Document toolboxDocument toolbox

Web application monitoring

The following set of tables can help you monitor different aspects of the web application itself. This may be useful in case you want to have a general overview of the web application’s normal development, extract specific information or identify abnormal situations that might require corrective measures.

Field formats

Please note that the format of the fields in these tables may vary due to code changes.

siem.logtrust.web.activity

In this table, you can find detailed information about everything that happened in the current domain. You can see below the most relevant fields included in this table along with a brief explanation.

Field

Data type

Description

Field

Data type

Description

level

str

Level of importance or urgency of the event

  • INFO → Messages for both end-users and system administrators to indicate the progress of the application

  • WARN → Potentially harmful situations to end-users or system administrators

  • ERROR → Events of great importance that threaten the normal development of the application

domain

str

Domain in which the action takes place

userid

str

ID associated with the user

username

str

User who performed the action

sessionid

str

Session in which the action is framed

correlationid

str

Unique identifier of the request

srcHost, srcPort

str, int

IP address and port from which the connection to Devo is requested

serverHost, serverPort

str, int

Server address and port through which the connection to Devo is established

type

str

Nature of the task performed

method

str

Data transfer method used

url, headers, params

str

URL, headers, and parameters of the request

referer

str

HTTP header field that identifies the address of the web page requested

userAgent

str

Web browser used to access Devo

locale

str

Language-variant combination employed by the user

contentLength, responseLength

int

Number of data bytes contained in the request from the source and the response from the server

responseTime

int

Total amount of time (in milliseconds) it takes to respond to the request

result, resourceInfo, errorInfo

str

Result of the request, and info related to the resource and possible errors in the request

country, region, city

str

Geographic location of the source connection established by the user

isp, org

str

Internet provider

siem.logtrust.web.navigation

In this table, you can find specific information about user activity. It contains a data structure similar to the siem.logtrust.web.activity with the difference that it includes only activity triggered by users and excludes platform and server response. You can see below the most relevant fields included in this table along with a brief explanation.

Field

Data type

Description

Field

Data type

Description

domain

str

Domain in which the action takes place

userid

str

ID associated with the user

sessionid

str

Session in which the action is framed

userEmail

str

Email address employed by the user to register and log in

serverHost, serverPort

str, int

Server address and port through which the connection to Devo is established

srcHost, srcPort

str, int

IP address and port from which the connection to Devo is requested

userAgent

str

Web browser used to access Devo

referer

str

HTTP header field that identifies the address of the web page requested

url

str

URL of the request

origin

str

Origin part of the URL

section

str

Area of the web application the user accessed

action

str

Task performed

type

str

Request type

message

str

Message in the request

country, region, city

str

Geographic location of the source connection established by the user

isp, org

str

Internet provider

siem.logtrust.web.info

In this table, you can find information about the development of the web application. It can be used to analyze the different events that take place on the platform to have an overview of the global situation. You can see below the most relevant fields included in this table along with a brief explanation.

Field

Data type

Description

Field

Data type

Description

level

str

Level of importance or urgency of the event

  • INFO → Messages for both end-users and system administrators to indicate the progress of the application

  • WARN → Potentially harmful situations to end-users or system administrators

  • ERROR → Events of great importance that threaten the normal development of the application

domain

str

Domain in which the event occurred

userid

str

ID associated with the user

sessionid

str

Session in which the action is framed

message

str

Full text describing the nature and content of the error

siem.logtrust.web.error

In this table, you can find information about the errors that occurred in the web application. It can be used to analyze common errors to possibly identify the cause. It is very similar to the siem.logtrust.web.info table with the difference that it includes only events that contain errors and excludes the rest of the levels. You can see below the most relevant fields included in this table along with a brief explanation.

Field

Data type

Description

Field

Data type

Description

level

str

Level of importance or urgency of the event (in this case only ERROR)

domain

str

Domain in which the error occurred

userid

str

ID associated with the user

sessionid

str

Session in which the action is framed

message

str

Full text describing the nature and content of the error

siem.logtrust.web.notification

In this table, you can find information about the notifications that occurred in the web application. You can see below the most relevant fields included in this table along with a brief explanation.

Field

Data type

Description

Field

Data type

Description

level

str

Level of importance or urgency of the notification

  • INFO → Messages for both end-users and system administrators to indicate the progress of the application

  • WARN → Potentially harmful situations to end-users or system administrators

  • ERROR → Events of great importance that threaten the normal development of the application

domain

str

Domain in which the notification occurred

userName

str

ID associated with the user that caused the notification

sessionId

str

ID of the session in which the action is framed

domainId

str

ID of the domain

userId

str

ID of the user

notificationId

str

ID of the notification

text

str

Text of the notification

creationDate

str

Date when the notification occured

notificationType

str

Type of notification

siem.logtrust.collector.counter

Field Name

Data Type

eventdate

timestamp

collector

str

engine

str

kind

str

object

str

events

int8

bytes

int8

client

str

tag

str

layouterror

layouterror

raw

str

rawSource

str

rawTagged

str

__trunk

str

__containerName

str

__containerHash

boxar(int1)

__containerOffset

int8

_beid

boxar(int1)

_seid

int8

eventid

boxar(int1)

devo.internal.audit.logs

In this table, you can find the complete record of the activity registered in the platform concerning users and their activity inside the platform, as well as roles, credentials, and preferences. It can primarily be used for audition processes but is also applicable to any other operational process requiring a comprehensive record of this activity.

Field

Data type

Description

Field

Data type

Description

eventdate

timestamp

Date in which the event was registered in Devo.

→ 2024-02-14 13:41:31.210

hostname

str

Name of the internal component in charge of executing the action.

→ webapp-2

action_date

int

Moment in time when the action occurs, expressed in milliseconds since the Unix epoch.

→ 1681917780246

type

str

Event classification.

→ AUDIT vs. OPERATIONAL

domain

str

Domain where the user behind the action was logged in, extracted from the authentication token.

→ demo, analytics, etc.

username

str

Email address of the user behind the action, extracted from the authentication token.

→ user@devo.com

user_role

str

Role or roles assigned to the user behind the action.

→ administrator, writer, viewer, etc.

server_hostname

str

IP address or name of the machine in charge of executing the action.

→ 25.42.123.789

url

str

Url of the action executed.

→ https://us.devo.com/#/home

service

str

Name of the service or application where the action was executed.

→ api, secops, lookups, alerts, users, roles, authentication, Exchange, etc.

section

str

When applicable, name of the specific part inside the service where the action was executed.

→ overview, preferences, threats, discover, etc.

subsection

str

When applicable, name of the specific part inside the section where the action was executed.

→ general, user activity, threats detected, alert, etc.

object_name

str

Name of the specific object affected by the action. This is the name assigned to the object when created, which may vary if edited.

→ Dangerous IPs, Alert pack: Firewall, etc.

object_id

str

Unique ID of the specific object affected by the action, which is automatically assigned when created and is normally invariable.

→ 238, map_12345, etc.

action

str

Description of the action executed.

→ open.app, preferences.update, authentication.token.seen, roles.uptade, get catalog, etc.

is_user_action

bool

This field indicates whether the action is performed by a user or if it is automatically generated by a system action.

→ true vs. false

status

str

This field indicates whtther the action was successfully executed or not. When the action fails, the reason will be included in the exception field.

→ success vs. failure

http_status

str

Http status code that your application is returning after performing the action.

→ 200, 404, etc.

headers

str

Name of the http headers, without their values, that are sent with executed http action.

→ content type, authorization, etc.

metadata

json

Relevant information to give context about the action, such as including the previous and new values when there is a change in the content of an object.

→ {"from":"Alert coverage"}

user_ip4

ip4

IP of the user performing the action.

→ 25.42.123.789

user_ip6

ip6

IP of the user performing the action.

→ 2001:0db8:85a3:0000:0000:8a2e:0370:7334

response_time

str

Duration of the action in milliseconds.

→ 458

exception

str

Trace of the exception generated when the action failed, which is indicated in the status field.

→ cannot load custom alert

authentication

str

Authentication type used to log in.

→ password, SAML, openID, token, API_keys, etc.

authentication_hash

str

Hash of the authentication token, normally using Scrypt algorithms.

→ 9fb8020742d78f3fd3a291f110dc1405ad7402fc5e30a582f5123d2744h247f4

instance

str

Name of the environment where the action was executed.

→ hostname1

correlation_id

str

Unique ID that identifies the action registered, as well as all the calls and applications involved in the interaction.

→ c4e6d7b6-4cfa-4f3d-bdaa-791d26f822e1