Focus

SaaS Security Administrator's Guide

Policy Violation Log Fields

Table of Contents

Policy Violation Log Fields

The descriptions and names of available log fields in a Data Security policy violation log.

The policy violation log is generated when an asset matches a policy rule. The log includes the following fields, which are available for ingestion by your Security information and event management (SIEM) system.

Fields are listed in the order that they are needed for push mode.

Field Name	Description
timestamp	Time the policy violation occurred. Values are in YYYY-MM-DD HH:MM:SS format.
serial	Serial number of the organization using the service (tenant).
log_type	Type of log. In this case, policy_violation.
cloud_app_instance	Instance name of the cloud application (not the type of cloud application) associated with the policy violation.
severity	Policy violation severity valued between 0 and 5.
incident_id	Unique ID number for the incident. Can be null (no value).
asset_id	Unique ID number for the asset associated with the policy violation.
item_name	Name of the file, folder, or user associated with the policy violation.
item_type	Values are File, Folder, or User.
item_owner	User who owns the asset associated with the policy violation.
item_creator	User who created the asset identified in the policy violation.
policy_rule_name	Name of the policy rule that triggered the violation.
future_use	Not currently implemented.
action_taken	Action taken to remedy the policy violation. For example, Log only, or Send Administrator Alert.
action_taken_by	Cloud app user who took action to remediate the policy violation. For automated remediation, the value is Aperture.

Remediation Activity Log Fields

Activity Monitoring Log Fields