Palo Alto Networks · Schema

Device

Device schema from Palo Alto Networks IoT Security API

Cloud SecurityCybersecurityFirewallNetwork SecuritySASESOARThreat IntelligenceXDR

Properties

Name Type Description
deviceid string Unique device identifier.
ip string IPv4 address of the device.
mac string MAC address of the device.
hostname string Hostname or NetBIOS name of the device.
profile string Device profile classification (e.g., IP Camera, Infusion Pump).
category string Device category (e.g., IoT, OT, IT).
risk_score integer Aggregate risk score from 0 (lowest) to 100 (highest).
os string Detected operating system.
os_version string Detected operating system version.
vendor string Device manufacturer or vendor.
model string Device model identifier.
site string Network site where the device was discovered.
subnet string Subnet the device belongs to.
first_seen string Timestamp when the device was first discovered.
last_seen string Timestamp when the device was last active.
monitored string Whether the device is currently monitored.
confidence_score integer Confidence level of the device profile classification.
tags array User-defined or system-assigned tags.
View JSON Schema on GitHub

JSON Schema

iot-security-api-device-schema.json Raw ↑ 
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "Device",
  "description": "Device schema from Palo Alto Networks IoT Security API",
  "$id": "https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/json-schema/iot-security-api-device-schema.json",
  "type": "object",
  "properties": {
    "deviceid": {
      "type": "string",
      "description": "Unique device identifier."
    },
    "ip": {
      "type": "string",
      "format": "ipv4",
      "description": "IPv4 address of the device."
    },
    "mac": {
      "type": "string",
      "description": "MAC address of the device."
    },
    "hostname": {
      "type": "string",
      "description": "Hostname or NetBIOS name of the device."
    },
    "profile": {
      "type": "string",
      "description": "Device profile classification (e.g., IP Camera, Infusion Pump)."
    },
    "category": {
      "type": "string",
      "description": "Device category (e.g., IoT, OT, IT)."
    },
    "risk_score": {
      "type": "integer",
      "minimum": 0,
      "maximum": 100,
      "description": "Aggregate risk score from 0 (lowest) to 100 (highest)."
    },
    "os": {
      "type": "string",
      "description": "Detected operating system."
    },
    "os_version": {
      "type": "string",
      "description": "Detected operating system version."
    },
    "vendor": {
      "type": "string",
      "description": "Device manufacturer or vendor."
    },
    "model": {
      "type": "string",
      "description": "Device model identifier."
    },
    "site": {
      "type": "string",
      "description": "Network site where the device was discovered."
    },
    "subnet": {
      "type": "string",
      "description": "Subnet the device belongs to."
    },
    "first_seen": {
      "type": "string",
      "format": "date-time",
      "description": "Timestamp when the device was first discovered."
    },
    "last_seen": {
      "type": "string",
      "format": "date-time",
      "description": "Timestamp when the device was last active."
    },
    "monitored": {
      "type": "string",
      "enum": [
        "yes",
        "no"
      ],
      "description": "Whether the device is currently monitored."
    },
    "confidence_score": {
      "type": "integer",
      "description": "Confidence level of the device profile classification."
    },
    "tags": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "User-defined or system-assigned tags."
    }
  }
}