SIEM event details (legacy customers only)
The content on this page deals with a legacy feature of the Akamai Identity Cloud. If you are currently an Identity Cloud customer and are using SIEM event delivery, that feature is still supported. However, if you’re new to the Identity Cloud, SIEM event delivery is no longer available.
Each event reported by the SIEM Event Delivery service is packaged using JSON (JavaScript Object Notation) formatting before being zipped up and sent to your Amazon S3 bucket. A typical event object looks something like this:
{
"id":
"message": {
"app_id": "htb8fuhxnf8e38jrzub3c7pfrr",
"client_id": "nmub5w3rru9k6rzupqaeb7bbwv6jn658",
"endpoint_uri": "http://documentation.akamai.com/widget/traditional_signin.jsonp",
"event_type": "legacy_traditional_signin",
"forward_headers": [
{
"name": "HTTP_X_FORWARDED_FOR",
"value": "192.168.1.1, 192.168.1.2, 192.168.1.3"
},
{
"name": "HTTP_X_FORWARDED_PROTO",
"value": "http" },
{
"name": "HTTP_X_FORWARDED_PORT",
"value": "80"
}
],
"ip_address": "192.168.1.1",
"origin": "https://login.documentation.akamai.com/",
"user_agent": "Mozilla/5.0 (Android 8.1.0; Mobile; rv:68.0) Gecko/68.0 Firefox/68.0",
"user_uuid": "437920f3-85dd-4cb7-ba8c-7025faea1d2c"
},
"msts": 1566206726081,
"type:" "siem#legacy_traditional_signin"
}
Like other JSON objects, SIEM events consist of a collection of key/value pairs; for example, this key/value pair specifies the type of event (legacy_traditional_signin) that took place:
"eventType": "legacy_traditional_signin",
As a general rule, key/value pairs vary among events: based on the type of event that occurred, Event A could have a different set of key/value pairs than Event B, which, in turn, could have a different set of key/value pairs than Event C. The following table lists keys that might present in an event notification. However, it’s highly-unlikely that all on these keys will be present in an event notification. The SIEM Event Delivery Service reports the event data (and the key/value pairs) relevant for a given event type.
Other SIEM event keys are described in the following table. To see sample event notifications for the various SIEM event types, see Sample SIEM event notifications.
| Key | Definition and Sample Value |
|---|---|
| app_id | Unique identifier of the Identity Cloud API client associated with the event. For example:"app_id": "htb8fuhxnf8e38jrzub3c7pfrr"This key appears on the following event notifications: siem#legacy_social_registration siem#legacy_social_signin * siem#legacy_traditional_registration * siem#legacy_traditional_signin * siem#new_email_verification * siem#password_recover * siem#profile_create * siem#profile_delete * siem#profile_update |
| attributes | Array of user profile attribute names associated with the event. For example:"attributes": ["email", "emailVerified"]This key appears on the following event notifications: * entityUpdated |
| captureApplicationId | Unique identifier of the Akamai Identity Cloud application associated with the event. For example:captureApplicationId": "zzyn9gy9r8xdy5zkru4y54syk6"This key appears on the following event notifications: authenticationFailedKnownUser authenticationFailedUnknownUser credentialAuthenticationAttemptsExceededKnownUser credentialAuthenticationAttemptsExceededUnknownUser entityCreated entityDeleted * entityUpdated |
| captureClientId | Unique identifier of the API client associated with the event. For example:"captureClient Id": "7c18051a-524b-44fb-9762-65cf284f0e12"This key appears on the following event notifications: authenticationFailedKnownUser authenticationFailedUnknownUser credentialAuthenticationAttemptsExceededKnownUser credentialAuthenticationAttemptsExceededUnknownUser entityCreated entityDeleted * entityUpdated |
| client_id | Unique identifier of the Identity Cloud API client associated with the event. For example:"client_id": "elrrniux51a3nrhfwzklvz3t46lb5n2m"This key appears on the following event notifications: siem#legacy_social_registration siem#legacy_social_signin * siem#legacy_traditional_registration * siem#legacy_traditional_signin * siem#new_email_verification * siem#password_recover * siem#profile_create * siem#profile_delete * siem#profile_update |
| endpoint_uri | Identity Cloud endpoint associated with the event. For example:"endpoint_uri": "https://documentation.akamai.com/widget/traditionalsignin.jsonp"This key appears on the following event notifications: siem#legacy_social_registration siem#legacy_social_signin * siem#legacy_traditional_registration * siem#legacy_traditional_signin * siem#new_email_verification * siem#password_recover * siem#profile_create * siem#profile_delete * siem#profile_update |
| entityType | Name of the entity type database associated with the event. For example:"eventType": "user"This key appears on the following event notifications: authenticationFailedKnownUser authenticationFailedUnknownUser credentialAuthenticationAttemptsExceededKnownUser credentialAuthenticationAttemptsExceededUnknownUser entityCreated entityDeleted * entityUpdated |
| event_type | Type of event that occurred (a user logged on, a user registered, an entity type was created, etc.). For example:"type": "legacy_traditional_signin"This key appears on the following event notifications: siem#legacy_social_registration siem#legacy_social_signin * siem#legacy_traditional_registration * siem#legacy_traditional_signin * siem#new_email_verification * siem#password_recover * siem#profile_create * siem#profile_delete * siem#profile_update |
| forward_headers | Header information for the event message. Common message headers include: *HTTP_X_FORWARDED_FOR (client IP address) * HTTP_X_FORWARDED_PROTO (protocol used in making the request) *HTTP_X_FORWARDED_PROTO (server port number) This key appears on the following event notifications: * siem#legacy_social_registration * siem#legacy_social_signin * siem#legacy_traditional_registration * siem#legacy_traditional_signin * siem#new_email_verification * siem#password_recover * siem#profile_create * siem#profile_delete * siem#profile_update |
| globalSub | Internal URI that points to a user record within the Identity Cloud user profile store. For example:"sub": "capture-v1://us.janraincapture.com/zzyn9gy9r8xdy5zkru4y54syk6/user/6b004bc5-179c-45c2-815d-31b06169371d"This key appears on the following event notifications: authenticationFailedKnownUser credentialAuthenticationAttemptsExceededKnownUser entityCreated entityDeleted * entityUpdated |
| Id | Universally unique identifier assigned to the event. For example:"id": "39874dfa-21g6-4rP2-ao74-5bHT63b81219"This key appears on the following event notifications: authenticationFailedKnownUser authenticationFailedUnknownUser credentialAuthenticationAttemptsExceededKnownUser credentialAuthenticationAttemptsExceededUnknownUser entityCreated entityDeleted entityUpdated siem#legacy_social_registration * siem#legacy_social_signin * siem#legacy_traditional_registration * siem#legacy_traditional_signin * siem#new_email_verification * siem#password_recover * siem#profile_create * siem#profile_delete * siem#profile_update |
| ip_address | IP address of the device used when the event occurred. Note that ip_address isn't guaranteed to be meaningful in every scenario. In cases where the event is triggered from Akamai systems, an Akamai IP address will be emitted. For example: "ip_address": "192.168.1.1"This key appears on the following event notifications: siem#legacy_social_registration siem#legacy_social_signin * siem#legacy_traditional_registration * siem#legacy_traditional_signin * siem#new_email_verification * siem#password_recover * siem#profile_create * siem#profile_delete * siem#profile_update |
| msts | Date and time when the event occurred. The msts value is formatted using Unix epoch time, which represents the number of seconds that have elapsed since 00:00:00 Coordinated Universal Time (UTC) on January 1, 1970. For example:"msts": "1553405263"This key appears on the following event notifications: authenticationFailedKnownUser authenticationFailedUnknownUser credentialAuthenticationAttemptsExceededKnownUser credentialAuthenticationAttemptsExceededUnknownUser entityCreated entityDeleted entityUpdated siem#legacy_social_registration * siem#legacy_social_registration * siem#legacy_social_signin * siem#legacy_traditional_registration * siem#legacy_traditional_signin * siem#new_email_verification * siem#password_recover * siem#profile_create * siem#profile_delete * siem#profile_update |
| origin | Specifies the address of the “origin server,” the server that contains the original web page. For example:"origin": "https://login.documentation.akamai.com"This key appears on the following event notifications: siem#legacy_social_registration siem#legacy_social_signin * siem#legacy_traditional_registration * siem#legacy_traditional_signin * siem#new_email_verification * siem#password_recover * siem#profile_create * siem#profile_delete * siem#profile_update |
| reason | Reason why authentication failed. For example:"reason": "invalidCredentials"This key appears on the following event notifications: authenticationFailedKnownUser authenticationFailedUnknownUser |
| sub | Unique Identity Cloud identifier of the user associated with the event. For example:"sub": "437920f3-85dd-4cb7-ba8c-7025faea1d2c"This key appears on the following event notifications: authenticationFailedKnownUser credentialAuthenticationAttemptsExceededKnownUser entityCreated entityDeleted * entityUpdated |
| type | Indicates the event source; this will always be set to siem# followed by the event type. For example:"type": "siem#legacy_traditional_signin"This key appears on the following event notifications: authenticationFailedKnownUser authenticationFailedUnknownUser credentialAuthenticationAttemptsExceededKnownUser credentialAuthenticationAttemptsExceededUnknownUser entityCreated entityDeleted entityUpdated siem#legacy_social_registration * siem#legacy_social_registration * siem#legacy_social_signin * siem#legacy_traditional_registration * siem#legacy_traditional_signin * siem#new_email_verification * siem#password_recover * siem#profile_create * siem#profile_delete * siem#profile_update |
| user_agent | User agent for the client application employed when the event occurred. The user agent typically identifies the web browser in use when the event took place. For example:"user_agent": "Mozilla/5.0 (Android 8.1.0; Mobile; rv:68.0)Gecko/68.0 Firefox/68.0"This key appears on the following event notifications: siem#legacy_social_registration siem#legacy_social_signin * siem#legacy_traditional_registration * siem#legacy_traditional_signin * siem#new_email_verification * siem#password_recover * siem#profile_create * siem#profile_delete * siem#profile_update |
| user_uuid | Unique Identity Cloud identifier of the user associated with the event. For example:"user_uuid": "437920f3-85dd-4cb7-ba8c-7025faea1d2c"This key appears on the following event notifications: siem#legacy_social_registration siem#legacy_social_signin * siem#legacy_traditional_registration * siem#legacy_traditional_signin * siem#new_email_verification * siem#password_recover * siem#profile_create * siem#profile_delete * siem#profile_update |
Updated almost 3 years ago