Virtual Private Cloud Audit Trails Events: CreateIpfix
Event JSON schema
{
"eventId": "string",
"eventSource": "string",
"eventType": "string",
"eventTime": "string",
"authentication": {
"authenticated": "boolean",
// Includes only one of the fields `subjectType`
"subjectType": "string",
// end of the list of possible fields
// Includes only one of the fields `subjectId`
"subjectId": "string",
// end of the list of possible fields
// Includes only one of the fields `subjectName`
"subjectName": "string",
// end of the list of possible fields
// Includes only one of the fields `federationId`
"federationId": "string",
// end of the list of possible fields
// Includes only one of the fields `federationName`
"federationName": "string",
// end of the list of possible fields
// Includes only one of the fields `federationType`
"federationType": "string",
// end of the list of possible fields
"tokenInfo": {
"maskedIamToken": "string",
// Includes only one of the fields `iamTokenId`
"iamTokenId": "string",
// end of the list of possible fields
// Includes only one of the fields `impersonatorId`
"impersonatorId": "string",
// end of the list of possible fields
// Includes only one of the fields `impersonatorType`
"impersonatorType": "string",
// end of the list of possible fields
// Includes only one of the fields `impersonatorName`
"impersonatorName": "string",
// end of the list of possible fields
// Includes only one of the fields `impersonatorFederationId`
"impersonatorFederationId": "string",
// end of the list of possible fields
// Includes only one of the fields `impersonatorFederationName`
"impersonatorFederationName": "string",
// end of the list of possible fields
// Includes only one of the fields `impersonatorFederationType`
"impersonatorFederationType": "string"
// end of the list of possible fields
}
},
"resourceMetadata": {
"path": [
{
"resourceType": "string",
"resourceId": "string",
// Includes only one of the fields `resourceName`
"resourceName": "string"
// end of the list of possible fields
}
]
},
"eventStatus": "string",
"details": {
"natSrcAddress": "string",
"natSrcPort": "string",
"protocol": "string",
"timestamp": "string",
"srcAddress": "string",
"srcPort": "string",
"dstAddress": "string",
"dstPort": "string",
"natDstAddress": "string",
"natDstPort": "string",
"vrf": "string",
"instanceId": "string",
"interfaceId": "string",
"subnetId": "string",
"networkId": "string",
"natEvent": "string",
"domainId": "string",
"agentId": "string",
"exportSeq": "string",
"natPool": "string"
}
}
Field description
|
Field |
Description |
|
eventId |
string |
|
eventSource |
string |
|
eventType |
string |
|
eventTime |
string (date-time) String in RFC3339 To work with values in this field, use the APIs described in the |
|
authentication |
|
|
resourceMetadata |
|
|
eventStatus |
enum (SynchronousEventStatus)
|
|
details |
IamAuthentication
|
Field |
Description |
|
authenticated |
boolean |
|
subjectType |
enum (IamSubjectType) Includes only one of the fields
|
|
subjectId |
string Includes only one of the fields |
|
subjectName |
string Includes only one of the fields |
|
federationId |
string Includes only one of the fields |
|
federationName |
string Includes only one of the fields |
|
federationType |
enum (FederationType) Includes only one of the fields
|
|
tokenInfo |
IamTokenInfo
|
Field |
Description |
|
maskedIamToken |
string |
|
iamTokenId |
string Includes only one of the fields |
|
impersonatorId |
string Includes only one of the fields |
|
impersonatorType |
enum (IamSubjectType) Includes only one of the fields
|
|
impersonatorName |
string Includes only one of the fields |
|
impersonatorFederationId |
string Includes only one of the fields |
|
impersonatorFederationName |
string Includes only one of the fields |
|
impersonatorFederationType |
enum (FederationType) Includes only one of the fields
|
ResourceMetadata
|
Field |
Description |
|
path[] |
Resource
|
Field |
Description |
|
resourceType |
string |
|
resourceId |
string |
|
resourceName |
string Includes only one of the fields |
EventDetails
|
Field |
Description |
|
natSrcAddress |
string |
|
natSrcPort |
string (int64) |
|
protocol |
string (int64) |
|
timestamp |
string (date-time) String in RFC3339 To work with values in this field, use the APIs described in the |
|
srcAddress |
string |
|
srcPort |
string (int64) |
|
dstAddress |
string |
|
dstPort |
string (int64) |
|
natDstAddress |
string |
|
natDstPort |
string (int64) |
|
vrf |
string (int64) |
|
instanceId |
string |
|
interfaceId |
string (int64) |
|
subnetId |
string |
|
networkId |
string |
|
natEvent |
string (int64) |
|
domainId |
string (int64) |
|
agentId |
string |
|
exportSeq |
string (int64) |
|
natPool |
string (int64) |