Page Comparison

...

Note

Extra columns

Fields marked as Extra in the table below are not shown by default in data tables and need to be explicitly requested in the query. You can find them marked as Extra when you perform a query so they can be easily identified. Learn more about this in Selecting unrevealed columns.

Field	Type	Extra fields
eventdate	`timestamp`
host	`str`
subtype	`str`
time	`str`
eventID	`str`
hostIP	`ip4`
type	`str`
id1	`str`
id2	`str`
id3	`str`
Alerts	`str`
AlertsPresent	`int4`
AuditPostureToken	`str`
AuthType	`str`
ConnectionStatus	`str`
EnforcementProfiles	`str`
ErrorCode	`str`
HostMACAddress	`str`
LoginStatus	`str`
MonitorMode	`str`
NASIPAddress	`str`
NASPort	`str`
RequestId	`str`
RequestTimestamp	`timestamp`
Roles	`str`
Service	`str`
SessionLogTimestamp	`timestamp`
Source	`str`
SystemPostureToken	`str`
Username	`str`
AcctAuthentic	`str`
AcctCalledStationId	`str`
AcctDelayTime	`str`
AcctStatusType	`str`
AuthMethod	`str`
AuthSource	`str`
AcctTimestamp	`timestamp`
AcctSessionId	`str`
AcctFramedIPAddress	`ip4`
AcctCallingStationId	`str`
AcctNASPortType	`str`
AcctNASPort	`str`
AcctNASIPAddress	`ip4`
AcctUsername	`str`
AcctInputOctets	`str`
AcctTerminationCause	`str`
unknown	`str`
rawMessage	`str`	✓
hostchain	`str`	✓
tag	`str`	✓

Field transformations

Even though all source tables have several features in common, they have some particularities that make it necessary to undergo a set of transformations to harmonize them for the union table. The most common transformations comprise changes in the data type or the application of rules when several columns in the source table feed a single column in the union table. You can find below the detailed list of transformations in each source table.

...

Anchor
tag1
tag1
nac.aruba.sessions.common

Field in union table

Field in source table

Field transformation

Type

Extra fields

eventdate

timestamp

host

str

subtype

-

Code Block
"common"

str

time

str

eventID

str

hostIP

ip4

type

str

id1

str

id2

str

id3

str

Alerts

str

AlertsPresent

int4

AuditPostureToken

str

AuthType

str

ConnectionStatus

str

EnforcementProfiles

str

ErrorCode

str

HostMACAddress

str

LoginStatus

str

MonitorMode

str

NASIPAddress

str

NASPort

str

RequestId

str

RequestTimestamp

timestamp

Roles

str

Service

str

SessionLogTimestamp

timestamp

Source

str

SystemPostureToken

str

Username

str

AcctAuthentic

-

Code Block
null('')

str

AcctCalledStationId

-

Code Block
null('')

str

AcctDelayTime

-

Code Block
null('')

str

AcctStatusType

-

Code Block
null('')

str

AuthMethod

-

Code Block
null('')

str

AuthSource

-

Code Block
null('')

str

AcctTimestamp

-

Code Block
null('')

timestamp

AcctSessionId

-

Code Block
null('')

str

AcctFramedIPAddress

-

Code Block
null(ip4('0.0.0.0'))

ip4

AcctCallingStationId

-

Code Block
null('')

str

AcctNASPortType

-

Code Block
null('')

str

AcctNASPort

-

Code Block
null('')

str

AcctNASIPAddress

-

Code Block
null(ip4('0.0.0.0'))

ip4

AcctUsername

-

Code Block
null('')

str

AcctInputOctets

-

Code Block
null('')

str

AcctTerminationCause

-

Code Block
null('')

str

unknown

str

rawMessage

str

✓

hostchain

str

✓

tag

str

✓

Anchor
tag1
tag1
nac.aruba.sessions.failed_authentications

Field in union table

Field in source table

Field transformation

Type

Extra fields

eventdate

timestamp

host

str

subtype

-

Code Block
"failed_authentications"

str

time

str

eventID

str

hostIP

ip4

type

str

id1

str

id2

str

id3

str

Alerts

str

AlertsPresent

-

Code Block
null(int4(0))

int4

AuditPostureToken

-

Code Block
null('')

str

AuthType

-

Code Block
null('')

str

ConnectionStatus

-

Code Block
null('')

str

EnforcementProfiles

str

ErrorCode

str

HostMACAddress

str

LoginStatus

-

Code Block
null('')

str

MonitorMode

-

Code Block
null('')

str

NASIPAddress

str

NASPort

-

Code Block
null('')

str

RequestId

-

Code Block
null('')

str

RequestTimestamp

timestamp

Roles

str

Service

-

Code Block
null('')

str

SessionLogTimestamp

-

Code Block
null('')

timestamp

Source

-

Code Block
null('')

str

SystemPostureToken

str

Username

str

AcctAuthentic

-

Code Block
null('')

str

AcctCalledStationId

-

Code Block
null('')

str

AcctDelayTime

-

Code Block
null('')

str

AcctStatusType

-

Code Block
null('')

str

AuthMethod

str

AuthSource

str

AcctTimestamp

-

Code Block
null('')

timestamp

AcctSessionId

-

Code Block
null('')

str

AcctFramedIPAddress

-

Code Block
null(ip4('0.0.0.0'))

ip4

AcctCallingStationId

-

Code Block
null('')

str

AcctNASPortType

-

Code Block
null('')

str

AcctNASPort

-

Code Block
null('')

str

AcctNASIPAddress

-

Code Block
null(ip4('0.0.0.0'))

ip4

AcctUsername

-

Code Block
null('')

str

AcctInputOctets

-

Code Block
null('')

str

AcctTerminationCause

-

Code Block
null('')

str

unknown

str

rawMessage

str

✓

hostchain

str

✓

tag

str

✓

Anchor
tag1
tag1
nac.aruba.sessions.radius

Field in union table

Field in source table

Field transformation

Type

Extra fields

eventdate

timestamp

host

str

subtype

-

Code Block
"radius"

str

time

str

eventID

str

hostIP

ip4

type

str

id1

str

id2

str

id3

str

Alerts

-

Code Block
null('')

str

AlertsPresent

-

Code Block
null(int4(0))

int4

AuditPostureToken

-

Code Block
null('')

str

AuthType

-

Code Block
null('')

str

ConnectionStatus

-

Code Block
null('')

str

EnforcementProfiles

-

Code Block
null('')

str

ErrorCode

-

Code Block
null('')

str

HostMACAddress

-

Code Block
null('')

str

LoginStatus

-

Code Block
null('')

str

MonitorMode

-

Code Block
null('')

str

NASIPAddress

-

Code Block
null(ip4('0.0.0.0'))

str

NASPort

-

Code Block
null('')

str

RequestId

-

Code Block
null('')

str

RequestTimestamp

-

Code Block
null('')

timestamp

Roles

-

Code Block
null('')

str

Service

-

Code Block
null('')

str

SessionLogTimestamp

-

Code Block
null('')

timestamp

Source

-

Code Block
null('')

str

SystemPostureToken

-

Code Block
null('')

str

Username

-

Code Block
null('')

str

AcctAuthentic

str

AcctCalledStationId

str

AcctDelayTime

str

AcctStatusType

str

AuthMethod

str

AuthSource

str

AcctTimestamp

-

Code Block
null('')

timestamp

AcctSessionId

str

AcctFramedIPAddress

ip4

AcctCallingStationId

str

AcctNASPortType

str

AcctNASPort

str

AcctNASIPAddress

ip4

AcctUsername

str

AcctInputOctets

str

AcctTerminationCause

str

unknown

str

rawMessage

str

✓

hostchain

str

✓

tag

str

✓

Versions Compared

Old Version 1

New Version Current

Key

Field transformations

Anchor
tag1
tag1
nac.aruba.sessions.common

Anchor
tag1
tag1
nac.aruba.sessions.failed_authentications

Anchor
tag1
tag1
nac.aruba.sessions.radius

Page Comparison

Versions Compared

Old Version 1

New Version Current

Key

Field transformations

Anchortag1tag1nac.aruba.sessions.common

Anchortag1tag1nac.aruba.sessions.failed_authentications

Anchortag1tag1nac.aruba.sessions.radius

Anchor
tag1
tag1
nac.aruba.sessions.common

Anchor
tag1
tag1
nac.aruba.sessions.failed_authentications

Anchor
tag1
tag1
nac.aruba.sessions.radius