Schema: Identity & Authentication

28 fields available

[← Back to Schema Field Reference](schema-field-reference-guide.md)

`actor.app_uid`

Unique identifier of the client application that performed the activity (Defender ServicePrincipalId). Matches the OCSF actor.app_uid attribute. Often empty for delegated user calls.

Providers: Not specified

`actor.invoked_by`

Name of the AWS service that invoked the activity (userIdentity.invokedBy). Values are service principals of the form .amazonaws.com. Present on 12.50% of CloudTrail events (deterministic 6h full scan of 335M events), spanning both AWSService and AssumedRole identities, so it is orthogonal to userIdentity.type. This path is ALSO still the third || fallback inside actor.user.name, which makes service principals appear there as usernames on 6.25% of events; that fallback is retained until the five cloud-aws-assumerole-* rules are updated, since removing it would null actor.user.name on 2.29% of events they depend on. Filter actor.invoked_by IS NULL to exclude service-initiated activity. Matches OCSF actor.invoked_by.

Providers: cloudtrail

`actor.process.command_line`

Full command line of the responsible process -- the process macOS holds accountable for the activity (Apple's TCC/privacy attribution root). Distinct from parent.process.*: it collapses launchd/xpcproxy indirection to the owning application or daemon. Sourced from Jamf Protect process.responsible_audit_token. Sparsely populated (~57% on jamf_protect exec events) -- treat as partial: selections fail closed and filters fail open when absent.

Providers: jamf_protect

`actor.process.file.path`

Absolute path to the executable of the responsible process -- the process macOS holds accountable for the activity (Apple's TCC/privacy attribution root). Distinct from parent.process.*: it collapses launchd/xpcproxy indirection to the owning application or daemon. Sourced from Jamf Protect process.responsible_audit_token.

Providers: jamf_protect

`actor.process.file.signature.certificate.subject`

Signing ID / certificate subject of the binary for the responsible process -- the process macOS holds accountable for the activity (Apple's TCC/privacy attribution root). Distinct from parent.process.*: it collapses launchd/xpcproxy indirection to the owning application or daemon. Sourced from Jamf Protect process.responsible_audit_token. Useful for allow-listing attribution roots by publisher.

Providers: jamf_protect

`actor.process.name`

File name of the executable of the responsible process -- the process macOS holds accountable for the activity (Apple's TCC/privacy attribution root). Distinct from parent.process.*: it collapses launchd/xpcproxy indirection to the owning application or daemon. Sourced from Jamf Protect process.responsible_audit_token.

Providers: jamf_protect

`actor.process.pid`

OS-assigned process identifier (PID) of the responsible process -- the process macOS holds accountable for the activity (Apple's TCC/privacy attribution root). Distinct from parent.process.*: it collapses launchd/xpcproxy indirection to the owning application or daemon. Sourced from Jamf Protect process.responsible_audit_token.

Providers: jamf_protect

`actor.process.uid`

Unique identifier for the process instance of the responsible process -- the process macOS holds accountable for the activity (Apple's TCC/privacy attribution root). Distinct from parent.process.*: it collapses launchd/xpcproxy indirection to the owning application or daemon. Sourced from Jamf Protect process.responsible_audit_token. On macOS this is a UUID.

Providers: jamf_protect

`actor.process.user.name`

Short name or login of the user running the responsible process -- the process macOS holds accountable for the activity (Apple's TCC/privacy attribution root). Distinct from parent.process.*: it collapses launchd/xpcproxy indirection to the owning application or daemon. Sourced from Jamf Protect process.responsible_audit_token.

Providers: jamf_protect

`actor.session.is_mfa`

Whether the role session presenting these credentials was itself MFA-authenticated (userIdentity.sessionContext.attributes.mfaAuthenticated). Distinct from is_mfa, which records whether the authentication event in hand used MFA: this field describes the pre-existing session an API call was made from. Populated for role-session actors only; null for IAMUser and AWSService identities, which have no sessionContext.

Providers: cloudtrail

`actor.session.issuer`

ARN of the role being assumed (requestParameters.roleArn)

Providers: cloudtrail

`actor.session.name`

Name of the assumed role session. For CloudTrail: role session name extracted from userIdentity.principalId after the colon (e.g. [email protected] from AROAEXAMPLE:[email protected]). Null when principalId has no colon (IAMUser/Root events) or is absent (AWSService identity). Often the user email for SSO-assumed roles.

Providers: cloudtrail

`actor.session.uid`

Unique identifier of the session. For CloudTrail: IAM role unique ID extracted from userIdentity.principalId before the colon (e.g. AROAEXAMPLE from AROAEXAMPLE:session-name). For IAMUser/Root events where principalId has no colon the full value is stored. Null when principalId is absent (e.g. AWSService identity). For EDR: browser profile ID.

Providers: crowdstrike,cloudtrail

`actor.user.account.uid`

Aws Account ID

Providers: cloudtrail

`actor.user.credential.uid`

Ex: AWS Access Key ID

Providers: cloudtrail

`actor.user.department`

Department of the acting user.

Providers: okta

`actor.user.domain`

Name of the directory or domain the acting user is a member of (e.g., NT AUTHORITY, machine name).

Providers: microsoft_defender

`actor.user.effective.group.id`

Unique identifier for the effective group on the system/platform (Unix GID).

Providers: crowdstrike,sentinel_one,jamf_protect

`actor.user.effective.id`

Unique identifier of the effective user (Unix UID).

Providers: crowdstrike,sentinel_one,jamf_protect

`actor.user.email`

Email address of the acting user.

Providers: okta,duo,cloudtrail,azure_event_hub,gcp_pubsub

`actor.user.name`

Short name or login of the acting user. May include domain prefix (e.g., NT AUTHORITY\SYSTEM) or email format.

Providers: crowdstrike,sentinel_one,microsoft_defender,jamf_protect,elastic,okta,duo,cloudtrail

`actor.user.org`

Organization the acting user belongs to.

Providers: okta

`actor.user.title`

Job title of the acting user.

Providers: okta

`actor.user.uid`

Unique identifier of the acting user. May be a Unix UID (e.g., 501), Windows SID (e.g., S-1-5-21-...), or provider-specific ID (e.g., Okta user ID).

Providers: crowdstrike,sentinel_one,microsoft_defender,okta,duo,cloudtrail,azure_event_hub,gcp_pubsub

`actor.user.uid_alt`

CloudTrail: AWS principalId from userIdentity. Format varies by identity type - for IAM roles: 'ROLE_ID:session-name' (e.g., AROAEXAMPLE:eks-session), for IAM users: account number, for AWS services: service name. Provides the unique identifier of the AWS principal that performed the action.

Providers: cloudtrail

`auth.protocol`

Authentication protocol used for the logon event. NOCSF extension.

Providers: microsoft_defender

`auth.service.name`

Service principal name requested in a Kerberos exchange. OCSF carries this on the Authentication class service object. Namespaced under auth. to avoid colliding with the existing service.name field, which records the application that logged the event.

Providers: azure_event_hub,microsoft_defender

`auth.ticket.encryption_type`

Encryption type negotiated for a Kerberos ticket, for example rc4-hmac or aes256-cts-hmac-sha1-96.

Providers: azure_event_hub,microsoft_defender