DuoAuthentication_CL

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Attribute Value
Ingestion API Supported ✓ Yes

Contents

Schema (43 columns)

Source: KQL validation test schema

Column Name Type
AccessDeviceBrowser string
AccessDeviceBrowserVersion string
AccessDeviceCity string
AccessDeviceCountry string
AccessDeviceEpkey string
AccessDeviceFlashVersion string
AccessDeviceHostname string
AccessDeviceIp string
AccessDeviceIsEncryptionEnabled string
AccessDeviceIsFirewallEnabled string
AccessDeviceIsPasswordSet string
AccessDeviceJavaVersion string
AccessDeviceOs string
AccessDeviceOsVersion string
AccessDeviceSecurityAgents dynamic
AccessDeviceState string
AdaptiveTrustAssessments dynamic
Alias string
ApplicationDestinationName string
ApplicationKey string
ApplicationName string
AuthDeviceCity string
AuthDeviceCountry string
AuthDeviceIp string
AuthDeviceKey string
AuthDeviceName string
AuthDeviceState string
Email string
EventTimestamp real
EventType string
Factor string
IsoTimestamp datetime
OodSoftware string
PassportAssessment dynamic
Reason string
Result string
TimeGenerated datetime
TrustedEndpointStatus string
TrustedSessionUuid string
TxId string
UserGroups dynamic
UserKey string
UserName string

Schema References

Official Microsoft Learn documentation for field/column information:

Solutions (1)

This table is used by the following solutions:

Connectors (1)

This table is ingested by the following connectors:

Connector Selection Criteria
Cisco Duo Authentication

Content Items Using This Table (10)

Analytic Rules (4)

In solution CiscoDuoSecurity:

Analytic Rule Selection Criteria
Cisco Duo - Authentication device new location
Cisco Duo - Multiple user login failures
Cisco Duo - New access device
Cisco Duo - Unexpected authentication factor

Hunting Queries (5)

In solution CiscoDuoSecurity:

Hunting Query Selection Criteria
Cisco Duo - Authentication error reasons
Cisco Duo - Authentication errors
Cisco Duo - Devices with unsecure settings
Cisco Duo - Devices with vulnerable OS
Cisco Duo - Fraud authentications

Workbooks (1)

In solution CiscoDuoSecurity:

Workbook Selection Criteria
CiscoDuo

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index