{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/main/json-schema/palo-alto-networks-audit-event-schema.json",
  "title": "AuditEvent",
  "x-generated": "2026-10-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/palo-alto-networks-search-api-openapi.yml#/components/schemas/AuditEvent",
  "properties": {
    "accessKey": {
      "type": "string"
    },
    "accessKeyUsed": {
      "type": "boolean"
    },
    "account": {
      "type": "string"
    },
    "accountName": {
      "type": "string"
    },
    "anomalyId": {
      "type": "string"
    },
    "browser": {
      "type": "string"
    },
    "cityId": {
      "format": "int32",
      "type": "integer"
    },
    "cityLatitude": {
      "format": "double",
      "type": "number"
    },
    "cityLongitude": {
      "format": "double",
      "type": "number"
    },
    "cityName": {
      "type": "string"
    },
    "countryId": {
      "format": "int32",
      "type": "integer"
    },
    "countryName": {
      "type": "string"
    },
    "dynamicData": {
      "additionalProperties": {
        "type": "object"
      },
      "type": "object"
    },
    "eventTs": {
      "format": "int64",
      "type": "integer"
    },
    "flaggedFeature": {
      "type": "string"
    },
    "id": {
      "format": "int64",
      "type": "integer"
    },
    "ingestionTs": {
      "format": "int64",
      "type": "integer"
    },
    "internal": {
      "type": "boolean"
    },
    "ip": {
      "type": "string"
    },
    "location": {
      "type": "string"
    },
    "name": {
      "type": "string"
    },
    "notPersisted": {
      "type": "boolean"
    },
    "objects": {
      "items": {
        "$ref": "#/$defs/ResourceIdBean"
      },
      "type": "array"
    },
    "os": {
      "type": "string"
    },
    "rawEvent": {
      "type": "object"
    },
    "reasonIds": {
      "items": {
        "format": "int32",
        "type": "integer"
      },
      "type": "array"
    },
    "regionApiIdentifier": {
      "type": "string"
    },
    "regionId": {
      "format": "int32",
      "type": "integer"
    },
    "regionName": {
      "type": "string"
    },
    "role": {
      "type": "string"
    },
    "source": {
      "type": "string"
    },
    "stateId": {
      "format": "int32",
      "type": "integer"
    },
    "stateName": {
      "type": "string"
    },
    "subject": {
      "type": "string"
    },
    "subjectType": {
      "enum": [
        "AWS_OTHER",
        "AZURE_OTHER",
        "GCP_OTHER",
        "AWS_IAM_USER",
        "AWS_ROOT",
        "AWS_ASSUMED_ROLE",
        "AWS_ROLE",
        "GCP_USER",
        "GCP_SERVICE_ACCOUNT",
        "AZURE_AD_USER",
        "AZURE_APPLICATION",
        "AWS_ACCOUNT",
        "AWS_SERVICE",
        "AWS_FEDERATED_USER",
        "AWS_SAML_USER",
        "AWS_WEB_IDENTITY_USER",
        "AWS_DIRECTORY"
      ],
      "type": "string"
    },
    "success": {
      "type": "boolean"
    },
    "timezone": {
      "type": "string"
    },
    "type": {
      "enum": [
        "UNKNOWN",
        "CREATE",
        "READ",
        "UPDATE",
        "DELETE",
        "LOGIN",
        "TEST",
        "AUDITD"
      ],
      "type": "string"
    },
    "userAgentBrowser": {
      "$ref": "#/$defs/UserAgentBrowser"
    },
    "userAgentOs": {
      "$ref": "#/$defs/UserAgentOs"
    }
  },
  "type": "object",
  "$defs": {
    "ResourceIdBean": {
      "description": "Model for Resource ID Bean",
      "properties": {
        "account": {
          "description": "Account",
          "readOnly": true,
          "type": "string"
        },
        "apiName": {
          "description": "Resource API name",
          "readOnly": true,
          "type": "string"
        },
        "cloudType": {
          "description": "Cloud type",
          "enum": [
            "ALL",
            "AWS",
            "AZURE",
            "GCP",
            "ALIBABA_CLOUD",
            "OCI",
            "IBM"
          ],
          "readOnly": true,
          "type": "string"
        },
        "insert_ts": {
          "description": "Insertion timestamp",
          "format": "int64",
          "readOnly": true,
          "type": "integer"
        },
        "region": {
          "description": "Region",
          "readOnly": true,
          "type": "string"
        },
        "resource": {
          "description": "Resource",
          "readOnly": true,
          "type": "string"
        },
        "resourceApiId": {
          "description": "Resource API ID",
          "format": "int32",
          "type": "integer"
        },
        "type": {
          "description": "Resource type",
          "readOnly": true,
          "type": "string"
        },
        "vpc": {
          "description": "VCP",
          "readOnly": true,
          "type": "string"
        }
      },
      "type": "object"
    },
    "UserAgentBrowser": {
      "properties": {
        "hash": {
          "format": "int32",
          "type": "integer"
        },
        "id": {
          "format": "int32",
          "type": "integer"
        },
        "name": {
          "type": "string"
        }
      },
      "type": "object"
    },
    "UserAgentOs": {
      "properties": {
        "hash": {
          "format": "int32",
          "type": "integer"
        },
        "id": {
          "format": "int32",
          "type": "integer"
        },
        "name": {
          "type": "string"
        }
      },
      "type": "object"
    }
  }
}