Parsers and Generated Fields
Tag Fields Created by Parser okta-sso
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser okta-sso
| Source Field | CPS Field |
|---|---|
| Vendor.securityContext.asOrg | client.as.organization.name |
| Vendor.client.geographicalContext.city | client.geo.city_name |
| Vendor.client.geographicalContext.country | client.geo.country_name |
| Vendor.client.geographicalContext.geolocation.lat | client.geo.location.lat |
| Vendor.client.geographicalContext.geolocation.lon | client.geo.location.lon |
| Vendor.client.geographicalContext.state | client.geo.region_name |
| Vendor.client.ipAddress | client.ip |
| Vendor.actor.displayName | client.user.full_name |
| Vendor.actor.id | client.user.id |
| Vendor.actor.alternateId | client.user.name |
| Vendor.eventType | event.action |
| Vendor.uuid | event.id |
| Vendor.outcome.reason | event.reason |
| Vendor.displayMessage | message |
| Vendor.client.ipAddress | source.as |
| Vendor.client.ipAddress | source.geo |
| Vendor.client.ipAddress | source.ip |
| Vendor.actor.id | source.user.full_name |
| Vendor.actor.id | source.user.id |
| Vendor.actor.alternateId | source.user.name |
| Vendor.actor.displayName | user.full_name |
| Vendor.actor.alternateId | user.name |
| Vendor.User.login | user.target.email |
| Vendor.User.displayName | user.target.full_name |
| Vendor.UserGroup.id; | user.target.group.id |
| Vendor.UserGroup.displayName | user.target.group.name |
| Vendor.User.id | user.target.id |
| Vendor.User.alternateId; | user.target.name |
| Vendor.client.userAgent.rawUserAgent | user_agent.original |