Access Events
Table of Contents
Access Events
Access events capture user interactions with websites, applications, and the browser sign-in/sign-out process in Prisma Browser.
Event Types
| Event Type | UI Name | Description |
|---|---|---|
| websiteAccess | Website access | A user visited a website or web application |
| loginAttempt | Login attempt | A user attempted to log in to an application |
| loginSuccess | Login success | A user successfully logged in to an application |
| loginFail | Login failed | A user login attempt failed |
| talonSignIn | Browser sign-in | A user signed in to Prisma Browser (includes posture evaluation) |
| browserSignOut | Browser sign-out | A user signed out of Prisma Browser (or was signed out) |
| remoteConnect | Remote connect | A user connected to a remote resource (SSH, RDP, VNC) |
| localDesktopAppAccess | Desktop app access | A user accessed a local desktop application monitored by Prisma Browser Beyond (BPY) |
When a device fails posture compliance during sign-in, the result is a talonSignIn event with action = Blocked and a posture blockReason. This is not a separate event type — posture enforcement is part of the sign-in flow.
Context Fields — Website Access
Events involving website visits include the following network context:
| Field | UI Label | Description |
|---|---|---|
| network.url | URL | The URL associated with the event |
| network.tabUrl | Page URL | The URL of the browser tab |
| network.frameUrl | Inline frame URL | The URL of the iframe (if the event occurred within a frame) |
| network.protocol | Protocol | HTTP or HTTPS |
| network.http.method | HTTP method | The HTTP method of the request (GET, POST, etc.) |
| network.http.status | Status code | The HTTP response status code |
| network.classifications | Website classification | URL category classifications (e.g., Social Media, News, Shopping) |
| network.webRiskLevel | Risk Level | The risk level assigned to the URL |
| network.webScanEngine | Web Scan Engine | The engine used for URL classification (PAN-DB, URL Real-Time, Live Page Scanning, ADNS, Hosts File) |
| network.queryParams | Query Parameters | Query parameters associated with the URL (when enhanced logging is enabled) |
| network.tunneledThroughPA | Tunneled through PA | Whether the connection was tunneled through Prisma Access |
| network.redirectDestinationUrl | Destination URL | The URL the user was redirected to |
| network.remoteConnectionProtocol | Remote Connection Protocol | The protocol for remote connections (SSH, RDP, VNC) |
Context Fields — Login Events
Login-related events include authentication context:
| Field | UI Label | Description |
|---|---|---|
| application.username | Login user | The username used for login |
| application.loginId | Login ID | The login identifier used |
| application.loginMethod | Login method | The authentication method (e.g., password, SSO, passkey) |
| application.identityProviderUrl | Identity provider URL | The IdP URL used for SSO login |
| application.serviceProviderUrl | Service provider URL | The SP URL |
| auth.ssoProvider | Identity provider | The SSO provider (Okta, Entra, PingOne, Google, Auth0, CyberArk, etc.) |
| auth.strengthLevel | Password strength | Password strength level (Weak, Fair, Good, Strong, Very Strong) — present only on Login success events with form-based login |
Passkey (WebAuthn) Context
When a login involves passkey/WebAuthn authentication:
| Field | UI Label | Description |
|---|---|---|
| application.webauthn.authenticatorAttachment | Authenticator type | Platform (built-in biometric/TPM) or cross-platform (USB key, NFC, BLE) |
| application.webauthn.authenticator | Authenticator | Human-readable name (Windows Hello, Touch ID, Face ID, YubiKey, Android) |
| application.webauthn.credentialId | Credential ID | Base64url-encoded credential ID for correlation across events |
| application.webauthn.relyingPartyId | Relying party | The relying party domain that owns the credential |
| application.webauthn.error.name | Error name | WebAuthn error type (NotAllowedError, SecurityError, AbortError) |
| application.webauthn.error.message | Error message | Human-readable error description |
Context Fields — Browser Sign-In / Sign-Out
Browser sign-in events include posture and state evaluation context. The sign-in event captures the full posture evaluation — whether the device was allowed, blocked for non-compliance, or bypassed.
| Field | UI Label | Description |
|---|---|---|
| posture.blockReason | Block reason | Why sign-in was blocked — one of the posture attribute failures |
| posture.suspensionType | Suspension type | Type of suspension — Device or User |
| policy.action | Action | Allowed, Blocked, or Proceeded anyway (bypassed) |
| policy.blockReason | Block reason | Policy-level block reason (e.g., NonCompliantSignIn when posture fails) |
| policy.signOutReason | Sign-out reason | Why the session ended (Inactivity, Timeout, Logout, Non-compliant device, Admin remediation, Tampering) |
Posture Block Reasons
When a device fails posture evaluation during sign-in, the event records which posture attribute caused the block:
| Block Reason | Description |
|---|---|
| OS Version | OS version is below the minimum required |
| Lock Screen | Device does not have a lock screen enabled |
| File System Encryption | Disk encryption is not enabled |
| Antivirus | Required antivirus is not running or not up to date |
| Serial Number | Device serial number is not in the approved list |
| Client Certificate | Device does not have the required client certificate |
| Device Type | Device type (VM, mobile, etc.) is not permitted |
| CrowdStrike ZTA Score | CrowdStrike Zero Trust Assessment score is below threshold |
| Device Suspended | The device has been suspended by an administrator |
| Entity Suspended | The user entity has been suspended |
| Browser Version | Browser version is below the minimum required |
| Domain Join | Device is not domain-joined |
| Firewall | Host firewall is not active |
Device Group Evaluation
When a device signs in, Prisma Browser evaluates all configured device groups and records the results:
| Field | Description |
|---|---|
| state.deviceGroupEvaluation[].name | Device group name |
| state.deviceGroupEvaluation[].isMatch | Whether the device matched this group |
| state.deviceGroupEvaluation[].blockReason | The posture attribute that caused a mismatch |
| state.deviceGroupEvaluation[].attributes | All evaluated attributes |
| state.deviceGroupEvaluation[].unmatchedAttributes | Attributes that did not match |
Sign-In Rules Evaluation
| Field | Description |
|---|---|
| state.signInRules[].description | Rule description |
| state.signInRules[].action | Rule action (allow/block) |
| state.signInRules[].priority | Rule priority |
| state.signInRules[].status | Matched or unmatched |
| state.signInRules[].deviceGroups | Device groups in the rule condition |
| state.signInRules[].unmatchedConditions | Conditions that did not match |
Context Fields — Desktop App Access
Events from Prisma Browser Beyond (BPY) include local desktop application context:
| Field | UI Label | Description |
|---|---|---|
| application.localDesktop.productName | Product name | Application product name (e.g., Microsoft Excel) |
| application.localDesktop.originalFileName | Original file name | Application executable name (e.g., EXCEL.EXE) |
| application.localDesktop.fileDescription | File description | Application file description |
| application.localDesktop.processPath | Process path | Full path of the application process |
| application.localDesktop.parentProcessPath | Parent process path | Parent process that launched the application |
| application.localDesktop.windowTitle | Window title | The window title of the application |
| application.localDesktop.thumbprint | Thumbprint | Signature hash of the executable |
Application Account Context
For applications with multi-tenant or workspace support, additional account-level context is captured:
| Field | Description |
|---|---|
| application.applicationAccount.tenantId | The tenant/organization ID within the application |
| application.applicationAccount.region | Application region (e.g., AWS region) |
| application.applicationAccount.channelId | Channel ID (e.g., Slack channel) |
| application.applicationAccount.workspaceName | Workspace name (e.g., Slack workspace) |
| application.applicationAccount.domain | Application domain (e.g., Microsoft tenant domain) |
| application.applicationAccount.planType | Account plan type (e.g., OpenAI plan) |
| application.applicationAccount.resourceHost | Application resource host |
Examples
Website Access — Allowed
| Field | Value |
|---|---|
| Type | Website access |
| Category | Access |
| User | jane.doe@acme.com |
| URL | www.salesforce.com/lightning/page/home |
| Application | Salesforce |
| App classification | Sanctioned |
| Action | Allowed |
| Policy rule | Allow sanctioned SaaS |
Website Access — Blocked (Unsanctioned App)
| Field | Value |
|---|---|
| Type | Website access blocked |
| Category | Access |
| User | john.smith@acme.com |
| URL | www.personalcloud.io/upload |
| Application | PersonalCloud |
| App classification | Unsanctioned |
| Action | Blocked |
| Block reason | Forbidden URL |
| Policy rule | Block unsanctioned file-sharing apps |
Browser Sign-In — Blocked (Non-Compliant Device)
| Field | Value |
|---|---|
| Type | Browser sign-in |
| Category | Access |
| User | mike.chen@acme.com |
| Action | Blocked |
| Block reason | File System Encryption |
| Device groups evaluated | Corporate Devices (not matched) |
| Unmatched attributes | File system encryption |
| Severity | Very high |
Before this migration, posture blocks were emitted as a separate nonCompliantDevice event type. The system now automatically represents these as talonSignIn with Action = Blocked and the specific posture block reason.