Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-custom-parsers-schema-auth

Authentication schema

Use this reference to identify the fields available in the auth schema and the parser fields used to populate them.

For a field to be populated in Sophos XDR, the corresponding parser field must be present in the source data.

Schema summary

Property Value
Schema name Auth
Parser field prefix Auth
Supports custom parsers Yes
Schema components Action, AuthCategory, ActionResult, FailureCategory, TrustFeatures, EncryptionType, LogonType

Schema components

Auth.Action

The type of authentication event.

Name Number Description
UNCLASSIFIED 0
LOGON 1 A user login or authenticate operation, or a start of a user session.
ACCOUNT 2
PRIVILEGE 3
POLICY 4 Account/Domain policy changes. For Windows, this computer's Security Settings Account Policy or Account Lockout Policy was modified via Local Security Policy or Group Policy in Active Directory. On a web based Auth platform like Okta, 1. Lifecycle policy changes, 2. User session lifetime, 3. MFA requirements, 4. Password complexity requirements.
SYSTEM 5 System Audit Policy changes. For web-based Auth providers, 1. API token create/revoke, 2. MFA verification request.
LOG 6
LOGOFF 7 A user logout operation or an end of a user session.
FAILURE 8 A user authentication attempt failure.
USER_MANAGEMENT 9 Actions including: 1. Adding a new user to the account, 2. Modifying an existing user, 3. Removing a user from the account, 4. Lifecycle events, 5. Update password/MFA setting.

Auth.AuthCategory

The category of authentication event.

Name Number Description
UNKNOWN_AUTH_CATEGORY 0
ACCOUNT_LOGON 10
ACCOUNT_LOGOFF 20
ACCOUNT_LOCK 30
ACCOUNT_UNLOCK 40
PASSWORD_CHANGE_ATTEMPT 50 The user attempted to change their own password.
PASSWORD_RESET_ATTEMPT 60 The source user attempted to change the target user's password, such as an admin reset.
PRE_AUTHENTICATION 70 A pre-required step for authentication, such as requesting a Kerberos authentication ticket.

Auth.ActionResult

The result of the action performed in auth_category.

Name Number Description
UNKNOWN_ACTION_RESULT 0
SUCCESS 10 The outcome of the auth_category step was successful.
FAILED 20 The outcome of the auth_category step was unsuccessful.

Auth.FailureCategory

The reason if the action_result is FAILED.

Name Number Description
UNKNOWN_FAILURE_CATEGORY 0
INCORRECT_USER_OR_PASSWORD 10
EXPIRED_PASSWORD 20
INVALID_ACCOUNT 30
INCORRECT_MFA 40
OUTSIDE_PERMISSIBLE_HOURS 50
OVERDUE_PASSWORD_CHANGE 60
ACCOUNT_LOCKED_OUT 70
ACCOUNT_DISABLED 80
OTHER_ERROR 90 There is an error reported that is not covered by the other categories.

Auth.TrustFeatures

Name Number Description
UNKNOWN_TRUSTED_FEATURES 0
MFA_USED 10
TRUSTED_IP_ADDRESS 20
OTHER_TRUSTED_ACCOUNT 30 Account is trusted in some other way, such as Entra ID registered or joined device.

Auth.EncryptionType

Name Number Description
ENCRYPTION_UNKNOWN 0
DES_CBC_CRC 1
DES_CBC_MD4 2
DES_CBC_MD5 3
DES3_CBC_MD5 4
DES3_CBC_SHA1 5
DSA_WITH_SHA1_CMSOID 6
MD5_WITH_RSA_ENCRYPTION_CMSOID 7
SHA1_WITH_RSA_ENCRYPTION_CMSOID 8
RC2CBC_ENVOID 9
RSA_ENCRYPTION_ENVOID 10
RSA_ES_OAEP_ENV_OID 11
DES_EDE3_CBC_ENV_OID 12
DES3_CBC_SHA1_KD 13
AES128_CTS_HMAC_SHA1_96 14
AES256_CTS_HMAC_SHA1_96 15
RC4_HMAC 16
RC4_HMAC_EXP 17
SUBKEY_KEYMATERIAL 18

Auth.LogonType

Value logon type that maps to WIN32 values.

Name Number Description
SYSTEMONLY 0 Unused but required for Proto3.
UNKNOWN 1
INTERACTIVE 2
NETWORK 3
BATCH 4
SERVICE 5
PROXY 6
UNLOCK 7
NETWORKCLEARTEXT 8
NEWCREDENTIALS 9
REMOTEINTERACTIVE 10
CACHEDINTERACTIVE 11
CACHEDREMOTEINTERACTIVE 12
CACHEDUNLOCKED 13

Schema fields

Normalized Field Type Parser Field Description
resource_id string resourceId$ Full resource string identifying the record.
tenant_id string tenantId$ ID of the tenant.
sensor_type string sensorType$ Type of device that generated this event.
sensor_event_id string sensorEventId$ Event ID of original_data assigned by the sensor.
sensor_tenant string sensorTenant$ A customer ID supplied by the application that originated the data.
sensor_id string sensorId$ An ID for the data supplied by the application that originated it.
sensor_cpe string sensorCpe$ CPE of the platform producing the alert.
original_data string originalData$ Original, unadulterated data prior to any transformation.
event_time_usec uint64 eventTimeUsec$ Event time in microseconds (µs).
ingest_time_usec uint64 ingestTimeUsec$ Ingest time in microseconds (µs).
event_time_fidelity TimeFidelity eventTimeFidelity$ Specifies the original precision of the time used to populate event_time_usec.
host_id string hostId$ The host ID that uniquely identifies the host where the event originated, such as IPv(4/6) address or device MAC address.
process_id string processId$ Identifier provided by the OS for the running process.
process_create_time_usec uint64 processCreateTimeUsec$ Create time of the process requesting authorization.
process_correlation_id string processCorrelationId$ Process correlation ID to protect against rolling IDs.
process_filename string processFilename$ Name of the file of the process that requested authorization.
process_file_hash FileHash fileHash$ Hash of the file of the process that requested authorization.
commandline string commandline$ Full command line of the process that made the authorization request.
sensor_version string sensorVersion$ The agent version as string.
action Auth.Action action$ The type of authentication event, such as LOGON or LOGOFF.
auth_category Auth.AuthCategory authCategory$ The type of authentication event, such as ACCOUNT_LOGON or ACCOUNT_LOCK.
action_result Auth.ActionResult actionResult$ The result of the action performed in auth_category, such as SUCCESS or FAILED.
failure_category Auth.FailureCategory failureCategory$ The reason if the action_result is FAILED.
trust_features Auth.TrustFeatures trustFeatures$ Indicates why a user logon could be legitimate, such as MFA was used.
auth_system string authSystem$ The system identifying the event, such as Windows, PAM, SSHD, or sudo.
target_user_name string targetUserName$ The account impacted by the action.
target_domain_name string targetDomainName$ Domain that the user is logging in to.
target_address string targetAddress$ IP address that the user is logging in to.
target_port string targetPort$ Port that the user is logging in to.
target_port_number uint32 targetPortNumber$ Port that the user is logging in to.
target_host_name string targetHostName$ Hostname of the target, such as a Windows workstation name.
source_user_name string sourceUserName$ Account that the user is logging in from.
source_domain_name string sourceDomainName$ Domain that the user is logging in from.
source_address string sourceAddress$ IP address that the user is logging in from.
source_port string sourcePort$ Port that the user is logging in from.
source_port_number uint32 sourcePortNumber$ Port that the user is logging in from.
os OperatingSystem os$.os$ Operating system: architecture of the user's machine.
logon_application_family string logonApplicationFamily$ The application used by the user to log on, devoid of version information, such as chrome or firefox.
user_agent string userAgent$ The user-agent string used in the request.
user_display_name string userDisplayName$ User account's display name.
member_name string memberName$ Distinguished name of the account that was added to or removed from security-enabled local group.
session_id string sessionId$ Identifier of the session to match logon/logoff.
logon_type Auth.LogonType logonType$ Value of logon type.
mfa_used bool mfaUsed$ Was MFA used when user was authenticated.
encryption_type Auth.EncryptionType encryptionType$ Ticket encryption type, such as 0x12 or 0x17.
win_event_level string winEventLevel$ The urgency level the event was assigned by Windows.
win_summary string winSummary$ The event summary provided by Windows.
win_keywords string winKeywords$ Keywords Windows applies to the event.
win_task_category string winTaskCategory$ The category Windows has classified the event.
win_event_id string winEventId$ Identifier of event generated by the Windows log.
device_trust_type string deviceTrustType$ Taken from trustType field in deviceDetails from Microsoft Graph Signin Events. See the Microsoft documentation. Can be used as an indicator of trustworthiness for the sign-in device.
src_ipblacklist_hits string repeated Provides the names of blacklists matched by the source.
dest_ipblacklist_hits string repeated Provides the names of blacklists matched by the destination.
src_ipgeo_summary GeoSummary The geographic location of the source IP. Not writable from a custom parser. Populated automatically by Sophos enrichment from source_address. See note at the end of this page.
dest_ipgeo_summary GeoSummary The geographic location of the destination IP. Not writable from a custom parser. Populated automatically by Sophos enrichment from target_address. See note at the end of this page.
status string status$
sub_status string subStatus$
extra_authenticationpackagename string extraAuthenticationpackagename$ The system performing authentication, such as NTLM or Kerberos.
extra_elevatedtoken string extraElevatedtoken$ Indicates if the session represented by this event has administration privileges.
extra_failurereason string extraFailurereason$ The reason for a failed login.
extra_homedirectory string extraHomedirector$ The home directory of the user process associated with the log event.
extra_impersonationlevel string extraImpersonationlevel$ MS WMI impersonation level.
extra_keylength int32 extraKeylength$ Length of key protecting the secure channel.
extra_lmpackagename string extraLmpackagename$ If this logon was authenticated via the NTLM protocol (instead of Kerberos, for instance) this field tells you which version of NTLM was used.
extra_logonprocessname string extraLogonprocessname$ The name of the MS trusted logon process, such as Winlogon or IKE.
extra_restrictedadminmode string extraRestrictedadminmode$ "Yes" for incoming Remote Desktop Connections where the client specified /restrictedAdmin on the command line.
extra_samaccountname string extraSamaccountname$ User logon name used to support clients and servers from a previous version of Windows (Pre-Windows 2000).
extra_targetoutbounddomainname string extraTargetoutbounddomainname$ MS domain name of target logon.
extra_targetoutboundusername string extraTargetoutboundusername$ MS user name of target logon.
extra_targetservername string extraTargetservername$ Hostname of target logon.
extra_userprincipalname string extraUserpricipalname$ Internet-style login name for the user based on the Internet standard RFC 822.
extra_virtualaccount string extraVirtualAccount$ Indicates MS services are configured to logon with a Virtual Account.
extra_workstationname string extraWorkstationname$ The computer name where the user is physically present in most cases unless this logon was initiated by a server application acting on behalf of the user.
extra_subject_domain_user_id string extraSubjectDomainUserId$ Identifies the account that requested the logon, not the user being logged onto.
extra_target_domain_user_id string extraTargetDomainUserId$ Identifies the account being logged on.
application_name string applicationName$ Identifies the application being logged into, notably for cloud integrations.
service_name string serviceName$ The name of the service where the user is trying to login.
service_sid string serviceSid$ Identifies the service where the user is trying to login.
ticket_options string ticketOptions$ The logon ticket options.
event_metadata KeyValuePairsIndexed Event metadata can be provided by the appliance to add context.

Geographic IP fields are not writable from custom parsers.

The src_ipgeo_summary and dest_ipgeo_summary fields are populated by an automatic Sophos enrichment step that runs after custom parser normalization. Any value a custom parser writes to these fields will be replaced before the event reaches queryable storage.

To get geographic data populated, ensure your parser writes the relevant IP addresses to source_address$ and target_address$. Enrichment uses those fields to look up the geographic data and fill in src_ipgeo_summary (from source_address) and dest_ipgeo_summary (from target_address) automatically.

Enrichment only applies to publicly routable IP addresses; private and loopback addresses are skipped.