Appendix A: SIEM Event Delivery Event Details

Important. As a general rule, key/value pairs vary among events: based on the type of event that occurred, Event A could have a different set of key/value pairs than Event B, which, in turn, could have a different set of key/value pairs than Event C. The following table lists keys that might present in an event notification. However, it’s highly-unlikely that all on these keys will be present in an event notification. The SIEM Event Delivery Service reports the event data (and the key/value pairs) relevant for a given event type.

Each event reported by the SIEM Event Delivery service is packaged using JSON (JavaScript Object Notation) formatting before being zipped up and sent to your Amazon S3 bucket. A typical event object looks something like this:

{
    "id":
    "message": {
        "app_id": "htb8fuhxnf8e38jrzub3c7pfrr",
        "client_id": "nmub5w3rru9k6rzupqaeb7bbwv6jn658",
        "endpoint_uri": "http://documentation.akamai.com/widget/traditional_signin.jsonp",
        "event_type": "legacy_traditional_signin",
        "forward_headers": [
            {
                "name": "HTTP_X_FORWARDED_FOR",
                "value": "192.168.1.1, 192.168.1.2, 192.168.1.3"
            },
            {
                "name": "HTTP_X_FORWARDED_PROTO",
                "value": "http"            },
            {
                "name": "HTTP_X_FORWARDED_PORT",
                "value": "80"
            }
        ],
        "ip_address": "192.168.1.1",
        "origin": "https://login.documentation.akamai.com/",
        "user_agent": "Mozilla/5.0 (Android 8.1.0; Mobile; rv:68.0) Gecko/68.0 Firefox/68.0",
        "user_uuid": "437920f3-85dd-4cb7-ba8c-7025faea1d2c"
    },
    "msts": 1566206726081,
    "type:" "siem#legacy_traditional_signin"
}

Like other JSON objects, SIEM events consist of a collection of key/value pairs; for example, this key/value pair specifies the type of event (legacy_traditional_signin) that took place:

"eventType": "legacy_traditional_signin",

Other SIEM event keys are described in the following table. To see sample event notifications for the various SIEM event types, see Appendix B.

Key	Definition and Sample Value
app_id	Unique identifier of the Identity Cloud API client associated with the event. For example: "app_id": "htb8fuhxnf8e38jrzub3c7pfrr" This key appears on the following event notifications: siem#legacy_social_registration siem#legacy_social_signin siem#legacy_traditional_registration siem#legacy_traditional_signin siem#new_email_verification siem#password_recover siem#profile_create siem#profile_delete siem#profile_update
attributes	Array of user profile attribute names associated with the event. For example: "attributes": ["email", "emailVerified"] This key appears on the following event notifications: entityUpdated
captureApplicationId	Unique identifier of the Akamai Identity Cloud application associated with the event. For example: "captureApplicationId": "zzyn9gy9r8xdy5zkru4y54syk6" This key appears on the following event notifications: authenticationFailedKnownUser authenticationFailedUnknownUser credentialAuthenticationAttemptsExceededKnownUser credentialAuthenticationAttemptsExceededUnknownUser entityCreated entityDeleted entityUpdated
captureClientId	Unique identifier of the API client associated with the event. For example: "captureClient Id": "7c18051a-524b-44fb-9762-65cf284f0e12" This key appears on the following event notifications: authenticationFailedKnownUser authenticationFailedUnknownUser credentialAuthenticationAttemptsExceededKnownUser credentialAuthenticationAttemptsExceededUnknownUser entityCreated entityDeleted entityUpdated
client_id	Unique identifier of the Identity Cloud API client associated with the event. For example: "client_id": "elrrniux51a3nrhfwzklvz3t46lb5n2m" This key appears on the following event notifications: siem#legacy_social_registration siem#legacy_social_signin siem#legacy_traditional_registration siem#legacy_traditional_signin siem#new_email_verification siem#password_recover siem#profile_create siem#profile_delete siem#profile_update
endpoint_uri	Identity Cloud endpoint associated with the event. For example: "endpoint_uri": "http://documentation.akamai.com/widget/ traditionalsignin.jsonp" This key appears on the following event notifications: siem#legacy_social_registration siem#legacy_social_signin siem#legacy_traditional_registration siem#legacy_traditional_signin siem#new_email_verification siem#password_recover siem#profile_create siem#profile_delete siem#profile_update
entityType	Name of the entity type database associated with the event. For example: "eventType": "user" This key appears on the following event notifications: authenticationFailedKnownUser authenticationFailedUnknownUser credentialAuthenticationAttemptsExceededKnownUser credentialAuthenticationAttemptsExceededUnknownUser entityCreated entityDeleted entityUpdated
event_type	Type of event that occurred (a user logged on, a user registered, an entity type was created, etc.). For example: "type": "legacy_traditional_signin" This key appears on the following event notifications: siem#legacy_social_registration siem#legacy_social_signin siem#legacy_traditional_registration siem#legacy_traditional_signin siem#new_email_verification siem#password_recover siem#profile_create siem#profile_delete siem#profile_update
forward_headers	Header information for the event message. Common message headers include: HTTP_X_FORWARDED_FOR (client IP address) HTTP_X_FORWARDED_PROTO (protocol used in making the request) HTTP_X_FORWARDED_PROTO (server port number) This key appears on the following event notifications: siem#legacy_social_registration siem#legacy_social_signin siem#legacy_traditional_registration siem#legacy_traditional_signin siem#new_email_verification siem#password_recover siem#profile_create siem#profile_delete siem#profile_update
globalSub	Internal URI that points to a user record within the Identity Cloud user profile store. For example: "sub": "capture-v1://us.janraincapture.com/ zzyn9gy9r8xdy5zkru4y54syk6/user/6b004bc5-179c-45c2-815d-31b06169371d" In the preceding URL, zzyn9gy9r8xdy5zkru4y54syk6 represents the unique identifier of the Identity Cloud application and 6b004bc5-179c-45c2-815d-31b06169371d represents the user’s UUID (Universally Unique Identifier). This key appears on the following event notifications: authenticationFailedKnownUser credentialAuthenticationAttemptsExceededKnownUser entityCreated entityDeleted entityUpdated
id	Universally unique identifier assigned to the event. For example: "id": "39874dfa-21g6-4rP2-ao74-5bHT63b81219" This key appears on the following event notifications: authenticationFailedKnownUser authenticationFailedUnknownUser credentialAuthenticationAttemptsExceededKnownUser credentialAuthenticationAttemptsExceededUnknownUser entityCreated entityDeleted entityUpdated siem#legacy_social_registration siem#legacy_social_signin siem#legacy_traditional_registration siem#legacy_traditional_signin siem#new_email_verification siem#password_recover siem#profile_create siem#profile_delete siem#profile_update
ip_address	IP address of the device used when the event occurred. For example: "Ip_address": "192.168.1.1" This key appears on the following event notifications: siem#legacy_social_registration siem#legacy_social_signin siem#legacy_traditional_registration siem#legacy_traditional_signin siem#new_email_verification siem#password_recover siem#profile_create siem#profile_delete siem#profile_update
msts	Date and time when the event occurred. The msts value is formatted using Unix epoch time, which represents the number of seconds that have elapsed since 00:00:00 Coordinated Universal Time (UTC) on January 1, 1970. For example: "msts": "1553405263" In the preceding example, the value 1553405263 represents Saturday, March 23, 2019 at 22:27:43 Pacific Daylight Time. This key appears on the following event notifications: authenticationFailedKnownUser authenticationFailedUnknownUser credentialAuthenticationAttemptsExceededKnownUser credentialAuthenticationAttemptsExceededUnknownUser entityCreated entityDeleted entityUpdated siem#legacy_social_registration siem#legacy_social_signin siem#legacy_traditional_registration siem#legacy_traditional_signin siem#new_email_verification siem#password_recover siem#profile_create siem#profile_delete siem#profile_update
origin	Specifies the address of the “origin server,” the server that contains the original web page. For example: "origin": "https://login.documentation.akamai.com" This key appears on the following event notifications: siem#legacy_social_registration siem#legacy_social_signin siem#legacy_traditional_registration siem#legacy_traditional_signin siem#new_email_verification siem#password_recover siem#profile_create siem#profile_delete siem#profile_update
reason	Reason why authentication failed. For example: "reason": "invalidCredentials" This key appears in the following event notifications: authenticationFailedKnownUser authenticationFailedUnknownUser
sub	Unique Identity Cloud identifier of the user associated with the event. For example: "sub": "437920f3-85dd-4cb7-ba8c-7025faea1d2c" This key appears on the following event notifications: authenticationFailedKnownUser credentialAuthenticationAttemptsExceededKnownUser entityCreated entityDeleted entityUpdated
type	Indicates the event source; this will always be set to siem# followed by the event type. For example: "type": "siem#legacy_traditional_signin" This key appears on the following event notifications: authenticationFailedKnownUser authenticationFailedUnknownUser credentialAuthenticationAttemptsExceededKnownUser credentialAuthenticationAttemptsExceededUnknownUser entityCreated entityDeleted entityUpdated siem#legacy_social_registration siem#legacy_social_registration siem#legacy_social_signin siem#legacy_traditional_registration siem#legacy_traditional_signin siem#new_email_verification siem#password_recover siem#profile_create siem#profile_delete siem#profile_update
user_agent	User agent for the client application employed when the event occurred. The user agent typically identifies the web browser in use when the event took place. For example: "user_agent": "Mozilla/5.0 (Android 8.1.0; Mobile; rv:68.0) Gecko/68.0 Firefox/68.0" This key appears on the following event notifications: siem#legacy_social_registration siem#legacy_social_signin siem#legacy_traditional_registration siem#legacy_traditional_signin siem#new_email_verification siem#password_recover siem#profile_create siem#profile_delete siem#profile_update
user_uuid	Unique Identity Cloud identifier of the user associated with the event. For example: "user_uuid": "437920f3-85dd-4cb7-ba8c-7025faea1d2c" This key appears on the following event notifications: siem#legacy_social_registration siem#legacy_social_signin siem#legacy_traditional_registration siem#legacy_traditional_signin siem#new_email_verification siem#password_recover siem#profile_create siem#profile_delete siem#profile_update

Rate this Article