AuditEventSummaryV2

Information related to Audit Events.
Supported Filters : 'And', 'Or', 'Equals' and 'Between'.
See the field description to know the filter types it supports.

JSON Example

{
    "application_pool_name": "calculator",
    "desktop_pool_name": "manual pool",
    "id": 1001,
    "machine_dns_name": "broker.domain.com",
    "machine_id": "3d78ef58-20a6-4f0e-923d-cb61938002bb",
    "message": "Broker broker1 has started handling events",
    "module": "Broker",
    "persistent_disk_id": "c1d5aec7-2126-3c55-aefa-11949003c9c2",
    "severity": "AUDIT_SUCCESS",
    "time": 1582181831000,
    "type": "AGENT_CONNECTED",
    "user_id": "S-1-5-21-1111111111-2222222222-3333333333-500"
}

string

application_pool_name

Optional

Application Pool associated with this event. Will be unset if there is no application association for this event. Supported Filters : 'Equals'. This property can be used for sorting.

string

desktop_pool_name

Optional

Desktop Pool associated with this event. Will be unset if there is no desktop association for this event. Supported Filters : 'Equals'. This property can be used for sorting.

integer As int64 As int64

Optional

Unique id representing an event. Supported Filters : 'Equals'.

string

machine_dns_name

Optional

FQDN of the machine in the Pod that has logged this event. Supported Filters : 'Equals'. This property can be used for sorting.

string

machine_id

Optional

Machine associated with this event. Will be unset if there is no machine association for this event. Supported Filters : 'Equals'.

string

message

Optional

Audit event message.

string

module

Optional

Horizon component that has logged this event. Supported Filters : 'Equals'. This property can be used for sorting.

string

persistent_disk_id

Optional

Persistent disk associated with this event.
Will be unset if there is no persistent disk association for this event. Supported Filters : 'Equals'.

string

severity

Optional

Severity type of the event. Supported Filters : 'Equals'. This property can be used for sorting.

INFO: Audit event is of INFO severity.
WARNING: Audit event is of WARNING severity
ERROR: Audit event is of ERROR severity
AUDIT_SUCCESS: Audit event is of AUDIT_SUCCESS severity
AUDIT_FAIL: Audit event is of AUDIT_FAIL severity
UNKNOWN: Not able to identify severity

Possible values are : INFO, WARNING, ERROR, AUDIT_SUCCESS, AUDIT_FAIL, UNKNOWN,

integer As int64 As int64

time

Optional

Time at which the event occurred. Supported Filters : 'Between'. This property can be used for sorting.

string

type

Optional

Event name that corresponds to an item in the message catalog. Supported Filters : 'Equals'. This property can be used for sorting.

string

user_id

Optional

Sid of the user associated with this event. Supported Filters : 'Equals'.