JSON messages
SessionClosed due to content policy violation
Description of the message: Emitted when content policy with termination action enabled is violated
Example message:
{"verdict":"TERMINATED","timestamp":"1568640063579","severity":"0","session_id":"svc-9S9nqpGqdns6GAJxULWjHp-my_connection-53","server_username":"root","server_port":"22","server_name":"server.acme.com","server_address":"10.170.255.206","protocol":"SSH","event_type_id":"449510124","event_name":"SessionClosed","connection_policy":"my_connection","client_port":"45946","client_name":"client.acme.com","client_address":"10.30.0.24","base_type_name":"meta","auth_method":"password","gateway_username":"gwtestauto"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
base_type_name |
Basic type |
message |
always |
Description: basic message type: meta
Example: meta
|
Field |
Name |
Scope |
Present |
|
event_type_id |
Signature ID |
message |
always |
Description: numeric identifier of message type
Example: 449510124
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: SessionClosed
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
severity |
Severity |
message |
always |
Description: number between 0-10 inclusive, equal to aggregated analytics score divided by 10 or 0 if analytics is disabled
Example: 0
|
Field |
Name |
Scope |
Present |
|
timestamp |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
server_username |
Server user |
session |
always |
Description: the server username
Example: root
|
Field |
Name |
Scope |
Present |
|
server_domain |
Server user domain if known |
session |
sometimes |
Description: the server domain, if known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
gateway_username |
Gateway username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
gateway_domain |
Gateway user domain |
session |
sometimes |
Description: the authenticated gateway user domain if there was a successful gateway authentication and known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
server_name |
Server name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
server_address |
Server address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
server_port |
Server port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
client_name |
Client name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
client_address |
Client address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
client_port |
Client port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
protocol |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: SSH
|
Field |
Name |
Scope |
Present |
|
connection_policy |
Connection policy name |
session |
always |
Description: SPS connection policy name
Example: my_connection
|
Field |
Name |
Scope |
Present |
|
auth_method |
Authentication method |
session |
always |
Description: the type of authentication used in gateway authentication
Example: password
|
Field |
Name |
Scope |
Present |
|
verdict |
Verdict |
session |
always |
Description: describes how the session ended, e.g. ACCEPT, AUTH_FAIL, DENY, FAIL, TERMINATED
Example: TERMINATED
ChannelAlert triggered
Description of the message: Emitted when channel alert triggered by content policy
Example message:
{"event_type_id":"1244069864","event_name":"ChannelAlert","session_id":"svc-eyKp4M2pDBpbwHW4nCSe36-my_connection-14","severity":"0","timestamp":"1567509110329","server_username":"root", "gateway_username":"gwtestauto","server_name":"server.acme.com","server_address":"10.170.255.206","server_port":"22","client_name":"client.acme.com","client_address":"10.30.0.24","client_port":"56988","protocol":"SSH","connection_policy":"my_connection","base_type_name":"content_alert","alerting_type":"adp.event.command","matched_regexp":"sudo","matched_content":"sudo","rule_name":"PatternMatcherRule"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
event_type_id |
Signature ID |
message |
always |
Description: numeric identifier of message type
Example: 1244069864
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: ChannelAlert
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
severity |
Severity |
message |
always |
Description: number between 0-10 inclusive, equal to aggregated analytics score divided by 10 or 0 if analytics is disabled
Example: 0
|
Field |
Name |
Scope |
Present |
|
timestamp |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
server_username |
Server user |
session |
always |
Description: the server username
Example: root
|
Field |
Name |
Scope |
Present |
|
gateway_username |
Gateway username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
server_name |
Server name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
server_address |
Server address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
server_port |
Server port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
client_name |
Client name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
client_address |
Client address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
client_port |
Client port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
protocol |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: SSH
|
Field |
Name |
Scope |
Present |
|
connection_policy |
Connection policy name |
session |
always |
Description: SPS connection policy name
Example: my_connection
|
Field |
Name |
Scope |
Present |
|
base_type_name |
Basic type |
message |
always |
Description: basic message type: content_alert
Example: content_alert
|
Field |
Name |
Scope |
Present |
|
alerting_type |
Event type |
message |
sometimes |
Description: the type of the event triggering the alert e.g. Command, Full screen content
Example: Command
|
Field |
Name |
Scope |
Present |
|
matched_regexp |
Matched regexp |
message |
sometimes |
Description: the regexp matching the content that triggered the alert
Example: sudo
|
Field |
Name |
Scope |
Present |
|
matched_content |
Matched content |
message |
sometimes |
Description: the screen content violating channel policy
Example: $ sudo
|
Field |
Name |
Scope |
Present |
|
rule_name |
Reason |
message |
sometimes |
Description: the rule triggering alert
Example: PatternMatcherRule
ServerConnect on initial contact
Description of the message: Emitted when SPS connects to the serverfor the first time in the session
Example message:
{"timestamp":"1557913242888","severity":"0","session_id":"svc-iiCfsG48oJG5smpuocBLAN-my_connection-43","server_port":"22","server_name":"server.acme.com","server_address":"10.170.255.206","protocol":"SSH","gateway_username":"gwtestauto","event_type_id":"107115592","event_name":"ServerConnect","connection_policy":"my_connection","client_port":"59190","client_name":"client.acme.com","client_address":"10.30.0.24","base_type_name":"meta"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
base_type_name |
Basic type |
message |
always |
Description: basic message type: meta
Example: meta
|
Field |
Name |
Scope |
Present |
|
event_type_id |
Signature ID |
message |
always |
Description: numeric identifier of message type
Example: 107115592
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: ServerConnect
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
severity |
Severity |
message |
always |
Description: number between 0-10 inclusive, equal to aggregated analytics score divided by 10 or 0 if analytics is disabled
Example: 0
|
Field |
Name |
Scope |
Present |
|
timestamp |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
gateway_username |
Gateway username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
gateway_domain |
Gateway user domain |
session |
sometimes |
Description: the authenticated gateway user domain if there was a successful gateway authentication and known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
server_name |
Server name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
server_address |
Server address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
server_port |
Server port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
client_name |
Client name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
client_address |
Client address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
client_port |
Client port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
protocol |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: SSH
|
Field |
Name |
Scope |
Present |
|
connection_policy |
Connection policy name |
session |
always |
Description: SPS connection policy name
Example: my_connection
ServerConnect for secondary channels
Description of the message: Emitted when SPS connects to the serverfor opening further channels. The difference from initial connection is that the server user name is known and authenticated this time.
Example message:
{"timestamp":"1557913242888","severity":"0","session_id":"svc-iiCfsG48oJG5smpuocBLAN-my_connection-43","server_port":"22","server_name":"server.acme.com","server_address":"10.170.255.206","protocol":"SSH","gateway_username":"gwtestauto","event_type_id":"107115592","event_name":"ServerConnect","connection_policy":"my_connection","server_username":"root","client_port":"59190","client_name":"client.acme.com","client_address":"10.30.0.24","base_type_name":"meta"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
base_type_name |
Basic type |
message |
always |
Description: basic message type: meta
Example: meta
|
Field |
Name |
Scope |
Present |
|
event_type_id |
Signature ID |
message |
always |
Description: numeric identifier of message type
Example: 107115592
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: ServerConnect
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
severity |
Severity |
message |
always |
Description: number between 0-10 inclusive, equal to aggregated analytics score divided by 10 or 0 if analytics is disabled
Example: 0
|
Field |
Name |
Scope |
Present |
|
timestamp |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
server_username |
Server user |
session |
always |
Description: the server username
Example: root
|
Field |
Name |
Scope |
Present |
|
server_domain |
Server user domain if known |
session |
sometimes |
Description: the server domain, if known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
gateway_username |
Gateway username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
gateway_domain |
Gateway user domain |
session |
sometimes |
Description: the authenticated gateway user domain if there was a successful gateway authentication and known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
server_name |
Server name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
server_address |
Server address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
server_port |
Server port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
client_name |
Client name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
client_address |
Client address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
client_port |
Client port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
protocol |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: SSH
|
Field |
Name |
Scope |
Present |
|
connection_policy |
Connection policy name |
session |
always |
Description: SPS connection policy name
Example: my_connection
ServerAuthenticationSuccess
Description of the message: Emitted after the server authentication successfully happened
Example message:
{"timestamp":"1557913243423","severity":"0","session_id":"svc-iiCfsG48oJG5smpuocBLAN-my_connection-43","server_username":"root","server_port":"22","server_name":"server.acme.com","server_address":"10.170.255.206","protocol":"SSH","gateway_username":"gwtestauto","event_type_id":"1865245228","event_name":"ServerAuthenticationSuccess","connection_policy":"my_connection","client_port":"59190","client_name":"client.acme.com","client_address":"10.30.0.24","base_type_name":"meta"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
base_type_name |
Basic type |
message |
always |
Description: basic message type: meta
Example: meta
|
Field |
Name |
Scope |
Present |
|
event_type_id |
Signature ID |
message |
always |
Description: numeric identifier of message type
Example: 1865245228
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: ServerAuthenticationSuccess
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
severity |
Severity |
message |
always |
Description: number between 0-10 inclusive, equal to aggregated analytics score divided by 10 or 0 if analytics is disabled
Example: 0
|
Field |
Name |
Scope |
Present |
|
timestamp |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
server_username |
Server user |
session |
always |
Description: the server username
Example: root
|
Field |
Name |
Scope |
Present |
|
server_domain |
Server user domain if known |
session |
sometimes |
Description: the server domain, if known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
gateway_username |
Gateway username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
gateway_domain |
Gateway user domain |
session |
sometimes |
Description: the authenticated gateway user domain if there was a successful gateway authentication and known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
server_name |
Server name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
server_address |
Server address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
server_port |
Server port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
client_name |
Client name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
client_address |
Client address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
client_port |
Client port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
protocol |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: SSH
|
Field |
Name |
Scope |
Present |
|
connection_policy |
Connection policy name |
session |
always |
Description: SPS connection policy name
Example: my_connection
ServerAuthenticationFailure
Description of the message: Emitted after the server authentication failed
Example message:
{"timestamp":"1557913134598","severity":"0","session_id":"svc-iiCfsG48oJG5smpuocBLAN-my_connection-33","server_username":"root","server_port":"22","server_name":"server.acme.com","server_address":"10.170.255.206","protocol":"SSH","gateway_username":"gwtestauto","event_type_id":"1262825953","event_name":"ServerAuthenticationFailure","connection_policy":"my_connection","client_port":"56692","client_name":"client.acme.com","client_address":"10.30.0.24","base_type_name":"meta"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
base_type_name |
Basic type |
message |
always |
Description: basic message type: meta
Example: meta
|
Field |
Name |
Scope |
Present |
|
event_type_id |
Signature ID |
message |
always |
Description: numeric identifier of message type
Example: 1262825953
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: ServerAuthenticationFailure
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
severity |
Severity |
message |
always |
Description: number between 0-10 inclusive, equal to aggregated analytics score divided by 10 or 0 if analytics is disabled
Example: 0
|
Field |
Name |
Scope |
Present |
|
timestamp |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
server_username |
Server user |
session |
always |
Description: contains the non authenticated server username
Example: root
|
Field |
Name |
Scope |
Present |
|
server_domain |
Server user domain if known |
session |
sometimes |
Description: the non authenticated server domain, if known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
gateway_username |
Gateway username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
gateway_domain |
Gateway user domain |
session |
sometimes |
Description: the authenticated gateway user domain if there was a successful gateway authentication and known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
server_name |
Server name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
server_address |
Server address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
server_port |
Server port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
client_name |
Client name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
client_address |
Client address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
client_port |
Client port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
protocol |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: SSH
|
Field |
Name |
Scope |
Present |
|
connection_policy |
Connection policy name |
session |
always |
Description: SPS connection policy name
Example: my_connection
GatewayAuthenticationFailure
Description of the message: Emitted after a failed gateway authentication. Note that the gateway username here is not authenticated and will not be retained in further messages to avoid confusion with an authenticated gateway user.
Example message:
{"timestamp":"1557913110027","severity":"0","session_id":"svc-iiCfsG48oJG5smpuocBLAN-my_connection-31","protocol":"SSH","gateway_username":"gwtestauto","event_type_id":"1843867026","event_name":"GatewayAuthenticationFailure","connection_policy":"my_connection","client_port":"56020","client_name":"client.acme.com","client_address":"10.30.0.24","base_type_name":"meta"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
base_type_name |
Basic type |
message |
always |
Description: basic message type: meta
Example: meta
|
Field |
Name |
Scope |
Present |
|
event_type_id |
Signature ID |
message |
always |
Description: numeric identifier of message type
Example: 1843867026
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: GatewayAuthenticationFailure
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
severity |
Severity |
message |
always |
Description: number between 0-10 inclusive, equal to aggregated analytics score divided by 10 or 0 if analytics is disabled
Example: 0
|
Field |
Name |
Scope |
Present |
|
timestamp |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
gateway_username |
Gateway username |
message |
always |
Description: the non authenticated gateway username
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
gateway_username |
Gateway user domain |
session |
sometimes |
Description: the non authenticated gateway user domain if known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
client_name |
Client name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
client_address |
Client address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
client_port |
Client port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
protocol |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: SSH
|
Field |
Name |
Scope |
Present |
|
connection_policy |
Connection policy name |
session |
always |
Description: SPS connection policy name
Example: my_connection
SessionClosed of successfully authenticated session
Description of the message: Emitted when the session ends and server authentication and any gateway authentication was successful. There may be further messages related to the session after this message due to post processing of session data!
Example message:
{"timestamp":"1557912701233","severity":"0","session_id":"svc-mBbMWzauBWHQN9TpoZz8mD-my_connection-6","server_username":"root","server_port":"22","server_name":"server.acme.com","server_address":"10.170.255.206","protocol":"SSH","gateway_username":"gwtestauto","event_type_id":"449510124","event_name":"SessionClosed","connection_policy":"my_connection","client_port":"46958","client_name":"client.acme.com","client_address":"10.30.0.24","base_type_name":"meta","auth_method":"password","verdict":"ACCEPT"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
base_type_name |
Basic type |
message |
always |
Description: basic message type: meta
Example: meta
|
Field |
Name |
Scope |
Present |
|
event_type_id |
Signature ID |
message |
always |
Description: numeric identifier of message type
Example: 449510124
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: SessionClosed
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
severity |
Severity |
message |
always |
Description: number between 0-10 inclusive, equal to aggregated analytics score divided by 10 or 0 if analytics is disabled
Example: 0
|
Field |
Name |
Scope |
Present |
|
timestamp |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
server_username |
Server user |
session |
always |
Description: the server username
Example: root
|
Field |
Name |
Scope |
Present |
|
server_domain |
Server user domain if known |
session |
sometimes |
Description: the server domain, if known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
gateway_username |
Gateway username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
gateway_domain |
Gateway user domain |
session |
sometimes |
Description: the authenticated gateway user domain if there was a successful gateway authentication and known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
server_name |
Server name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
server_address |
Server address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
server_port |
Server port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
client_name |
Client name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
client_address |
Client address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
client_port |
Client port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
protocol |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: SSH
|
Field |
Name |
Scope |
Present |
|
connection_policy |
Connection policy name |
session |
always |
Description: SPS connection policy name
Example: my_connection
|
Field |
Name |
Scope |
Present |
|
auth_method |
Authentication method |
session |
always |
Description: the type of authentication used in gateway authentication
Example: password
|
Field |
Name |
Scope |
Present |
|
verdict |
Verdict |
session |
always |
Description: describes how the session ended, e.g. ACCEPT, AUTH_FAIL, DENY, FAIL, TERMINATED
Example: ACCEPT
SessionClosed after a failed gateway authentication
Description of the message: Emitted when the session ends because gateway authentication failed.
Example message:
{"timestamp":"1557912725391","severity":"0","session_id":"svc-mBbMWzauBWHQN9TpoZz8mD-my_connection-9","protocol":"SSH","event_type_id":"449510124","event_name":"SessionClosed","connection_policy":"my_connection","client_port":"47444","client_name":"client.acme.com","client_address":"10.30.0.24","base_type_name":"meta","verdict":"AUTH_FAIL"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
base_type_name |
Basic type |
message |
always |
Description: basic message type: meta
Example: meta
|
Field |
Name |
Scope |
Present |
|
event_type_id |
Signature ID |
message |
always |
Description: numeric identifier of message type
Example: 449510124
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: SessionClosed
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
severity |
Severity |
message |
always |
Description: number between 0-10 inclusive, equal to aggregated analytics score divided by 10 or 0 if analytics is disabled
Example: 0
|
Field |
Name |
Scope |
Present |
|
timestamp |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
client_name |
Client name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
client_address |
Client address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
client_port |
Client port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
protocol |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: SSH
|
Field |
Name |
Scope |
Present |
|
connection_policy |
Connection policy name |
session |
always |
Description: SPS connection policy name
Example: my_connection
|
Field |
Name |
Scope |
Present |
|
verdict |
Verdict |
session |
always |
Description: describes how the session ended, e.g. ACCEPT, AUTH_FAIL, DENY, FAIL, TERMINATED
Example: AUTH_FAIL
SessionClosed after a failed server authentication
Description of the message: Emitted when the session ends because server authentication failed.
Example message:
{"timestamp":"1557912748990","severity":"0","session_id":"svc-mBbMWzauBWHQN9TpoZz8mD-my_connection-11","verdict":"AUTH_FAIL","server_port":"22","server_name":"server.acme.com","server_address":"10.170.255.206","protocol":"SSH","gateway_username":"gwtestauto","event_type_id":"449510124","event_name":"SessionClosed","connection_policy":"my_connection","client_port":"47840","client_name":"client.acme.com","client_address":"10.30.0.24","base_type_name":"meta"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
base_type_name |
Basic type |
message |
always |
Description: basic message type: meta
Example: meta
|
Field |
Name |
Scope |
Present |
|
event_type_id |
Signature ID |
message |
always |
Description: numeric identifier of message type
Example: 449510124
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: SessionClosed
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
severity |
Severity |
message |
always |
Description: number between 0-10 inclusive, equal to aggregated analytics score divided by 10 or 0 if analytics is disabled
Example: 0
|
Field |
Name |
Scope |
Present |
|
timestamp |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
gateway_username |
Gateway username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
gateway_domain |
Gateway user domain |
session |
sometimes |
Description: the authenticated gateway user domain if there was a successful gateway authentication and known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
server_name |
Server name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
server_address |
Server address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
server_port |
Server port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
client_name |
Client name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
client_address |
Client address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
client_port |
Client port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
protocol |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: SSH
|
Field |
Name |
Scope |
Present |
|
connection_policy |
Connection policy name |
session |
always |
Description: SPS connection policy name
Example: my_connection
|
Field |
Name |
Scope |
Present |
|
verdict |
Verdict |
session |
always |
Description: describes how the session ended, e.g. ACCEPT, AUTH_FAIL, DENY, FAIL, TERMINATED
Example: AUTH_FAIL
RdpEmbeddedInTsg
Description of the message: Emitted when the gateway user is acquired in a Terminal Service Gateway authentication scenario.
Example message:
{"timestamp":"1558007294417","severity":"0","session_id":"svc-oUDm7arcL8zNb3t2CVwSQr-my_connection-50-4","protocol":"RDP","gateway_username":"gwtestauto","event_type_id":"998298775","event_name":"RdpEmbeddedInTsg","connection_policy":"my_connection","client_port":"51270","client_name":"client.acme.com","client_address":"10.30.0.24","base_type_name":"meta"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
base_type_name |
Basic type |
message |
always |
Description: basic message type: meta
Example: meta
|
Field |
Name |
Scope |
Present |
|
event_type_id |
Signature ID |
message |
always |
Description: numeric identifier of message type
Example: 998298775
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: RdpEmbeddedInTsg
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
severity |
Severity |
message |
always |
Description: number between 0-10 inclusive, equal to aggregated analytics score divided by 10 or 0 if analytics is disabled
Example: 0
|
Field |
Name |
Scope |
Present |
|
timestamp |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
gateway_username |
Gateway username |
session |
always |
Description: the authenticated gateway username
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
client_name |
Client name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
client_address |
Client address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
client_port |
Client port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
protocol |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: SSH
|
Field |
Name |
Scope |
Present |
|
connection_policy |
Connection policy name |
session |
always |
Description: SPS connection policy name
Example: my_connection
SessionScored
Description of the message: Score messages represent scoring events when SPS has calculated an initial or changed score for the session.
Example message:
{"timestamp":"1558009822701","severity":"7","session_id":"svc-62a6XGcPzaFvLYDhVYDYXj-my_connection-0","server_username":"root","server_port":"22","server_name":"server.acme.com","server_address":"10.170.255.206","protocol":"SSH","gateway_username":"gwtestauto","event_type_id":"1991765353","event_name":"SessionScored","connection_policy":"my_connection","client_port":"35620","client_name":"client.acme.com","client_address":"10.30.0.24","base_type_name":"score","algorithm_score":"18","algorithm_name":"keystroke","aggregated_score":"70"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
base_type_name |
Basic type |
message |
always |
Description: basic message type: score
Example: score
|
Field |
Name |
Scope |
Present |
|
event_type_id |
Signature ID |
message |
always |
Description: numeric identifier of message type
Example: 1991765353
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: SessionScored
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
severity |
Severity |
message |
always |
Description: number between 0-10 inclusive, equal to aggregated analytics score divided by 10 or 0 if analytics is disabled
Example: 0
|
Field |
Name |
Scope |
Present |
|
timestamp |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
server_username |
Server user |
session |
always |
Description: the server username
Example: root
|
Field |
Name |
Scope |
Present |
|
server_domain |
Server user domain if known |
session |
sometimes |
Description: the server domain, if known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
gateway_username |
Gateway username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
gateway_domain |
Gateway user domain |
session |
sometimes |
Description: the authenticated gateway user domain if there was a successful gateway authentication and known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
server_name |
Server name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
server_address |
Server address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
server_port |
Server port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
client_name |
Client name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
client_address |
Client address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
client_port |
Client port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
protocol |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: SSH
|
Field |
Name |
Scope |
Present |
|
connection_policy |
Connection policy name |
session |
always |
Description: SPS connection policy name
Example: my_connection
|
Field |
Name |
Scope |
Present |
|
aggregated_score |
Aggregated score |
message |
always |
Description: the average score from all enabled analytics algorithms
Example: 50
|
Field |
Name |
Scope |
Present |
|
algorithm_name |
Algorithm name |
message |
always |
Description: the name of the algorithm that changed value
Example: keystroke
|
Field |
Name |
Scope |
Present |
|
algorithm_score |
Algorithm score |
message |
always |
Description: the new score value of the algorithm that changed value
Example: 60
CommandChannelEvent
Description of the message: Emitted when a command is detected in the session channel text.
Example message:
{"timestamp":"1557912701166","severity":"0","session_id":"svc-mBbMWzauBWHQN9TpoZz8mD-my_connection-6","server_username":"root","server_port":"22","server_name":"server.acme.com","server_address":"10.170.255.206","protocol":"SSH","gateway_username":"gwtestauto","event_type_id":"127084214","event_name":"CommandChannelEvent","connection_policy":"my_connection","command":"exit","client_port":"46958","client_name":"client.acme.com","client_address":"10.30.0.24","base_type_name":"content"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
base_type_name |
Basic type |
message |
always |
Description: basic message type: content
Example: content
|
Field |
Name |
Scope |
Present |
|
event_type_id |
Signature ID |
message |
always |
Description: numeric identifier of message type
Example: 127084214
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: CommandChannelEvent
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
severity |
Severity |
message |
always |
Description: number between 0-10 inclusive, equal to aggregated analytics score divided by 10 or 0 if analytics is disabled
Example: 0
|
Field |
Name |
Scope |
Present |
|
timestamp |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
server_username |
Server user |
session |
always |
Description: the server username
Example: root
|
Field |
Name |
Scope |
Present |
|
server_domain |
Server user domain if known |
session |
sometimes |
Description: the server domain, if known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
gateway_username |
Gateway username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
gateway_domain |
Gateway user domain |
session |
sometimes |
Description: the authenticated gateway user domain if there was a successful gateway authentication and known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
server_name |
Server name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
server_address |
Server address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
server_port |
Server port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
client_name |
Client name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
client_address |
Client address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
client_port |
Client port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
protocol |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: SSH
|
Field |
Name |
Scope |
Present |
|
connection_policy |
Connection policy name |
session |
always |
Description: SPS connection policy name
Example: my_connection
|
Field |
Name |
Scope |
Present |
|
command |
Command |
message |
always |
Description: the full command detected
Example: exit
WindowTitleChannelEvent
Description of the message: Emitted when a command is detected in the session channel text.
Example message:
{"window_title":"Shortcut Tools Application Tools Administrative Tools","timestamp":"1558007305516","severity":"0","session_id":"svc-oUDm7arcL8zNb3t2CVwSQr-my_connection-50-4","server_username":"Administrator","server_port":"3389","server_name":"server.acme.com","server_address":"10.170.255.206","protocol":"RDP","gateway_username":"gwtestauto","event_type_id":"911383355","event_name":"WindowTitleChannelEvent","connection_policy":"my_connection","client_port":"51270","client_name":"client.acme.com","client_address":"10.30.0.24","base_type_name":"content"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
base_type_name |
Basic type |
message |
always |
Description: basic message type: content
Example: content
|
Field |
Name |
Scope |
Present |
|
event_type_id |
Signature ID |
message |
always |
Description: numeric identifier of message type
Example: 911383355
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: WindowTitleChannelEvent
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
severity |
Severity |
message |
always |
Description: number between 0-10 inclusive, equal to aggregated analytics score divided by 10 or 0 if analytics is disabled
Example: 0
|
Field |
Name |
Scope |
Present |
|
timestamp |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
server_username |
Server user |
session |
always |
Description: the server username
Example: root
|
Field |
Name |
Scope |
Present |
|
server_domain |
Server user domain if known |
session |
sometimes |
Description: the server domain, if known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
gateway_username |
Gateway username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
gateway_domain |
Gateway user domain |
session |
sometimes |
Description: the authenticated gateway user domain if there was a successful gateway authentication and known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
server_name |
Server name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
server_address |
Server address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
server_port |
Server port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
client_name |
Client name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
client_address |
Client address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
client_port |
Client port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
protocol |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: SSH
|
Field |
Name |
Scope |
Present |
|
connection_policy |
Connection policy name |
session |
always |
Description: SPS connection policy name
Example: my_connection
|
Field |
Name |
Scope |
Present |
|
window_title |
Window title |
message |
always |
Description: the window title detected in graphical protocol
Example: firefox
FileTransfer
Description of the message: Emitted when a command is detected in the session channel text.
Example message:
{"timestamp":"1558023671115","severity":"0","session_id":"svc-2L83Phh9J6GKLWTc881awk-my_connection-316","server_username":"root","server_port":"22","server_name":"server.acme.com","server_address":"10.170.255.206","protocol":"SSH","gateway_username":"gwtestauto","filepath":"","filename":"cpuinfo","file_operation":"UPLOAD","event_type_id":"1127618380","event_name":"FileTransfer","connection_policy":"my_connection","client_port":"44292","client_name":"client.acme.com","client_address":"10.30.0.24","base_type_name":"content"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
base_type_name |
Basic type |
message |
always |
Description: basic message type: content
Example: content
|
Field |
Name |
Scope |
Present |
|
event_type_id |
Signature ID |
message |
always |
Description: numeric identifier of message type
Example: 1127618380
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: FileTransfer
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
severity |
Severity |
message |
always |
Description: number between 0-10 inclusive, equal to aggregated analytics score divided by 10 or 0 if analytics is disabled
Example: 0
|
Field |
Name |
Scope |
Present |
|
timestamp |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
server_username |
Server user |
session |
always |
Description: the server username
Example: root
|
Field |
Name |
Scope |
Present |
|
server_domain |
Server user domain if known |
session |
sometimes |
Description: the server domain, if known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
gateway_username |
Gateway username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
gateway_domain |
Gateway user domain |
session |
sometimes |
Description: the authenticated gateway user domain if there was a successful gateway authentication and known
Example: acme.com
|
Field |
Name |
Scope |
Present |
|
server_name |
Server name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
server_address |
Server address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
server_port |
Server port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
client_name |
Client name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
client_address |
Client address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
client_port |
Client port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
protocol |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: SSH
|
Field |
Name |
Scope |
Present |
|
connection_policy |
Connection policy name |
session |
always |
Description: SPS connection policy name
Example: my_connection
|
Field |
Name |
Scope |
Present |
|
file_operation |
Operation |
message |
always |
Description: the operation on the file such as UPLOAD/DOWNLOAD. It may contain the suffix 'WARNING', if the operation failed
Example: UPLOAD
|
Field |
Name |
Scope |
Present |
|
filename |
Filename |
message |
always |
Description: the file name
Example: foobar.txt
|
Field |
Name |
Scope |
Present |
|
filepath |
File path |
message |
always |
Description: the path to the file on the server
Example: /tmp
JSON_CIM messages
SessionClosed due to content policy violation
Description of the message: Emitted when content policy with termination action enabled is violated
Example message:
{"verdict":"TERMINATED","vendor":"OneIdentity","user":"root","transport":"tcp","src_user":"gwtestauto","src_port":"57542","src_ip":"10.30.0.24","src":"client.acme.com","session_id":"svc-w6rJcFNZ3c6Bqqu2pAoeoS-my_connection-1","product":"SPS-5.11.0","event_name":"SessionClosed","dvc":"sps1.acme.com","dest_port":"22","dest_ip":"10.170.255.206","dest":"server.acme.com","app":"ssh","_time":"1568984418014"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
|
Field |
Name |
Scope |
Present |
|
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
|
Field |
Name |
Scope |
Present |
|
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: SessionClosed
|
Field |
Name |
Scope |
Present |
|
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
|
Field |
Name |
Scope |
Present |
|
dest_ip |
Destination address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
dest |
Destination host name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
user |
Name of the user |
session |
always |
Description: the server username
Example: root
|
Field |
Name |
Scope |
Present |
|
dest_port |
Destination port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
src_user |
Source username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
|
Field |
Name |
Scope |
Present |
|
verdict |
Verdict |
session |
always |
Description: describes how the session ended, e.g. ACCEPT, AUTH_FAIL, DENY, FAIL, TERMINATED
Example: TERMINATED
ChannelAlert triggered
Description of the message: Emitted when channel alert triggered by content policy
Example message:
{"vendor":"OneIdentity","user":"root","transport":"tcp","subject":"PatternMatcherRule","src_user":"gwtestauto","src_port":"57542","src_ip":"10.30.0.24","src":"client.acme.com","session_id":"svc-w6rJcFNZ3c6Bqqu2pAoeoS-my_connection-1","product":"SPS-5.11.0","matched_regexp":"free","event_name":"ChannelAlert","dvc":"sps1.acme.com","dest_port":"22","dest_ip":"10.170.255.206","dest":"server.acme.com","app":"ssh","alerting_type":"Full screen content","_time":"1568984413910"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
|
Field |
Name |
Scope |
Present |
|
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
|
Field |
Name |
Scope |
Present |
|
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
|
Field |
Name |
Scope |
Present |
|
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
|
Field |
Name |
Scope |
Present |
|
src_user |
Source username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
matched_regexp |
Matched regexp |
message |
sometimes |
Description: the regexp matching the content that triggered the alert
Example: sudo
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: ChannelAlert
|
Field |
Name |
Scope |
Present |
|
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
|
Field |
Name |
Scope |
Present |
|
dest_port |
Destination port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
dest_ip |
Destination address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
dest |
Destination host name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
user |
Name of the user |
session |
always |
Description: the server username
Example: root
|
Field |
Name |
Scope |
Present |
|
alerting_type |
Event type |
message |
sometimes |
Description: the type of the event triggering the alert e.g. Command, Full screen content
Example: Command
|
Field |
Name |
Scope |
Present |
|
subject |
Reason |
message |
sometimes |
Description: the rule triggering alert
Example: PatternMatcherRule
ServerConnect on initial contact
Description of the message: Emitted when SPS connects to the serverfor the first time in the session
Example message:
{"vendor":"OneIdentity","user":"","transport":"tcp","src_user":"gwtestauto","src_port":"58140","src_ip":"10.30.0.24","src":"client.acme.com","session_id":"svc-iiCfsG48oJG5smpuocBLAN-my_connection-39","product":"SPS-5.11.0","event_name":"ServerConnect","dvc":"sps1.acme.com","dest_port":"22","dest_ip":"10.170.255.206","dest":"server.acme.com","app":"ssh","action":"added","_time":"1557913195000"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
|
Field |
Name |
Scope |
Present |
|
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
|
Field |
Name |
Scope |
Present |
|
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: ServerConnect
|
Field |
Name |
Scope |
Present |
|
action |
Action |
message |
always |
Description: the taken by the device according to CIM model
Example: added
|
Field |
Name |
Scope |
Present |
|
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
|
Field |
Name |
Scope |
Present |
|
dest_ip |
Destination address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
dest |
Destination host name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
user |
Name of the user |
message |
always |
Description: empty, not known in this message type
Example:
|
Field |
Name |
Scope |
Present |
|
dest_port |
Destination port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
src_user |
Source username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
ServerConnect for secondary channels
Description of the message: Emitted when SPS connects to the serverfor opening further channels. The difference from initial connection is that the server user name is known and authenticated this time.
Example message:
{"vendor":"OneIdentity","user":"","transport":"tcp","src_user":"gwtestauto","src_port":"58140","src_ip":"10.30.0.24","src":"client.acme.com","user":"root","session_id":"svc-iiCfsG48oJG5smpuocBLAN-my_connection-39","product":"SPS-5.11.0","event_name":"ServerConnect","dvc":"sps1.acme.com","dest_port":"22","dest_ip":"10.170.255.206","dest":"server.acme.com","app":"ssh","action":"added","_time":"1557913195000"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
|
Field |
Name |
Scope |
Present |
|
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
|
Field |
Name |
Scope |
Present |
|
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: ServerConnect
|
Field |
Name |
Scope |
Present |
|
action |
Action |
message |
always |
Description: the taken by the device according to CIM model
Example: added
|
Field |
Name |
Scope |
Present |
|
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
|
Field |
Name |
Scope |
Present |
|
dest_ip |
Destination address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
dest |
Destination host name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
user |
Name of the user |
session |
always |
Description: the server username
Example: root
|
Field |
Name |
Scope |
Present |
|
dest_port |
Destination port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
src_user |
Source username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
ServerAuthenticationSuccess
Description of the message: Emitted after the server authentication successfully happened
Example message:
{"vendor":"OneIdentity","user":"root","transport":"tcp","src_user":"gwtestauto","src_port":"57982","src_ip":"10.30.0.24","src":"client.acme.com","session_id":"svc-iiCfsG48oJG5smpuocBLAN-my_connection-38","product":"SPS-5.11.0","event_name":"ServerAuthenticationSuccess","dvc":"sps1.acme.com","dest_port":"22","dest_ip":"10.170.255.206","dest":"server.acme.com","app":"ssh","action":"success","_time":"1557913189329"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
|
Field |
Name |
Scope |
Present |
|
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
|
Field |
Name |
Scope |
Present |
|
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: ServerAuthenticationSuccess
|
Field |
Name |
Scope |
Present |
|
action |
Action |
message |
always |
Description: marks a successful authentication
Example: success
|
Field |
Name |
Scope |
Present |
|
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
|
Field |
Name |
Scope |
Present |
|
dest_ip |
Destination address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
dest |
Destination host name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
user |
Name of the user |
session |
always |
Description: the server username
Example: root
|
Field |
Name |
Scope |
Present |
|
dest_port |
Destination port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
src_user |
Source username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
ServerAuthenticationFailure
Description of the message: Emitted after the server authentication failed
Example message:
{"vendor":"OneIdentity","user":"root","transport":"tcp","src_user":"gwtestauto","src_port":"58140","src_ip":"10.30.0.24","src":"client.acme.com","session_id":"svc-iiCfsG48oJG5smpuocBLAN-my_connection-39","product":"SPS-5.11.0","event_name":"ServerAuthenticationFailure","dvc":"sps1.acme.com","dest_port":"22","dest_ip":"10.170.255.206","dest":"server.acme.com","app":"ssh","action":"failure","_time":"1557913197211"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
|
Field |
Name |
Scope |
Present |
|
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
|
Field |
Name |
Scope |
Present |
|
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: ServerAuthenticationFailure
|
Field |
Name |
Scope |
Present |
|
action |
Action |
message |
always |
Description: marks a failed authentication
Example: failure
|
Field |
Name |
Scope |
Present |
|
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
|
Field |
Name |
Scope |
Present |
|
dest_ip |
Destination address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
dest |
Destination host name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
user |
Name of the user |
session |
always |
Description: contains the non authenticated server username
Example: root
|
Field |
Name |
Scope |
Present |
|
dest_port |
Destination port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
src_user |
Source username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
GatewayAuthenticationFailure
Description of the message: Emitted after a failed gateway authentication. Note that the gateway username here is not authenticated and will not be retained in further messages to avoid confusion with an authenticated gateway user.
Example message:
{"vendor":"OneIdentity","user":"","transport":"tcp","src_user":"gwtestauto","src_port":"49070","src_ip":"10.30.0.24","src":"client.acme.com","session_id":"svc-mBbMWzauBWHQN9TpoZz8mD-my_connection-15","product":"SPS-5.11.0","event_name":"GatewayAuthenticationFailure","dvc":"sps1.acme.com","dest_port":"","dest_ip":"","dest":"","app":"ssh","action":"failure","_time":"1557912792360"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
|
Field |
Name |
Scope |
Present |
|
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
|
Field |
Name |
Scope |
Present |
|
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: GatewayAuthenticationFailure
|
Field |
Name |
Scope |
Present |
|
action |
Action |
message |
always |
Description: marks a failed authentication
Example: failure
|
Field |
Name |
Scope |
Present |
|
dest |
Destination host name |
session |
always |
Description: empty, not known in this message type
Example:
|
Field |
Name |
Scope |
Present |
|
dest_ip |
Destination address |
session |
always |
Description: empty, not known in this message type
Example:
|
Field |
Name |
Scope |
Present |
|
user |
Name of the user |
message |
always |
Description: empty, not known in this message type
Example:
|
Field |
Name |
Scope |
Present |
|
dest_port |
Destination port |
session |
always |
Description: empty, not known in this message type
Example:
|
Field |
Name |
Scope |
Present |
|
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
|
Field |
Name |
Scope |
Present |
|
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
src_user |
Source username |
message |
always |
Description: the non authenticated gateway username
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
SessionClosed of successfully authenticated session
Description of the message: Emitted when the session ends and server authentication and any gateway authentication was successful. There may be further messages related to the session after this message due to post processing of session data!
Example message:
{"vendor":"OneIdentity","user":"root","transport":"tcp","src_user":"gwtestauto","src_port":"48302","src_ip":"10.30.0.24","src":"client.acme.com","session_id":"svc-mBbMWzauBWHQN9TpoZz8mD-my_connection-12","product":"SPS-5.11.0","event_name":"SessionClosed","dvc":"sps1.acme.com","verdict":"ACCEPT","dest_port":"22","dest_ip":"10.170.255.206","dest":"server.acme.com","app":"ssh","_time":"1557912765545"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
|
Field |
Name |
Scope |
Present |
|
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
|
Field |
Name |
Scope |
Present |
|
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: SessionClosed
|
Field |
Name |
Scope |
Present |
|
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
|
Field |
Name |
Scope |
Present |
|
dest_ip |
Destination address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
dest |
Destination host name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
user |
Name of the user |
session |
always |
Description: the server username
Example: root
|
Field |
Name |
Scope |
Present |
|
dest_port |
Destination port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
src_user |
Source username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
|
Field |
Name |
Scope |
Present |
|
verdict |
Verdict |
session |
always |
Description: describes how the session ended, e.g. ACCEPT, AUTH_FAIL, DENY, FAIL, TERMINATED
Example: ACCEPT
SessionClosed after a failed gateway authentication
Description of the message: Emitted when the session ends because gateway authentication failed.
Example message:
{"vendor":"OneIdentity","user":"","transport":"tcp","src_user":"","src_port":"49070","src_ip":"10.30.0.24","src":"client.acme.com","session_id":"svc-mBbMWzauBWHQN9TpoZz8mD-my_connection-15","product":"SPS-5.11.0","event_name":"SessionClosed","dvc":"sps1.acme.com","dest_port":"","dest_ip":"","dest":"","app":"ssh","_time":"1557912792398","verdict":"AUTH_FAIL"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
|
Field |
Name |
Scope |
Present |
|
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
|
Field |
Name |
Scope |
Present |
|
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: SessionClosed
|
Field |
Name |
Scope |
Present |
|
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
|
Field |
Name |
Scope |
Present |
|
dest_ip |
Destination address |
session |
always |
Description: empty, not known in this message type
Example:
|
Field |
Name |
Scope |
Present |
|
dest |
Destination host name |
session |
always |
Description: empty, not known in this message type
Example:
|
Field |
Name |
Scope |
Present |
|
user |
Name of the user |
message |
always |
Description: empty, not known in this message type
Example:
|
Field |
Name |
Scope |
Present |
|
dest_port |
Destination port |
session |
always |
Description: empty, not known in this message type
Example:
|
Field |
Name |
Scope |
Present |
|
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
src_user |
Source username |
session |
always |
Description: empty, not known in this message type
Example:
|
Field |
Name |
Scope |
Present |
|
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
|
Field |
Name |
Scope |
Present |
|
verdict |
Verdict |
session |
always |
Description: describes how the session ended, e.g. ACCEPT, AUTH_FAIL, DENY, FAIL, TERMINATED
Example: AUTH_FAIL
SessionClosed after a failed server authentication
Description of the message: Emitted when the session ends because server authentication failed.
Example message:
{"vendor":"OneIdentity","user":"","transport":"tcp","src_user":"gwtestauto","src_port":"49426","src_ip":"10.30.0.24","src":"client.acme.com","session_id":"svc-mBbMWzauBWHQN9TpoZz8mD-my_connection-17","product":"SPS-5.11.0","event_name":"SessionClosed","dvc":"sps1.acme.com","dest_port":"22","verdict":"AUTH_FAIL","dest_ip":"10.170.255.206","dest":"server.acme.com","app":"ssh","_time":"1557912813792"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
|
Field |
Name |
Scope |
Present |
|
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
|
Field |
Name |
Scope |
Present |
|
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: SessionClosed
|
Field |
Name |
Scope |
Present |
|
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
|
Field |
Name |
Scope |
Present |
|
dest_ip |
Destination address |
session |
always |
Description: the IP address of the server
Example: 10.170.255.206
|
Field |
Name |
Scope |
Present |
|
dest |
Destination host name |
session |
always |
Description: the server hostname or IP address if hostname is not known
Example: server.acme.com
|
Field |
Name |
Scope |
Present |
|
user |
Name of the user |
message |
always |
Description: empty, not known in this message type
Example:
|
Field |
Name |
Scope |
Present |
|
dest_port |
Destination port |
session |
always |
Description: the port number on the server
Example: 22
|
Field |
Name |
Scope |
Present |
|
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
src_user |
Source username |
session |
sometimes |
Description: the authenticated gateway username if there was a successful gateway authentication
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
|
Field |
Name |
Scope |
Present |
|
verdict |
Verdict |
session |
always |
Description: describes how the session ended, e.g. ACCEPT, AUTH_FAIL, DENY, FAIL, TERMINATED
Example: AUTH_FAIL
RdpEmbeddedInTsg
Description of the message: Emitted when the gateway user is acquired in a Terminal Service Gateway authentication scenario.
Example message:
{"vendor":"OneIdentity","user":"","transport":"tcp","src_user":"gwtestauto","src_port":"51204","src_ip":"10.30.0.24","src":"client.acme.com","session_id":"svc-oUDm7arcL8zNb3t2CVwSQr-my_connection-47-4","product":"SPS-5.11.0","event_name":"RdpEmbeddedInTsg","dvc":"sps1.acme.com","dest_port":"","dest_ip":"","dest":"","app":"rdp","action":"allowed","_time":"1558006936608"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
|
Field |
Name |
Scope |
Present |
|
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
|
Field |
Name |
Scope |
Present |
|
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: RdpEmbeddedInTsg
|
Field |
Name |
Scope |
Present |
|
action |
Action |
message |
always |
Description: the action taken by the device according to CIM model
Example: allowed
|
Field |
Name |
Scope |
Present |
|
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
app |
Application protocol |
session |
always |
Description: SPS supported protocol
Example: ssh
|
Field |
Name |
Scope |
Present |
|
dest_ip |
Destination address |
session |
always |
Description: empty, not known in this message type
Example:
|
Field |
Name |
Scope |
Present |
|
dest |
Destination host name |
session |
always |
Description: empty, not known in this message type
Example:
|
Field |
Name |
Scope |
Present |
|
user |
Name of the user |
message |
always |
Description: empty, not known in this message type
Example:
|
Field |
Name |
Scope |
Present |
|
dest_port |
Destination port |
session |
always |
Description: empty, not known in this message type
Example:
|
Field |
Name |
Scope |
Present |
|
src_ip |
Source address |
session |
always |
Description: the IP address of the client
Example: 10.30.0.24
|
Field |
Name |
Scope |
Present |
|
src |
Source host name |
session |
always |
Description: the client hostname or IP address if hostname is not known
Example: client.acme.com
|
Field |
Name |
Scope |
Present |
|
src_user |
Source username |
session |
always |
Description: the authenticated gateway username
Example: gwtestauto
|
Field |
Name |
Scope |
Present |
|
src_port |
Source port |
session |
always |
Description: the port number on the client
Example: 38014
|
Field |
Name |
Scope |
Present |
|
transport |
Transport |
session |
always |
Description: the layer 3 protocol
Example: tcp
SessionScored
Description of the message: Score messages represent scoring events when SPS has calculated an initial or changed score for the session.
Example message:
{"vendor":"OneIdentity","signature":"keystroke","session_id":"svc-416YVFZMy7rT8RA7T7yeAs-my_connection-0","product":"SPS-5.11.0","event_name":"SessionScored","dvc":"sps1.acme.com","algorithm_score":"18","algorithm_name":"keystroke","aggregated_score":"70","action":"allowed","_time":"1558010880806"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
|
Field |
Name |
Scope |
Present |
|
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
|
Field |
Name |
Scope |
Present |
|
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: SessionScored
|
Field |
Name |
Scope |
Present |
|
action |
Action |
message |
always |
Description: the action taken by the device according to CIM model
Example: allowed
|
Field |
Name |
Scope |
Present |
|
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
aggregated_score |
Aggregated score |
message |
always |
Description: the average score from all enabled analytics algorithms
Example: 50
|
Field |
Name |
Scope |
Present |
|
algorithm_name |
Algorithm name |
message |
always |
Description: the name of the algorithm that changed value
Example: keystroke
|
Field |
Name |
Scope |
Present |
|
signature |
Signature |
message |
always |
Description: the algorithm name as CIM intrusion detection signature
Example: hostlogin
|
Field |
Name |
Scope |
Present |
|
algorithm_score |
Algorithm score |
message |
always |
Description: the new score value of the algorithm that changed value
Example: 60
CommandChannelEvent
Description of the message: Emitted when a command is detected in the session channel text.
Example message:
{"vendor":"OneIdentity","session_id":"svc-mBbMWzauBWHQN9TpoZz8mD-my_connection-12","product":"SPS-5.11.0","event_name":"CommandChannelEvent","dvc":"sps1.acme.com","command":"exit","action":"allowed","_time":"1557912765461"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
|
Field |
Name |
Scope |
Present |
|
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
|
Field |
Name |
Scope |
Present |
|
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: CommandChannelEvent
|
Field |
Name |
Scope |
Present |
|
action |
Action |
message |
always |
Description: the action taken by the device according to CIM model
Example: allowed
|
Field |
Name |
Scope |
Present |
|
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
command |
Command |
message |
always |
Description: the full command detected
Example: exit
WindowTitleChannelEvent
Description of the message: Emitted when a command is detected in the session channel text.
Example message:
{"window_title":"Shortcut Tools Application Tools Administrative Tools","vendor":"OneIdentity","session_id":"svc-oUDm7arcL8zNb3t2CVwSQr-my_connection-47-4","product":"SPS-5.11.0","event_name":"WindowTitleChannelEvent","dvc":"sps1.acme.com","action":"allowed","_time":"1558007001482"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
|
Field |
Name |
Scope |
Present |
|
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
|
Field |
Name |
Scope |
Present |
|
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: WindowTitleChannelEvent
|
Field |
Name |
Scope |
Present |
|
action |
Action |
message |
always |
Description: the action taken by the device according to CIM model
Example: allowed
|
Field |
Name |
Scope |
Present |
|
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
window_title |
Window title |
message |
always |
Description: the window title detected in graphical protocol
Example: firefox
FileTransfer
Description of the message: Emitted when a command is detected in the session channel text.
Example message:
{"vendor":"OneIdentity","session_id":"svc-2L83Phh9J6GKLWTc881awk-my_connection-324","product":"SPS-5.11.0","file_path":"/cpuinfo","file_operation":"UPLOAD","file_name":"cpuinfo","event_name":"FileTransfer","dvc":"sps1.acme.com","action":"allowed","_time":"1558023721326"}
The message contains the following fields.
|
Field |
Name |
Scope |
Present |
|
vendor |
Device vendor |
product |
always |
Description: fixed to OneIdentity
Example: OneIdentity
|
Field |
Name |
Scope |
Present |
|
product |
Product version |
product |
always |
Description: short product name with version
Example: SPS-5.11.0
|
Field |
Name |
Scope |
Present |
|
dvc |
Device fqdn |
device |
always |
Description: the hostname of SPS
Example: sps1.acme.com
|
Field |
Name |
Scope |
Present |
|
session_id |
Session ID |
session |
always |
Description: the unique identifier of the session
Example: svc-hjdBxA2UWkTadH3juDVwrT-my_connection-0
|
Field |
Name |
Scope |
Present |
|
event_name |
Event name |
message |
always |
Description: the type of the message
Example: FileTransfer
|
Field |
Name |
Scope |
Present |
|
action |
Action |
message |
always |
Description: the action taken by the device according to CIM model
Example: allowed
|
Field |
Name |
Scope |
Present |
|
_time |
Timestamp |
message |
always |
Description: the UNIX time stamp when the event occurred
Example: 1554470652340
|
Field |
Name |
Scope |
Present |
|
file_operation |
Operation |
message |
always |
Description: the operation on the file such as UPLOAD/DOWNLOAD. It may contain the suffix 'WARNING', if the operation failed
Example: UPLOAD
|
Field |
Name |
Scope |
Present |
|
file_name |
Filename |
message |
always |
Description: the file name
Example: foobar.txt
|
Field |
Name |
Scope |
Present |
|
file_path |
Full file path |
message |
always |
Description: the name of the file including its path on the server (in case of RDP protocol, this field is empty, in this case the full path of the file is in the filename field)
Example: /tmp/foobar.txt
Starling integration
One Identity Starling helps to combine products from the One Identity line to create a secure and customizable cloud service. For more information, see the Starling technical documentation.
If you are using a Starling 2FA plugin, (that is, you have uploaded it to Basic Settings > Plugins and then configured it at Policies > AA Plugin Configurations) and the SPS node is joined to One Identity Starling, you do not have to specify api_key and api_url in the Starling 2FA plugin configuration. This configuration method is more secure.
Topics:
Joining SPS to One Identity Starling
The following describes how to use SPS with One Identity Starling and take advantage of companion features from Starling products such as 2FA and Identity Analytics.
Prerequisites
-
An existing Starling organization (tenant)
NOTE: Consider the following:
-
If you have several Starling organizations, you can join your SPS to any of the existing organizations, however, ensure that you remember the Starling organization you joined to your SPS. This might be required if there is a join failure and you need to unjoin SPS from the respective Starling organization.
-
To use Starling with SPS, you need a Starling organization and account within the United States data center (European Union data center is not yet supported).
-
To join SPS to One Identity Starling
-
Navigate to Basic Settings > Starling Integration.
CAUTION: If SPS nodes are joined to a cluster, ensure that you initiate your Starling integration on the Central Management node.
-
To check the availability of SPS and Starling, that is, SPS can connect directly to the web and SPS can access Starling, click Check availability.
-
If your SPS cannot connect directly to the web, check your Internet connection and ensure that SPS can connect to the web, then re-initiate the process of joining your SPS to Starling.
If your SPS is behind a web proxy, navigate to Basic Settings > Network > HTTPS Proxy and configure the proxy settings. For more information, see Network settings.
NOTE:Currently only built-in Certificate Authorities are supported. If web proxy replaces the certificates of the Starling website on-the-fly, the join process might fail.
-
If SPS cannot access Starling, wait until Starling is available and re-initiate the process of joining your SPS to Starling.
Figure 73: Basic Settings > Starling Integration — SPS is ready to join Starling
-
-
When SPS is ready to join Starling, click Start join.
NOTE: Once you click Start join, you cannot stop the process and your SPS machine will be joined to Starling.
Ensure that you continue with the join process, and once the join process is complete, if required, you can unjoin SPS from Starling.
For more information, see Unjoining SPS from One Identity Starling.
The One Identity Starling site will open in a new tab.
-
To allow SPS to access your Starling organization and the services that you have subscribed to, click Allow.
The Join to Starling screen is displayed.
-
Copy your Credential String from the page.
The credential string allows SPS to communicate with Starling.
-
Navigate back to the SPS tab.
-
Paste your credential string into the Credential string field.
NOTE: If for some reason you cannot paste the credential string, you can re-retrieve it by refreshing this page and repeating the join process. You will receive the same credential string if you did not change your host name.
-
To complete the join process, click Save & finish joining.
Result
Your SPS instance is joined to Starling.
Figure 74: Basic Settings > Starling Integration — Example of SPS joined to Starling
