Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-custom-parsers-schema-cloudaudit

Cloud Audit schema

Use this reference to identify the fields available in the cloudaudit schema and the parser fields used to populate them.

For a field to be populated in Sophos XDR, the corresponding parser field must be present in the source data.

Schema summary

Property Value
Schema name CloudAudit
Parser field prefix CloudAudit
Supports custom parsers Yes
Schema components CloudResource

Schema components

CloudAudit.CloudResource

CloudResource identifies and describes an audited resource in the cloud.

Normalized Field Type Parser Field Description
resource_id string resourceId$ A unique identifier for a resource assigned by the cloud provider.
resource_account_id string resourceAccountId$ Account ID to which the resource belongs in the cloud.
resource_type string resourceType$ Resource type assigned by the cloud provider.

Schema fields

Normalized Field Type Parser Field Description
resource_id string resourceId$ Full resource string identifying the record.
tenant_id string tenantId$ ID of the tenant.
sensor_type string sensorType$ Type of device that generated this event.
sensor_event_id string sensorEventId$ Event ID of original_data assigned by the sensor.
sensor_tenant string sensorTenant$ A customer ID supplied by the application that originated the data.
sensor_id string sensorId$ An ID for the data supplied by the application that originated it.
sensor_cpe string sensorCpe$ CPE of the platform producing the alert.
original_data string originalData$ Original, unadulterated data prior to any transformation.
event_time_usec uint64 eventTimeUsec$ Event time in microseconds (µs).
ingest_time_usec uint64 ingestTimeUsec$ Ingest time in microseconds (µs).
event_time_fidelity TimeFidelity eventTimeFidelity$ Specifies the original precision of the time used to populate event_time_usec.
host_id string hostId$ The host ID that uniquely identifies the host where the event originated, such as IPv(4/6) address or device MAC address.
sensor_version string sensorVersion$ The agent version as string.
user_name string userName$ Name of the cloud user who conducted the audited activity.
user_type string userType$ Type of the audited user, categorized by cloud providers.
access_key string accessKey$ Access key used by the user during the audited activity.
mfa_used bool mfaUsed$ If MFA used when user was authenticated.
user_id string userId$ Unique ID for the user.
target_user_name string targetUserName$ The account impacted by the action.
source_user_name string sourceUserName$ The user associated with the source.
event_type string eventType$ Audit event type assigned by cloud provider, such as 'AwsApiCall'.
event_name string eventName$ Audit event name assigned by cloud provider, such as 'PutObject'.
event_source string eventSource$ Audit event source assigned by cloud provider, such as 's3.amazonaws.com'.
recipient_account_id string recipientAccountId$ Audit event's recipient account_id assigned by cloud provider.
read_only bool readOnly$ Audit event is read-only.
management_event bool managementEvent$ Audit event is management event.
bucket_name string bucketName$ Name for the bucket containing the object, such as 'us-bucket01'.
target_hostname string targetHostname$ The name of the target host, such as 'us-bucket01.s3.amazonaws.com'.
object_key string objectKey$ The key of the object, such as 'sample_image.jpg'.
object_prefix string objectPrefix$ The prefix specified for the object.
resources CloudAudit.CloudResource repeated Complete list of resources accessed by the audited event. Each resource is described by resource_account_id, resource_id, and resource_type.
source_address string sourceAddress$ The IP address from where the user initiated the request that triggered the audited event.
user_agent string userAgent$ User-Agent used in the request.
source_ipgeo_summary GeoSummary sourceIpgeoSummary$ The geographic location of the source IP.
os OperatingSystem $os.$os Operating system: architecture of the user's machine.
logon_application_family string logonApplicationFamily$ The application used by the user to logon, devoid of version information, such as chrome or firefox.
region string region$ The data center region, such as 'sa-east-1'.
status string status$ The result status of the audited event.
error_code string errorCode$ The result error code of the audited event, if any.
error_message string errorMessage$ The result error message of the audited event, if any.
request_parameters KeyValuePairsIndexed requestParameters$ List of parameters in the request in key-value pairs.
responses KeyValuePairsIndexed responses$ Responses from cloud services.
additional_event_data KeyValuePairsIndexed additionalEventData$ Additional metadata of the audited events in key-value pairs.