Audit EMAIL Fields

Table of Contents

The following table identifies the Audit field names that the Log Forwarding app uses when you forward logs using the EMAIL log format.

EMAIL Name	Query Name
ActorDisplayName	actor_display_name
ActorID	actor_id
ConnectionErrorID	connection_error.id
ConnectionErrorValue	connection_error.value
CortexDataLakeTenantID	customer_id
EventCategory	event_category
EventClientIP	event_client_ip.value
EventDescription	event_description
EventDestination	event_dest.value
EventDestinationAction	event_dest_action
EventDestinationURL	event_dest_url
EventDestinationUserUserID	event_dest_user.user_id
EventDestinationUserUUID	event_dest_user.uuid
DestinationVendor	event_dest_vendor
EventDetails	event_detail
EventID	event_id
EventName	event_name
EventResult	event_result
EventSource	event_source.value
EventSourceURL	event_source_url
EventSourceUserDomain	event_source_user.domain
EventSourceUser	event_source_user.user
EventSourceUserUserID	event_source_user.user_id
EventSourceUserUUID	event_source_user.uuid
EventSourceUserEmail	event_source_user_email
EventSourceUserFirstName	event_source_user_first_name
EventSourceUserLastName	event_source_user_last_name
EventSourceUserUUIDV4	event_source_user_uuid_v4
EventSubCategory	event_sub_category
EventTime	event_time
LogSource	log_source
LogSourceGroupID	log_source_group_id
DeviceSN	log_source_id
DeviceName	log_source_name
LogSourceTimeZoneOffset	log_source_tz_offset
TimeReceived	log_time
LogType	log_type.value
PlatformType	platform_type
Subtype	sub_type.value
TSGID	tsg_id
VendorName	vendor_name
VendorSeverity	vendor_severity.value