Access events capture user interactions with websites, applications, and the browser sign-in/sign-out process in Prisma Browser.
Context Fields — Website Access
Events involving website visits include the following network context:
| Field | UI Label | Description |
|---|
| network.url | URL | The URL associated with the event |
| network.tabUrl | Page URL | The URL of the browser tab |
| network.frameUrl | Inline frame URL | The URL of the iframe (if the event occurred within a frame) |
| network.protocol | Protocol | HTTP or HTTPS |
| network.http.method | HTTP method | The HTTP method of the request (GET, POST, etc.) |
| network.http.status | Status code | The HTTP response status code |
| network.classifications | Website classification | URL category classifications (e.g., Social Media, News, Shopping) |
| network.webRiskLevel | Risk Level | The risk level assigned to the URL |
| network.webScanEngine | Web Scan Engine | The engine used for URL classification (PAN-DB, URL Real-Time, Live Page Scanning, ADNS, Hosts File) |
| network.queryParams | Query Parameters | Query parameters associated with the URL (when enhanced logging is enabled) |
| network.tunneledThroughPA | Tunneled through PA | Whether the connection was tunneled through Prisma Access |
| network.redirectDestinationUrl | Destination URL | The URL the user was redirected to |
| network.remoteConnectionProtocol | Remote Connection Protocol | The protocol for remote connections (SSH, RDP, VNC) |
Context Fields — Login Events
Login-related events include authentication context:
| Field | UI Label | Description |
|---|
| application.username | Login user | The username used for login |
| application.loginId | Login ID | The login identifier used |
| application.loginMethod | Login method | The authentication method (e.g., password, SSO, passkey) |
| application.identityProviderUrl | Identity provider URL | The IdP URL used for SSO login |
| application.serviceProviderUrl | Service provider URL | The SP URL |
| auth.ssoProvider | Identity provider | The SSO provider (Okta, Entra, PingOne, Google, Auth0, CyberArk, etc.) |
| auth.strengthLevel | Password strength | Password strength level (Weak, Fair, Good, Strong, Very Strong) — present only on Login success events with form-based login |
Passkey (WebAuthn) Context
When a login involves passkey/WebAuthn authentication:
| Field | UI Label | Description |
|---|
| application.webauthn.authenticatorAttachment | Authenticator type | Platform (built-in biometric/TPM) or cross-platform (USB key, NFC, BLE) |
| application.webauthn.authenticator | Authenticator | Human-readable name (Windows Hello, Touch ID, Face ID, YubiKey, Android) |
| application.webauthn.credentialId | Credential ID | Base64url-encoded credential ID for correlation across events |
| application.webauthn.relyingPartyId | Relying party | The relying party domain that owns the credential |
| application.webauthn.error.name | Error name | WebAuthn error type (NotAllowedError, SecurityError, AbortError) |
| application.webauthn.error.message | Error message | Human-readable error description |
Context Fields — Browser Sign-In / Sign-Out
Browser sign-in events include posture and state evaluation context. The sign-in event captures the full posture evaluation — whether the device was allowed, blocked for non-compliance, or bypassed.
| Field | UI Label | Description |
|---|
| posture.blockReason | Block reason | Why sign-in was blocked — one of the posture attribute failures |
| posture.suspensionType | Suspension type | Type of suspension — Device or User |
| policy.action | Action | Allowed, Blocked, or Proceeded anyway (bypassed) |
| policy.blockReason | Block reason | Policy-level block reason (e.g., NonCompliantSignIn when posture fails) |
| policy.signOutReason | Sign-out reason | Why the session ended (Inactivity, Timeout, Logout, Non-compliant device, Admin remediation, Tampering) |
Posture Block Reasons
When a device fails posture evaluation during sign-in, the event records which posture attribute caused the block:
| Block Reason | Description |
|---|
| OS Version | OS version is below the minimum required |
| Lock Screen | Device does not have a lock screen enabled |
| File System Encryption | Disk encryption is not enabled |
| Antivirus | Required antivirus is not running or not up to date |
| Serial Number | Device serial number is not in the approved list |
| Client Certificate | Device does not have the required client certificate |
| Device Type | Device type (VM, mobile, etc.) is not permitted |
| CrowdStrike ZTA Score | CrowdStrike Zero Trust Assessment score is below threshold |
| Device Suspended | The device has been suspended by an administrator |
| Entity Suspended | The user entity has been suspended |
| Browser Version | Browser version is below the minimum required |
| Domain Join | Device is not domain-joined |
| Firewall | Host firewall is not active |
Context Fields — Desktop App Access
Events from Prisma Browser Beyond (BPY) include local desktop application context:
| Field | UI Label | Description |
|---|
| application.localDesktop.productName | Product name | Application product name (e.g., Microsoft Excel) |
| application.localDesktop.originalFileName | Original file name | Application executable name (e.g., EXCEL.EXE) |
| application.localDesktop.fileDescription | File description | Application file description |
| application.localDesktop.processPath | Process path | Full path of the application process |
| application.localDesktop.parentProcessPath | Parent process path | Parent process that launched the application |
| application.localDesktop.windowTitle | Window title | The window title of the application |
| application.localDesktop.thumbprint | Thumbprint | Signature hash of the executable |
Application Account Context
For applications with multi-tenant or workspace support, additional account-level context is captured:
| Field | Description |
|---|
| application.applicationAccount.tenantId | The tenant/organization ID within the application |
| application.applicationAccount.region | Application region (e.g., AWS region) |
| application.applicationAccount.channelId | Channel ID (e.g., Slack channel) |
| application.applicationAccount.workspaceName | Workspace name (e.g., Slack workspace) |
| application.applicationAccount.domain | Application domain (e.g., Microsoft tenant domain) |
| application.applicationAccount.planType | Account plan type (e.g., OpenAI plan) |
| application.applicationAccount.resourceHost | Application resource host |
