Introduction
The tags beginning with auth.thycotic
identify events generated by Delinea (formerly Thycotic).
Valid tags and data tables
The full tag must have 3 levels. The first two are fixed as auth.thycotic
. The third level identifies the type of events sent.
These are the valid tags and corresponding data tables that will receive the parsers' data:
Product / Service | Tags | Data tables |
---|---|---|
Thycotic Secret Server |
|
|
For more information, read more About Devo tags.
Table structure
These are the fields displayed in this table:
Field | Type | Extra fields |
---|---|---|
eventdate |
| |
cefVersion |
| |
embDeviceVendor |
| |
embDeviceProduct |
| |
deviceVersion |
| |
signatureID |
| |
name |
| |
severity |
| |
_cefVer |
| |
duid |
| |
duser |
| |
fileId |
| |
fileType |
| |
fname |
| |
msg |
| |
rt |
| |
src |
| |
suid |
| |
suser |
| |
suserDisplayName |
| |
folder |
| |
hostchain |
| ✓ |
tag |
| ✓ |
rawMessage |
| ✓ |