Parsers and Generated Fields
Tag Fields Created by Parser okta-sso
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser okta-sso
| Source Field | LogScale Repository Field |
|---|---|
| Vendor.client.userAgent.rawUserAgent | agent.original |
| Vendor.securityContext.asOrg | client.as.organization.name |
| Vendor.client.geographicalContext.geolocation.lat | client.geo.location.lat |
| Vendor.client.geographicalContext.geolocation.lon | client.geo.location.lon |
| Vendor.client.ipAddress | client.ip |
| Vendor.actor.id | client.user.id |
| Vendor.actor.alternateId | client.user.name |
| Vendor.eventType | event.action |
| Vendor.uuid | event.id |
| Vendor.outcome.reason | event.reason |
| Vendor.displayMessage | message |
| Vendor.User.displayName | name |
| Vendor.actor.displayName | name |
| Vendor.actor.id | name |
| Vendor.client.geographicalContext.city | name |
| Vendor.client.geographicalContext.country | name |
| Vendor.client.geographicalContext.state | name |
| Vendor.client.ipAddress | source.as |
| Vendor.client.ipAddress | source.geo |
| Vendor.client.ipAddress | source.ip |
| Vendor.actor.id | source.user.id |
| Vendor.actor.alternateId | source.user.name |
| Vendor.actor.alternateId | user.name |
| Vendor.User.login | user.target.email |
| Vendor.UserGroup.id | user.target.group.id |
| Vendor.UserGroup.displayName | user.target.group.name |
| Vendor.User.id | user.target.id |
| Vendor.User.alternateId | user.target.name |