{"actor":{"alternateId":"username@elastic.co","detailEntry":null,"displayName":"xxxxxx","id":"00u1abvz4pYqdM8ms4x6","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102nZHzd6OHSfGG51vsoc22gw","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"id":null,"ipAddress":"175.16.199.1","userAgent":{"browser":"FIREFOX","os":"Mac OS X","rawUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"},"zone":"null"},"debugContext":{"debugData":{"authnRequestId":"XkcAsWb8WjwDP76xh@1v8wAABp0","requestId":"XkccyyMli2Uay2I93ZgRzQAAB0c","requestUri":"/login/signout","threatSuspected":"false","url":"/login/signout?message=login_page_messages.session_has_expired"}},"displayMessage":"User logout from Okta","eventType":"user.session.end","legacyEventType":"core.user_auth.logout_success","outcome":{"reason":null,"result":"SUCCESS"},"published":"2020-02-14T22:18:51.843Z","request":{"ipChain":[{"geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"ip":"175.16.199.1","source":null,"version":"V4"}]},"securityContext":{"asNumber":null,"asOrg":null,"domain":null,"isProxy":null,"isp":null},"severity":"INFO","target":null,"transaction":{"detail":{},"id":"XkccyyMli2Uay2I93ZgRzQAAB0c","type":"WEB"},"uuid":"faf7398a-4f77-11ea-97fb-5925e98228bd","version":"0"}
{"actor":{"alternateId":"xxxxxx@elastic.co","detailEntry":null,"displayName":"xxxxxx","id":"00u1abvz4pYqdM8ms4x6","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102bZDNFfWaQSyEZQuDgWt-uQ","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"id":null,"ipAddress":"175.16.199.1","userAgent":{"browser":"FIREFOX","os":"Mac OS X","rawUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"},"zone":"null"},"debugContext":{"debugData":{"deviceFingerprint":"541daf91d15bef64a7e08c946fd9a9d0","requestId":"XkcAsWb8WjwDP76xh@1v8wAABp0","requestUri":"/api/v1/authn","threatSuspected":"false","url":"/api/v1/authn?"}},"displayMessage":"User login to Okta","eventType":"user.session.start","legacyEventType":"core.user_auth.login_success","outcome":{"reason":null,"result":"SUCCESS"},"published":"2020-02-14T20:18:57.718Z","request":{"ipChain":[{"geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"ip":"175.16.199.1","source":null,"version":"V4"}]},"securityContext":{"asNumber":null,"asOrg":null,"domain":null,"isProxy":null,"isp":null},"severity":"INFO","target":null,"transaction":{"detail":{},"id":"XkcAsWb8WjwDP76xh@1v8wAABp0","type":"WEB"},"uuid":"3aeede38-4f67-11ea-abd3-1f5d113f2546","version":"0"}
{"actor":{"alternateId":"xxxxxx@elastic.co","detailEntry":null,"displayName":"xxxxxx","id":"00u1abvz4pYqdM8ms4x6","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102bZDNFfWaQSyEZQuDgWt-uQ","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"id":null,"ipAddress":"175.16.199.1","userAgent":{"browser":"FIREFOX","os":"Mac OS X","rawUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"},"zone":"null"},"debugContext":{"debugData":{"deviceFingerprint":"541daf91d15bef64a7e08c946fd9a9d0","requestId":"XkcAsWb8WjwDP76xh@1v8wAABp0","requestUri":"/api/v1/authn","threatSuspected":"false","url":"/api/v1/authn?"}},"displayMessage":"Evaluation of sign-on policy","eventType":"policy.evaluate_sign_on","legacyEventType":null,"outcome":{"reason":"Sign-on policy evaluation resulted in ALLOW","result":"ALLOW"},"published":"2020-02-14T20:18:57.762Z","request":{"ipChain":[{"geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"ip":"175.16.199.1","source":null,"version":"V4"}]},"securityContext":{"asNumber":null,"asOrg":null,"domain":null,"isProxy":null,"isp":null},"severity":"INFO","target":[{"alternateId":"unknown","detailEntry":{"policyType":"OktaSignOn"},"displayName":"Default Policy","id":"00p1abvweGGDW10Ur4x6","type":"PolicyEntity"},{"alternateId":"00p1abvweGGDW10Ur4x6","detailEntry":null,"displayName":"Default Rule","id":"0pr1abvwfqGFI4n064x6","type":"PolicyRule"}],"transaction":{"detail":{},"id":"XkcAsWb8WjwDP76xh@1v8wAABp0","type":"WEB"},"uuid":"3af594f9-4f67-11ea-abd3-1f5d113f2546","version":"0"}
{"actor":{"alternateId":"someusername@elastic.co","detailEntry":null,"displayName":"xxxxxx","id":"00u1abvz4pYqdM8ms4x6","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102nZHzd6OHSfGG51vsoc22gw","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"id":null,"ipAddress":"175.16.199.1","userAgent":{"browser":"FIREFOX","os":"Mac OS X","rawUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"},"zone":"null"},"debugContext":{"debugData":{"authnRequestId":"XkcAsWb8WjwDP76xh@1v8wAABp0","requestId":"XkccyyMli2Uay2I93ZgRzQAAB0c","requestUri":"/login/signout","threatSuspected":"false","url":"/login/signout?message=login_page_messages.session_has_expired"}},"displayMessage":"User logout from Okta","eventType":"user.session.end","legacyEventType":"core.user_auth.logout_success","outcome":{"reason":null,"result":"SUCCESS"},"published":"2020-02-14T22:18:51.843Z","request":{"ipChain":[{"geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"ip":"175.16.199.1","source":null,"version":"V4"}]},"securityContext":{"asNumber":null,"asOrg":null,"domain":null,"isProxy":null,"isp":null},"severity":"INFO","target":null,"transaction":{"detail":{},"id":"XkccyyMli2Uay2I93ZgRzQAAB0c","type":"WEB"},"uuid":"faf7398a-4f77-11ea-97fb-5925e98228bd","version":"0"}
{"actor":{"alternateId":"xxxxxx@elastic.co","detailEntry":null,"displayName":"xxxxxx","id":"00u1abvz4pYqdM8ms4x6","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102bZDNFfWaQSyEZQuDgWt-uQ","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"id":null,"ipAddress":"175.16.199.1","userAgent":{"browser":"FIREFOX","os":"Mac OS X","rawUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"},"zone":"null"},"debugContext":{"debugData":{"deviceFingerprint":"541daf91d15bef64a7e08c946fd9a9d0","requestId":"XkcAsWb8WjwDP76xh@1v8wAABp0","requestUri":"/api/v1/authn","threatSuspected":"false","url":"/api/v1/authn?"}},"displayMessage":"User login to Okta","eventType":"user.session.start","legacyEventType":"core.user_auth.login_success","outcome":{"reason":null,"result":"SUCCESS"},"published":"2020-02-14T20:18:57.718Z","request":{"ipChain":[{"geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"ip":"175.16.199.1","source":null,"version":"V4"}]},"securityContext":{"asNumber":null,"asOrg":null,"domain":null,"isProxy":null,"isp":null},"severity":"INFO","target":null,"transaction":{"detail":{},"id":"XkcAsWb8WjwDP76xh@1v8wAABp0","type":"WEB"},"uuid":"3aeede38-4f67-11ea-abd3-1f5d113f2546","version":"0"}
{"actor":{"alternateId":"xxxxxx@elastic.co","detailEntry":null,"displayName":"xxxxxx","id":"00u1abvz4pYqdM8ms4x6","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102bZDNFfWaQSyEZQuDgWt-uQ","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"id":null,"ipAddress":"175.16.199.1","userAgent":{"browser":"FIREFOX","os":"Mac OS X","rawUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"},"zone":"null"},"debugContext":{"debugData":{"deviceFingerprint":"541daf91d15bef64a7e08c946fd9a9d0","requestId":"XkcAsWb8WjwDP76xh@1v8wAABp0","requestUri":"/api/v1/authn","threatSuspected":"false","url":"/api/v1/authn?"}},"displayMessage":"Evaluation of sign-on policy","eventType":"policy.evaluate_sign_on","legacyEventType":null,"outcome":{"reason":"Sign-on policy evaluation resulted in ALLOW","result":"ALLOW"},"published":"2020-02-14T20:18:57.762Z","request":{"ipChain":[{"geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"ip":"175.16.199.1","source":null,"version":"V4"}]},"securityContext":{"asNumber":null,"asOrg":null,"domain":null,"isProxy":null,"isp":null},"severity":"INFO","target":[{"alternateId":"unknown","detailEntry":{"policyType":"OktaSignOn"},"displayName":"Default Policy","id":"00p1abvweGGDW10Ur4x6","type":"PolicyEntity"},{"alternateId":"00p1abvweGGDW10Ur4x6","detailEntry":null,"displayName":"Default Rule","id":"0pr1abvwfqGFI4n064x6","type":"PolicyRule"}],"transaction":{"detail":{},"id":"XkcAsWb8WjwDP76xh@1v8wAABp0","type":"WEB"},"uuid":"3af594f9-4f67-11ea-abd3-1f5d113f2546","version":"0"}
{"actor":{"alternateId":"xxxxxx@elastic.co","detailEntry":null,"displayName":"xxxxxx","id":"00u1abvz4pYqdM8ms4x6","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102nZHzd6OHSfGG51vsoc22gw","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"id":null,"ipAddress":"175.16.199.1","userAgent":{"browser":"FIREFOX","os":"Mac OS X","rawUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"},"zone":"null"},"debugContext":{"debugData":{"authnRequestId":"XkcAsWb8WjwDP76xh@1v8wAABp0","requestId":"XkccyyMli2Uay2I93ZgRzQAAB0c","requestUri":"/login/signout","threatSuspected":"false","url":"/login/signout?message=login_page_messages.session_has_expired"}},"displayMessage":"User logout from Okta","eventType":"user.session.end","legacyEventType":"core.user_auth.logout_success","outcome":{"reason":null,"result":"SUCCESS"},"published":"2020-02-14T22:18:51.843Z","request":{"ipChain":[{"geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"ip":"175.16.199.1","source":null,"version":"V4"}]},"securityContext":{"asNumber":null,"asOrg":null,"domain":null,"isProxy":null,"isp":null},"severity":"INFO","target":null,"transaction":{"detail":{},"id":"XkccyyMli2Uay2I93ZgRzQAAB0c","type":"WEB"},"uuid":"faf7398a-4f77-11ea-97fb-5925e98228bd","version":"0"}
{"actor":{"alternateId":"xxxxxx@elastic.co","detailEntry":null,"displayName":"xxxxxx","id":"00u1abvz4pYqdM8ms4x6","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102bZDNFfWaQSyEZQuDgWt-uQ","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"id":null,"ipAddress":"175.16.199.1","userAgent":{"browser":"FIREFOX","os":"Mac OS X","rawUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"},"zone":"null"},"debugContext":{"debugData":{"deviceFingerprint":"541daf91d15bef64a7e08c946fd9a9d0","requestId":"XkcAsWb8WjwDP76xh@1v8wAABp0","requestUri":"/api/v1/authn","threatSuspected":"false","url":"/api/v1/authn?"}},"displayMessage":"User login to Okta","eventType":"user.session.start","legacyEventType":"core.user_auth.login_success","outcome":{"reason":null,"result":"SUCCESS"},"published":"2020-02-14T20:18:57.718Z","request":{"ipChain":[{"geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"ip":"175.16.199.1","source":null,"version":"V4"}]},"securityContext":{"asNumber":null,"asOrg":null,"domain":null,"isProxy":null,"isp":null},"severity":"INFO","target":null,"transaction":{"detail":{},"id":"XkcAsWb8WjwDP76xh@1v8wAABp0","type":"WEB"},"uuid":"3aeede38-4f67-11ea-abd3-1f5d113f2546","version":"0"}
{"actor":{"alternateId":"xxxxxx@elastic.co","detailEntry":null,"displayName":"xxxxxx","id":"00u1abvz4pYqdM8ms4x6","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102bZDNFfWaQSyEZQuDgWt-uQ","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"id":null,"ipAddress":"175.16.199.1","userAgent":{"browser":"FIREFOX","os":"Mac OS X","rawUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"},"zone":"null"},"debugContext":{"debugData":{"deviceFingerprint":"541daf91d15bef64a7e08c946fd9a9d0","requestId":"XkcAsWb8WjwDP76xh@1v8wAABp0","requestUri":"/api/v1/authn","threatSuspected":"false","url":"/api/v1/authn?"}},"displayMessage":"Evaluation of sign-on policy","eventType":"policy.evaluate_sign_on","legacyEventType":null,"outcome":{"reason":"Sign-on policy evaluation resulted in ALLOW","result":"ALLOW"},"published":"2020-02-14T20:18:57.762Z","request":{"ipChain":[{"geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"ip":"175.16.199.1","source":null,"version":"V4"}]},"securityContext":{"asNumber":null,"asOrg":null,"domain":null,"isProxy":null,"isp":null},"severity":"INFO","target":[{"alternateId":"unknown","detailEntry":{"policyType":"OktaSignOn"},"displayName":"Default Policy","id":"00p1abvweGGDW10Ur4x6","type":"PolicyEntity"},{"alternateId":"00p1abvweGGDW10Ur4x6","detailEntry":null,"displayName":"Default Rule","id":"0pr1abvwfqGFI4n064x6","type":"PolicyRule"}],"transaction":{"detail":{},"id":"XkcAsWb8WjwDP76xh@1v8wAABp0","type":"WEB"},"uuid":"3af594f9-4f67-11ea-abd3-1f5d113f2546","version":"0"}
{"actor":{"alternateId":"xxxxxx@elastic.co","detailEntry":null,"displayName":"xxxxxx","id":"00u1abvz4pYqdM8ms4x6","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102nZHzd6OHSfGG51vsoc22gw","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"id":null,"ipAddress":"null","userAgent":{"browser":"FIREFOX","os":"Mac OS X","rawUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"},"zone":"null"},"debugContext":{"debugData":{"authnRequestId":"XkcAsWb8WjwDP76xh@1v8wAABp0","requestId":"XkccyyMli2Uay2I93ZgRzQAAB0c","requestUri":"/login/signout","threatSuspected":"false","url":"/login/signout?message=login_page_messages.session_has_expired"}},"displayMessage":"User logout from Okta","eventType":"user.session.end","legacyEventType":"core.user_auth.logout_success","outcome":{"reason":null,"result":"SUCCESS"},"published":"2020-02-14T22:18:51.843Z","request":{"ipChain":[{"geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"ip":"175.16.199.1","source":null,"version":"V4"}]},"securityContext":{"asNumber":null,"asOrg":null,"domain":null,"isProxy":null,"isp":null},"severity":"INFO","target":null,"transaction":{"detail":{},"id":"XkccyyMli2Uay2I93ZgRzQAAB0c","type":"WEB"},"uuid":"faf7398a-4f77-11ea-97fb-5925e98228bd","version":"0"}
{"actor":{"alternateId":"xxxxxx@elastic.co","detailEntry":null,"displayName":"xxxxxx","id":"00u1abvz4pYqdM8ms4x6","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102bZDNFfWaQSyEZQuDgWt-uQ","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"id":null,"ipAddress":"null","userAgent":{"browser":"FIREFOX","os":"Mac OS X","rawUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"},"zone":"null"},"debugContext":{"debugData":{"deviceFingerprint":"541daf91d15bef64a7e08c946fd9a9d0","requestId":"XkcAsWb8WjwDP76xh@1v8wAABp0","requestUri":"/api/v1/authn","threatSuspected":"false","url":"/api/v1/authn?"}},"displayMessage":"User login to Okta","eventType":"user.session.start","legacyEventType":"core.user_auth.login_success","outcome":{"reason":null,"result":"SUCCESS"},"published":"2020-02-14T20:18:57.718Z","request":{"ipChain":[{"geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"ip":"175.16.199.1","source":null,"version":"V4"}]},"securityContext":{"asNumber":null,"asOrg":null,"domain":null,"isProxy":null,"isp":null},"severity":"INFO","target":null,"transaction":{"detail":{},"id":"XkcAsWb8WjwDP76xh@1v8wAABp0","type":"WEB"},"uuid":"3aeede38-4f67-11ea-abd3-1f5d113f2546","version":"0"}
{"actor":{"alternateId":"xxxxxx@elastic.co","detailEntry":null,"displayName":"xxxxxx","id":"00u1abvz4pYqdM8ms4x6","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102bZDNFfWaQSyEZQuDgWt-uQ","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"id":null,"ipAddress":"null","userAgent":{"browser":"FIREFOX","os":"Mac OS X","rawUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"},"zone":"null"},"debugContext":{"debugData":{"deviceFingerprint":"541daf91d15bef64a7e08c946fd9a9d0","requestId":"XkcAsWb8WjwDP76xh@1v8wAABp0","requestUri":"/api/v1/authn","threatSuspected":"false","url":"/api/v1/authn?"}},"displayMessage":"Evaluation of sign-on policy","eventType":"policy.evaluate_sign_on","legacyEventType":null,"outcome":{"reason":"Sign-on policy evaluation resulted in ALLOW","result":"ALLOW"},"published":"2020-02-14T20:18:57.762Z","request":{"ipChain":[{"geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"ip":"175.16.199.1","source":null,"version":"V4"}]},"securityContext":{"asNumber":null,"asOrg":null,"domain":null,"isProxy":null,"isp":null},"severity":"INFO","target":[{"alternateId":"unknown","detailEntry":{"policyType":"OktaSignOn"},"displayName":"Default Policy","id":"00p1abvweGGDW10Ur4x6","type":"PolicyEntity"},{"alternateId":"00p1abvweGGDW10Ur4x6","detailEntry":null,"displayName":"Default Rule","id":"0pr1abvwfqGFI4n064x6","type":"PolicyRule"}],"transaction":{"detail":{},"id":"XkcAsWb8WjwDP76xh@1v8wAABp0","type":"WEB"},"uuid":"3af594f9-4f67-11ea-abd3-1f5d113f2546","version":"0"}
{"actor":{"alternateId":"test@test.com","detailEntry":null,"displayName":"test@test.com","id":"00u1abvz4pYqdM8ms4x6","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"xxxxxx","interface":null,"issuer":null},"client":{"device":"Unknown","geographicalContext":{"city":"Ashburn","country":"United States","geolocation":{"lat":39.1469,"lon":-77.5903},"postalCode":"20149","state":"Virginia"},"id":null,"ipAddress":"81.2.69.144","userAgent":{"browser":"UNKNOWN","os":"Unknown","rawUserAgent":"blah"},"zone":"null"},"debugContext":{"debugData":{"logOnlySecurityData":"{\"risk\":{\"reasons\":\"Anomalous Location, Anomalous Device\",\"level\":\"HIGH\"},\"behaviors\":{\"New Geo-Location\":\"POSITIVE\",\"New Device\":\"BAD_REQUEST\",\"New IP\":\"POSITIVE\",\"New State\":\"POSITIVE\",\"New Country\":\"POSITIVE\",\"Velocity\":\"NEGATIVE\",\"New City\":\"POSITIVE\"}}","originalPrincipal":{"alternateId":"test@test.com","detailEntry":null,"displayName":"Test","id":"00u1abvz4pYqdM8ms4x6","type":"User"},"requestId":"XkccyyMli2Uay2I93ZgRzQAAB0c","requestUri":"/api/v1/authn","threatSuspected":"false","url":"/api/v1/authn?"}},"device":null,"displayMessage":"User login to Okta","eventType":"user.session.start","legacyEventType":"core.user_auth.login_success","outcome":{"reason":null,"result":"SUCCESS"},"published":"2022-05-11T09:25:18.716Z","request":{"ipChain":[{"geographicalContext":{"city":"Ashburn","country":"United States","geolocation":{"lat":39.1469,"lon":-77.5903},"postalCode":"20149","state":"Virginia"},"ip":"81.2.69.144","source":null,"version":"V4"}]},"securityContext":{"asNumber":14618,"asOrg":"amazon data services nova","domain":"amazonaws.com","isProxy":false,"isp":"amazon.com  inc."},"severity":"INFO","target":null,"transaction":{"detail":{"requestApiTokenId":"MDU0ZTEyM2QwYjc2N2FiZDI2YzViZDRiODVkNGNhZDFkZjg4YjU2ZiAgLQo="},"id":"00u1abvz4pYqdM8ms4x6","type":"WEB"},"uuid":"faf7398a-4f77-11ea-97fb-5925e98228bd","version":"0"}
{"actor":{"alternateId":"test1@test.com","detailEntry":null,"displayName":"None","id":"00u1abvz4pYqdM8ms4x6","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102nZHzd6OHSfGG51vsoc22gw","interface":null,"issuer":null},"client":{"device":"Mobile","geographicalContext":{"city":"Purcellville","country":"United States","geolocation":{"lat":39.64,"lon":-77.8346},"postalCode":"20132","state":"Virginia"},"id":null,"ipAddress":"67.43.156.14","userAgent":{"browser":"SAFARI","os":"Mac OS X (iPhone)","rawUserAgent":"Mozilla/5.0 (iPhone; CPU iPhone OS 15_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 Safari"},"zone":"null"},"debugContext":{"debugData":{"authnRequestId":"XkcAsWb8WjwDP76xh@1v8wAABp0","behaviors":"{New Geo-Location=NEGATIVE, New Device=NEGATIVE, New IP=NEGATIVE, New State=NEGATIVE, New Country=NEGATIVE, New City=NEGATIVE}","deviceFingerprint":"541daf91d15bef64a7e08c946fd9a9d0","requestId":"XkccyyMli2Uay2I93ZgRzQAAB0c","requestUri":"/api/v1/authn/factors/ZmZmOTQ3Yjk5MTh/verify","risk":"{level=LOW}","threatSuspected":"false","url":"/api/v1/authn/factors/ZmZmOTQ3Yjk5MTh/verify?autoPush=false\u0026rememberDevice=false"}},"device":null,"displayMessage":"Verify user identity","eventType":"user.authentication.verify","legacyEventType":null,"outcome":{"reason":null,"result":"SUCCESS"},"published":"2022-05-11T09:27:08.708Z","request":{"ipChain":[{"geographicalContext":{"city":"Purcellville","country":"United States","geolocation":{"lat":39.64,"lon":-77.8346},"postalCode":"20132","state":"Virginia"},"ip":"67.43.156.14","source":null,"version":"V4"}]},"securityContext":{"asNumber":7922,"asOrg":"comcast","domain":"comcast.net","isProxy":false,"isp":"comcast"},"severity":"INFO","target":null,"transaction":{"detail":{},"id":"00u1abvz4pYqdM8ms4x6","type":"WEB"},"uuid":"faf7398a-4f77-11ea-97fb-5925e98228bd","version":"0"}
{"actor":{"alternateId":"Snipped_User@domain.com","detailEntry":null,"displayName":"Last_name, First_Name","id":"user_id","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102qmxOh1EdTHqn1_86CB9fzA","interface":null,"issuer":null},"client":{"device":"unknown","geographicalContext":{"city":"City","country":"Country","geolocation":{"lat":0.00,"lon":0.00},"postalCode":"00000","state":"State"},"id":null,"ipAddress":"81.2.69.144","userAgent":{"browser":"unknown","os":"unknown","rawUserAgent":"unknown"},"zone":"null"},"debugContext":{"debugData":{"authnRequestId":"Y5elHFMngoYoVKvakwnp2wAAAKo","behaviors":"{New Geo-Location=NEGATIVE, New Device=POSITIVE, New IP=NEGATIVE, New State=NEGATIVE, New Country=NEGATIVE, Velocity=POSITIVE, New City=NEGATIVE}","dtHash":"751b157a5a24ed83129433243e8d42307434b047120c32d7a7f5a5d2d91726fa","requestId":"Y5elHFMngoYoVKvakwnp2wAAAKo","requestUri":"/api/v1/authn","risk":"{reasons=Anomalous Device, Anomalous Location, level=HIGH}","threatSuspected":"false","url":"/api/v1/authn?"}},"device":null,"displayMessage":"Verify user identity","eventType":"user.authentication.verify","legacyEventType":null,"outcome":{"reason":null,"result":"SUCCESS"},"published":"2022-12-12T22:03:08.791Z","request":{"ipChain":[{"geographicalContext":{"city":"City","country":"Country","geolocation":{"lat":0.00,"lon":0.00},"postalCode":"00000","state":"State"},"ip":"81.2.69.144","source":null,"version":"V4"}]},"securityContext":{"asNumber":1828,"asOrg":"org","domain":"domain.com","isProxy":false,"isp":"isp"},"severity":"INFO","target":null,"transaction":{"detail":{},"id":"Y5elHFMngoYoVKvakwnp2wAAAKo","type":"WEB"},"uuid":"c32ae8ec-7a68-11ed-b8a7-9134a086ef85","version":"0"}
{"actor":{"alternateId":"user@domain.com","detailEntry":null,"displayName":"first last","id":"id","type":"User"},"authenticationContext":{"authenticationProvider":"FACTOR_PROVIDER","authenticationStep":0,"credentialProvider":"OKTA_CREDENTIAL_PROVIDER","credentialType":null,"externalSessionId":"uuid","interface":null,"issuer":null},"client":{"device":"Mobile","geographicalContext":{"city":"Lucerne","country":"Switzerland","geolocation":{"lat":47.0511,"lon":8.3056},"postalCode":"6007","state":"Lucerne"},"id":null,"ipAddress":"127.0.0.1","userAgent":{"browser":"UNKNOWN","os":"Unknown mobile","rawUserAgent":"B7FdsdB65BN.com.okta.mobile/7.12.0 OktaVerify/7.12.0 iOS/16.1.2 Apple/iPhone14,2 6C743C36-ewew-400D-8FB9-A5F049A745CF"},"zone":"null"},"debugContext":{"debugData":{"authnRequestId":"uuid","behaviors":"{New Geo-Location=NEGATIVE, New Device=NEGATIVE, New IP=NEGATIVE, New State=NEGATIVE, Velocity Behavior=NEGATIVE, New Country=NEGATIVE, New City=NEGATIVE}","factor":"OKTA_VERIFY_PUSH","requestId":"uuid","requestUri":"/api/v1/authn/factors/id/transactions/id/verify","risk":"{level=LOW}","threatSuspected":"false","url":"/api/v1/authn/factors/id/transactions/id/verify?"}},"device":null,"displayMessage":"Authentication of user via MFA","eventType":"user.authentication.auth_via_mfa","legacyEventType":"core.user.factor.attempt_success","outcome":{"reason":null,"result":"SUCCESS"},"published":"2023-02-06T08:56:36.909Z","request":{"ipChain":[{"geographicalContext":{"city":"Lucerne","country":"Switzerland","geolocation":{"lat":47.0511,"lon":8.3056},"postalCode":"6007","state":"Lucerne"},"ip":"127.0.0.1","source":null,"version":"V4"}]},"securityContext":{"asNumber":3303,"asOrg":"bluewin is an lir and isp in switzerland.","domain":"swisscom.ch","isProxy":false,"isp":"swisscom (schweiz) ag"},"severity":"INFO","target":[{"alternateId":"user@domain.com","detailEntry":null,"displayName":"first last","id":"id","type":"User"}],"transaction":{"detail":{},"id":"uuid","type":"WEB"},"uuid":"uuid","version":"0"}
{"actor":{"alternateId":"name@domain.com","detailEntry":null,"displayName":"first last","id":"id","type":"User"},"authenticationContext":{"authenticationProvider":"FACTOR_PROVIDER","authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"id","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Bredstedt","country":"Germany","geolocation":{"lat":54.6208,"lon":8.9631},"postalCode":"25821","state":"Schleswig-Holstein"},"id":null,"ipAddress":"127.0.0.1","userAgent":{"browser":"FIREFOX","os":"Linux","rawUserAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0"},"zone":"null"},"debugContext":{"debugData":{"authnRequestId":"id","behaviors":"{New Geo-Location=POSITIVE, New Device=NEGATIVE, New IP=POSITIVE, New State=NEGATIVE, Velocity Behavior=NEGATIVE, New Country=NEGATIVE, New City=POSITIVE}","deviceFingerprint":"id","dtHash":"hash","factor":"FIDO_WEBAUTHN","promptingPolicyTypes":"[OKTA_SIGN_ON]","requestId":"id","requestUri":"/api/v1/authn/factors/webauthn/verify","risk":"{level=LOW}","threatSuspected":"false","url":"/api/v1/authn/factors/webauthn/verify?rememberDevice=false"}},"device":null,"displayMessage":"Authentication of user via MFA","eventType":"user.authentication.auth_via_mfa","legacyEventType":"core.user.factor.attempt_success","outcome":{"reason":null,"result":"SUCCESS"},"published":"2023-02-06T08:58:37.110Z","request":{"ipChain":[{"geographicalContext":{"city":"Bredstedt","country":"Germany","geolocation":{"lat":54.6208,"lon":8.9631},"postalCode":"25821","state":"Schleswig-Holstein"},"ip":"127.0.0.1","source":null,"version":"V4"}]},"securityContext":{"asNumber":62336,"asOrg":"customer access","domain":"german-local.net","isProxy":false,"isp":"purtel.com gmbh"},"severity":"INFO","target":[{"alternateId":"name@domain.com","detailEntry":null,"displayName":"first last","id":"id","type":"User"}],"transaction":{"detail":{},"id":"id","type":"WEB"},"uuid":"uuid","version":"0"}
{"actor":{"alternateId":"name@domain.com","detailEntry":null,"displayName":"first last","id":"id","type":"User"},"authenticationContext":{"authenticationProvider":"FACTOR_PROVIDER","authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"id","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Bredstedt","country":"Germany","geolocation":{"lat":54.6208,"lon":8.9631},"postalCode":"25821","state":"Schleswig-Holstein"},"id":null,"ipAddress":"127.0.0.1","userAgent":{"browser":"FIREFOX","os":"Linux","rawUserAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0"},"zone":"null"},"debugContext":{"debugData":{"authnRequestId":"id","behaviors":"{New Geo-Location=POSITIVE, New Device=NEGATIVE, New IP=POSITIVE, New State=NEGATIVE, Velocity Behavior=NEGATIVE, New Country=NEGATIVE, New City=POSITIVE}","deviceFingerprint":"id","dtHash":"hash","factor":"FIDO_WEBAUTHN","promptingPolicyTypes":"[OKTA_SIGN_ON]","requestId":"id","requestUri":"/api/v1/authn/factors/webauthn/verify","risk":"{level=LOW}","threatSuspected":"false","url":"/api/v1/authn/factors/webauthn/verify?rememberDevice=false"}},"device":null,"displayMessage":"Authentication of user via MFA","eventType":"user.authentication.auth_via_mfa","legacyEventType":"core.user.factor.attempt_success","outcome":{"reason":null,"result":"SUCCESS"},"published":"2023-02-06T08:58:37.110Z","request":{"ipChain":[{"geographicalContext":{"city":"Bredstedt","country":"Germany","geolocation":{"lat":54.6208,"lon":8.9631},"postalCode":"25821","state":"Schleswig-Holstein"},"ip":"127.0.0.1","source":null,"version":"V4"}]},"securityContext":{"asNumber":62336,"asOrg":"customer access","domain":"german-local.net","isProxy":false,"isp":"purtel.com gmbh"},"severity":"INFO","target":[{"alternateId":"target_user@blah.co","detailEntry":null,"displayName":"Test Target User","id":"00udfsat7","type":"User"},{"alternateId":"unknown","detailEntry":null,"displayName":"software-users","id":"00gofdasfdsat7","type":"UserGroup"}],"transaction":{"detail":{},"id":"id","type":"WEB"},"uuid":"uuid","version":"0"}
{"actor":{"alternateId":"actor.user@test.com","detailEntry":null,"displayName":"Test Actor User","id":"randomidhere","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"602deqxi8mycjkwk3sth4ci6cxxtr9rr","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"San Francisco","country":"United States","geolocation":{"lat":37.7642,"lon":-122.3993},"postalCode":"94107","state":"California"},"id":null,"ipAddress":"192.168.7.19","userAgent":{"browser":"CHROME","os":"Mac OS X","rawUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36"},"zone":"null"},"debugContext":{"debugData":{"dtHash":"veqflnui3t7ql7k6v0nptw9lipilzybr","requestId":"3bsdgs8tyatf74aufwsvkt7lv1i9x0o9","requestUri":"/admin/group/h23gdxfk7jc8kf5fb923xc1lt5ojey93/addUser","url":"/admin/group/h23gdxfk7jc8kf5fb923xc1lt5ojey93/addUser?"}},"device":null,"displayMessage":"Add user to group membership","eventType":"group.user_membership.add","legacyEventType":"core.user_group_member.user_add","outcome":{"reason":null,"result":"SUCCESS"},"published":"2023-04-26T16:25:06.297Z","request":{"ipChain":[{"geographicalContext":{"city":"San Francisco","country":"United States","geolocation":{"lat":37.7642,"lon":-122.3993},"postalCode":"94107","state":"California"},"ip":"192.168.7.19","source":null,"version":"V4"}]},"securityContext":{"asNumber":6461,"asOrg":"elasticsearch inc","domain":"thisisadomain.com","isProxy":false,"isp":"bandwidth"},"severity":"INFO","target":[{"alternateId":"target.user@test.com","detailEntry":null,"displayName":"Target User Test Name","id":"7cexsxmg5m671po4lmyb29a0knaqpaqg","type":"User"},{"alternateId":"unknown","detailEntry":null,"displayName":"Sales","id":"h23gdxfk7jc8kf5fb923xc1lt5ojey93","type":"UserGroup"}],"transaction":{"detail":{},"id":"448ahm88tkkxo0npwiu28ws20oj38nya","type":"WEB"},"uuid":"B96ED4D1-D013-4A13-AEFE-A67FA32C5747","version":"0"}
{"actor":{"alternateId":"system@okta.com","detailEntry":null,"displayName":"Okta System","id":"spr294puarJOdUsWD1t7","type":"SystemPrincipal"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"4ivdy6m56cqo8s6w57o6cvq5fbb409wr","interface":null,"issuer":null},"client":{"device":null,"geographicalContext":null,"id":null,"ipAddress":null,"userAgent":null,"zone":null},"debugContext":{"debugData":{}},"device":null,"displayMessage":"Successfully imported new member to an app group","eventType":"app.user_management","legacyEventType":"app.user_management.app_group_member_import.insert_success","outcome":{"reason":null,"result":"SUCCESS"},"published":"2023-04-27T00:56:17.750Z","request":{"ipChain":[]},"securityContext":{"asNumber":null,"asOrg":null,"domain":null,"isProxy":null,"isp":null},"severity":"INFO","target":[{"alternateId":"domain.user@test.com","detailEntry":null,"displayName":"domain.user@test.com","id":"ew1qskfvt7mvqipcx6hxt3j95pqi01p8","type":"AppUser"},{"alternateId":"group_email@test.com","detailEntry":null,"displayName":"Payable","id":"l2l6h6p946io0fwyd3jw7jzgy8sq6a61","type":"AppGroup"},{"alternateId":"domain.user@test.com","detailEntry":null,"displayName":"Domain User","id":"9uuw5t9im68f03w5b9a3x72i18gugbqn","type":"User"},{"alternateId":"G Suite","detailEntry":null,"displayName":"Google Workspace","id":"1a45g3hf19hvzgggw2ybn7e5q7xh0v4a","type":"AppInstance"}],"transaction":{"detail":{},"id":"37r7dugr7fswsjdzv4r97layultdf19r","type":"JOB"},"uuid":"23A8F6AA-0E52-45F7-A2FB-FEF6E0B38FC7","version":"0"}
{"actor":{"alternateId":"test.user@test.com","detailEntry":null,"displayName":"Test User","id":"00uk123456abct7","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"idxabcdefg123zA","interface":null,"issuer":null},"client":{},"debugContext":{},"device":{"device_integrator":null,"disk_encryption_type":"ALL_INTERNAL_VOLUMES","id":"abcdefghijklmnop","jailbreak":null,"managed":false,"name":"MacBookPro14,2","os_platform":"OSX","os_version":"12.6.6","registered":true,"screen_lock_type":"PASSCODE","secure_hardware_present":true},"displayMessage":"User single sign on to app","eventType":"user.authentication.sso","legacyEventType":"app.auth.sso","outcome":{"reason":null,"result":"SUCCESS"},"published":"2023-05-23T19:39:49.513Z","request":{"ipChain":[{"geographicalContext":{"city":"Lawn Park","country":"United States","geolocation":{"lat":47.8907,"lon":-87.7908},"postalCode":"999999","state":"California"},"ip":"192.168.1.10","source":null,"version":"V4"}]},"securityContext":{"asNumber":7018,"asOrg":"at&t corp.","domain":"sbcglobal.net","isProxy":false,"isp":"att services inc"},"severity":"INFO","target":[{"alternateId":"Wiki","detailEntry":{"signOnModeType":"SAML_2_0"},"displayName":"An App Server","id":"0o123456abcdef1t7","type":"AppInstance"},{"alternateId":"test.user@test.com","detailEntry":null,"displayName":"Test User","id":"0ustyhdhurhjtdrhh1t7","type":"AppUser"}],"transaction":{"detail":{},"id":"ZGmw","type":"WEB"},"uuid":"2D6FC3CC-3BFB-4AC1-8259-016CF6A5976C","version":"0"}
{"actor":{"alternateId":"test.user@test.com","detailEntry":null,"displayName":"Test User","id":"00uk123456abct7","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"idxabcdefg123zA","interface":null,"issuer":null},"client":{},"debugContext":{},"device":{"device_integrator":"{\"WSC\":{},\"CROWDSTRIKE\":{}}","disk_encryption_type":"ALL_INTERNAL_VOLUMES","id":"V9YPwc5tnhWcaLs3","jailbreak":null,"managed":false,"name":"MacBookPro18,2","os_platform":"OSX","os_version":"13.3.1","registered":true,"screen_lock_type":"BIOMETRIC","secure_hardware_present":true},"displayMessage":"User single sign on to app","eventType":"user.authentication.sso","legacyEventType":"app.auth.sso","outcome":{"reason":null,"result":"SUCCESS"},"published":"2023-05-23T19:39:49.513Z","request":{"ipChain":[{"geographicalContext":{"city":"Lawn Park","country":"United States","geolocation":{"lat":47.8907,"lon":-87.7908},"postalCode":"999999","state":"California"},"ip":"192.168.1.10","source":null,"version":"V4"}]},"securityContext":{"asNumber":7018,"asOrg":"at&t corp.","domain":"sbcglobal.net","isProxy":false,"isp":"att services inc"},"severity":"INFO","target":[{"alternateId":"Wiki","detailEntry":{"signOnModeType":"SAML_2_0"},"displayName":"An App Server","id":"0o123456abcdef1t7","type":"AppInstance"},{"alternateId":"test.user@test.com","detailEntry":null,"displayName":"Test User","id":"0ustyhdhurhjtdrhh1t7","type":"AppUser"}],"transaction":{"detail":{},"id":"ZGmw","type":"WEB"},"uuid":"2D6FC3CC-3BFB-4AC1-8259-016CF6A5976C","version":"0"}
{"actor":{"alternateId":"test.user@domain.com","detailEntry":null,"displayName":"Test User","id":"00ua123456abcat7","type":"User"},"authenticationContext":{"authenticationProvider":"FACTOR_PROVIDER","authenticationStep":0,"credentialProvider":"OKTA_CREDENTIAL_PROVIDER","credentialType":null,"externalSessionId":"idx123456asdsajA","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Palezieux","country":"Switzerland","geolocation":{"lat":46.5379,"lon":6.8409},"postalCode":"1607","state":"Vaud"},"id":null,"ipAddress":"192.168.1.10","userAgent":{"browser":"UNKNOWN","os":"Mac OS X","rawUserAgent":"B7F62B65BN.com.okta.mobile/3.13.4 OktaDeviceSDK/0.0.1 macOS/13.3.1 Apple/MacBookPro18,2 UUID123"},"zone":"null"},"debugContext":{"debugData":{"dtHash":"abc123456abc","factor":"SIGNED_NONCE","requestId":"123456abcdefghij","requestUri":"/idp/authenticators/123456abcdefghij/transactions/123456abcdefghij/verify","url":"/idp/authenticators/123456abcdefghij/transactions/123456abcdefghij/verify?"}},"device":null,"displayMessage":"Authentication of user via MFA","eventType":"user.authentication.auth_via_mfa","legacyEventType":"core.user.factor.attempt_success","outcome":{"reason":null,"result":"SUCCESS"},"published":"2023-05-22T12:11:48.092Z","request":{"ipChain":[{"geographicalContext":{"city":"Palezieux","country":"Switzerland","geolocation":{"lat":46.5379,"lon":6.8409},"postalCode":"1607","state":"Vaud"},"ip":"192.168.1.10","source":null,"version":"V4"}]},"securityContext":{"asNumber":39544,"asOrg":"vo energies catv customers - region of oron/vd","domain":"voenergies.net","isProxy":false,"isp":"vo energies multimedia sa"},"severity":"INFO","target":[{"alternateId":"test.user@domain.com","detailEntry":null,"displayName":"Test User","id":"00ua123456abcat7","type":"User"},{"alternateId":"unknown","detailEntry":{"methodTypeUsed":"Use Okta FastPass","methodUsedVerifiedProperties":"[DEVICE_BOUND, PHISHING_RESISTANT, USER_VERIFYING, USER_PRESENCE, HARDWARE_PROTECTED]"},"displayName":"Okta Verify","id":"00ua123456abcat7","type":"AuthenticatorEnrollment"}],"transaction":{"detail":{},"id":"00ua123456abcat7","type":"WEB"},"uuid":"150A5E5C-C236-426A-A0D1-B79F1E391A6B","version":"0"}
{"actor":{"alternateId":"john.doe@elastic.co","detailEntry":null,"displayName":"John Doe","id":"00aabbccddeeffaaaaaa","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"abcdefghijklM-NopQrsTUvWx","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Bay Shore","country":"United States","geolocation":{"lat":40.7051,"lon":-73.243},"postalCode":"11706","state":"New York"},"id":null,"ipAddress":"192.168.1.10","userAgent":{"browser":"UNKNOWN","os":"Mac OS X","rawUserAgent":"FAKEFAKEFAKE.com.okta.mobile/8.1.1 OktaDeviceSDK/0.0.1 macOS/13.4.0 Apple/MacBookPro16,2 RANDOM-AAAA-BBBB-CCCC-DDDDDDDDDDDD"},"zone":"null"},"debugContext":{"debugData":{"requestId":"XXXXXXXXXXXXXXXXXX","requestUri":"/idp/authenticators","url":"/idp/authenticators?"}},"device":null,"displayMessage":"Add device to user","eventType":"device.user.add","legacyEventType":null,"outcome":{"reason":null,"result":"SUCCESS"},"published":"2023-06-07T15:49:45.109Z","request":{"ipChain":[{"geographicalContext":{"city":"Bay Shore","country":"United States","geolocation":{"lat":40.7051,"lon":-73.243},"postalCode":"11706","state":"New York"},"ip":"175.16.199.18","source":null,"version":"V4"}]},"securityContext":{"asNumber":701,"asOrg":"verizon","domain":"verizon.net","isProxy":false,"isp":"verizon"},"severity":"INFO","target":[{"alternateId":"unknown","detailEntry":{"deviceStatus":"CREATED","managed":"false","oktaDeviceId":"xxxxxxxxxxxxxxxxx","osPlatform":"MACOS","osVersion":"13.4.0","serialNumber":"XXXXXXXX","tpmPresent":"false","uuid":"AAAAAAAA-CCCC-DDDD-EEEE-BBBBBBBBBBBB"},"displayName":"John's MacBook Pro","id":"fakefakefakefake","type":"UDDevice"}],"transaction":{"detail":{"requestApiTokenId":"aa.aa.bbbbbbbbbbbbbbbbbbbbbbb_wwwwwwwwwwwwwwww"},"id":"ABCDEFCGALKDJDLK","type":"WEB"},"uuid":"aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa","version":"0"}
{"actor":{"alternateId":"john.doe@elastic.co","detailEntry":null,"displayName":"John Doe","id":"00aabbccddeeffaaaaaa","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"abcdefghijklM-NopQrsTUvWx","interface":null,"issuer":null,"rootSessionId":"xYz123"},"client":{"device":"Computer","geographicalContext":{"city":"Bay Shore","country":"United States","geolocation":{"lat":40.7051,"lon":-73.243},"postalCode":"11706","state":"New York"},"id":null,"ipAddress":"192.168.1.10","userAgent":{"browser":"UNKNOWN","os":"Mac OS X","rawUserAgent":"FAKEFAKEFAKE.com.okta.mobile/8.1.1 OktaDeviceSDK/0.0.1 macOS/13.4.0 Apple/MacBookPro16,2 RANDOM-AAAA-BBBB-CCCC-DDDDDDDDDDDD"},"zone":"null"},"debugContext":{"debugData":{"requestId":"XXXXXXXXXXXXXXXXXX","requestUri":"/idp/authenticators","url":"/idp/authenticators?"}},"device":null,"displayMessage":"Add device to user","eventType":"device.user.add","legacyEventType":null,"outcome":{"reason":null,"result":"SUCCESS"},"published":"2023-06-07T15:49:45.109Z","request":{"ipChain":[{"geographicalContext":{"city":"Bay Shore","country":"United States","geolocation":{"lat":40.7051,"lon":-73.243},"postalCode":"11706","state":"New York"},"ip":"175.16.199.18","source":null,"version":"V4"}]},"securityContext":{"asNumber":701,"asOrg":"verizon","domain":"verizon.net","isProxy":false,"isp":"verizon"},"severity":"INFO","target":[{"alternateId":"unknown","detailEntry":{"deviceStatus":"CREATED","managed":"false","oktaDeviceId":"xxxxxxxxxxxxxxxxx","osPlatform":"MACOS","osVersion":"13.4.0","serialNumber":"XXXXXXXX","tpmPresent":"false","uuid":"AAAAAAAA-CCCC-DDDD-EEEE-BBBBBBBBBBBB"},"displayName":"John's MacBook Pro","id":"fakefakefakefake","type":"UDDevice"}],"transaction":{"detail":{"requestApiTokenId":"aa.aa.bbbbbbbbbbbbbbbbbbbbbbb_wwwwwwwwwwwwwwww","rootApiTokenId":"uIxB1234"},"id":"ABCDEFCGALKDJDLK","type":"WEB"},"uuid":"aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa","version":"0"}
{"actor":{"alternateId":"bob@example.com","detailEntry":null,"displayName":"Example Display Name","id":"2h6z8d9g3c1h5q0u0h","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"PPnOj1MkDzz017IOa7ibM1fVF","interface":null,"issuer":null,"rootSessionId":"trslP9xeLAISN2PxTGrXj33BA"},"client":{"device":"Unknown","geographicalContext":{"city":"Council Bluffs","country":"United States","geolocation":{"lat":41.2591,"lon":-95.8517},"postalCode":"51502","state":"Iowa"},"id":null,"ipAddress":"203.0.113.144","userAgent":{"browser":"UNKNOWN","os":"Unknown","rawUserAgent":"pekko-http/1.2.0"},"zone":"null"},"debugContext":{"debugData":{"dtHash":"8c2a5f7d1b3e9a4c6d09b6a1e32d847f9c5d1e2b6c0a5f8d2e9b01c3456789a","protocol":"SAML 2.0","requestId":"b2k8hJm5j17uL9W3S3ZfR9b2L2x","requestUri":"/api/v1/idps/1i6q4p0j9g5zMv2g7a0x0y3","url":"/api/v1/idps/1i6q4p0j9g5zMv2g7a0x0y3?"}},"device":null,"displayMessage":"Update an Identity Provider","eventType":"system.idp.lifecycle.update","legacyEventType":null,"outcome":{"reason":null,"result":"SUCCESS"},"published":"2025-08-19T19: 49: 51.342Z","request":{"ipChain":[{"geographicalContext":null,"ip":"127.0.0.1","source":null,"version":"V4"},{"geographicalContext":{"city":"Council Bluffs","country":"United States","geolocation":{"lat":41.2591,"lon":-95.8517},"postalCode":"51502","state":"Iowa"},"ip":"203.0.113.144","source":null,"version":"V4"}]},"securityContext":{"asNumber":396982,"asOrg":"google","domain":"googleusercontent.com","isProxy":false,"isp":"google"},"severity":"INFO","target":[{"alternateId":"saml_idp","changeDetails":{"from":{"policySubject":{"filter":"^$","matchType":"USERNAME","userNameTemplate":{"template":"idpuser.email"}}},"to":{"policySubject":{"filter":"^.+@(?i)(?:example\\.com)$","matchType":"USERNAME","userNameTemplate":{"template":"idpuser.email"}}}},"detailEntry":null,"displayName":"iam-service-tr-kl-9081549725-rgt-ad49c6","id":"1i6q4p0j9g5zMv2g7a0x0y3","type":"IdentityProvider"}],"transaction":{"detail":{"requestApiTokenId":"1t3u8Lxy5qA7kGj2F9d4","rootApiTokenId":"1t3u8Lxy5qA7kGj2F9d4"},"id":"b2k8hJm5j17uL9W3S3ZfR9b2L2x","type":"WEB"},"uuid":"1a2b3c4d-5e6f-7g8h-9i0j-1k2l3m4n5o6p","version":"0"}
{"actor":{"alternateId":"0oa1abcdEFGHijkl5d7","detailEntry":null,"displayName":"Okta Admin Console","id":"0oa1abcdEFGHijkl5d7","type":"PublicClientApp"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102nZHzd6OHSfGG51vsoc22gw","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"id":null,"ipAddress":"175.16.199.1","userAgent":{"browser":"FIREFOX","os":"Mac OS X","rawUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"},"zone":"null"},"debugContext":{"debugData":{"authnRequestId":"XkcAsWb8WjwDP76xh@1v8wAABp0","requestId":"XkccyyMli2Uay2I93ZgRzQAAB0c","requestUri":"/login/signout","threatSuspected":"false","url":"/login/signout?message=login_page_messages.session_has_expired"}},"displayMessage":"User logout from Okta","eventType":"user.session.end","legacyEventType":"core.user_auth.logout_success","outcome":{"reason":null,"result":"SUCCESS"},"published":"2020-02-14T22:18:51.843Z","request":{"ipChain":[{"geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"ip":"175.16.199.1","source":null,"version":"V4"}]},"securityContext":{"asNumber":null,"asOrg":null,"domain":null,"isProxy":null,"isp":null},"severity":"INFO","target":null,"transaction":{"detail":{},"id":"XkccyyMli2Uay2I93ZgRzQAAB0c","type":"WEB"},"uuid":"e1f2a3b4-0001-11ef-9a1b-0242ac120002","version":"0"}
{"actor":{"alternateId":"Example App","detailEntry":null,"displayName":"Example App","id":"0oa2wxyzABCDefgh5d7","type":"AppInstance"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102nZHzd6OHSfGG51vsoc22gw","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"id":null,"ipAddress":"175.16.199.1","userAgent":{"browser":"FIREFOX","os":"Mac OS X","rawUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"},"zone":"null"},"debugContext":{"debugData":{"authnRequestId":"XkcAsWb8WjwDP76xh@1v8wAABp0","requestId":"XkccyyMli2Uay2I93ZgRzQAAB0c","requestUri":"/login/signout","threatSuspected":"false","url":"/login/signout?message=login_page_messages.session_has_expired"}},"displayMessage":"User logout from Okta","eventType":"user.session.end","legacyEventType":"core.user_auth.logout_success","outcome":{"reason":null,"result":"SUCCESS"},"published":"2020-02-14T22:18:51.843Z","request":{"ipChain":[{"geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"ip":"175.16.199.1","source":null,"version":"V4"}]},"securityContext":{"asNumber":null,"asOrg":null,"domain":null,"isProxy":null,"isp":null},"severity":"INFO","target":null,"transaction":{"detail":{},"id":"XkccyyMli2Uay2I93ZgRzQAAB0c","type":"WEB"},"uuid":"e1f2a3b4-0002-11ef-9a1b-0242ac120002","version":"0"}