Base security events share the common fields below, plus the additional fields listed in each event subsection. Web-server access events have a different shape, they do not use these common fields and instead carry the set in the Web-server access fields table at the end.
These fields appear on Base security events.
| Field | Value | Explanation | Present when |
|---|
message | string | Human-readable summary of the event. | Always |
activity_name | string | The action the event represents (for example, Logon, Setting Change). | Always |
status | Success / Failure / Other / Unknown | Outcome of the action. | Always |
status_id | 1 / 2 / 99 / 0 | Numeric form of the status (1 Success, 2 Failure, 99 Other, 0 Unknown). | Always |
time | integer | Event time, as a Unix timestamp in milliseconds. | Always |
status_detail | string | Reason or detail for a failure. | On some failures (for example, a failed password sign-in) |
actor.user.name | string | The administrator who performed the action. | When the action is tied to an administrator session |
src_endpoint.ip | string | Source IP address of the request that triggered the event. | When the event originates from a request through the web interface |
metadata.correlation_uid | string | Correlation ID shared by all events produced by the same request. | When the event originates from a request through the web interface |
| Field | Value | Explanation | Present when |
|---|
auth_protocol | Password / Token / SAML | The sign-in method used. | Always |
auth_protocol_id | integer | Numeric form of the sign-in method. | Always |
service.name | Appliance Web | The service that was signed in to. | Always |
unmapped.identity_provider_id | string | The identity provider used. | SAML sign-ins only |
auth_protocol reflects the sign-in method, Password or SAML for a direct sign-in to the appliance, or Token when the appliance interface is opened from the product's /login interface (as on cloud-managed appliances).
| Field | Value | Explanation | Present when |
|---|
user | object | The account that was changed, in its state before the change. | Always |
user_result | object | The changed values of the account after the change. | Account Update only |
unmapped.changes | object | The specific fields that changed, with their old and new values. | Account Update only |
unmapped.user_state | object | A snapshot of the account state. | Create and Delete only |
unmapped.backup_codes_remaining | integer | The number of unused backup codes remaining. | MFA Backup Code Used only |
| Field | Value | Explanation | Present when |
|---|
tunnel_type_id | integer | Numeric form of the tunnel type. | Always |
tunnel_type | string | The tunnel type (for example, Support). | Always |
unmapped.user | object | The contact name and email entered on the support request. | New support-session requests only |
unmapped.incident | string | The incident reference entered on the support request. | New support-session requests only |
unmapped.support_code | string | The support code used to start the session. | Legacy support sessions only |
| Field | Value | Explanation | Present when |
|---|
app.name | string | Name of the update or patch. | Install and Update events (not manual uploads) |
unmapped.update_id | string | Identifier of the update. | Single-update installs |
unmapped.patches | array | Names of the patches installed. | Patch installs |
unmapped.file | object | Uploaded package name and size. | Manual package uploads |
| Field | Value | Explanation | Present when |
|---|
certificate.subject | string | The certificate subject (distinguished name). | Certificate operations on a specific certificate |
certificate.issuer | string | The certificate issuer (distinguished name). | Certificate operations on a specific certificate |
certificate.serial_number | string | The certificate serial number. | Certificate operations on a specific certificate |
certificate.expiration_time | integer | Certificate expiry, as a Unix timestamp in milliseconds. | Certificate operations on a specific certificate |
certificate.fingerprints | array | Certificate fingerprints (SHA-1 and SHA-256). | Certificate operations on a specific certificate |
common_name | string | The common name of the certificate or request. | Certificate and request creation and deletion |
acme_server | string | The ACME directory URL. | ACME-related events |
cert_hostname | string | The hostname the certificate was issued for. | ACME-related events |
exported_with_private_key | true | Indicates the private key was included in the export. | Certificate Export when the private key is included |
days_remaining | integer | Days remaining until the certificate expires. | Certificate Expiry only |
| Field | Value | Explanation | Present when |
|---|
setting.key | string | The setting that changed. | Setting Change and Update Settings Change |
setting.old_value | any | The value before the change. | Setting Change and Update Settings Change |
setting.new_value | any | The value after the change. | Setting Change and Update Settings Change |
| Field | Value | Explanation | Present when |
|---|
store_id | string | Identifier of the secret store involved. | Always |
| Field | Value | Explanation | Present when |
|---|
src_endpoint.ip | string | Source IP address of the client. | Always |
src_endpoint.port | integer | Source port of the client. | Not on all requests |
metadata.correlation_uid | string | Correlation ID shared with related events from the same request. | Always |
time | integer | Request time, as a Unix timestamp in milliseconds. | Always |
http_request.http_method | string | HTTP method (for example, GET, POST). | Always |
http_request.url.hostname | string | Requested host. | Always |
http_request.url.scheme | http / https | Request scheme. | Always |
http_request.url.path | string | Requested path. | Always |
http_request.url.query_string | string | Query string. | Always |
http_request.version | string | HTTP version. | Always |
http_request.user_agent | string | Client user agent. | Always |
http_request.referrer | string | Referring URL. | Not on all requests |
http_request.length | integer | Bytes received from the client. | Not on all requests |
http_response.code | integer | HTTP status code. | Always |
http_response.length | integer | Bytes returned to the client. | Always |
duration | integer | Request duration in milliseconds. | Always |
tls.version | string | TLS protocol version. | HTTPS requests only |
tls.cipher | string | TLS cipher. | HTTPS requests only |
tls.sni | string | Server name indication. | HTTPS requests only |
