tm-v1-schema

Okta

Layer: Identity

This documentation provides detailed information about all fields available for Okta.

Field Name Type Searchable General Field Description Example Products
clientBrowser string true - The client browser Chrome 119.0.0
  • Microsoft Entra ID
  • Okta
clientOS string true - The client OS Windows
  • Microsoft Entra ID
  • Okta
eventId string true - The identity provider event ID
  • 1 - EVENT_SOURCE_AAD_SIGN_INS
  • 2 - EVENT_SOURCE_AAD_DIR_AUDIT
  • Microsoft Entra ID
  • Active Directory (on-premises)
  • Okta
eventName string true - The event type
  • EVENT_SOURCE_AAD_SIGN_INS
  • EVENT_SOURCE_AAD_DIR_AUDIT
  • EVENT_SOURCE_OPA_WINDOWS_EVENT
  • Microsoft Entra ID
  • Active Directory (on-premises)
  • Okta
eventTime real true - The time the identity provider detected the event 1657781088000
  • Microsoft Entra ID
  • Active Directory (on-premises)
  • Okta
idpName string true - The identity provider
  • Microsoft Entra ID
  • Microsoft Active Directory
  • google
  • Microsoft Entra ID
  • Okta
ipAddress string true
  • IPv4
  • IPv6
 The client IP 10.10.10.10
  • Microsoft Entra ID
  • Okta
locationCity string true - The city where the event happened Singapore
  • Microsoft Entra ID
  • Okta
locationCountry string true - The country where the event happened
  • US
  • TW
  • Microsoft Entra ID
  • Okta
locationLatitude string true - The latitude of the event location 121.568
  • Microsoft Entra ID
  • Okta
locationLongitude string true - The longitude of the event location 121.568
  • Microsoft Entra ID
  • Okta
locationState string true - The state where the event happened Central Singapore
  • Microsoft Entra ID
  • Okta
orgId string true - The organization ID 11111111-1111-1111-1111-111111111111
  • Microsoft Entra ID
  • Okta
principalName string true UserAccount The User Principal Name sample_email@trendmicro.com
  • Microsoft Entra ID
  • Okta
principalName string true - The user principal name used to sign in to the proxy sample_email@trendmicro.com
  • Web Security
  • Zero Trust Secure Access - Internet Access
  • Cloud App Security
  • Zero Trust Secure Access - Private Access
  • Container Security
  • Okta
remarks string true - The additional information
  • warning: fork: Resource temporarily unavailable
  • pam_unix(cron:session): session opened for user root by (uid=0)
  • WinEvtLog: Application: AUDIT_FAILURE(18470): MSSQL$SA: (no user): no domain: EXAMPLE.com: Login failed for user 'example_user'. Reason: The account is disabled. [CLIENT: 10.10.10.10]
  • Endpoint & Workload Security
  • Deep Discovery Inspector
  • Virtual Network Sensor
  • Deep Security
  • Cloud App Security
  • Apex One as a Service
  • Email Security
  • Cloud One Network Security
  • TXOne EdgeOne
  • Email Sensor
  • File Security
  • Agentless Vulnerability & Threat Detection
  • Zero Trust Secure Access - Internet Access
  • Endpoint Sensor
  • Okta
signInCountries dynamic true - The countries from which a user signed in
  • PH
  • AU
  • Cloud App Security
  • Microsoft Entra ID
  • Okta
status string true - The sign-in status result
  • 50126
  • 50155
  • Microsoft Entra ID
  • Okta
statusReason string true - The sign-in status
  • Error validating credentials due to invalid username or password.
  • Others.
  • Microsoft Entra ID
  • Okta
tenantId string true - The Microsoft Entra ID Tenant ID of the organization 11111111-1111-1111-1111-111111111111
  • Microsoft Entra ID
  • Okta
userDisplayName string true UserAccount The user display name Test User(RD-TW)
  • Microsoft Entra ID
  • Okta
userId string true UserAccount The user ID 11111111-1111-1111-1111-111111111111
  • Microsoft Entra ID
  • Okta

Field Statistics

Generated by XDR Common Schema Public Doc Generator V2

This site is open source. Improve this page.