Description of the message: Emitted when SPS connects to the serverfor the first time in the session
Example message:
{"vendor":"OneIdentity","user":"","transport":"tcp","src_user":"gwtestauto","src_port":"58140","src_ip":"10.30.0.24","src":"client.acme.com","session_id":"svc-iiCfsG48oJG5smpuocBLAN-my_connection-39","product":"SPS-5.11.0","event_name":"ServerConnect","dvc":"sps1.acme.com","dest_port":"22","dest_ip":"10.170.255.206","dest":"server.acme.com","app":"ssh","action":"added","_time":"1557913195000"}
The message contains the following fields.
Field |
Name |
Scope |
Present |
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
Field |
Name |
Scope |
Present |
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
Field |
Name |
Scope |
Present |
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
Field |
Name |
Scope |
Present |
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
Field |
Name |
Scope |
Present |
event_name |
Event name |
message |
always |
Description: the type of the message
Example: ServerConnect
Field |
Name |
Scope |
Present |
action |
Action |
message |
always |
Description: the taken by the device according to CIM model
Example: added
Field |
Name |
Scope |
Present |
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
Field |
Name |
Scope |
Present |
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
Field |
Name |
Scope |
Present |
dest_ip |
Destination address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
Field |
Name |
Scope |
Present |
dest |
Destination host name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
Field |
Name |
Scope |
Present |
user |
Name of the user |
message |
always |
Description: empty, not known in this message type
Example:
Field |
Name |
Scope |
Present |
dest_port |
Destination port |
session |
always |
Description: the port number on the server
Example: 22
Field |
Name |
Scope |
Present |
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
Field |
Name |
Scope |
Present |
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
Field |
Name |
Scope |
Present |
src_user |
Source username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
Field |
Name |
Scope |
Present |
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
Field |
Name |
Scope |
Present |
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
Description of the message: Emitted when SPS connects to the serverfor opening further channels. The difference from initial connection is that the server user name is known and authenticated this time.
Example message:
{"vendor":"OneIdentity","user":"","transport":"tcp","src_user":"gwtestauto","src_port":"58140","src_ip":"10.30.0.24","src":"client.acme.com","user":"root","session_id":"svc-iiCfsG48oJG5smpuocBLAN-my_connection-39","product":"SPS-5.11.0","event_name":"ServerConnect","dvc":"sps1.acme.com","dest_port":"22","dest_ip":"10.170.255.206","dest":"server.acme.com","app":"ssh","action":"added","_time":"1557913195000"}
The message contains the following fields.
Field |
Name |
Scope |
Present |
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
Field |
Name |
Scope |
Present |
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
Field |
Name |
Scope |
Present |
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
Field |
Name |
Scope |
Present |
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
Field |
Name |
Scope |
Present |
event_name |
Event name |
message |
always |
Description: the type of the message
Example: ServerConnect
Field |
Name |
Scope |
Present |
action |
Action |
message |
always |
Description: the taken by the device according to CIM model
Example: added
Field |
Name |
Scope |
Present |
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
Field |
Name |
Scope |
Present |
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
Field |
Name |
Scope |
Present |
dest_ip |
Destination address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
Field |
Name |
Scope |
Present |
dest |
Destination host name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
Field |
Name |
Scope |
Present |
user |
Name of the user |
session |
always |
Description: the server username
Example: root
Field |
Name |
Scope |
Present |
dest_port |
Destination port |
session |
always |
Description: the port number on the server
Example: 22
Field |
Name |
Scope |
Present |
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
Field |
Name |
Scope |
Present |
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
Field |
Name |
Scope |
Present |
src_user |
Source username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
Field |
Name |
Scope |
Present |
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
Field |
Name |
Scope |
Present |
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
Description of the message: Emitted after the server authentication successfully happened
Example message:
{"vendor":"OneIdentity","user":"root","transport":"tcp","src_user":"gwtestauto","src_port":"57982","src_ip":"10.30.0.24","src":"client.acme.com","session_id":"svc-iiCfsG48oJG5smpuocBLAN-my_connection-38","product":"SPS-5.11.0","event_name":"ServerAuthenticationSuccess","dvc":"sps1.acme.com","dest_port":"22","dest_ip":"10.170.255.206","dest":"server.acme.com","app":"ssh","action":"success","_time":"1557913189329"}
The message contains the following fields.
Field |
Name |
Scope |
Present |
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
Field |
Name |
Scope |
Present |
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
Field |
Name |
Scope |
Present |
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
Field |
Name |
Scope |
Present |
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
Field |
Name |
Scope |
Present |
event_name |
Event name |
message |
always |
Description: the type of the message
Example: ServerAuthenticationSuccess
Field |
Name |
Scope |
Present |
action |
Action |
message |
always |
Description: marks a successful authentication
Example: success
Field |
Name |
Scope |
Present |
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
Field |
Name |
Scope |
Present |
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
Field |
Name |
Scope |
Present |
dest_ip |
Destination address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
Field |
Name |
Scope |
Present |
dest |
Destination host name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
Field |
Name |
Scope |
Present |
user |
Name of the user |
session |
always |
Description: the server username
Example: root
Field |
Name |
Scope |
Present |
dest_port |
Destination port |
session |
always |
Description: the port number on the server
Example: 22
Field |
Name |
Scope |
Present |
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
Field |
Name |
Scope |
Present |
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
Field |
Name |
Scope |
Present |
src_user |
Source username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
Field |
Name |
Scope |
Present |
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
Field |
Name |
Scope |
Present |
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
Description of the message: Emitted after the server authentication failed
Example message:
{"vendor":"OneIdentity","user":"root","transport":"tcp","src_user":"gwtestauto","src_port":"58140","src_ip":"10.30.0.24","src":"client.acme.com","session_id":"svc-iiCfsG48oJG5smpuocBLAN-my_connection-39","product":"SPS-5.11.0","event_name":"ServerAuthenticationFailure","dvc":"sps1.acme.com","dest_port":"22","dest_ip":"10.170.255.206","dest":"server.acme.com","app":"ssh","action":"failure","_time":"1557913197211"}
The message contains the following fields.
Field |
Name |
Scope |
Present |
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
Field |
Name |
Scope |
Present |
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
Field |
Name |
Scope |
Present |
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
Field |
Name |
Scope |
Present |
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
Field |
Name |
Scope |
Present |
event_name |
Event name |
message |
always |
Description: the type of the message
Example: ServerAuthenticationFailure
Field |
Name |
Scope |
Present |
action |
Action |
message |
always |
Description: marks a failed authentication
Example: failure
Field |
Name |
Scope |
Present |
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
Field |
Name |
Scope |
Present |
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
Field |
Name |
Scope |
Present |
dest_ip |
Destination address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
Field |
Name |
Scope |
Present |
dest |
Destination host name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
Field |
Name |
Scope |
Present |
user |
Name of the user |
session |
always |
Description: contains the non authenticated server username
Example: root
Field |
Name |
Scope |
Present |
dest_port |
Destination port |
session |
always |
Description: the port number on the server
Example: 22
Field |
Name |
Scope |
Present |
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
Field |
Name |
Scope |
Present |
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
Field |
Name |
Scope |
Present |
src_user |
Source username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
Field |
Name |
Scope |
Present |
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
Field |
Name |
Scope |
Present |
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
Description of the message: Emitted after a failed gateway authentication. Note that the gateway username here is not authenticated and will not be retained in further messages to avoid confusion with an authenticated gateway user.
Example message:
{"vendor":"OneIdentity","user":"","transport":"tcp","src_user":"gwtestauto","src_port":"49070","src_ip":"10.30.0.24","src":"client.acme.com","session_id":"svc-mBbMWzauBWHQN9TpoZz8mD-my_connection-15","product":"SPS-5.11.0","event_name":"GatewayAuthenticationFailure","dvc":"sps1.acme.com","dest_port":"","dest_ip":"","dest":"","app":"ssh","action":"failure","_time":"1557912792360"}
The message contains the following fields.
Field |
Name |
Scope |
Present |
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
Field |
Name |
Scope |
Present |
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
Field |
Name |
Scope |
Present |
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
Field |
Name |
Scope |
Present |
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
Field |
Name |
Scope |
Present |
event_name |
Event name |
message |
always |
Description: the type of the message
Example: GatewayAuthenticationFailure
Field |
Name |
Scope |
Present |
action |
Action |
message |
always |
Description: marks a failed authentication
Example: failure
Field |
Name |
Scope |
Present |
dest |
Destination host name |
session |
always |
Description: empty, not known in this message type
Example:
Field |
Name |
Scope |
Present |
dest_ip |
Destination address |
session |
always |
Description: empty, not known in this message type
Example:
Field |
Name |
Scope |
Present |
user |
Name of the user |
message |
always |
Description: empty, not known in this message type
Example:
Field |
Name |
Scope |
Present |
dest_port |
Destination port |
session |
always |
Description: empty, not known in this message type
Example:
Field |
Name |
Scope |
Present |
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
Field |
Name |
Scope |
Present |
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
Field |
Name |
Scope |
Present |
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
Field |
Name |
Scope |
Present |
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
Field |
Name |
Scope |
Present |
src_user |
Source username |
message |
always |
Description: the non authenticated gateway username
Example: gwtestauto
Field |
Name |
Scope |
Present |
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
Field |
Name |
Scope |
Present |
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
Description of the message: Emitted when the session ends and server authentication and any gateway authentication was successful. There may be further messages related to the session after this message due to post processing of session data!
Example message:
{"vendor":"OneIdentity","user":"root","transport":"tcp","src_user":"gwtestauto","src_port":"48302","src_ip":"10.30.0.24","src":"client.acme.com","session_id":"svc-mBbMWzauBWHQN9TpoZz8mD-my_connection-12","product":"SPS-5.11.0","event_name":"SessionClosed","dvc":"sps1.acme.com","dest_port":"22","dest_ip":"10.170.255.206","dest":"server.acme.com","app":"ssh","_time":"1557912765545"}
The message contains the following fields.
Field |
Name |
Scope |
Present |
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
Field |
Name |
Scope |
Present |
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
Field |
Name |
Scope |
Present |
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
Field |
Name |
Scope |
Present |
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
Field |
Name |
Scope |
Present |
event_name |
Event name |
message |
always |
Description: the type of the message
Example: SessionClosed
Field |
Name |
Scope |
Present |
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
Field |
Name |
Scope |
Present |
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
Field |
Name |
Scope |
Present |
dest_ip |
Destination address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
Field |
Name |
Scope |
Present |
dest |
Destination host name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
Field |
Name |
Scope |
Present |
user |
Name of the user |
session |
always |
Description: the server username
Example: root
Field |
Name |
Scope |
Present |
dest_port |
Destination port |
session |
always |
Description: the port number on the server
Example: 22
Field |
Name |
Scope |
Present |
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
Field |
Name |
Scope |
Present |
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
Field |
Name |
Scope |
Present |
src_user |
Source username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
Field |
Name |
Scope |
Present |
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
Field |
Name |
Scope |
Present |
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
Description of the message: Emitted when the session ends because gateway authentication failed.
Example message:
{"vendor":"OneIdentity","user":"","transport":"tcp","src_user":"","src_port":"49070","src_ip":"10.30.0.24","src":"client.acme.com","session_id":"svc-mBbMWzauBWHQN9TpoZz8mD-my_connection-15","product":"SPS-5.11.0","event_name":"SessionClosed","dvc":"sps1.acme.com","dest_port":"","dest_ip":"","dest":"","app":"ssh","_time":"1557912792398"}
The message contains the following fields.
Field |
Name |
Scope |
Present |
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
Field |
Name |
Scope |
Present |
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
Field |
Name |
Scope |
Present |
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
Field |
Name |
Scope |
Present |
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
Field |
Name |
Scope |
Present |
event_name |
Event name |
message |
always |
Description: the type of the message
Example: SessionClosed
Field |
Name |
Scope |
Present |
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
Field |
Name |
Scope |
Present |
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
Field |
Name |
Scope |
Present |
dest_ip |
Destination address |
session |
always |
Description: empty, not known in this message type
Example:
Field |
Name |
Scope |
Present |
dest |
Destination host name |
session |
always |
Description: empty, not known in this message type
Example:
Field |
Name |
Scope |
Present |
user |
Name of the user |
message |
always |
Description: empty, not known in this message type
Example:
Field |
Name |
Scope |
Present |
dest_port |
Destination port |
session |
always |
Description: empty, not known in this message type
Example:
Field |
Name |
Scope |
Present |
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
Field |
Name |
Scope |
Present |
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
Field |
Name |
Scope |
Present |
src_user |
Source username |
session |
always |
Description: empty, not known in this message type
Example:
Field |
Name |
Scope |
Present |
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
Field |
Name |
Scope |
Present |
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
Description of the message: Emitted when the session ends because server authentication failed.
Example message:
{"vendor":"OneIdentity","user":"","transport":"tcp","src_user":"gwtestauto","src_port":"49426","src_ip":"10.30.0.24","src":"client.acme.com","session_id":"svc-mBbMWzauBWHQN9TpoZz8mD-my_connection-17","product":"SPS-5.11.0","event_name":"SessionClosed","dvc":"sps1.acme.com","dest_port":"22","dest_ip":"10.170.255.206","dest":"server.acme.com","app":"ssh","_time":"1557912813792"}
The message contains the following fields.
Field |
Name |
Scope |
Present |
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
Field |
Name |
Scope |
Present |
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
Field |
Name |
Scope |
Present |
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
Field |
Name |
Scope |
Present |
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
Field |
Name |
Scope |
Present |
event_name |
Event name |
message |
always |
Description: the type of the message
Example: SessionClosed
Field |
Name |
Scope |
Present |
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
Field |
Name |
Scope |
Present |
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
Field |
Name |
Scope |
Present |
dest_ip |
Destination address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
Field |
Name |
Scope |
Present |
dest |
Destination host name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
Field |
Name |
Scope |
Present |
user |
Name of the user |
message |
always |
Description: empty, not known in this message type
Example:
Field |
Name |
Scope |
Present |
dest_port |
Destination port |
session |
always |
Description: the port number on the server
Example: 22
Field |
Name |
Scope |
Present |
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
Field |
Name |
Scope |
Present |
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
Field |
Name |
Scope |
Present |
src_user |
Source username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
Field |
Name |
Scope |
Present |
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
Field |
Name |
Scope |
Present |
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
Description of the message: Emitted when the gateway user is acquired in a Terminal Service Gateway authentication scenario.
Example message:
{"vendor":"OneIdentity","user":"","transport":"tcp","src_user":"gwtestauto","src_port":"51204","src_ip":"10.30.0.24","src":"client.acme.com","session_id":"svc-oUDm7arcL8zNb3t2CVwSQr-my_connection-47-4","product":"SPS-5.11.0","event_name":"RdpEmbeddedInTsg","dvc":"sps1.acme.com","dest_port":"","dest_ip":"","dest":"","app":"rdp","action":"allowed","_time":"1558006936608"}
The message contains the following fields.
Field |
Name |
Scope |
Present |
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
Field |
Name |
Scope |
Present |
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
Field |
Name |
Scope |
Present |
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
Field |
Name |
Scope |
Present |
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
Field |
Name |
Scope |
Present |
event_name |
Event name |
message |
always |
Description: the type of the message
Example: RdpEmbeddedInTsg
Field |
Name |
Scope |
Present |
action |
Action |
message |
always |
Description: the action taken by the device according to CIM model
Example: allowed
Field |
Name |
Scope |
Present |
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
Field |
Name |
Scope |
Present |
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
Field |
Name |
Scope |
Present |
dest_ip |
Destination address |
session |
always |
Description: empty, not known in this message type
Example:
Field |
Name |
Scope |
Present |
dest |
Destination host name |
session |
always |
Description: empty, not known in this message type
Example:
Field |
Name |
Scope |
Present |
user |
Name of the user |
message |
always |
Description: empty, not known in this message type
Example:
Field |
Name |
Scope |
Present |
dest_port |
Destination port |
session |
always |
Description: empty, not known in this message type
Example:
Field |
Name |
Scope |
Present |
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
Field |
Name |
Scope |
Present |
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
Field |
Name |
Scope |
Present |
src_user |
Source username |
session |
always |
Description: the authenticated gateway username
Example: gwtestauto
Field |
Name |
Scope |
Present |
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
Field |
Name |
Scope |
Present |
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
Description of the message: Score messages represent scoring events when SPS has calculated an initial or changed score for the session.
Example message:
{"vendor":"OneIdentity","signature":"keystroke","session_id":"svc-416YVFZMy7rT8RA7T7yeAs-my_connection-0","product":"SPS-5.11.0","event_name":"SessionScored","dvc":"sps1.acme.com","algorithm_score":"18","algorithm_name":"keystroke","aggregated_score":"70","action":"allowed","_time":"1558010880806"}
The message contains the following fields.
Field |
Name |
Scope |
Present |
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
Field |
Name |
Scope |
Present |
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
Field |
Name |
Scope |
Present |
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
Field |
Name |
Scope |
Present |
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
Field |
Name |
Scope |
Present |
event_name |
Event name |
message |
always |
Description: the type of the message
Example: SessionScored
Field |
Name |
Scope |
Present |
action |
Action |
message |
always |
Description: the action taken by the device according to CIM model
Example: allowed
Field |
Name |
Scope |
Present |
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
Field |
Name |
Scope |
Present |
aggregated_score |
Aggregated score |
message |
always |
Description: the average score from all enabled analytics algorithms
Example: 50
Field |
Name |
Scope |
Present |
algorithm_name |
Algorithm name |
message |
always |
Description: the name of the algorithm that changed value
Example: keystroke
Field |
Name |
Scope |
Present |
signature |
Signature |
message |
always |
Description: the algorithm name as CIM intrusion detection signature
Example: hostlogin
Field |
Name |
Scope |
Present |
algorithm_score |
Algorithm score |
message |
always |
Description: the new score value of the algorithm that changed value
Example: 60
Description of the message: Emitted when a command is detected in the session channel text.
Example message:
{"vendor":"OneIdentity","session_id":"svc-mBbMWzauBWHQN9TpoZz8mD-my_connection-12","product":"SPS-5.11.0","event_name":"CommandChannelEvent","dvc":"sps1.acme.com","command":"exit","action":"allowed","_time":"1557912765461"}
The message contains the following fields.
Field |
Name |
Scope |
Present |
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
Field |
Name |
Scope |
Present |
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
Field |
Name |
Scope |
Present |
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
Field |
Name |
Scope |
Present |
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
Field |
Name |
Scope |
Present |
event_name |
Event name |
message |
always |
Description: the type of the message
Example: CommandChannelEvent
Field |
Name |
Scope |
Present |
action |
Action |
message |
always |
Description: the action taken by the device according to CIM model
Example: allowed
Field |
Name |
Scope |
Present |
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
Field |
Name |
Scope |
Present |
command |
Command |
message |
always |
Description: the full command detected
Example: exit
Description of the message: Emitted when a command is detected in the session channel text.
Example message:
{"window_title":"Shortcut Tools Application Tools Administrative Tools","vendor":"OneIdentity","session_id":"svc-oUDm7arcL8zNb3t2CVwSQr-my_connection-47-4","product":"SPS-5.11.0","event_name":"WindowTitleChannelEvent","dvc":"sps1.acme.com","action":"allowed","_time":"1558007001482"}
The message contains the following fields.
Field |
Name |
Scope |
Present |
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
Field |
Name |
Scope |
Present |
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
Field |
Name |
Scope |
Present |
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
Field |
Name |
Scope |
Present |
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
Field |
Name |
Scope |
Present |
event_name |
Event name |
message |
always |
Description: the type of the message
Example: WindowTitleChannelEvent
Field |
Name |
Scope |
Present |
action |
Action |
message |
always |
Description: the action taken by the device according to CIM model
Example: allowed
Field |
Name |
Scope |
Present |
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
Field |
Name |
Scope |
Present |
window_title |
Window title |
message |
always |
Description: the window title detected in graphical protocol
Example: firefox
Description of the message: Emitted when a command is detected in the session channel text.
Example message:
{"vendor":"OneIdentity","session_id":"svc-2L83Phh9J6GKLWTc881awk-my_connection-324","product":"SPS-5.11.0","file_path":"/cpuinfo","file_operation":"UPLOAD","file_name":"cpuinfo","event_name":"FileTransfer","dvc":"sps1.acme.com","action":"allowed","_time":"1558023721326"}
The message contains the following fields.
Field |
Name |
Scope |
Present |
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
Field |
Name |
Scope |
Present |
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
Field |
Name |
Scope |
Present |
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
Field |
Name |
Scope |
Present |
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
Field |
Name |
Scope |
Present |
event_name |
Event name |
message |
always |
Description: the type of the message
Example: FileTransfer
Field |
Name |
Scope |
Present |
action |
Action |
message |
always |
Description: the action taken by the device according to CIM model
Example: allowed
Field |
Name |
Scope |
Present |
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
Field |
Name |
Scope |
Present |
file_operation |
Operation |
message |
always |
Description: the operation on the file such as UPLOAD/DOWNLOAD. It may contain the suffix 'WARNING', if the operation failed
Example: UPLOAD
Field |
Name |
Scope |
Present |
file_name |
Filename |
message |
always |
Description: the file name
Example: foobar.txt
Field |
Name |
Scope |
Present |
file_path |
Full file path |
message |
always |
Description: the name of the file including its path on the server
Example: /tmp/foobar.txt
One Identity Starling helps to combine products from the One Identity line to create a secure and customizable cloud service. For details on One Identity Starling, see Starling - Technical Documentation.
If you are using a Starling 2FA plugin, (that is, you have uploaded it to Basic Settings > Plugins and then configured it at Policies > AA Plugin Configurations) and the SPS node is joined to One Identity Starling, you do not have to specify api_key and api_url in the Starling 2FA plugin configuration. This configuration method is more secure.
|
NOTE:
Currently the solution does not support using an HTTP proxy. |
The following describes how to join SPS to One Identity Starling and take advantage of companion features from Starling products such as 2FA and Identity Analytics.
To join SPS to One Identity Starling
Click Next.
|
NOTE:
By clicking Next, you have joined your SPS machine to Starling. Now you have to store this information in SPS to finish the join process. |
Copy your Credential String from the page. For example,
8dc0d6d4-b062-4357-abe2-8634523a91d9:4c0321bf-a099-4f95-86a6-20c6a4eb9298
Paste your Credential String into the Credential String field.
|
NOTE:
If for some reason you cannot paste the Credential String, you can re-retrieve it by refreshing this page and repeating the join process. You will receive the same Credential String if you did not change your host name. |
If you intend to decommission an SPS machine, or replace it with another one, you have to unjoin that machine and join the new machine. The following describes how to unjoin SPS from One Identity Starling.
To unjoin SPS from One Identity Starling
© ALL RIGHTS RESERVED. Nutzungsbedingungen Datenschutz Cookie Preference Center