Lastline AuditLog Result Format

The Lastline AuditLog consists of a list of audit events. The list of audit events is updated as certain actions are performed on the system. For example, when a user logs in, a new audit event is stored to record this action.

Each element describes an audit event.

Entry contents

• account.

  Type: String.

  Example: user@example.com.

  The username that triggered this audit event.

• event_category.

  Type: String.

  Example: authentication.

  The category of this audit event.

• event_name:

  Type: String.

  Example: SUCCESSFUL_LOGIN.

  The name of the action recorded by this audit event.

• event_severity:

  Type: String.

  Example: INFO.

  The severity level associated to the action recorded by this audit event. One of INFO, WARNING, ERROR.

• entity_type: (optional).

  Type: String.

  Example: event.

  The type of object that was affected by the action recorded by this audit event (if any).

• entity_id: (optional).

  Type: String.

  The ID of the object that was affected by the action recorded by this audit event (if any).

• ts:

  Type: Date.

  The date and time when this audit event occurred.

• src_ip:

  Type: String.

  The IP address (dotted decimal format) that triggered this audit event.