Prisma Browser Event Types
A complete reference for every event type generated by Prisma Browser, including common fields, log levels, actions, and event categories.
| Where Can I Use This? | What Do I Need? |
|---|
- Strata Cloud Manager
- Prisma Browser standalone
|
- Prisma Access with Prisma Browser bundle license or Prisma Browser standalone license
- Superuser or Prisma Browser role
|
Prisma Browser Event Types provides a complete reference for every event that Prisma Browser generates. Events capture user activity, security enforcement decisions, and system health information from across your Enterprise Browser deployment. Use this reference to understand the event data available in the Events screen and in exported reports.
How Events Are Structured
Every event generated by Prisma Browser follows a common structure. Each event contains a core set of common fields that are always present, plus context objects that vary by event type.
Common Fields
The following fields appear on every event, regardless of type or log level:
| Field | UI Label | Description | Example |
|---|
| ID | ID | Unique event identifier (PULID format) | 01HX7QJKM3P4R5S6T7V8W9Y0Z |
| Timestamp | Time | When the event occurred (UTC) | 2026-07-06T08:15:30.000Z |
| Type | Type | The specific event type | File download |
| Category | Category | The event category grouping | DLP |
| Action | Action | The policy enforcement outcome | Blocked |
| User | User | The user who generated the event | jane.doe@acme.com |
| Device | Device | The endpoint hostname | ACME-LAPTOP-042 |
| Policy rule | Policy rule | The rule that matched the event (if applicable) | Block sensitive file uploads |
| Mode | Mode | Whether the rule is in enforcement or monitor mode | Enforcement |
| Browser type | Browser type | Enterprise browser, Extension only, Mobile, or Desktop | Enterprise browser |
| OS | OS | The operating system | Windows 11 |
User Fields
Every event identifies the user who performed the action:
| Field | UI Label | Description | Example |
|---|
| user.email | User | Email address of the user | jane.doe@acme.com |
| user.name | User name | Full name of the user | Jane Doe |
| user.externalId | User ID | Unique user identifier from the IdP | user_abc123 |
| user.shortUsername | Short username | Shortened username | jane.doe |
| user.groups.names | User group | User group memberships (enriched) | Engineering, US-West |
Policy Fields
When an event matches a policy rule, these fields describe the enforcement decision:
| Field | UI Label | Description | Example |
|---|
| policy.action | Action | The enforcement outcome | Blocked |
| policy.ruleDescription | Policy rule | Description of the matched rule | Block file uploads to unsanctioned apps |
| policy.ruleId | Rule ID | Internal rule identifier | 01HX7QJK... |
| policy.blockReason | Block reason | Why the activity was blocked | Sensitive content |
| policy.failureReason | Failure reason | Why the operation failed | Cloud scanning timeout |
| policy.signOutReason | Sign-out reason | Why a session ended | Inactivity |
| policy.bypassAllowed | Bypass allowed | Whether the user can proceed past the block | Yes / No |
| policy.bypassReason | Bypass reason | User-provided reason for bypassing | Manager approved verbally |
| policy.isMonitor | Mode | Whether the rule is in monitor mode (detect only, no enforcement) | true / false |
| policy.evidence.types | Evidence | What evidence was collected | Event recording, Screenshot |
| policy.definedAction | Defined action | The original action configured in the rule | Block |
| policy.revision | Policy revision | The active policy configuration version number | 14 |
Context Objects
Depending on the event type, additional context is attached to the event record. For example:
- A File download event includes file context (file name, type, SHA-256 hash, download URL)
- A Website access event includes network context (URL, HTTP method, web classifications)
- A Browser sign-in event includes posture context (block reason, device group evaluation)
- A GenAI prompt event includes prompt context (prompt text, included files, embedded AI application)
Each child article below documents the specific context fields available for its event types.
Log Levels and Anonymization
The visibility of event data depends on the log level configured on the matching policy rule. Each rule specifies how much detail to record when an event is generated.
| Log Level | UI Label | Behavior |
|---|
| None | Off | The event is not generated at all — no record is created |
| Anonymize | Anonymized | The event is generated but personal data fields are masked |
| Full | On | All event data is preserved with full detail (this is the default for new rules) |
| Enhanced | Enhanced | Same as On, plus evidence collection is enabled (screenshot or event recording) |
Log Level Availability by Rule Type
| Rule Type | Configurable Log Levels | Default |
|---|
| Access and Data Control rules | None, Anonymize, Full, Enhanced | Full |
| Browser Security rules | Anonymize only (not configurable) | Anonymize |
| Browser Customization rules | Anonymize only (not configurable) | Anonymize |
Events generated by Browser Security or Browser Customization rules are always anonymized. Only events generated by Access and Data Control rules can be configured to use Full or Enhanced logging.
How Anonymization Works
When an event is logged at the Anonymize level, the following transformations are applied:
| Field Type | Anonymized Form | Example |
|---|
| URLs (all URL fields) | Domain preserved, path replaced | www.acme.com/**** |
| file:// URLs | Entire path hidden | file://**** |
| Email addresses | Local part hidden, domain preserved | ****@acme.com |
| Strings (file name, file path, MIME type, page title, printer name) | Replaced with fixed string | ** Anonymized ** |
The following fields are always present at full fidelity, regardless of log level:
- Event ID, timestamp, and event type
- Device context (hostname, OS, browser type, browser version, serial number)
- Policy context (rule ID, action, mode)
- File SHA-256 hash
- File size (bytes)
- Web classifications (URL categories)
- Extension details (for extension events)
Session Recording and Query Parameters
Session recording is configured separately from log level. When enabled on a rule, it records the full browsing session within specified applications (including non-event actions like clicks, scrolling, and typing). Recording automatically stops after 5 minutes of inactivity. When session recording is enabled, the log level cannot be set to Off — it automatically uses at least Anonymized.
An additional per-rule option controls whether URL query parameters are logged. When Query Parameters is enabled, the full URL including query string is recorded. When disabled (default), query parameters are stripped. At the Anonymize level, query parameters are never included regardless of this setting.
Event Categories
Prisma Browser groups events into the following categories in the Events screen:
| Category | UI Label | Description | Event Count |
|---|
| access | Access | Website visits, login attempts, sign-in/sign-out, remote connections, desktop app access, DevTools, WebRTC, JIT, maintenance | 14 types |
| dlp | DLP | File transfers, clipboard actions, printing, screenshots, screen recording, GenAI prompts | 16 types |
| malwareProtection | Malware | Malicious files, websites, and extensions detected | 3 types |
| extensions | Extensions | Browser extension lifecycle events | 5 types |
| tampering | Tampering | Unauthorized modification of browser files, processes, network, engine, or RCE exploit attempt | 7 types |
| browserSecurity | Browser security | Attack surface reduction (protected browsing) controls | 1 type |
| pinCode | PIN Code | PIN code brute-force detection | 1 type |
Some categories contain event types that are more naturally understood by topic. For
example, DevTools, WebRTC, and JIT events appear under Access in the UI
category filter, but are documented under BROWSER SECURITY EVENTS because they
relate to browser security controls. Maintenance events also appear under Access,
but are documented in MAINTENANCE EVENTS because they represent system
health.
Audit events (admin console actions) are tracked separately and covered in AUDIT
EVENTS.
Event Actions
Every event records a policy enforcement outcome as an Action. The action tells you what happened — whether the activity was allowed, blocked, or handled in some other way. Actions start from the rule's configured effect (Allow or Block) but are refined at event time based on context: the admin-configured rule specifies Allow, Block, or Prompt; runtime conditions such as encryption state, scan results, bypass flow, and admin approvals determine the specific action variant; and system events without policy enforcement use informational actions like Detected or Applied.
Standard Policy Outcomes
| Action | Meaning | Typical Event Types |
|---|
| Allowed | The activity was permitted by policy | All types — the default when a rule allows or no rule matches |
| Blocked | The activity was blocked by policy | websiteAccess, fileDownload, fileUpload, clipboardCopy, clipboardPaste, loginAttempt, extensionEnable, extensionUpdate, talonSignIn |
| Proceeded anyway | The user was presented a block prompt and chose to proceed (bypass) | websiteAccess, fileDownload, fileUpload, clipboardPaste, sanitizingContent, loginAttempt |
Data Protection Actions
| Action | Meaning | Typical Event Types |
|---|
| Allowed encrypted | The file was allowed after being encrypted by the browser | fileDownload, fileUpload |
| Blocked encrypted | The file was blocked because it arrived encrypted (cannot be scanned) | fileDownload |
| Saved to cloud | The file was redirected to cloud vault storage instead of local download | fileDownload |
| Masked content | Sensitive data on the page was replaced with masking characters | maskingContent |
| Allowed (protected) | The clipboard content was allowed but in a protected/controlled context | clipboardCopy |
Administrative Flow Actions
| Action | Meaning | Typical Event Types |
|---|
| Permission requested | The user requested admin approval to proceed past a block | loginAttempt, sanitizingContent, unmaskContent |
| Allowed with admin approval | An admin approved the user's request to proceed | fileDownload, fileUpload, loginAttempt, sanitizingContent, unmaskContent |
Security Control Actions
| Action | Meaning | Typical Event Types |
|---|
| Prevented | A security control prevented the activity (no prompt shown) | maliciousExtension |
| Activated | A security control was activated on the page | maskingContent, formSubmission, asrControl |
| Enforced | A policy enforcement was applied automatically | extensionDisable, extensionUninstall, browserSignOut |
| Redirected | The user was redirected to Prisma Browser or another URL | websiteAccess (flex-link or URL redirect rules) |
Connection Actions
| Action | Meaning | Typical Event Types |
|---|
| Connected | A remote connection was established | remoteConnect |
| Disconnected | A remote connection was terminated | remoteConnect |
| Failed | The operation failed (connection error or cloud scan unavailable) | remoteConnect, fileDownload |
Informational Actions
| Action | Meaning | Typical Event Types |
|---|
| Detected | An event was observed and logged — the system detected something but did not cause or enforce the action | browserClosure, browserStartupFailure, authenticationFailure, tamperingAttempt |
| Applied | A configuration or state change was applied | browserSignOut (inactivity/timeout) |
| Network error detected | A network error was encountered during page load | websiteAccess |
When a rule is in Monitor mode, the event still records the action that would have been enforced (Blocked, Blocked sensitive, etc.), but the Mode field shows "Monitor" and the activity is not actually prevented. This allows admins to see what the rule would do before turning it into enforcement mode.
Event Severity
Each event is assigned a severity level during enrichment. In the Events screen, severity is presented as an Is incident indicator:
| Is Incident | Severity Level | Meaning |
|---|
| Yes | Very high | Critical security events requiring immediate attention (tampering, RCE exploit, posture block) |
| No | None / Low / Medium / High | Normal operational events or standard policy enforcement |
The Events screen surfaces severity as a binary "Is incident" filter (Yes/No). Events with severity "Very high" are flagged as incidents. All other events are considered non-incident.
Enriched Fields
When events are viewed in the Prisma Browser Events screen or consumed externally, additional enriched fields are included:
| Field | Description |
|---|
| IP address | Public IP address of the device at the time of the event |
| User groups | User group memberships at the time of the event |
| Device groups | Device group memberships at the time of the event |
| MITRE | MITRE ATT&CK technique IDs associated with the event |
| Compliance | Security compliance standards applicable to the event (PCI DSS, SOC 2, HIPAA) |
| Browser brand | The browser brand (Prisma Browser, Chrome, Edge, Firefox, etc.) |
| App classification | Application classification level (Sanctioned, Tolerated, Unsanctioned, Unclassified) |
| App tags | Application tag names assigned by the organization |
Device Context
All events include device information to identify where the activity occurred:
| Field | Description |
|---|
| Hostname | Endpoint device hostname |
| OS | Operating system type and version (Windows, macOS, iOS, Android, ChromeOS, Linux) |
| Browser type | Enterprise browser, mobile browser, extension only, or desktop |
| Browser brand | Arc, Brave, Chrome, Edge, Firefox, Opera, Safari, Prisma Browser, etc. |
| Browser version | Version of the browser at the time of the event |
| Extension version | Prisma Browser Extension version (for extension deployments) |
| Device type | Desktop, laptop, VM, smartphone, tablet, or Chromebook |
| Serial number | Manufacturer serial number |
| Manufacturer | Device manufacturer (e.g., Apple Inc., Dell Inc., Lenovo) |
| Model | Device model |
| Public IP | Public IP address |
| Local IPs | Local network IP addresses |
Application Context
Events involving application access include additional application information:
| Field | Description |
|---|
| Application | Application name as identified in the application catalog |
| Login user | The username used for login |
| Login method | The authentication method used |
| Identity provider URL | The SSO identity provider URL |
| Service provider URL | The service provider URL |
| GenAI | Whether the application is a GenAI application |
| Use cases | Application use cases |
| Reputation risk | Application reputation risk level (Low, Medium, High) |
| App classification | Sanctioned, Tolerated, Unsanctioned, or Unclassified |
| App tags | Organization-defined application tags |
| Passkey (WebAuthn) | Authenticator type, credential ID, relying party, and error details for passkey ceremonies |
