Event Publishing Wizard - Edit Mode

Event Name

Native Name

Service

SK4 Unified Event

Event Type

Status

SK4 Version

Splunk Data Exists

Created Date

Mon Feb 18 2019 17:29:14 GMT+0000 (Coordinated Universal Time)

Last Update

Tue May 28 2019 08:10:00 GMT+0000 (Coordinated Universal Time)

Description

SPL Query

ELK Query

Development Notes

Raw Data

CEF:0|Skyformation|SkyFormation Cloud Apps Security|2.0.0|sk4-login-success|login-success|0|cat=access cs1=unknown cs1Label=login-type cs6Label=raw-event destinationServiceName=Box deviceInboundInterface=568f46d9-eed3-4e69-a1a9-295121ef99a1 dproc=endpoint-admin-audit dtz=default-tenant end=1548694877000 flexString1=LOGIN flexString1Label=application-action msg=[uri@skyformation.com] successfully logged in from IP [82.80.134.106] via [unknown] request=Success requestClientApplication=LAtest Box src=82.80.134.106 suid=email suser=uri@skyformation.com ext__created_by__name=Uri Ben Dor ext__ip_address_=82.80.134.106 ext_source_type=user ext__event_type_=LOGIN ext_source_login=uri@skyformation.com ext__created_by__type=user ext_source_name=Uri Ben Dor ext__created_at_=2019-01-28T09:01:17-08:00 ext__created_by__login=uri@skyformation.com ext__event_id_=568f46d9-eed3-4e69-a1a9-295121ef99a1 ext__created_by__id=1297226072 ext_source_id=1297226072 ext_type=event cs6={"source":{"type":"user","id":"1297226072","name":"Uri Ben Dor","login":"uri@skyformation.com"},"created_by":{"type":"user","id":"1297226072","name":"Uri Ben Dor","login":"uri@skyformation.com"},"action_by":null,"created_at":"2019-01-28T09:01:17-08:00","event_id":"568f46d9-eed3-4e69-a1a9-295121ef99a1","event_type":"LOGIN","ip_address":"82.80.134.106","type":"event","session_id":null,"additional_details":null}

Supported also on