...
This table collects information about different authentication events generated by a variety of platforms JumpCloud.
Source tables
The information displayed is extracted from the following tables:
Expand |
---|
|
auth.jumpcloud.directory.events
auth.jumpcloud.ldap.events
auth.jumpcloud.mdm.events
auth.jumpcloud.radius.events
auth.jumpcloud.software.events
auth.jumpcloud.sso.events
auth.jumpcloud.systems.events
|
How is the data sent to Devo?
Use the JumpCloud collector.
Table structure
This is the set of columns displayed by this union table, which is the result of the collection of columns present in all source tables:
Note |
---|
Extra fields Fields marked as Extra in the table below are not shown by default in data tables and need to be explicitly requested in the query. You can find them marked as Extra when you perform a query so they can be easily identified. Learn more about this in Selecting unrevealed columns. |
Field | Type | Field transformation | Source field name | Extra fields |
---|
eventdate | timestamp
| | | |
source | str
| | | |
hostname | str
| | | |
initiated_by__id | str
| | | |
initiated_by__type | str
| | | |
initiated_by__email | str
| | | |
initiated_by__username | str
| | | |
geoip__country_code | str
| | | |
geoip__timezone | str
| | | |
geoip__latitude | float8
| | | |
geoip__continent_code | str
| | | |
geoip__region_name | str
| | | |
geoip__region_code | str
| | | |
geoip__longitude | float8
| | | |
resource__id | str
| | | |
resource__type | str
| | | |
resource__username | str
| | | |
changes | str
| | | |
auth_method | str
| | | |
event_type | str
| | | |
provider | str
| | | |
service | str
| | | |
organization | str
| | | |
at_version | str
| | | |
client_ipv4 | ip4
| Code Block |
---|
ifthenelse(my_client_ip -> '.', ip4(my_client_ip), null) |
| my_client_ip | |
client_ipv6 | ip6
| Code Block |
---|
ifthenelse(my_client_ip -> ':', ip6(my_client_ip), null) |
| my_client_ip | |
id | str
| | | |
user_agent__patch | str
| | | |
user_agent__minor | str
| | | |
user_agent__os | str
| | | |
user_agent__major | str
| | | |
user_agent__build | str
| | | |
user_agent__name | str
| | | |
user_agent__os_name | str
| | | |
user_agent__device | str
| | | |
timestamp | timestamp
| | | |
err | str
| | | |
error_message | str
| | | |
start_tls | bool
| | | |
tls_established | bool
| | | |
dn | str
| | | |
mech | str
| | | |
connection_id | str
| | | |
port | str
| | | |
success | bool
| | | |
error_code | str
| | | |
operation_number | str
| | | |
username | str
| | | |
mdm_type | str
| | | |
request_type | str
| | | |
mdm_device_id | str
| | | |
mdm_device_manager_id | str
| | | |
command__request_type | str
| | | |
command__payload | str
| | | |
command_uuid | str
| | | |
error_chain | str
| | | |
status | str
| | | |
message | str
| | | |
system__hostname | str
| | | |
system__displayName | str
| | | |
system__id | str
| | | |
process_name | str
| | | |
system_timestamp | timestamp
| | | |
windows_meta__user_tasks | str
| | | |
windows_meta__user_process | str
| | | |
windows_meta__elevated | bool
| | | |
windows_meta__user_services | str
| | | |
windows_meta__logon_type | str
| | | |
sso_token_success | bool
| | | |
auth_context__policies_applied | str
| | | |
mfa | bool
| | | |
application__name | str
| | | |
application__id | str
| | | |
application__sso_url | str
| | | |
idp_initiated | bool
| | | |
at_devo_pulling_id | str
| | | |
hostchain | str
| | | ✓ |
tag | str
| | | ✓ |
rawMessage | str
| | | ✓ |
Field transformations
Even though all source tables have several features in common, they have some particularities that make it necessary to undergo a set of transformations to harmonize them for the union table. The most common transformations comprise changes in the data type or the application of rules when several columns in the source table feed a single column in the union table. You can find below the detailed list of transformations in each source table.
Rw ui tabs macro |
---|
auth.jumpcloud.directory.eventsField in union table | Field in source table | Field transformation | Data type | Extra fields |
---|
eventdate | eventdate | | timestamp
| | source | - | Code Block |
---|
"auth.jumpcloud.directory.events" |
| str
| | hostname | hostname | | str
| | initiated_by__id | initiated_by__id | | str
| | initiated_by__type | initiated_by__type | | str
| | initiated_by__email | initiated_by__email | | str
| | initiated_by__username | initiated_by__username | | str
| | geoip__country_code | geoip__country_code | | str
| | geoip__timezone | geoip__timezone | | str
| | geoip__latitude | geoip__latitude | | float8
| | geoip__continent_code | geoip__continent_code | | str
| | geoip__region_name | geoip__region_name | | str
| | geoip__region_code | geoip__region_code | | str
| | geoip__longitude | geoip__longitude | | float8
| | resource__id | resource__id | | str
| | resource__type | resource__type | | str
| | resource__username | resource__username | | str
| | changes | changes | | str
| | auth_method | auth_method | | str
| | event_type | event_type | | str
| | provider | provider | | str
| | service | service | | str
| | organization | organization | | str
| | at_version | at_version | | str
| | client_ipv4 | client_ipv4 | | ip4
| | client_ipv6 | client_ipv6 | | ip6
| | id | id | | str
| | user_agent__patch | user_agent__patch | | str
| | user_agent__minor | user_agent__minor | | str
| | user_agent__os | user_agent__os | | str
| | user_agent__major | user_agent__major | | str
| | user_agent__build | user_agent__build | | str
| | user_agent__name | user_agent__name | | str
| | user_agent__os_name | user_agent__os_name | | str
| | user_agent__device | user_agent__device | | str
| | timestamp | timestamp | | timestamp
| | err | - | | str
| | error_message | - | | str
| | start_tls | - | | bool
| | tls_established | - | | bool
| | dn | - | | str
| | mech | - | | str
| | connection_id | - | | str
| | port | - | | str
| | success | success | | bool
| | error_code | - | | str
| | operation_number | - | | str
| | username | - | | str
| | mdm_type | - | | str
| | request_type | - | | str
| | mdm_device_id | - | | str
| | mdm_device_manager_id | - | | str
| | command__request_type | - | | str
| | command__payload | - | | str
| | command_uuid | - | | str
| | error_chain | - | | str
| | status | - | | str
| | message | - | | str
| | system__hostname | - | | str
| | system__displayName | - | | str
| | system__id | - | | str
| | process_name | - | | str
| | system_timestamp | - | | timestamp
| | windows_meta__user_tasks | - | | str
| | windows_meta__user_process | - | | str
| | windows_meta__elevated | - | | bool
| | windows_meta__user_services | - | | str
| | windows_meta__logon_type | - | | str
| | sso_token_success | - | | bool
| | auth_context__policies_applied | - | | str
| | mfa | mfa | | bool
| | application__name | - | | str
| | application__id | - | | str
| | application__sso_url | - | | str
| | idp_initiated | - | | bool
| | at_devo_pulling_id | - | | str
| | hostchain | hostchain | | str
| ✓ | tag | tag | | str
| ✓ | rawMessage | rawMessage | | str
| ✓ |
auth.jumpcloud.ldap.eventsField in union table | Field in source table | Field transformation | Data type | Extra fields |
---|
eventdate | eventdate | | timestamp
| | source | - | Code Block |
---|
"auth.jumpcloud.ldap.events" |
| str
| | hostname | hostname | | str
| | initiated_by__id | - | | str
| | initiated_by__type | initiated_by__type | | str
| | initiated_by__email | initiated_by__email | | str
| | initiated_by__username | initiated_by__username | | str
| | geoip__country_code | - | | str
| | geoip__timezone | - | | str
| | geoip__latitude | - | Code Block |
---|
float8(null('')) |
| float8
| | geoip__continent_code | - | | str
| | geoip__region_name | - | | str
| | geoip__region_code | - | | str
| | geoip__longitude | - | Code Block |
---|
float8(null('')) |
| float8
| | resource__id | - | | str
| | resource__type | - | | str
| | resource__username | - | | str
| | changes | - | | str
| | auth_method | auth_method | | str
| | event_type | event_type | | str
| | provider | - | | str
| | service | service | | str
| | organization | organization | | str
| | at_version | at_version | | str
| | client_ipv4 | client_ipv4 | | ip4
| | client_ipv6 | client_ipv6 | | ip6
| | id | id | | str
| | user_agent__patch | - | | str
| | user_agent__minor | - | | str
| | user_agent__os | - | | str
| | user_agent__major | - | | str
| | user_agent__build | - | | str
| | user_agent__name | - | | str
| | user_agent__os_name | - | | str
| | user_agent__device | - | | str
| | timestamp | timestamp | | timestamp
| | err | err | | str
| | error_message | error_message | | str
| | start_tls | start_tls | | bool
| | tls_established | tls_established | | bool
| | dn | dn | | str
| | mech | mech | | str
| | connection_id | connection_id | | str
| | port | port | | str
| | success | success | | bool
| | error_code | error_code | | str
| | operation_number | operation_number | | str
| | username | username | | str
| | mdm_type | - | | str
| | request_type | - | | str
| | mdm_device_id | - | | str
| | mdm_device_manager_id | - | | str
| | command__request_type | - | | str
| | command__payload | - | | str
| | command_uuid | - | | str
| | error_chain | - | | str
| | status | - | | str
| | message | - | | str
| | system__hostname | - | | str
| | system__displayName | - | | str
| | system__id | - | | str
| | process_name | - | | str
| | system_timestamp | - | | timestamp
| | windows_meta__user_tasks | - | | str
| | windows_meta__user_process | - | | str
| | windows_meta__elevated | - | | bool
| | windows_meta__user_services | - | | str
| | windows_meta__logon_type | - | | str
| | sso_token_success | - | | bool
| | auth_context__policies_applied | - | | str
| | mfa | - | | bool
| | application__name | - | | str
| | application__id | - | | str
| | application__sso_url | - | | str
| | idp_initiated | - | | bool
| | at_devo_pulling_id | - | | str
| | hostchain | hostchain | | str
| ✓ | tag | tag | | str
| ✓ | rawMessage | rawMessage | | str
| ✓ |
auth.jumpcloud.mdm.eventsField in union table | Field in source table | Field transformation | Data type | Extra fields |
---|
eventdate | eventdate | | timestamp
| | source | - | Code Block |
---|
"auth.jumpcloud.mdm.events" |
| str
| | hostname | hostname | | str
| | initiated_by__id | - | | str
| | initiated_by__type | - | | str
| | initiated_by__email | - | | str
| | initiated_by__username | - | | str
| | geoip__country_code | - | | str
| | geoip__timezone | - | | str
| | geoip__latitude | - | Code Block |
---|
float8(null('')) |
| float8
| | geoip__continent_code | - | | str
| | geoip__region_name | - | | str
| | geoip__region_code | - | | str
| | geoip__longitude | - | Code Block |
---|
float8(null('')) |
| float8
| | resource__id | - | | str
| | resource__type | - | | str
| | resource__username | - | | str
| | changes | - | | str
| | auth_method | - | | str
| | event_type | event_type | | str
| | provider | - | | str
| | service | service | | str
| | organization | organization | | str
| | at_version | at_version | | str
| | client_ipv4 | client_ipv4 | | ip4
| | client_ipv6 | client_ipv6 | | ip6
| | id | id | | str
| | user_agent__patch | - | | str
| | user_agent__minor | - | | str
| | user_agent__os | - | | str
| | user_agent__major | - | | str
| | user_agent__build | - | | str
| | user_agent__name | - | | str
| | user_agent__os_name | - | | str
| | user_agent__device | - | | str
| | timestamp | timestamp | | timestamp
| | err | - | | str
| | error_message | - | | str
| | start_tls | - | | bool
| | tls_established | - | | bool
| | dn | - | | str
| | mech | - | | str
| | connection_id | - | | str
| | port | - | | str
| | success | - | | bool
| | error_code | - | | str
| | operation_number | - | | str
| | username | - | | str
| | mdm_type | mdm_type | | str
| | request_type | request_type | | str
| | mdm_device_id | mdm_device_id | | str
| | mdm_device_manager_id | mdm_device_manager_id | | str
| | command__request_type | command__request_type | | str
| | command__payload | command__payload | | str
| | command_uuid | command_uuid | | str
| | error_chain | error_chain | | str
| | status | status | | str
| | message | - | | str
| | system__hostname | - | | str
| | system__displayName | - | | str
| | system__id | - | | str
| | process_name | - | | str
| | system_timestamp | - | | timestamp
| | windows_meta__user_tasks | - | | str
| | windows_meta__user_process | - | | str
| | windows_meta__elevated | - | | bool
| | windows_meta__user_services | - | | str
| | windows_meta__logon_type | - | | str
| | sso_token_success | - | | bool
| | auth_context__policies_applied | - | | str
| | mfa | - | | bool
| | application__name | - | | str
| | application__id | - | | str
| | application__sso_url | - | | str
| | idp_initiated | - | | bool
| | at_devo_pulling_id | - | | str
| | hostchain | hostchain | | str
| ✓ | tag | tag | | str
| ✓ | rawMessage | rawMessage | | str
| ✓ |
auth.jumpcloud.radius.eventsField in union table | Field in source table | Field transformation | Data type | Extra fields |
---|
eventdate | eventdate | | timestamp
| | source | - | Code Block |
---|
"auth.jumpcloud.radius.events" |
| str
| | hostname | hostname | | str
| | initiated_by__id | initiated_by__id | | str
| | initiated_by__type | initiated_by__type | | str
| | initiated_by__email | initiated_by__email | | str
| | initiated_by__username | - | | str
| | geoip__country_code | geoip__country_code | | str
| | geoip__timezone | geoip__timezone | | str
| | geoip__latitude | geoip__latitude | | float8
| | geoip__continent_code | geoip__continent_code | | str
| | geoip__region_name | geoip__region_name | | str
| | geoip__region_code | geoip__region_code | | str
| | geoip__longitude | geoip__longitude | | float8
| | resource__id | - | | str
| | resource__type | - | | str
| | resource__username | - | | str
| | changes | - | | str
| | auth_method | - | | str
| | event_type | - | | str
| | provider | - | | str
| | service | service | | str
| | organization | organization | | str
| | at_version | - | | str
| | client_ipv4 | client_ipv4 | | ip4
| | client_ipv6 | client_ipv6 | | ip6
| | id | id | | str
| | user_agent__patch | - | | str
| | user_agent__minor | - | | str
| | user_agent__os | - | | str
| | user_agent__major | - | | str
| | user_agent__build | - | | str
| | user_agent__name | - | | str
| | user_agent__os_name | - | | str
| | user_agent__device | - | | str
| | timestamp | timestamp | | timestamp
| | err | - | | str
| | error_message | error_message | | str
| | start_tls | - | | bool
| | tls_established | - | | bool
| | dn | - | | str
| | mech | - | | str
| | connection_id | - | | str
| | port | - | | str
| | success | success | | bool
| | error_code | - | | str
| | operation_number | - | | str
| | username | username | | str
| | mdm_type | - | | str
| | request_type | - | | str
| | mdm_device_id | - | | str
| | mdm_device_manager_id | - | | str
| | command__request_type | - | | str
| | command__payload | - | | str
| | command_uuid | - | | str
| | error_chain | - | | str
| | status | - | | str
| | message | - | | str
| | system__hostname | - | | str
| | system__displayName | - | | str
| | system__id | - | | str
| | process_name | - | | str
| | system_timestamp | - | | timestamp
| | windows_meta__user_tasks | - | | str
| | windows_meta__user_process | - | | str
| | windows_meta__elevated | - | | bool
| | windows_meta__user_services | - | | str
| | windows_meta__logon_type | - | | str
| | sso_token_success | - | | bool
| | auth_context__policies_applied | - | | str
| | mfa | mfa | | bool
| | application__name | - | | str
| | application__id | - | | str
| | application__sso_url | - | | str
| | idp_initiated | - | | bool
| | at_devo_pulling_id | - | | str
| | hostchain | hostchain | | str
| ✓ | tag | tag | | str
| ✓ | rawMessage | rawMessage | | str
| ✓ |
auth.jumpcloud.software.eventsField in union table | Field in source table | Field transformation | Data type | Extra field |
---|
eventdate | eventdate | | timestamp
| | source | - | Code Block |
---|
"auth.jumpcloud.software.events" |
| str
| | hostname | hostname | | str
| | initiated_by__id | initiated_by__id | | str
| | initiated_by__type | initiated_by__type | | str
| | initiated_by__email | - | | str
| | initiated_by__username | - | | str
| | geoip__country_code | - | | str
| | geoip__timezone | - | | str
| | geoip__latitude | - | Code Block |
---|
float8(null('')) |
| float8
| | geoip__continent_code | - | | str
| | geoip__region_name | - | | str
| | geoip__region_code | - | | str
| | geoip__longitude | - | Code Block |
---|
float8(null('')) |
| float8
| | resource__id | resource__id | | str
| | resource__type | resource__type | | str
| | resource__username | - | | str
| | changes | changes | | str
| | auth_method | - | | str
| | event_type | event_type | | str
| | provider | provider | | str
| | service | service | | str
| | organization | organization | | str
| | at_version | at_version | | str
| | client_ipv4 | client_ipv4 | | ip4
| | client_ipv6 | client_ipv6 | | ip6
| | id | id | | str
| | user_agent__patch | - | | str
| | user_agent__minor | - | | str
| | user_agent__os | - | | str
| | user_agent__major | - | | str
| | user_agent__build | - | | str
| | user_agent__name | - | | str
| | user_agent__os_name | - | | str
| | user_agent__device | - | | str
| | timestamp | timestamp | | timestamp
| | err | - | | str
| | error_message | - | | str
| | start_tls | - | | bool
| | tls_established | - | | bool
| | dn | - | | str
| | mech | - | | str
| | connection_id | - | | str
| | port | - | | str
| | success | - | | bool
| | error_code | - | | str
| | operation_number | - | | str
| | username | - | | str
| | mdm_type | - | | str
| | request_type | - | | str
| | mdm_device_id | - | | str
| | mdm_device_manager_id | - | | str
| | command__request_type | - | | str
| | command__payload | - | | str
| | command_uuid | - | | str
| | error_chain | - | | str
| | status | - | | str
| | message | - | | str
| | system__hostname | system__hostname | | str
| | system__displayName | - | | str
| | system__id | system__id | | str
| | process_name | - | | str
| | system_timestamp | - | | timestamp
| | windows_meta__user_tasks | - | | str
| | windows_meta__user_process | - | | str
| | windows_meta__elevated | - | | bool
| | windows_meta__user_services | - | | str
| | windows_meta__logon_type | - | | str
| | sso_token_success | - | | bool
| | auth_context__policies_applied | - | | str
| | mfa | - | | bool
| | application__name | application__name | | str
| | application__id | - | | str
| | application__sso_url | - | | str
| | idp_initiated | - | | bool
| | at_devo_pulling_id | at_devo_pulling_id | | str
| | hostchain | hostchain | | str
| ✓ | tag | tag | | str
| ✓ | rawMessage | rawMessage | | str
| ✓ |
auth.jumpcloud.sso.eventsField in union table | Field in source table | Field transformation | Data type | Extra fields |
---|
eventdate | eventdate | | timestamp
| | source | - | Code Block |
---|
"auth.jumpcloud.sso.events" |
| str
| | hostname | hostname | | str
| | initiated_by__id | initiated_by__id | | str
| | initiated_by__type | initiated_by__type | | str
| | initiated_by__email | - | | str
| | initiated_by__username | initiated_by__username | | str
| | geoip__country_code | geoip__country_code | | str
| | geoip__timezone | geoip__timezone | | str
| | geoip__latitude | geoip__latitude | | float8
| | geoip__continent_code | geoip__continent_code | | str
| | geoip__region_name | geoip__region_name | | str
| | geoip__region_code | geoip__region_code | | str
| | geoip__longitude | geoip__longitude | | float8
| | resource__id | - | | str
| | resource__type | - | | str
| | resource__username | - | | str
| | changes | - | | str
| | auth_method | - | | str
| | event_type | event_type | | str
| | provider | provider | | str
| | service | service | | str
| | organization | organization | | str
| | at_version | at_version | | str
| | client_ipv4 | client_ipv4 | | ip4
| | client_ipv6 | client_ipv6 | | ip6
| | id | id | | str
| | user_agent__patch | user_agent__patch | | str
| | user_agent__minor | user_agent__minor | | str
| | user_agent__os | user_agent__os | | str
| | user_agent__major | user_agent__major | | str
| | user_agent__build | user_agent__build | | str
| | user_agent__name | user_agent__name | | str
| | user_agent__os_name | user_agent__os_name | | str
| | user_agent__device | user_agent__device | | str
| | timestamp | timestamp | | timestamp
| | err | - | | str
| | error_message | error_message | | str
| | start_tls | - | | bool
| | tls_established | - | | bool
| | dn | - | | str
| | mech | - | | str
| | connection_id | - | | str
| | port | - | | str
| | success | - | | bool
| | error_code | - | | str
| | operation_number | - | | str
| | username | - | | str
| | mdm_type | - | | str
| | request_type | - | | str
| | mdm_device_id | - | | str
| | mdm_device_manager_id | - | | str
| | command__request_type | - | | str
| | command__payload | - | | str
| | command_uuid | - | | str
| | error_chain | - | | str
| | status | - | | str
| | message | - | | str
| | system__hostname | - | | str
| | system__displayName | - | | str
| | system__id | - | | str
| | process_name | - | | str
| | system_timestamp | - | | timestamp
| | windows_meta__user_tasks | - | | str
| | windows_meta__user_process | - | | str
| | windows_meta__elevated | - | | bool
| | windows_meta__user_services | - | | str
| | windows_meta__logon_type | - | | str
| | sso_token_success | sso_token_success | | bool
| | auth_context__policies_applied | auth_context__policies_applied | | str
| | mfa | mfa | | bool
| | application__name | application__name | | str
| | application__id | application__id | | str
| | application__sso_url | application__sso_url | | str
| | idp_initiated | idp_initiated | | bool
| | at_devo_pulling_id | - | | str
| | hostchain | hostchain | | str
| ✓ | tag | tag | | str
| ✓ | rawMessage | rawMessage | | str
| ✓ |
auth.jumpcloud.systems.eventsField in union table | Field in source table | Field transformation | Type | Extra fields |
---|
eventdate | eventdate | | timestamp
| | source | - | Code Block |
---|
"auth.jumpcloud.systems.events" |
| str
| | hostname | hostname | | str
| | initiated_by__id | initiated_by__id | | str
| | initiated_by__type | initiated_by__type | | str
| | initiated_by__email | - | | str
| | initiated_by__username | initiated_by__username | | str
| | geoip__country_code | geoip__country_code | | str
| | geoip__timezone | geoip__timezone | | str
| | geoip__latitude | geoip__latitude | | float8
| | geoip__continent_code | geoip__continent_code | | str
| | geoip__region_name | geoip__region_name | | str
| | geoip__region_code | geoip__region_code | | str
| | geoip__longitude | geoip__longitude | | float8
| | resource__id | resource__id | | str
| | resource__type | resource__type | | str
| | resource__username | resource__username | | str
| | changes | changes | | str
| | auth_method | - | | str
| | event_type | event_type | | str
| | provider | provider | | str
| | service | service | | str
| | organization | organization | | str
| | at_version | at_version | | str
| | client_ipv4 | client_ipv4 | | ip4
| | client_ipv6 | client_ipv6 | | ip6
| | id | id | | str
| | user_agent__patch | - | | str
| | user_agent__minor | - | | str
| | user_agent__os | - | | str
| | user_agent__major | - | | str
| | user_agent__build | - | | str
| | user_agent__name | - | | str
| | user_agent__os_name | - | | str
| | user_agent__device | - | | str
| | timestamp | timestamp | | timestamp
| | err | - | | str
| | error_message | - | | str
| | start_tls | - | | bool
| | tls_established | - | | bool
| | dn | - | | str
| | mech | - | | str
| | connection_id | - | | str
| | port | - | | str
| | success | success | | bool
| | error_code | - | | str
| | operation_number | - | | str
| | username | username | | str
| | mdm_type | - | | str
| | request_type | - | | str
| | mdm_device_id | - | | str
| | mdm_device_manager_id | - | | str
| | command__request_type | - | | str
| | command__payload | - | | str
| | command_uuid | - | | str
| | error_chain | - | | str
| | status | - | | str
| | message | message | | str
| | system__hostname | system__hostname | | str
| | system__displayName | system__displayName | | str
| | system__id | system__id | | str
| | process_name | process_name | | str
| | system_timestamp | system_timestamp | | timestamp
| | windows_meta__user_tasks | windows_meta__user_tasks | | str
| | windows_meta__user_process | windows_meta__user_process | | str
| | windows_meta__elevated | windows_meta__elevated | | bool
| | windows_meta__user_services | windows_meta__user_services | | str
| | windows_meta__logon_type | windows_meta__logon_type | | str
| | sso_token_success | - | | bool
| | auth_context__policies_applied | - | | str
| | mfa | - | | bool
| | application__name | - | | str
| | application__id | - | | str
| | application__sso_url | - | | str
| | idp_initiated | - | | bool
| | at_devo_pulling_id | - | | str
| | hostchain | hostchain | | str
| ✓ | tag | tag | | str
| ✓ | rawMessage | rawMessage | | str
| ✓ |
|