The messages are standard syslog messages in RFC3164 format (also called legacy-syslog or BSD-syslog format). The body of the syslog message (the MESSAGE part) can be formatted as one of:
Common Event Format (CEF), based on the ArcSight CEF specification rev. 16, 22 July 2010
JavaScript Object Notation (JSON)
JSON-CIM format (available in SPS version 5.11 and later).
CEF (Common Event Format): the mapping to CEF will be described in terms of mapping from the JSON format to CEF. In CEF all relevant keys are present, but the value may be empty if it is not known.
Here <...> is substituted with the actual values.
CEF:0|OneIdentity|SPS|<SPS_version>|<event_type_id>|<event_name>|<severity>|
CEF extensions that are always present:
app: string, equal to Application protocol
cs1: string, equal to session_id
cs1Label: string, equal to literal "Session ID"
dst: string, equal to Destination address
duser: string, equal to Destination username
dvc: string, equal to Device address
src: equal to Source address
start: equal to timestamp
suser: equal to Source username
For details on the exact messages and the fields they contain, see CEF messages.
JSON (JavaScript Object Notation): the generated JSON structure is flat and the keys in the JSON depend on what kind of event is described. Some keys are always present in all messages. There are also keys that are message type specific, but may be missing if the related information is not available.
Keys that are always present and filled:
base_type_name: string, specifies the main category of the message, one of "meta", "content" or "score".
client_address: string, the IP address of the client.
client_name: string, the client hostname or IP address if hostname is not known.
client_port: integer, the port number of the client.
connection_policy: string, the name of the Connection Policy related to the session.
event_type_id: integer, a unique number specifying the message type (primarily for CEF).
event_name: string, the name of the event type.
gateway_username: string, the authenticated gateway username if there was a successful gateway authentication.
protocol: string, the application-level protocol.
session_id: string, the unique identifier of the session.
severity: integer, 0-10, the score of the session divided by 10 at the time of the message was created. The value is 0 if the score is not available.
timestamp: string, milliseconds since Unix epoch.
For details on the exact messages and the fields they contain, see JSON messages.
In One Identity Safeguard for Privileged Sessions (SPS) version 5.11 and later versions of SPS, the JSON-CIM external message format is also supported. The JSON-CIM format is a JSON format following Splunk's CIM field names. As a result, Splunk applications can interpret the JSON-CIM format.
Keys that are always present and filled:
dvc: string, equal to Device FQDN
event_name: string, the name of the event
product: string, the short name of the product and its version number
session_id: The unique ID of the session
_time: Timestamp when the event occurred
vendor: Contains the OneIdentity string
For details on the exact messages and the fields they contain, see JSON_CIM messages.
© 2024 One Identity LLC. ALL RIGHTS RESERVED. 使用条款 隐私 Cookie Preference Center
