Event Publishing Wizard - Edit Mode

Event Name

Native Name

Service

SK4 Unified Event

Event Type

Status

SK4 Version

Splunk Data Exists

Created Date

Tue Apr 30 2019 12:43:57 GMT+0000 (Coordinated Universal Time)

Last Update

Tue Jun 18 2019 11:10:42 GMT+0000 (Coordinated Universal Time)

Description

SPL Query

ELK Query

Development Notes

Raw Data

CEF:0|skyformation|SkyFormation Cloud Apps Security|testDeviceVersion|sk4-authentication-factor-updated|authentication-factor-updated|0|cat=multi-factored-authentication cs1=mobile-application cs1Label=factor-type cs6Label=raw-event destinationServiceName=Palo Alto Aperture devicePayloadId=id : [01351002234] ; name : [N/A] dproc=log_events dtz=default-tenant duid=username duser=dan.malkovich@exabeam.com end=1554045027000 flexString1=update flexString1Label=application-action msg=Optional[User username: dan.malkovich@exabeam.com] updated authentication factor {"type":"mobile-application"} for User username: dan.malkovich@exabeam.com requestClientApplication=acc1 requestMethod=admin_audit src=82.80.134.106 suid=username suser=dan.malkovich@exabeam.com ext__item_name_=dan.malkovich@exabeam.com ext__resource_value_new_=pass_code ext__event_type_=user ext__admin_id_=dan.malkovich@exabeam.com ext__item_type_=user ext__admin_role_=Super Admin ext_serial=01351002234 ext_field=config_state ext_timestamp=2019-03-31T15:10:27Z ext_action=update ext__resource_value_old_=mfa ext__log_type_=admin_audit ext_ip=82.80.134.106 cs6={"log_type":"admin_audit","admin_id":"dan.malkovich@exabeam.com","admin_role":"Super Admin","ip":"82.80.134.106","event_type":"user","item_type":"user","item_name":"dan.malkovich@exabeam.com","field":"config_state","action":"update","resource_value_old":"mfa","resource_value_new":"pass_code","timestamp":"2019-03-31T15:10:27Z","serial":"01351002234"}

Supported also on