Microsoft ADFS Collection

Modeling Rule

Microsoft AD FS Collection

Details

IDMicrosoft_ADFS_Collection
From Version8.3.0
TagsMicrosoft Windows Active Directory Federation Services ADFS Event Colletion

Schema

microsoft_adfs_raw

Field Type Array?
_collector_type string
activity_id string
channel string
computer_name string
event_action string
event_data string
event_id string
event_result string
host_name string
log_level string
message string
opcode string
process_pid int
process_thread_id int
provider_name string
record_id int
task string
time_created datetime
user string
{
    "microsoft_adfs_raw": {
        "time_created": {
            "type": "datetime",
            "is_array": false
        },
        "_collector_type": {
            "type": "string",
            "is_array": false
        },
        "event_data": {
            "type": "string",
            "is_array": false
        },
        "event_id": {
            "type": "string",
            "is_array": false
        },
        "record_id": {
            "type": "int",
            "is_array": false
        },
        "host_name": {
            "type": "string",
            "is_array": false
        },
        "opcode": {
            "type": "string",
            "is_array": false
        },
        "event_result": {
            "type": "string",
            "is_array": false
        },
        "user": {
            "type": "string",
            "is_array": false
        },
        "provider_name": {
            "type": "string",
            "is_array": false
        },
        "process_pid": {
            "type": "int",
            "is_array": false
        },
        "process_thread_id": {
            "type": "int",
            "is_array": false
        },
        "log_level": {
            "type": "string",
            "is_array": false
        },
        "channel": {
            "type": "string",
            "is_array": false
        },
        "message": {
            "type": "string",
            "is_array": false
        },
        "computer_name": {
            "type": "string",
            "is_array": false
        },
        "task": {
            "type": "string",
            "is_array": false
        },
        "event_action": {
            "type": "string",
            "is_array": false
        },
        "activity_id": {
            "type": "string",
            "is_array": false
        }
    }
}