preferred, or manual. | 
| CDL.Logging.GlobalProtect.GPGatewayLocation | unknown | Location of the GlobalProtect gateway. | 
```
created_at: 2025-04-01T07:56:42Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1320,3 +1320,155 @@ against. That is, log types must be fully qualified and the instance ID is a par
 However in this integration the instance ID is added automatically to the query so the name `firewall.traffic` is a valid table name
 * The SQL syntax supported for queries is `csql`
 * The provided authentication items ([configuration step 4](#configure-cortex-data-lake-on-cortex-xsoar)) can only be used once for each Strata Logging Service XSOAR Connector tenant (but can be shared for different Cortex XSOAR instances). Trying to re-generate those items will revoke any previously generated set of authentication items.
+
+### cdl-query-gp-logs
+***
+Searches the GlobalProtect VPN log table.
+
+#### Base Command
+
+`cdl-query-gp-logs`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| limit | The maximum number of logs to return. Default is 10. Default is 10. | Optional | 
+| page | Page to return. | Optional | 
+| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional | 
+| transform_results | If set to false, query results are not mapped into the standard command context. Default is "true". Possible values are: true, false. Default is true. | Optional | 
+| fields | The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all". Default is all. | Optional | 
+| end_time | The query end time. For example, end_time="2018-04-26 00:00:00". | Optional | 
+| start_time | The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00. Default is '1970-01-01 00:00:00'. | Optional | 
+| time_range | First log time (&lt;number&gt; &lt;time unit&gt;. For example, 12 minutes, 7 days, 3 weeks). | Optional | 
+| event_name | Event name for which to search. | Optional | 
+| gateway | GlobalProtect gateway for which to search. | Optional | 
+| private_ipv4 | Private IP address (v4) of the user that connected for which to search. | Optional | 
+| private_ipv6 | Private IP address (v6) of the user that connected for which to search. | Optional | 
+| public_ipv4 | Public IP address (v4) of the user that connected for which to search. | Optional | 
+| public_ipv6 | Public IP address (v6) of the user that connected for which to search. | Optional | 
+| source_user | The source username for which to search. | Optional | 
+| event_status | Event status (success or failure) for which to search. | Optional | 
+| portal | GlobalProtect portal for which to search. | Optional | 
+
+#### Context Output
+
+| **Path** | **Type** | **Description** |
+| --- | --- | --- |
+| CDL.Logging.GlobalProtect.AttemptedGateways | unknown | All gateways that were available and attempted for the client location. | 
+| CDL.Logging.GlobalProtect.AuthMethod | unknown | Authentication method used for the GlobalProtect connection. | 
+| CDL.Logging.GlobalProtect.ConnectMethod | unknown | Identifies how the GlobalProtect app connected to the the Gateway. | 
+| CDL.Logging.GlobalProtect.ConnectionErrorID | unknown | Enumeration integer assigned to the connection_error field value. | 
+| CDL.Logging.GlobalProtect.ConnectionErrorValue | unknown | Error information for unsuccessful connection. | 
+| CDL.Logging.GlobalProtect.CountOfRepeats | unknown | Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval. | 
+| CDL.Logging.GlobalProtect.CustomerID | unknown | The ID that uniquely identifies the Cortex Data Lake instance which received this log record. | 
+| CDL.Logging.GlobalProtect.EndpointDeviceName | unknown | Name of the device that the user used for the connection. | 
+| CDL.Logging.GlobalProtect.EndpointGPVersion | unknown | GlobalProtect client version number. | 
+| CDL.Logging.GlobalProtect.EndpointOSType | unknown | OS type of the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EndpointOSVersion | unknown | OS version of the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EndpointSN | unknown | ID that uniquely identifies the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EventID | unknown | The name of the event. | 
+| CDL.Logging.GlobalProtect.Gateway | unknown | Gateway for the connection. | 
+| CDL.Logging.GlobalProtect.GatewayPriority | unknown | Priority of gateway. | 
+| CDL.Logging.GlobalProtect.GatewaySelectionType | unknown | Gateway Selection Method i.e automatic, preferred or manual. | 
+| CDL.Logging.GlobalProtect.GPGatewayLocation | unknown | Location of the Global Protect Gateway. | 
+| CDL.Logging.GlobalProtect.HostID | unknown | Unique identifier GlobalProtect has assigned to the host. | 
+| CDL.Logging.GlobalProtect.IsDuplicateLog | unknown | Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector. | 
+| CDL.Logging.GlobalProtect.IsExported | unknown | Indicates if this log was exported from the firewall using the firewall's log export function. | 
+| CDL.Logging.GlobalProtect.IsForwarded | unknown | Internal-use field that indicates if the log is being forwarded. | 
+| CDL.Logging.GlobalProtect.IsPrismaBranch | unknown | Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise. | 
path: Packs/CortexDataLake/Integrations/CortexDataLake/README.md
user: login: ShirleyDenkberg
body: ```suggestion
| CDL.Logging.GlobalProtect.IsForwarded | unknown | Internal use field that indicates if the log is being forwarded. | 
| CDL.Logging.GlobalProtect.IsPrismaBranch | unknown | Internal use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise. | 
```
created_at: 2025-04-01T07:57:22Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1320,3 +1320,155 @@ against. That is, log types must be fully qualified and the instance ID is a par
 However in this integration the instance ID is added automatically to the query so the name `firewall.traffic` is a valid table name
 * The SQL syntax supported for queries is `csql`
 * The provided authentication items ([configuration step 4](#configure-cortex-data-lake-on-cortex-xsoar)) can only be used once for each Strata Logging Service XSOAR Connector tenant (but can be shared for different Cortex XSOAR instances). Trying to re-generate those items will revoke any previously generated set of authentication items.
+
+### cdl-query-gp-logs
+***
+Searches the GlobalProtect VPN log table.
+
+#### Base Command
+
+`cdl-query-gp-logs`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| limit | The maximum number of logs to return. Default is 10. Default is 10. | Optional | 
+| page | Page to return. | Optional | 
+| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional | 
+| transform_results | If set to false, query results are not mapped into the standard command context. Default is "true". Possible values are: true, false. Default is true. | Optional | 
+| fields | The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all". Default is all. | Optional | 
+| end_time | The query end time. For example, end_time="2018-04-26 00:00:00". | Optional | 
+| start_time | The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00. Default is '1970-01-01 00:00:00'. | Optional | 
+| time_range | First log time (&lt;number&gt; &lt;time unit&gt;. For example, 12 minutes, 7 days, 3 weeks). | Optional | 
+| event_name | Event name for which to search. | Optional | 
+| gateway | GlobalProtect gateway for which to search. | Optional | 
+| private_ipv4 | Private IP address (v4) of the user that connected for which to search. | Optional | 
+| private_ipv6 | Private IP address (v6) of the user that connected for which to search. | Optional | 
+| public_ipv4 | Public IP address (v4) of the user that connected for which to search. | Optional | 
+| public_ipv6 | Public IP address (v6) of the user that connected for which to search. | Optional | 
+| source_user | The source username for which to search. | Optional | 
+| event_status | Event status (success or failure) for which to search. | Optional | 
+| portal | GlobalProtect portal for which to search. | Optional | 
+
+#### Context Output
+
+| **Path** | **Type** | **Description** |
+| --- | --- | --- |
+| CDL.Logging.GlobalProtect.AttemptedGateways | unknown | All gateways that were available and attempted for the client location. | 
+| CDL.Logging.GlobalProtect.AuthMethod | unknown | Authentication method used for the GlobalProtect connection. | 
+| CDL.Logging.GlobalProtect.ConnectMethod | unknown | Identifies how the GlobalProtect app connected to the the Gateway. | 
+| CDL.Logging.GlobalProtect.ConnectionErrorID | unknown | Enumeration integer assigned to the connection_error field value. | 
+| CDL.Logging.GlobalProtect.ConnectionErrorValue | unknown | Error information for unsuccessful connection. | 
+| CDL.Logging.GlobalProtect.CountOfRepeats | unknown | Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval. | 
+| CDL.Logging.GlobalProtect.CustomerID | unknown | The ID that uniquely identifies the Cortex Data Lake instance which received this log record. | 
+| CDL.Logging.GlobalProtect.EndpointDeviceName | unknown | Name of the device that the user used for the connection. | 
+| CDL.Logging.GlobalProtect.EndpointGPVersion | unknown | GlobalProtect client version number. | 
+| CDL.Logging.GlobalProtect.EndpointOSType | unknown | OS type of the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EndpointOSVersion | unknown | OS version of the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EndpointSN | unknown | ID that uniquely identifies the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EventID | unknown | The name of the event. | 
+| CDL.Logging.GlobalProtect.Gateway | unknown | Gateway for the connection. | 
+| CDL.Logging.GlobalProtect.GatewayPriority | unknown | Priority of gateway. | 
+| CDL.Logging.GlobalProtect.GatewaySelectionType | unknown | Gateway Selection Method i.e automatic, preferred or manual. | 
+| CDL.Logging.GlobalProtect.GPGatewayLocation | unknown | Location of the Global Protect Gateway. | 
+| CDL.Logging.GlobalProtect.HostID | unknown | Unique identifier GlobalProtect has assigned to the host. | 
+| CDL.Logging.GlobalProtect.IsDuplicateLog | unknown | Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector. | 
+| CDL.Logging.GlobalProtect.IsExported | unknown | Indicates if this log was exported from the firewall using the firewall's log export function. | 
+| CDL.Logging.GlobalProtect.IsForwarded | unknown | Internal-use field that indicates if the log is being forwarded. | 
+| CDL.Logging.GlobalProtect.IsPrismaBranch | unknown | Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise. | 
+| CDL.Logging.GlobalProtect.IsPrismaMobile | unknown | Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise. | 
+| CDL.Logging.GlobalProtect.LogSource | unknown | Identifies the origin of the data. | 
+| CDL.Logging.GlobalProtect.LogSourceID | unknown | ID that uniquely identifies the source of the log. | 
+| CDL.Logging.GlobalProtect.LogSourceName | unknown | Name of the source of the log. | 
+| CDL.Logging.GlobalProtect.LogTime | unknown | Time the log was received in Strata Logging Service XSOAR Connector. | 
+| CDL.Logging.GlobalProtect.LogType | unknown | Identifies the log type. | 
+| CDL.Logging.GlobalProtect.LoginDuration | unknown | Duration for which the connected user was logged on. | 
+| CDL.Logging.GlobalProtect.Opaque | unknown | Additional information regarding the event. | 
+| CDL.Logging.GlobalProtect.PanoramaSN | unknown | Panorama Serial associated with CDL. | 
+| CDL.Logging.GlobalProtect.PlatformType | unknown | The platform type. | 
+| CDL.Logging.GlobalProtect.Portal | unknown | Global Protect Portal or Gateway that the user connected to. | 
path: Packs/CortexDataLake/Integrations/CortexDataLake/README.md
user: login: ShirleyDenkberg
body: ```suggestion
| CDL.Logging.GlobalProtect.Portal | unknown | GlobalProtect portal or gateway that the user connected to. | 
```
created_at: 2025-04-01T07:57:45Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1320,3 +1320,155 @@ against. That is, log types must be fully qualified and the instance ID is a par
 However in this integration the instance ID is added automatically to the query so the name `firewall.traffic` is a valid table name
 * The SQL syntax supported for queries is `csql`
 * The provided authentication items ([configuration step 4](#configure-cortex-data-lake-on-cortex-xsoar)) can only be used once for each Strata Logging Service XSOAR Connector tenant (but can be shared for different Cortex XSOAR instances). Trying to re-generate those items will revoke any previously generated set of authentication items.
+
+### cdl-query-gp-logs
+***
+Searches the GlobalProtect VPN log table.
+
+#### Base Command
+
+`cdl-query-gp-logs`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| limit | The maximum number of logs to return. Default is 10. Default is 10. | Optional | 
+| page | Page to return. | Optional | 
+| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional | 
+| transform_results | If set to false, query results are not mapped into the standard command context. Default is "true". Possible values are: true, false. Default is true. | Optional | 
+| fields | The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all". Default is all. | Optional | 
+| end_time | The query end time. For example, end_time="2018-04-26 00:00:00". | Optional | 
+| start_time | The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00. Default is '1970-01-01 00:00:00'. | Optional | 
+| time_range | First log time (&lt;number&gt; &lt;time unit&gt;. For example, 12 minutes, 7 days, 3 weeks). | Optional | 
+| event_name | Event name for which to search. | Optional | 
+| gateway | GlobalProtect gateway for which to search. | Optional | 
+| private_ipv4 | Private IP address (v4) of the user that connected for which to search. | Optional | 
+| private_ipv6 | Private IP address (v6) of the user that connected for which to search. | Optional | 
+| public_ipv4 | Public IP address (v4) of the user that connected for which to search. | Optional | 
+| public_ipv6 | Public IP address (v6) of the user that connected for which to search. | Optional | 
+| source_user | The source username for which to search. | Optional | 
+| event_status | Event status (success or failure) for which to search. | Optional | 
+| portal | GlobalProtect portal for which to search. | Optional | 
+
+#### Context Output
+
+| **Path** | **Type** | **Description** |
+| --- | --- | --- |
+| CDL.Logging.GlobalProtect.AttemptedGateways | unknown | All gateways that were available and attempted for the client location. | 
+| CDL.Logging.GlobalProtect.AuthMethod | unknown | Authentication method used for the GlobalProtect connection. | 
+| CDL.Logging.GlobalProtect.ConnectMethod | unknown | Identifies how the GlobalProtect app connected to the the Gateway. | 
+| CDL.Logging.GlobalProtect.ConnectionErrorID | unknown | Enumeration integer assigned to the connection_error field value. | 
+| CDL.Logging.GlobalProtect.ConnectionErrorValue | unknown | Error information for unsuccessful connection. | 
+| CDL.Logging.GlobalProtect.CountOfRepeats | unknown | Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval. | 
+| CDL.Logging.GlobalProtect.CustomerID | unknown | The ID that uniquely identifies the Cortex Data Lake instance which received this log record. | 
+| CDL.Logging.GlobalProtect.EndpointDeviceName | unknown | Name of the device that the user used for the connection. | 
+| CDL.Logging.GlobalProtect.EndpointGPVersion | unknown | GlobalProtect client version number. | 
+| CDL.Logging.GlobalProtect.EndpointOSType | unknown | OS type of the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EndpointOSVersion | unknown | OS version of the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EndpointSN | unknown | ID that uniquely identifies the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EventID | unknown | The name of the event. | 
+| CDL.Logging.GlobalProtect.Gateway | unknown | Gateway for the connection. | 
+| CDL.Logging.GlobalProtect.GatewayPriority | unknown | Priority of gateway. | 
+| CDL.Logging.GlobalProtect.GatewaySelectionType | unknown | Gateway Selection Method i.e automatic, preferred or manual. | 
+| CDL.Logging.GlobalProtect.GPGatewayLocation | unknown | Location of the Global Protect Gateway. | 
+| CDL.Logging.GlobalProtect.HostID | unknown | Unique identifier GlobalProtect has assigned to the host. | 
+| CDL.Logging.GlobalProtect.IsDuplicateLog | unknown | Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector. | 
+| CDL.Logging.GlobalProtect.IsExported | unknown | Indicates if this log was exported from the firewall using the firewall's log export function. | 
+| CDL.Logging.GlobalProtect.IsForwarded | unknown | Internal-use field that indicates if the log is being forwarded. | 
+| CDL.Logging.GlobalProtect.IsPrismaBranch | unknown | Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise. | 
+| CDL.Logging.GlobalProtect.IsPrismaMobile | unknown | Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise. | 
+| CDL.Logging.GlobalProtect.LogSource | unknown | Identifies the origin of the data. | 
+| CDL.Logging.GlobalProtect.LogSourceID | unknown | ID that uniquely identifies the source of the log. | 
+| CDL.Logging.GlobalProtect.LogSourceName | unknown | Name of the source of the log. | 
+| CDL.Logging.GlobalProtect.LogTime | unknown | Time the log was received in Strata Logging Service XSOAR Connector. | 
+| CDL.Logging.GlobalProtect.LogType | unknown | Identifies the log type. | 
+| CDL.Logging.GlobalProtect.LoginDuration | unknown | Duration for which the connected user was logged on. | 
+| CDL.Logging.GlobalProtect.Opaque | unknown | Additional information regarding the event. | 
+| CDL.Logging.GlobalProtect.PanoramaSN | unknown | Panorama Serial associated with CDL. | 
+| CDL.Logging.GlobalProtect.PlatformType | unknown | The platform type. | 
+| CDL.Logging.GlobalProtect.Portal | unknown | Global Protect Portal or Gateway that the user connected to. | 
+| CDL.Logging.GlobalProtect.PrivateIPv4 | unknown | Private IP address \(v4\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.PrivateIPv6 | unknown | Private IP address \(v6\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.ProjectName | unknown | Project name. | 
+| CDL.Logging.GlobalProtect.PublicIPv4 | unknown | Public IP address \(v4\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.PublicIPv6 | unknown | Public IP address \(v6\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.QuarantineReason | unknown | Quarantine reason. | 
+| CDL.Logging.GlobalProtect.SequenceNo | unknown | The log entry identifier, which is incremented sequentially. | 
+| CDL.Logging.GlobalProtect.SourceRegion | unknown | Region of the Gateway \(or User\) that connected. | 
path: Packs/CortexDataLake/Integrations/CortexDataLake/README.md
user: login: ShirleyDenkberg
body: ```suggestion
| CDL.Logging.GlobalProtect.SourceRegion | unknown | Region of the gateway \(or user\) that connected. | 
```
created_at: 2025-04-01T07:58:03Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1320,3 +1320,155 @@ against. That is, log types must be fully qualified and the instance ID is a par
 However in this integration the instance ID is added automatically to the query so the name `firewall.traffic` is a valid table name
 * The SQL syntax supported for queries is `csql`
 * The provided authentication items ([configuration step 4](#configure-cortex-data-lake-on-cortex-xsoar)) can only be used once for each Strata Logging Service XSOAR Connector tenant (but can be shared for different Cortex XSOAR instances). Trying to re-generate those items will revoke any previously generated set of authentication items.
+
+### cdl-query-gp-logs
+***
+Searches the GlobalProtect VPN log table.
+
+#### Base Command
+
+`cdl-query-gp-logs`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| limit | The maximum number of logs to return. Default is 10. Default is 10. | Optional | 
+| page | Page to return. | Optional | 
+| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional | 
+| transform_results | If set to false, query results are not mapped into the standard command context. Default is "true". Possible values are: true, false. Default is true. | Optional | 
+| fields | The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all". Default is all. | Optional | 
+| end_time | The query end time. For example, end_time="2018-04-26 00:00:00". | Optional | 
+| start_time | The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00. Default is '1970-01-01 00:00:00'. | Optional | 
+| time_range | First log time (&lt;number&gt; &lt;time unit&gt;. For example, 12 minutes, 7 days, 3 weeks). | Optional | 
+| event_name | Event name for which to search. | Optional | 
+| gateway | GlobalProtect gateway for which to search. | Optional | 
+| private_ipv4 | Private IP address (v4) of the user that connected for which to search. | Optional | 
+| private_ipv6 | Private IP address (v6) of the user that connected for which to search. | Optional | 
+| public_ipv4 | Public IP address (v4) of the user that connected for which to search. | Optional | 
+| public_ipv6 | Public IP address (v6) of the user that connected for which to search. | Optional | 
+| source_user | The source username for which to search. | Optional | 
+| event_status | Event status (success or failure) for which to search. | Optional | 
+| portal | GlobalProtect portal for which to search. | Optional | 
+
+#### Context Output
+
+| **Path** | **Type** | **Description** |
+| --- | --- | --- |
+| CDL.Logging.GlobalProtect.AttemptedGateways | unknown | All gateways that were available and attempted for the client location. | 
+| CDL.Logging.GlobalProtect.AuthMethod | unknown | Authentication method used for the GlobalProtect connection. | 
+| CDL.Logging.GlobalProtect.ConnectMethod | unknown | Identifies how the GlobalProtect app connected to the the Gateway. | 
+| CDL.Logging.GlobalProtect.ConnectionErrorID | unknown | Enumeration integer assigned to the connection_error field value. | 
+| CDL.Logging.GlobalProtect.ConnectionErrorValue | unknown | Error information for unsuccessful connection. | 
+| CDL.Logging.GlobalProtect.CountOfRepeats | unknown | Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval. | 
+| CDL.Logging.GlobalProtect.CustomerID | unknown | The ID that uniquely identifies the Cortex Data Lake instance which received this log record. | 
+| CDL.Logging.GlobalProtect.EndpointDeviceName | unknown | Name of the device that the user used for the connection. | 
+| CDL.Logging.GlobalProtect.EndpointGPVersion | unknown | GlobalProtect client version number. | 
+| CDL.Logging.GlobalProtect.EndpointOSType | unknown | OS type of the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EndpointOSVersion | unknown | OS version of the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EndpointSN | unknown | ID that uniquely identifies the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EventID | unknown | The name of the event. | 
+| CDL.Logging.GlobalProtect.Gateway | unknown | Gateway for the connection. | 
+| CDL.Logging.GlobalProtect.GatewayPriority | unknown | Priority of gateway. | 
+| CDL.Logging.GlobalProtect.GatewaySelectionType | unknown | Gateway Selection Method i.e automatic, preferred or manual. | 
+| CDL.Logging.GlobalProtect.GPGatewayLocation | unknown | Location of the Global Protect Gateway. | 
+| CDL.Logging.GlobalProtect.HostID | unknown | Unique identifier GlobalProtect has assigned to the host. | 
+| CDL.Logging.GlobalProtect.IsDuplicateLog | unknown | Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector. | 
+| CDL.Logging.GlobalProtect.IsExported | unknown | Indicates if this log was exported from the firewall using the firewall's log export function. | 
+| CDL.Logging.GlobalProtect.IsForwarded | unknown | Internal-use field that indicates if the log is being forwarded. | 
+| CDL.Logging.GlobalProtect.IsPrismaBranch | unknown | Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise. | 
+| CDL.Logging.GlobalProtect.IsPrismaMobile | unknown | Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise. | 
+| CDL.Logging.GlobalProtect.LogSource | unknown | Identifies the origin of the data. | 
+| CDL.Logging.GlobalProtect.LogSourceID | unknown | ID that uniquely identifies the source of the log. | 
+| CDL.Logging.GlobalProtect.LogSourceName | unknown | Name of the source of the log. | 
+| CDL.Logging.GlobalProtect.LogTime | unknown | Time the log was received in Strata Logging Service XSOAR Connector. | 
+| CDL.Logging.GlobalProtect.LogType | unknown | Identifies the log type. | 
+| CDL.Logging.GlobalProtect.LoginDuration | unknown | Duration for which the connected user was logged on. | 
+| CDL.Logging.GlobalProtect.Opaque | unknown | Additional information regarding the event. | 
+| CDL.Logging.GlobalProtect.PanoramaSN | unknown | Panorama Serial associated with CDL. | 
+| CDL.Logging.GlobalProtect.PlatformType | unknown | The platform type. | 
+| CDL.Logging.GlobalProtect.Portal | unknown | Global Protect Portal or Gateway that the user connected to. | 
+| CDL.Logging.GlobalProtect.PrivateIPv4 | unknown | Private IP address \(v4\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.PrivateIPv6 | unknown | Private IP address \(v6\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.ProjectName | unknown | Project name. | 
+| CDL.Logging.GlobalProtect.PublicIPv4 | unknown | Public IP address \(v4\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.PublicIPv6 | unknown | Public IP address \(v6\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.QuarantineReason | unknown | Quarantine reason. | 
+| CDL.Logging.GlobalProtect.SequenceNo | unknown | The log entry identifier, which is incremented sequentially. | 
+| CDL.Logging.GlobalProtect.SourceRegion | unknown | Region of the Gateway \(or User\) that connected. | 
+| CDL.Logging.GlobalProtect.SourceUser | unknown | The username that connected. | 
+| CDL.Logging.GlobalProtect.SourceUserDomain | unknown | Domain to which the Source User belongs. | 
path: Packs/CortexDataLake/Integrations/CortexDataLake/README.md
user: login: ShirleyDenkberg
body: ```suggestion
| CDL.Logging.GlobalProtect.SourceUserDomain | unknown | Domain to which the source user belongs. | 
```
created_at: 2025-04-01T07:59:03Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1320,3 +1320,155 @@ against. That is, log types must be fully qualified and the instance ID is a par
 However in this integration the instance ID is added automatically to the query so the name `firewall.traffic` is a valid table name
 * The SQL syntax supported for queries is `csql`
 * The provided authentication items ([configuration step 4](#configure-cortex-data-lake-on-cortex-xsoar)) can only be used once for each Strata Logging Service XSOAR Connector tenant (but can be shared for different Cortex XSOAR instances). Trying to re-generate those items will revoke any previously generated set of authentication items.
+
+### cdl-query-gp-logs
+***
+Searches the GlobalProtect VPN log table.
+
+#### Base Command
+
+`cdl-query-gp-logs`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| limit | The maximum number of logs to return. Default is 10. Default is 10. | Optional | 
+| page | Page to return. | Optional | 
+| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional | 
+| transform_results | If set to false, query results are not mapped into the standard command context. Default is "true". Possible values are: true, false. Default is true. | Optional | 
+| fields | The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all". Default is all. | Optional | 
+| end_time | The query end time. For example, end_time="2018-04-26 00:00:00". | Optional | 
+| start_time | The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00. Default is '1970-01-01 00:00:00'. | Optional | 
+| time_range | First log time (&lt;number&gt; &lt;time unit&gt;. For example, 12 minutes, 7 days, 3 weeks). | Optional | 
+| event_name | Event name for which to search. | Optional | 
+| gateway | GlobalProtect gateway for which to search. | Optional | 
+| private_ipv4 | Private IP address (v4) of the user that connected for which to search. | Optional | 
+| private_ipv6 | Private IP address (v6) of the user that connected for which to search. | Optional | 
+| public_ipv4 | Public IP address (v4) of the user that connected for which to search. | Optional | 
+| public_ipv6 | Public IP address (v6) of the user that connected for which to search. | Optional | 
+| source_user | The source username for which to search. | Optional | 
+| event_status | Event status (success or failure) for which to search. | Optional | 
+| portal | GlobalProtect portal for which to search. | Optional | 
+
+#### Context Output
+
+| **Path** | **Type** | **Description** |
+| --- | --- | --- |
+| CDL.Logging.GlobalProtect.AttemptedGateways | unknown | All gateways that were available and attempted for the client location. | 
+| CDL.Logging.GlobalProtect.AuthMethod | unknown | Authentication method used for the GlobalProtect connection. | 
+| CDL.Logging.GlobalProtect.ConnectMethod | unknown | Identifies how the GlobalProtect app connected to the the Gateway. | 
+| CDL.Logging.GlobalProtect.ConnectionErrorID | unknown | Enumeration integer assigned to the connection_error field value. | 
+| CDL.Logging.GlobalProtect.ConnectionErrorValue | unknown | Error information for unsuccessful connection. | 
+| CDL.Logging.GlobalProtect.CountOfRepeats | unknown | Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval. | 
+| CDL.Logging.GlobalProtect.CustomerID | unknown | The ID that uniquely identifies the Cortex Data Lake instance which received this log record. | 
+| CDL.Logging.GlobalProtect.EndpointDeviceName | unknown | Name of the device that the user used for the connection. | 
+| CDL.Logging.GlobalProtect.EndpointGPVersion | unknown | GlobalProtect client version number. | 
+| CDL.Logging.GlobalProtect.EndpointOSType | unknown | OS type of the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EndpointOSVersion | unknown | OS version of the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EndpointSN | unknown | ID that uniquely identifies the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EventID | unknown | The name of the event. | 
+| CDL.Logging.GlobalProtect.Gateway | unknown | Gateway for the connection. | 
+| CDL.Logging.GlobalProtect.GatewayPriority | unknown | Priority of gateway. | 
+| CDL.Logging.GlobalProtect.GatewaySelectionType | unknown | Gateway Selection Method i.e automatic, preferred or manual. | 
+| CDL.Logging.GlobalProtect.GPGatewayLocation | unknown | Location of the Global Protect Gateway. | 
+| CDL.Logging.GlobalProtect.HostID | unknown | Unique identifier GlobalProtect has assigned to the host. | 
+| CDL.Logging.GlobalProtect.IsDuplicateLog | unknown | Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector. | 
+| CDL.Logging.GlobalProtect.IsExported | unknown | Indicates if this log was exported from the firewall using the firewall's log export function. | 
+| CDL.Logging.GlobalProtect.IsForwarded | unknown | Internal-use field that indicates if the log is being forwarded. | 
+| CDL.Logging.GlobalProtect.IsPrismaBranch | unknown | Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise. | 
+| CDL.Logging.GlobalProtect.IsPrismaMobile | unknown | Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise. | 
+| CDL.Logging.GlobalProtect.LogSource | unknown | Identifies the origin of the data. | 
+| CDL.Logging.GlobalProtect.LogSourceID | unknown | ID that uniquely identifies the source of the log. | 
+| CDL.Logging.GlobalProtect.LogSourceName | unknown | Name of the source of the log. | 
+| CDL.Logging.GlobalProtect.LogTime | unknown | Time the log was received in Strata Logging Service XSOAR Connector. | 
+| CDL.Logging.GlobalProtect.LogType | unknown | Identifies the log type. | 
+| CDL.Logging.GlobalProtect.LoginDuration | unknown | Duration for which the connected user was logged on. | 
+| CDL.Logging.GlobalProtect.Opaque | unknown | Additional information regarding the event. | 
+| CDL.Logging.GlobalProtect.PanoramaSN | unknown | Panorama Serial associated with CDL. | 
+| CDL.Logging.GlobalProtect.PlatformType | unknown | The platform type. | 
+| CDL.Logging.GlobalProtect.Portal | unknown | Global Protect Portal or Gateway that the user connected to. | 
+| CDL.Logging.GlobalProtect.PrivateIPv4 | unknown | Private IP address \(v4\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.PrivateIPv6 | unknown | Private IP address \(v6\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.ProjectName | unknown | Project name. | 
+| CDL.Logging.GlobalProtect.PublicIPv4 | unknown | Public IP address \(v4\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.PublicIPv6 | unknown | Public IP address \(v6\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.QuarantineReason | unknown | Quarantine reason. | 
+| CDL.Logging.GlobalProtect.SequenceNo | unknown | The log entry identifier, which is incremented sequentially. | 
+| CDL.Logging.GlobalProtect.SourceRegion | unknown | Region of the Gateway \(or User\) that connected. | 
+| CDL.Logging.GlobalProtect.SourceUser | unknown | The username that connected. | 
+| CDL.Logging.GlobalProtect.SourceUserDomain | unknown | Domain to which the Source User belongs. | 
+| CDL.Logging.GlobalProtect.SourceUserName | unknown | The Source User username. | 
+| CDL.Logging.GlobalProtect.SourceUserUUID | unknown | Unique identifier assigned to the Source User. | 
+| CDL.Logging.GlobalProtect.SSLResponseTime | unknown | SSL Response Time in milliseconds. | 
path: Packs/CortexDataLake/Integrations/CortexDataLake/README.md
user: login: ShirleyDenkberg
body: ```suggestion
| CDL.Logging.GlobalProtect.SourceUserName | unknown | The source user username. | 
| CDL.Logging.GlobalProtect.SourceUserUUID | unknown | Unique identifier assigned to the source user. | 
| CDL.Logging.GlobalProtect.SSLResponseTime | unknown | SSL response time in milliseconds. | 
```
created_at: 2025-04-01T07:59:06Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1320,3 +1320,155 @@ against. That is, log types must be fully qualified and the instance ID is a par
 However in this integration the instance ID is added automatically to the query so the name `firewall.traffic` is a valid table name
 * The SQL syntax supported for queries is `csql`
 * The provided authentication items ([configuration step 4](#configure-cortex-data-lake-on-cortex-xsoar)) can only be used once for each Strata Logging Service XSOAR Connector tenant (but can be shared for different Cortex XSOAR instances). Trying to re-generate those items will revoke any previously generated set of authentication items.
+
+### cdl-query-gp-logs
+***
+Searches the GlobalProtect VPN log table.
+
+#### Base Command
+
+`cdl-query-gp-logs`
+
+#### Input
+
+| **Argument Name** | **Description** | **Required** |
+| --- | --- | --- |
+| limit | The maximum number of logs to return. Default is 10. Default is 10. | Optional | 
+| page | Page to return. | Optional | 
+| page_size | Number of entries per page. Defaults to 50 (in case only page was provided). | Optional | 
+| transform_results | If set to false, query results are not mapped into the standard command context. Default is "true". Possible values are: true, false. Default is true. | Optional | 
+| fields | The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all". Default is all. | Optional | 
+| end_time | The query end time. For example, end_time="2018-04-26 00:00:00". | Optional | 
+| start_time | The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00. Default is '1970-01-01 00:00:00'. | Optional | 
+| time_range | First log time (&lt;number&gt; &lt;time unit&gt;. For example, 12 minutes, 7 days, 3 weeks). | Optional | 
+| event_name | Event name for which to search. | Optional | 
+| gateway | GlobalProtect gateway for which to search. | Optional | 
+| private_ipv4 | Private IP address (v4) of the user that connected for which to search. | Optional | 
+| private_ipv6 | Private IP address (v6) of the user that connected for which to search. | Optional | 
+| public_ipv4 | Public IP address (v4) of the user that connected for which to search. | Optional | 
+| public_ipv6 | Public IP address (v6) of the user that connected for which to search. | Optional | 
+| source_user | The source username for which to search. | Optional | 
+| event_status | Event status (success or failure) for which to search. | Optional | 
+| portal | GlobalProtect portal for which to search. | Optional | 
+
+#### Context Output
+
+| **Path** | **Type** | **Description** |
+| --- | --- | --- |
+| CDL.Logging.GlobalProtect.AttemptedGateways | unknown | All gateways that were available and attempted for the client location. | 
+| CDL.Logging.GlobalProtect.AuthMethod | unknown | Authentication method used for the GlobalProtect connection. | 
+| CDL.Logging.GlobalProtect.ConnectMethod | unknown | Identifies how the GlobalProtect app connected to the the Gateway. | 
+| CDL.Logging.GlobalProtect.ConnectionErrorID | unknown | Enumeration integer assigned to the connection_error field value. | 
+| CDL.Logging.GlobalProtect.ConnectionErrorValue | unknown | Error information for unsuccessful connection. | 
+| CDL.Logging.GlobalProtect.CountOfRepeats | unknown | Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval. | 
+| CDL.Logging.GlobalProtect.CustomerID | unknown | The ID that uniquely identifies the Cortex Data Lake instance which received this log record. | 
+| CDL.Logging.GlobalProtect.EndpointDeviceName | unknown | Name of the device that the user used for the connection. | 
+| CDL.Logging.GlobalProtect.EndpointGPVersion | unknown | GlobalProtect client version number. | 
+| CDL.Logging.GlobalProtect.EndpointOSType | unknown | OS type of the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EndpointOSVersion | unknown | OS version of the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EndpointSN | unknown | ID that uniquely identifies the endpoint on which the GlobalProtect client is deployed. | 
+| CDL.Logging.GlobalProtect.EventID | unknown | The name of the event. | 
+| CDL.Logging.GlobalProtect.Gateway | unknown | Gateway for the connection. | 
+| CDL.Logging.GlobalProtect.GatewayPriority | unknown | Priority of gateway. | 
+| CDL.Logging.GlobalProtect.GatewaySelectionType | unknown | Gateway Selection Method i.e automatic, preferred or manual. | 
+| CDL.Logging.GlobalProtect.GPGatewayLocation | unknown | Location of the Global Protect Gateway. | 
+| CDL.Logging.GlobalProtect.HostID | unknown | Unique identifier GlobalProtect has assigned to the host. | 
+| CDL.Logging.GlobalProtect.IsDuplicateLog | unknown | Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector. | 
+| CDL.Logging.GlobalProtect.IsExported | unknown | Indicates if this log was exported from the firewall using the firewall's log export function. | 
+| CDL.Logging.GlobalProtect.IsForwarded | unknown | Internal-use field that indicates if the log is being forwarded. | 
+| CDL.Logging.GlobalProtect.IsPrismaBranch | unknown | Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise. | 
+| CDL.Logging.GlobalProtect.IsPrismaMobile | unknown | Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise. | 
+| CDL.Logging.GlobalProtect.LogSource | unknown | Identifies the origin of the data. | 
+| CDL.Logging.GlobalProtect.LogSourceID | unknown | ID that uniquely identifies the source of the log. | 
+| CDL.Logging.GlobalProtect.LogSourceName | unknown | Name of the source of the log. | 
+| CDL.Logging.GlobalProtect.LogTime | unknown | Time the log was received in Strata Logging Service XSOAR Connector. | 
+| CDL.Logging.GlobalProtect.LogType | unknown | Identifies the log type. | 
+| CDL.Logging.GlobalProtect.LoginDuration | unknown | Duration for which the connected user was logged on. | 
+| CDL.Logging.GlobalProtect.Opaque | unknown | Additional information regarding the event. | 
+| CDL.Logging.GlobalProtect.PanoramaSN | unknown | Panorama Serial associated with CDL. | 
+| CDL.Logging.GlobalProtect.PlatformType | unknown | The platform type. | 
+| CDL.Logging.GlobalProtect.Portal | unknown | Global Protect Portal or Gateway that the user connected to. | 
+| CDL.Logging.GlobalProtect.PrivateIPv4 | unknown | Private IP address \(v4\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.PrivateIPv6 | unknown | Private IP address \(v6\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.ProjectName | unknown | Project name. | 
+| CDL.Logging.GlobalProtect.PublicIPv4 | unknown | Public IP address \(v4\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.PublicIPv6 | unknown | Public IP address \(v6\) of the user that connected. | 
+| CDL.Logging.GlobalProtect.QuarantineReason | unknown | Quarantine reason. | 
+| CDL.Logging.GlobalProtect.SequenceNo | unknown | The log entry identifier, which is incremented sequentially. | 
+| CDL.Logging.GlobalProtect.SourceRegion | unknown | Region of the Gateway \(or User\) that connected. | 
+| CDL.Logging.GlobalProtect.SourceUser | unknown | The username that connected. | 
+| CDL.Logging.GlobalProtect.SourceUserDomain | unknown | Domain to which the Source User belongs. | 
+| CDL.Logging.GlobalProtect.SourceUserName | unknown | The Source User username. | 
+| CDL.Logging.GlobalProtect.SourceUserUUID | unknown | Unique identifier assigned to the Source User. | 
+| CDL.Logging.GlobalProtect.SSLResponseTime | unknown | SSL Response Time in milliseconds. | 
+| CDL.Logging.GlobalProtect.Stage | unknown | Name of the stage in the GlobalProtect connection workflow. | 
+| CDL.Logging.GlobalProtect.EventStatus | unknown | The status \(success or failure\) of the event. | 
+| CDL.Logging.GlobalProtect.Subtype | unknown | The log subtype. | 
+| CDL.Logging.GlobalProtect.TimeGenerated | unknown | Time when the log was generated on the firewall's data plane. | 
+| CDL.Logging.GlobalProtect.TunnelType | unknown | Tunnel Type i.e. SSL or VPN. | 
path: Packs/CortexDataLake/Integrations/CortexDataLake/README.md
user: login: ShirleyDenkberg
body: ```suggestion
| CDL.Logging.GlobalProtect.TunnelType | unknown | Tunnel type i.e., SSL or VPN. | 
```
created_at: 2025-04-01T07:59:24Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,7 @@
+
+#### Integrations
+
+##### Strata Logging Service XSOAR Connector
+
+- Added a new command **cdl-query-gp-logs** to query GlobalProtect VPN logs.
path: Packs/CortexDataLake/ReleaseNotes/1_4_18.md
user: login: ShirleyDenkberg
body: ```suggestion
- Added the command ***cdl-query-gp-logs*** command to query GlobalProtect VPN logs.
```
created_at: 2025-04-01T08:00:05Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2088,7 +2046,151 @@ script:
       type: String
   - description: Use this command in case your authentication calls fail due to internal call-limit, the command will reset the limit cache.
     name: cdl-reset-authentication-timeout
-  dockerimage: demisto/python_pancloud_v2:1.0.0.117311
+    arguments: []
+  - arguments:
+    - defaultValue: "10"
+      description: The maximum number of logs to return. Default is 10.
+      name: limit
+    - description: Page to return.
+      name: page
+    - description: Number of entries per page. Defaults to 50 (in case only page was provided).
+      name: page_size
+    - auto: PREDEFINED
+      defaultValue: "true"
+      description: If set to false, query results are not mapped into the standard command context. Default is "true".
+      name: transform_results
+      predefined:
+      - "true"
+      - "false"
+    - defaultValue: all
+      description: The fields selected in the query. Selection can be "all" (same as *) or a comma-separated list of specific fields. The list of fields can be found after viewing all the outputted fields with "all".
+      name: fields
+    - description: The query end time. For example, end_time="2018-04-26 00:00:00".
+      name: end_time
+    - defaultValue: '''1970-01-01 00:00:00'''
+      description: The query start time. For example, start_time="2018-04-26 00:00:00". Default is 1970-01-01 00:00:00.
+      name: start_time
+    - description: First log time (<number> <time unit>. For example, 12 minutes, 7 days, 3 weeks).
+      name: time_range
+    - description: Event name for which to search.
+      name: event_name
+    - description: GlobalProtect gateway for which to search.
+      name: gateway
+    - description: Private IP address (v4) of the user that connected for which to search.
+      name: private_ipv4
+    - description: Private IP address (v6) of the user that connected for which to search.
+      name: private_ipv6
+    - description: Public IP address (v4) of the user that connected for which to search.
+      name: public_ipv4
+    - description: Public IP address (v6) of the user that connected for which to search.
+      name: public_ipv6
+    - description: The source username for which to search.
+      name: source_user
+    - description: Event status (success or failure) for which to search.
+      name: event_status
+    - description: GlobalProtect portal for which to search.
+      name: portal
+    - description: Name of the stage in the GlobalProtect connection workflow for
+        which to search.
+      name: stage
+    description: Searches the GlobalProtect VPN log table.
+    name: cdl-query-gp-logs
+    outputs:
+    - contextPath: CDL.Logging.GlobalProtect.AttemptedGateways
+      description: All gateways that were available and attempted for the client location.
+    - contextPath: CDL.Logging.GlobalProtect.AuthMethod
+      description: Authentication method used for the GlobalProtect connection.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorID
+      description: Enumeration integer assigned to the connection_error field value.
+    - contextPath: CDL.Logging.GlobalProtect.ConnectionErrorValue
+      description: Error information for unsuccessful connection.
+    - contextPath: CDL.Logging.GlobalProtect.CountOfRepeats
+      description: Number of sessions with same Source IP, Destination IP, Application, and Content/Threat Type seen for the summary interval.
+    - contextPath: CDL.Logging.GlobalProtect.CustomerID
+      description: The ID that uniquely identifies the Cortex Data Lake instance which received this log record.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointDeviceName
+      description: Name of the device that the user used for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointGPVersion
+      description: GlobalProtect client version number.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSType
+      description: OS type of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EndpointOSVersion
+      description: OS version of the endpoint on which the GlobalProtect client is deployed.
+    - contextPath: CDL.Logging.GlobalProtect.EventID
+      description: The name of the event.
+    - contextPath: CDL.Logging.GlobalProtect.Gateway
+      description: Gateway for the connection.
+    - contextPath: CDL.Logging.GlobalProtect.GatewayPriority
+      description: Priority of gateway.
+    - contextPath: CDL.Logging.GlobalProtect.GatewaySelectionType
+      description: Gateway Selection Method i.e automatic, preferred or manual.
+    - contextPath: CDL.Logging.GlobalProtect.HostID
+      description: Unique identifier GlobalProtect has assigned to the host.
+    - contextPath: CDL.Logging.GlobalProtect.IsDuplicateLog
+      description: Indicates whether this log data is available in multiple locations, such as from Strata Logging Service as well as from an on-premise log collector.
+    - contextPath: CDL.Logging.GlobalProtect.IsExported
+      description: Indicates if this log was exported from the firewall using the firewall's log export function.
+    - contextPath: CDL.Logging.GlobalProtect.IsForwarded
+      description: Internal-use field that indicates if the log is being forwarded.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaBranch
+      description: Internal-use field. If set to 1, the log was generated on a cloud-based firewall. If 0, the firewall was running on-premise.
+    - contextPath: CDL.Logging.GlobalProtect.IsPrismaMobile
+      description: Internal use field. If set to 1, the log record was generated using a cloud-based GlobalProtect instance. If 0, GlobalProtect was hosted on-premise.
+    - contextPath: CDL.Logging.GlobalProtect.LogSource
+      description: Identifies the origin of the data.
+    - contextPath: CDL.Logging.GlobalProtect.LogSourceID
+      description: ID that uniquely identifies the source of the log.
+    - contextPath: CDL.Logging.GlobalProtect.LogSourceName
+      description: Name of the source of the log.
+    - contextPath: CDL.Logging.GlobalProtect.LogTime
+      description: Time the log was received in Strata Logging Service XSOAR Connector.
+    - contextPath: CDL.Logging.GlobalProtect.LogType
+      description: Identifies the log type.
+    - contextPath: CDL.Logging.GlobalProtect.LoginDuration
+      description: Duration for which the connected user was logged on.
+    - contextPath: CDL.Logging.GlobalProtect.Opaque
+      description: Additional information regarding the event.
+    - contextPath: CDL.Logging.GlobalProtect.PlatformType
+      description: The platform type.
+    - contextPath: CDL.Logging.GlobalProtect.Portal
+      description: Global Protect Portal or Gateway that the user connected to.
+    - contextPath: CDL.Logging.GlobalProtect.PrivateIPv4
+      description: Private IP address (v4) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.PrivateIPv6
+      description: Private IP address (v6) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.ProjectName
+      description: Project name.
+    - contextPath: CDL.Logging.GlobalProtect.PublicIPv4
+      description: Public IP address (v4) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.PublicIPv6
+      description: Public IP address (v6) of the user that connected.
+    - contextPath: CDL.Logging.GlobalProtect.QuarantineReason
+      description: Quarantine reason.
+    - contextPath: CDL.Logging.GlobalProtect.SequenceNo
+      description: The log entry identifier, which is incremented sequentially.
+    - contextPath: CDL.Logging.GlobalProtect.SourceRegion
+      description: Region of the Gateway (or User) that connected.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUser
+      description: The username that connected.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUserDomain
+      description: Domain to which the Source User belongs.
+    - contextPath: CDL.Logging.GlobalProtect.SourceUserName
+      description: The Source User username.
+    - contextPath: CDL.Logging.GlobalProtect.SSLResponseTime
+      description: SSL Response Time in milliseconds.
path: Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake.yml
user: login: inbalapt1
body: > 

Hi @ali-sawyer, please apply this and all the others that you missed.
created_at: 2025-04-02T06:44:04Z
author_association: CONTRIBUTOR

PR comments:
user: login: content-bot
created_at: 2025-03-03T20:30:13Z
body: Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the [Contribution Registration](https://forms.gle/XDfxU4E61ZwEESSMA) form, so our content wizard @inbalapt1 will know the proposed changes are ready to be reviewed.
For your convenience, here is a [link](https://xsoar.pan.dev/docs/contributing/sla) to the contributions SLAs document.
author_association: CONTRIBUTOR
user: login: content-bot
created_at: 2025-03-03T20:30:15Z
body: Hi @ali-sawyer, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this [link](https://xsoar.pan.dev/docs/packs/packs-format#contributorsjson).
author_association: CONTRIBUTOR
user: login: CLAassistant
created_at: 2025-03-04T17:58:30Z
body: [![CLA assistant check](https://cla-assistant.io/pull/badge/signed)](https://cla-assistant.io/demisto/content?pullRequest=38876) <br/>All committers have signed the CLA.
author_association: NONE
user: login: ali-sawyer
created_at: 2025-03-06T20:54:46Z
body: Hi @inbalapt1, thanks for reviewing. The section stuff must've been added since the last time this integration had a substantial update. I added section settings, I did my best to follow what seems to be the convention from the other Cortex packs, but please feel free to make any changes to it.

For the example command – I have a lab SLS instance, but it does not have any GP logs in it. So I do not have a good way to run an example command and get results back. Does the content team have access to an SLS instance with GP logs? If not, I am implementing this on behalf of a customer, so I can also try to work with them to test and get example command output.
author_association: CONTRIBUTOR
user: login: inbalapt1
created_at: 2025-03-09T13:04:28Z
body: Hi @ali-sawyer 

> Hi @inbalapt1, thanks for reviewing. The section stuff must've been added since the last time this integration had a substantial update. I added section settings, I did my best to follow what seems to be the convention from the other Cortex packs, but please feel free to make any changes to it.
> 
> For the example command – I have a lab SLS instance, but it does not have any GP logs in it. So I do not have a good way to run an example command and get results back. Does the content team have access to an SLS instance with GP logs? If not, I am implementing this on behalf of a customer, so I can also try to work with them to test and get example command output.

Hi @ali-sawyer ,
Thanks for updating the code!
About the example command in the README file- you can fake the results - use the expected fields (or some of them) and give those fictive values. Please look at the format of the command-example ```!cdl-get-critical-threat-logs limit="1" time_range="10 days"``` or another command-example and use it for creating for the command-example ```!cdl-query-gp-logs time_range="10 days" limit="1"```

In addition, please rename the release notes to 1_4_17.md and update the pack_metadata-currentVersion to it. 
Moreover, please add a unittest for the query_gp_logs_command function.

Thanks!!
author_association: CONTRIBUTOR
user: login: ali-sawyer
created_at: 2025-03-11T01:49:06Z
body: @inbalapt1 Done, I added a unit test function by following the format of one of the existing ones.
author_association: CONTRIBUTOR
user: login: inbalapt1
created_at: 2025-03-11T12:53:20Z
body: Hi @ali-sawyer ,
Great work!
We're ready for a demo. Please check this page, and let me know when you're available for one over DFIR.
Alternatively, feel free to send me (to this email - [iapt@paloaltonetworks.com](mailto:iapt@paloaltonetworks.com) or over DFIR - inbal apt) or add to the PR a recording of the demo.

Additionally, please run demisto-sdk pre-commit to fix the failure.
author_association: CONTRIBUTOR
user: login: inbalapt1
created_at: 2025-03-25T09:19:17Z
body: Hi @ali-sawyer ,
Please run `demisto-sdk pre-commit` to solve the pre-commit failure.
Thanks! 
author_association: CONTRIBUTOR
user: login: content-bot
created_at: 2025-03-27T07:13:22Z
body: For the Reviewer: Trigger build request has been accepted for this contribution PR.
author_association: CONTRIBUTOR
user: login: content-bot
created_at: 2025-03-27T07:13:28Z
body: For the Reviewer: Successfully created a pipeline in GitLab with url: https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/pipelines/2991153
author_association: CONTRIBUTOR
user: login: ShirleyDenkberg
created_at: 2025-04-01T08:00:43Z
body: @inbalapt1 Doc review completed.
author_association: CONTRIBUTOR
user: login: ali-sawyer
created_at: 2025-04-02T04:31:10Z
body: @inbalapt1 Committed all changes from the doc review.
author_association: CONTRIBUTOR
user: login: content-bot
created_at: 2025-04-02T06:53:45Z
body: For the Reviewer: Trigger build request has been accepted for this contribution PR.
author_association: CONTRIBUTOR
user: login: content-bot
created_at: 2025-04-02T06:53:51Z
body: For the Reviewer: Successfully created a pipeline in GitLab with url: https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/pipelines/3035510
author_association: CONTRIBUTOR
user: login: content-bot
created_at: 2025-04-02T07:12:19Z
body: Validate summary
The following errors were thrown as a part of this pr: RN106, RM110.
The following errors can be ignored: RM110.
The following errors cannot be ignored: RN106.
The following errors don't run as part of the nightly flow and therefore can be force merged: RN106.

nVerdict: PR can be force merged from validate perspective? ❌
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-04-02T15:04:58Z
body: Thank you for your contribution. Your external PR has been merged and the changes are now included in an internal PR for further review. The internal PR will be merged to the master branch within 3 business days.
author_association: NONE