Supported Logs source that either:
schema: Duo.Administrator
parser:
native:
name: Duo.Administrator
description: Duo administrator log events.
referenceURL: https://duo.com/docs/adminapi#administrator-logs
fields:
- name: action
required: true
description: The type of change that was performed.
type: string
- name: description
description: String detailing what changed, either as free-form text or serialized JSON.
type: string
- name: description_json
description: The 'Description' field as a JSON object, if it is valid JSON. Otherwise, null.
type: json
- name: isotimestamp
required: true
description: ISO8601 timestamp of the event.
type: timestamp
timeFormat: rfc3339
isEventTime: true
- name: object
description: 'The object that was acted on. For example: "jsmith" (for users), "(555) 713-6275 x456" (for phones), or "HOTP 8-digit 123456" (for tokens).'
type: string
- name: timestamp
description: Unix timestamp of the event.
type: timestamp
timeFormat: unix
- name: username
required: true
description: 'The full name of the administrator who performed the action in the Duo Admin Panel. If the action was performed with the API this will be "API". Automatic actions like deletion of inactive users have "System" for the username. Changes synchronized from Directory Sync will have a username of the form (example) "AD Sync: name of directory".'
type: string
indicators:
- username
Keep this file in a safe place—it contains the credentials for this service account.
| AWS | |
|---|---|
google.subject | assertion.arn.extract('arn:aws:sts::{account_id}:')+":"+assertion.arn.extract('assumed-role/{role_and_session}').extract('/{session}') |
attribute.account | assertion.account |
The value of the google.subject attribute cannot exceed 127 characters. You may use Common Expression Language (CEL) expressions to transform or combine attributes from the token issued by AWS. The expression suggested in the table above takes this limit into account, and is an attempt at transforming the ARN into a value that uniquely identifies Panther entities. For more information on the AWS attributes, see "Example 2 - Called by user created with AssumeRole" on this AWS documentation page.
principal://iam.googleapis.com/projects/<PROJECT_NUMBER>/locations/global/workloadIdentityPools/<POOL_ID>/subject/SUBJECT_ATTRIBUTE_VALUE
principalSet://iam.googleapis.com/projects/<PROJECT_NUMBER>/locations/global/workloadIdentityPools/<POOL_ID>/*
my-service-account@my-project.iam.gserviceaccount.com
schema: GSuite.Reports
description:
referenceURL: https://developers.google.com/admin-sdk/reports/v1/reference/activities/list#response
fields:
- name: id
required: true
description: Unique identifier for each activity record.
type: object
fields:
- name: applicationName
description: Application name to which the event belongs.
type: string
- name: customerId
description: The unique identifier for a Google Workspace account.
type: string
- name: time
description: Time of occurrence of the activity.
type: timestamp
timeFormat: rfc3339
isEventTime: true
- name: uniqueQualifier
description: Unique qualifier if multiple events have the same time.
type: string
- name: actor
description: User doing the action.
type: object
fields:
- name: email
description: The primary email address of the actor. May be absent if there is no email address associated with the actor.
type: string
indicators:
- email
- name: profileId
description: The unique Google Workspace profile ID of the actor. May be absent if the actor is not a Google Workspace user.
type: string
- name: callerType
description: The type of actor.
type: string
- name: key
description: Only present when callerType is KEY. Can be the consumer_key of the requestor for OAuth 2LO API requests or an identifier for robot accounts.
type: string
- name: kind
required: true
description: The type of API resource. For an activity report, the value is reports#activities.
type: string
- name: ownerDomain
description: This is the domain that is affected by the report's event. For example domain of Admin console or the Drive application's document owner.
type: string
indicators:
- domain
- name: ipAddress
description: IP address of the user doing the action. This is the Internet Protocol (IP) address of the user when logging into Google Workspace which may or may not reflect the user's physical location. For example, the IP address can be the user's proxy server's address or a virtual private network (VPN) address. The API supports IPv4 and IPv6.
type: string
indicators:
- ip
- name: events
description: Activity events in the report.
type: array
element:
type: object
fields:
- name: type
description: Type of event. The Google Workspace service or feature that an administrator changes is identified in the type property which identifies an event using the eventName property. For a full list of the API's type categories, see the list of event names for various applications above in applicationName.
type: string
- name: name
description: Name of the event. This is the specific name of the activity reported by the API. And each eventName is related to a specific Google Workspace service or feature which the API organizes into types of events.
type: string
- name: parameters
description: Parameter value pairs for various applications. For more information about eventName parameters, see the list of event names for various applications above in applicationName.
type: array
element:
type: object
fields:
- name: name
description: The name of the parameter.
type: string
- name: value
description: String value of the parameter.
type: string
- name: intValue
description: Integer value of the parameter.
type: bigint
- name: boolValue
description: Boolean value of the parameter.
type: boolean
- name: multiValue
description: String values of the parameter.
type: array
element:
type: string
- name: multiIntValue
description: Integer values of the parameter.
type: array
element:
type: bigint
- name: messageValue
description: 'Nested parameter value pairs associated with this parameter. Complex value type for a parameter are returned as a list of parameter values. For example, the address parameter may have a value as [{parameter: [{name: city, value: abc}]}]'
type: json
- name: multiMessageValue
description: List of messageValue objects.
type: array
element:
type: json
| Attribute | Description | Required | |
|---|---|---|---|
actionName | The action that was attempted. | String | true |
actionDescription | An optional brief description of the action attempted. | String | false |
actionResult | The result of the action that was attempted. | String - SUCCEEDED, FAILED, or PARTIALLY_FAILED | true |
actionParams | The parameters supplied that were relevant to the action being attempted. Values are grouped under dynamic and static keys based on the way they were provided to the operation | Dict | false |
actionDetails | Additional metadata and/or details about the action being attempted. | Dict | false |
actor | Identifying information about the actor. | Dict | true |
actor.id | The ID of the actor that attempted the action. | String | true |
actor.type | The type of actor (user/token). | String -USER or TOKEN | true |
actor.name | The name of the actor that attempted the action. | String | false |
actor.attributes | The attributes of the actor that attempted the action. | Dict | false |
errors | Errors encountered while performing the action. | List | false |
errors.message | The error message for the error encountered. | String | false |
sourceIP | The IP address from which the request originated. | String | false |
XForwardedFor | All IP addresses included in the X-Forwarded-Header. | List | false |
userAgent | Information about the actor's browser, or slackbot if the action was initiated via Slack Bot. | String | false |
timestamp | The date/time at which the action was attempted. | String | true |
pantherVersion | The version of this Panther instance at the time the action was attempted. | String | true |