The table below lists the keys and values in a message with an audit event.
Information about the audit event
Key |
Value |
|---|---|
suser |
The name of the user whose account is being modified |
suid |
ID of the making the change. |
outcome |
Result of the action. |
spriv |
User role. |
src |
Source IP address. |
msg |
Detailed description of the security event. |
deviceCustomDate1
deviceCustomDate1Label |
Last time when the user account was authorized. |
cs1 cs1Label |
Password check parameter, policy name, or template name. |
deviceCustomDate2 deviceCustomDate2Label |
Expiration date of the user account. |
cs cs2Label |
Name of the rule or profile. |
cs3 cs3Label |
User account status: active or inactive. |
cs4 cs4Label |
Old network address. |
cs5 cs5Label |
New network address. |
act |
Type of action. |
deviceFacility |
Firewall component. |
deviceInboundinterface |
Destination interface. |
deviceexternalId |
ID of the interface or profile. |