Values of fields in the body of CEF messages for classes of Auth group events
Aug 21, 2023
ID 151771
In the body of CEF messages for classes of Auth group events, you can use keys in accordance with their semantics (see the table below).
Permissible values of the fields for classes of Auth group events
Key | Value |
|---|---|
cs1 | Integration type (LDAP). |
cs1Label | Its value is always |
cn1 | Number of seconds the server was unavailable. |
cn1Label | Its value is always |
reason | Description of the error. |
start | Start of the period of LDAP server unavailability. |
end | End of the period of LDAP server unavailability. |
rt | Time of the first event. |
deviceServiceName | Service name. |
Each class of Auth group events can contain only keys that are relevant to it (see the table below).
Relevant keys for classes of Auth group events
Event class | Relevant keys |
|---|---|
LMS_EV_EXT_DIR_REPORT_FOR_PERIOD | rt, cs1, cs1Label, deviceServiceName, start, end |
LMS_EV_EXT_DIR_SERVICE_ERROR | cs1, cs1Label, deviceServiceName, reason, cn1, cn1Label |
LMS_EV_EXT_DIR_SERVICE_UP | No value |
LMS_EV_EXT_DIR_SERVICE_DISABLED | No value |
