Classes of events of the ICAP group

In the body of CEF messages of events classes of the ICAP group, keys may be used in accordance with their semantics (see the table below).

Allowed values of fields of event classes of the ICAP group

Key	Value
cs1	<User name>.
cs1Label	The value is always `UserName`.
cs2	Name of the workspace.
cs2Label	The value is always `Workspace`.
cs3	Name of the traffic processing rule. Multiple names are allowed.
cs3Label	The value is always `RulesNames`.
request	Request URL.
src	User IP address.
requestClientApplication	The name of the browser or application that processes the traffic (User agent).
act	One of the following actions: `Allow`, `Block`, `Redirect`.

Each event class of the ICAP group may only contain keys that are relevant to it (see the table below).

Relevant keys for event classes of the ICAP group

Event class	Relevant keys
LMS_EV_ICAP_MESSAGE_PROCESSED	cs1, cs1Label, cs2, cs2Label,cs3, cs3Label, src, request, requestClientApplication, act