Event Types

All 551 events with OCSF mappings, grouped by Directory Insights service — same layout as the Directory Insights API event-type lists.

Services#

• Access Management — 7 events
• AI Admin — 6 events
• AI Gateway — 3 events
• Alerts — 8 events
• Asset Management — 9 events
• Directory — Command and Policy Events — 35 events
• Directory — Integrations — 56 events
• Directory — MTP/MSP Events — 29 events
• Directory — Object Events — 46 events
• Directory — User and Admin Events — 98 events
• GenAI — 12 events
• Generic Directory Insights — 2 events
• LDAP — 2 events
• MDM — 11 events
• Notifications — 8 events
• Object Storage — 4 events
• Password Manager — 72 events
• Password Vault — 47 events
• RADIUS — 1 event
• Reports — 13 events
• SaaS Management — 16 events
• Slack Integration — 2 events
• Software — 7 events
• SSO — 1 event
• Systems — 51 events
• Workflow — 5 events

Access Management#

access_management · 7 events

OCSF field mappings#

Legend

• Description: what the OCSF field represents (from OCSF schema v1.8.0)
• Source: raw JumpCloud event field(s) mapped via ${{placeholder}} template
• Transform: fieldMappings entry applied at runtime (cast, enum, etc.)
• Literal: static value set in the mapping template
• Usage: event types in this service that include this field

Core

activity_id

• Description: The normalized identifier of the activity that triggered the event.
• Literal: 1, 3, 4
• Usage: all events in this service

activity_name

• Description: The event activity name, as defined by the activity_id.
• Literal: Create, Delete, Update
• Usage: all events in this service

category_name

• Description: The event category name, as defined by category_uid value: Discovery.
• Literal: Identity & Access Management
• Usage: all events in this service

category_uid

• Description: The category unique identifier of the event.
• Literal: 3
• Usage: all events in this service

class_name

• Description: The event class name, as defined by class_uid value: User Inventory Info.
• Literal: Entity Management
• Usage: all events in this service

class_uid

• Description: The unique identifier of a class. A class describes the attributes available in an event.
• Literal: 3004
• Usage: all events in this service

severity_id

• Description: OCSF severity identifier for the event.
• Literal: 1
• Usage: all events in this service

status_detail

• Description: The status detail contains additional information about the event/finding outcome.
• Source: error_message
• Usage: all events in this service

status_id

• Description: Normalized status of the activity (1=Success, 2=Failure).
• Source: success
• Transform:
• success → boolean_to_status_id; true→1, false→2 (all events in this service)
• Usage: all events in this service

time

• Description: Event time, in epoch milliseconds (OCSF time).
• Source: timestamp
• Transform:
• timestamp → iso8601_to_epoch_millis (all events in this service)
• Usage: all events in this service

type_uid

• Description: The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.
• Literal: 300401, 300403, 300404
• Usage: all events in this service

Metadata

metadata.event_code

• Description: JumpCloud event type code.
• Source: event_type
• Usage: all events in this service

metadata.original_time

• Description: The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs.
• Source: server_timestamp
• Usage: all events in this service

metadata.product.name

• Description: Originating JumpCloud service that produced the event.
• Source: service
• Usage: all events in this service

metadata.tenant_uid

• Description: JumpCloud organization (tenant) identifier.
• Source: organization
• Usage: all events in this service

metadata.uid

• Description: Unique event identifier assigned by JumpCloud.
• Source: id
• Usage: all events in this service

metadata.version

• Description: OCSF schema version used for this event.
• Literal: 1.8.0
• Usage: all events in this service

Actor

actor.user.email_addr

• Description: Email address of the actor who initiated the event.
• Source: initiated_by.email
• Usage: access_management_access_request_approval, access_management_access_request_settings_update, access_management_approval_flow_create, access_management_approval_flow_delete, access_management_approval_flow_update, access_management_association_change

actor.user.name

• Description: Display name of the actor who initiated the event.
• Source: initiated_by.name, initiated_by.username
• Usage: access_management_access_request, access_management_access_request_approval, access_management_approval_flow_create

actor.user.type_id

• Description: OCSF user type of the actor (1=User, 2=Admin, 3=System, 4=Service).
• Source: initiated_by.type
• Transform:
• initiated_by.type → enum; enumValues: {'user': 1, 'admin': 2, 'system': 3, 'service': 4, 'device': 99}; default: 99 (all events in this service)
• Usage: all events in this service

actor.user.uid

• Description: Unique identifier of the actor who initiated the event.
• Source: initiated_by.id
• Usage: all events in this service

Entity

entity.data.access_request_id

• Description: JumpCloud extension data on the managed entity: access_request_id.
• Source: access_request_id
• Usage: access_management_access_request_approval, access_management_association_change

entity.data.association_attributes

• Description: JumpCloud extension data on the managed entity: association_attributes.
• Source: association.attributes
• Usage: access_management_association_change

entity.data.association_from_name

• Description: JumpCloud extension data on the managed entity: association_from_name.
• Source: association.connection.from.name
• Usage: access_management_association_change

entity.data.association_from_object_id

• Description: JumpCloud extension data on the managed entity: association_from_object_id.
• Source: association.connection.from.object_id
• Usage: access_management_association_change

entity.data.association_from_type

• Description: JumpCloud extension data on the managed entity: association_from_type.
• Source: association.connection.from.type
• Usage: access_management_association_change

entity.data.association_op

• Description: JumpCloud extension data on the managed entity: association_op.
• Source: association.op
• Usage: access_management_association_change

entity.data.association_to_name

• Description: JumpCloud extension data on the managed entity: association_to_name.
• Source: association.connection.to.name
• Usage: access_management_association_change

entity.data.association_to_object_id

• Description: JumpCloud extension data on the managed entity: association_to_object_id.
• Source: association.connection.to.object_id
• Usage: access_management_association_change

entity.data.association_to_type

• Description: JumpCloud extension data on the managed entity: association_to_type.
• Source: association.connection.to.type
• Usage: access_management_association_change

entity.data.changed_field

• Description: JumpCloud extension data on the managed entity: changed_field.
• Source: changes.field
• Usage: all events in this service

entity.data.changes_from

• Description: JumpCloud extension data on the managed entity: changes_from.
• Source: changes.from
• Usage: access_management_access_request, access_management_access_request_approval, access_management_access_request_settings_update, access_management_approval_flow_create, access_management_approval_flow_delete, access_management_association_change

entity.data.changes_from_LdapGroups_name

• Description: JumpCloud extension data on the managed entity: changes_from_LdapGroups_name.
• Source: changes.from.LdapGroups.name
• Usage: access_management_approval_flow_update

entity.data.initiated_from_slack_app_id

• Description: JumpCloud extension data on the managed entity: initiated_from_slack_app_id.
• Source: initiated_from.slack.app_id
• Usage: access_management_access_request_approval

entity.data.initiated_from_slack_source

• Description: JumpCloud extension data on the managed entity: initiated_from_slack_source.
• Source: initiated_from.slack.source
• Usage: access_management_access_request_approval

entity.data.initiated_from_slack_team_id

• Description: JumpCloud extension data on the managed entity: initiated_from_slack_team_id.
• Source: initiated_from.slack.team_id
• Usage: access_management_access_request_approval

entity.data.initiated_from_slack_user_id

• Description: JumpCloud extension data on the managed entity: initiated_from_slack_user_id.
• Source: initiated_from.slack.user_id
• Usage: access_management_access_request_approval

entity.data.resource_id

• Description: JumpCloud extension data on the managed entity: resource_id.
• Source: resource.id
• Usage: access_management_access_request

entity.data.resource_type

• Description: JumpCloud extension data on the managed entity: resource_type.
• Source: resource.type
• Usage: access_management_access_request

entity.data.workflow.description

• Description: JumpCloud extension data on the managed entity: workflow.description.
• Source: workflow.description
• Usage: access_management_access_request, access_management_access_request_approval, access_management_approval_flow_create, access_management_approval_flow_delete, access_management_approval_flow_update, access_management_association_change

entity.data.workflow.id

• Description: JumpCloud extension data on the managed entity: workflow.id.
• Source: workflow.id
• Usage: access_management_access_request, access_management_access_request_approval, access_management_approval_flow_create, access_management_approval_flow_delete, access_management_approval_flow_update, access_management_association_change

entity.data.workflow.name

• Description: JumpCloud extension data on the managed entity: workflow.name.
• Source: workflow.name
• Usage: access_management_access_request, access_management_access_request_approval, access_management_approval_flow_create, access_management_approval_flow_delete, access_management_approval_flow_update, access_management_association_change

entity.data.workflow.type

• Description: JumpCloud extension data on the managed entity: workflow.type.
• Source: workflow.type
• Usage: access_management_access_request, access_management_access_request_approval, access_management_approval_flow_create, access_management_approval_flow_delete, access_management_approval_flow_update, access_management_association_change

entity.name

• Description: The name of the managed entity. It should match the name of the specific entity object's name if populated, or the name of the managed entity if the type_id is 'Other'.
• Source: resource.name
• Usage: access_management_access_request_settings_update, access_management_approval_flow_create, access_management_approval_flow_delete, access_management_approval_flow_update

entity.type

• Description: The managed entity type. For example: Policy, User, Organization, Device.
• Source: resource.type
• Usage: access_management_access_request_approval, access_management_access_request_settings_update, access_management_approval_flow_create, access_management_approval_flow_delete, access_management_approval_flow_update, access_management_association_change

entity.uid

• Description: The identifier of the managed entity. It should match the uid of the specific entity's object UID if populated, or the source specific ID if the type_id is 'Other'.
• Source: access_request_id, resource.id
• Usage: all events in this service

entity_result.data.changes_to

• Description: JumpCloud extension data on the managed entity: changes_to.
• Source: changes.to
• Usage: access_management_access_request, access_management_access_request_approval, access_management_access_request_settings_update, access_management_association_change

entity_result.data.changes_to_LdapGroups_name

• Description: JumpCloud extension data on the managed entity: changes_to_LdapGroups_name.
• Source: changes.to.LdapGroups.name
• Usage: access_management_approval_flow_create, access_management_approval_flow_delete, access_management_approval_flow_update

Src Endpoint

src_endpoint.autonomous_system.name

• Description: Organization name for the Autonomous System.
• Source: asn.organization
• Usage: all events in this service

src_endpoint.autonomous_system.number

• Description: Unique number that the AS is identified by.
• Source: asn.number
• Transform:
• asn.number → int (all events in this service)
• Usage: all events in this service

src_endpoint.ip

• Description: Source IP address the request originated from.
• Source: client_ip
• Usage: all events in this service

src_endpoint.location.city

• Description: The name of the city.
• Source: location.City.Name
• Usage: all events in this service

src_endpoint.location.continent

• Description: The name of the continent.
• Source: geoip.continent_code
• Usage: all events in this service

src_endpoint.location.country

• Description: The ISO 3166-1 Alpha-2 country code.

  Note: The two letter country code should be capitalized. For example: US or CA.

• Source: location.Country.IsoCode
• Usage: all events in this service

src_endpoint.location.lat

• Description: The geographical Latitude coordinate represented in Decimal Degrees (DD). For example: 42.361145.
• Source: geoip.latitude
• Transform:
• geoip.latitude → double (all events in this service)
• Usage: all events in this service

src_endpoint.location.long

• Description: The geographical Longitude coordinate represented in Decimal Degrees (DD). For example: -71.057083.
• Source: geoip.longitude
• Transform:
• geoip.longitude → double (all events in this service)
• Usage: all events in this service

src_endpoint.location.region

• Description: The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. For example, 'CH-VD' for the Canton of Vaud, Switzerland
• Source: location.Subdivisions.IsoCode
• Usage: all events in this service

Http Request

http_request.user_agent

• Description: The request header that identifies the operating system and web browser.
• Source: user_agent
• Usage: all events in this service

Observables

observables[].name

• Description: The full name of the observable attribute. The name is a pointer/reference to an attribute within the OCSF event data. For example: file.name. Array attributes may be represented in one of three ways. For example: resources.uid, resources[].uid, resources[0].uid.
• Literal: actor.user.email_addr, actor.user.name, actor.user.uid, http_request.user_agent, src_endpoint.ip, src_endpoint.location.country
• Usage: all events in this service

observables[].type_id

• Description: The observable value type identifier.
• Literal: 14, 16, 2, 31, 4, 5
• Usage: all events in this service

observables[].value

• Description: The value associated with the observable attribute. The meaning of the value depends on the observable type.
  If the name refers to a scalar attribute, then the value is the value of the attribute.
  If the name refers to an object attribute, then the value is not populated.
• Source: client_ip, geoip.country_code, initiated_by.email, initiated_by.id, initiated_by.name, initiated_by.username, location.Country.IsoCode, user_agent
• Usage: all events in this service

Unmapped

unmapped.@timestamp

• Description: JumpCloud Directory Insights field @timestamp preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: @timestamp
• Usage: access_management_access_request, access_management_access_request_approval, access_management_access_request_settings_update, access_management_approval_flow_create, access_management_association_change

unmapped.@version

• Description: JumpCloud Directory Insights field @version preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: @version
• Usage: all events in this service

unmapped.asn.network

• Description: JumpCloud Directory Insights field asn.network preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: asn.network
• Usage: all events in this service

unmapped.file_input_timestamp

• Description: JumpCloud Directory Insights field file_input_timestamp preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: file_input_timestamp
• Usage: access_management_access_request, access_management_access_request_approval, access_management_access_request_settings_update, access_management_approval_flow_create, access_management_association_change

unmapped.geoip.region_name

• Description: JumpCloud Directory Insights field geoip.region_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: geoip.region_name
• Usage: all events in this service

unmapped.geoip.timezone

• Description: JumpCloud Directory Insights field geoip.timezone preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: geoip.timezone
• Usage: all events in this service

unmapped.initiated_by.source_metadata.workflow.id

• Description: JumpCloud Directory Insights field initiated_by.source_metadata.workflow.id preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: initiated_by.source_metadata.workflow.id
• Usage: access_management_approval_flow_create

unmapped.initiated_by.source_metadata.workflow.run_id

• Description: JumpCloud Directory Insights field initiated_by.source_metadata.workflow.run_id preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: initiated_by.source_metadata.workflow.run_id
• Usage: access_management_approval_flow_create

unmapped.initiated_by.source_metadata.workflow.type

• Description: JumpCloud Directory Insights field initiated_by.source_metadata.workflow.type preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: initiated_by.source_metadata.workflow.type
• Usage: access_management_approval_flow_create

unmapped.initiated_by_email_hash

• Description: JumpCloud Directory Insights field initiated_by_email_hash preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: initiated_by_email_hash
• Usage: access_management_access_request_approval, access_management_access_request_settings_update, access_management_approval_flow_create, access_management_approval_flow_delete, access_management_approval_flow_update, access_management_association_change

unmapped.initiated_by_id_hash

• Description: JumpCloud Directory Insights field initiated_by_id_hash preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: initiated_by_id_hash
• Usage: all events in this service

unmapped.initiated_by_name_hash

• Description: JumpCloud Directory Insights field initiated_by_name_hash preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: initiated_by_name_hash
• Usage: access_management_approval_flow_create

unmapped.initiated_by_username_hash

• Description: JumpCloud Directory Insights field initiated_by_username_hash preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: initiated_by_username_hash
• Usage: access_management_access_request, access_management_access_request_approval

unmapped.is_out_of_bound

• Description: JumpCloud Directory Insights field is_out_of_bound preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: is_out_of_bound
• Usage: all events in this service

unmapped.jc_application_name

• Description: JumpCloud Directory Insights field jc_application_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_application_name
• Usage: all events in this service

unmapped.jc_index_name

• Description: JumpCloud Directory Insights field jc_index_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_index_name
• Usage: access_management_access_request_approval, access_management_association_change

unmapped.jc_initiated_by_email

• Description: JumpCloud Directory Insights field jc_initiated_by_email preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_initiated_by_email
• Usage: access_management_access_request_settings_update, access_management_approval_flow_create, access_management_approval_flow_delete, access_management_approval_flow_update

unmapped.jc_initiated_by_username

• Description: JumpCloud Directory Insights field jc_initiated_by_username preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_initiated_by_username
• Usage: access_management_access_request_settings_update, access_management_approval_flow_create, access_management_approval_flow_delete, access_management_approval_flow_update

unmapped.jc_organization_name

• Description: JumpCloud Directory Insights field jc_organization_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_organization_name
• Usage: access_management_access_request_settings_update, access_management_approval_flow_create, access_management_approval_flow_delete, access_management_approval_flow_update

unmapped.jc_provider_id

• Description: JumpCloud Directory Insights field jc_provider_id preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_provider_id
• Usage: access_management_access_request_settings_update, access_management_approval_flow_create, access_management_approval_flow_delete, access_management_approval_flow_update

unmapped.jc_transformation_ts

• Description: JumpCloud Directory Insights field jc_transformation_ts preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_transformation_ts
• Usage: all events in this service

unmapped.location.Country.Name

• Description: JumpCloud Directory Insights field location.Country.Name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: location.Country.Name
• Usage: all events in this service

unmapped.location.Subdivisions.Name

• Description: JumpCloud Directory Insights field location.Subdivisions.Name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: location.Subdivisions.Name
• Usage: all events in this service

unmapped.pid

• Description: JumpCloud Directory Insights field pid preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: pid
• Usage: all events in this service

unmapped.provider

• Description: JumpCloud Directory Insights field provider preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: provider
• Usage: access_management_access_request_settings_update, access_management_approval_flow_create

unmapped.resource_id_hash

• Description: JumpCloud Directory Insights field resource_id_hash preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource_id_hash
• Usage: access_management_access_request, access_management_access_request_approval, access_management_approval_flow_create, access_management_approval_flow_delete, access_management_approval_flow_update, access_management_association_change

unmapped.tags

• Description: JumpCloud Directory Insights field tags preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: tags
• Usage: access_management_access_request, access_management_access_request_approval, access_management_access_request_settings_update, access_management_approval_flow_create, access_management_association_change

unmapped.timestamp_source

• Description: JumpCloud Directory Insights field timestamp_source preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: timestamp_source
• Usage: all events in this service

unmapped.useragent.device

• Description: JumpCloud Directory Insights field useragent.device preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.device
• Usage: all events in this service

unmapped.useragent.major

• Description: JumpCloud Directory Insights field useragent.major preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.major
• Usage: all events in this service

unmapped.useragent.minor

• Description: JumpCloud Directory Insights field useragent.minor preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.minor
• Usage: all events in this service

unmapped.useragent.name

• Description: JumpCloud Directory Insights field useragent.name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.name
• Usage: all events in this service

unmapped.useragent.os

• Description: JumpCloud Directory Insights field useragent.os preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.os
• Usage: all events in this service

unmapped.useragent.os_full

• Description: JumpCloud Directory Insights field useragent.os_full preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.os_full
• Usage: all events in this service

unmapped.useragent.os_major

• Description: JumpCloud Directory Insights field useragent.os_major preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.os_major
• Usage: all events in this service

unmapped.useragent.os_minor

• Description: JumpCloud Directory Insights field useragent.os_minor preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.os_minor
• Usage: all events in this service

unmapped.useragent.os_name

• Description: JumpCloud Directory Insights field useragent.os_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.os_name
• Usage: all events in this service

unmapped.useragent.os_patch

• Description: JumpCloud Directory Insights field useragent.os_patch preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.os_patch
• Usage: all events in this service

unmapped.useragent.os_version

• Description: JumpCloud Directory Insights field useragent.os_version preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.os_version
• Usage: all events in this service

unmapped.useragent.patch

• Description: JumpCloud Directory Insights field useragent.patch preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.patch
• Usage: all events in this service

unmapped.useragent.version

• Description: JumpCloud Directory Insights field useragent.version preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.version
• Usage: all events in this service

unmapped.workflow

• Description: JumpCloud Directory Insights field workflow preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: workflow
• Usage: access_management_access_request_settings_update

AI Admin#

ai_admin · 6 events

OCSF field mappings#

Legend

• Description: what the OCSF field represents (from OCSF schema v1.8.0)
• Source: raw JumpCloud event field(s) mapped via ${{placeholder}} template
• Transform: fieldMappings entry applied at runtime (cast, enum, etc.)
• Literal: static value set in the mapping template
• Usage: event types in this service that include this field

Core

activity_id

• Description: The normalized identifier of the activity that triggered the event.
• Literal: 1, 3, 4
• Usage: all events in this service

activity_name

• Description: The event activity name, as defined by the activity_id.
• Literal: Create, Delete, Update
• Usage: all events in this service

category_name

• Description: The event category name, as defined by category_uid value: Discovery.
• Literal: Identity & Access Management
• Usage: all events in this service

category_uid

• Description: The category unique identifier of the event.
• Literal: 3
• Usage: all events in this service

class_name

• Description: The event class name, as defined by class_uid value: User Inventory Info.
• Literal: Entity Management
• Usage: all events in this service

class_uid

• Description: The unique identifier of a class. A class describes the attributes available in an event.
• Literal: 3004
• Usage: all events in this service

severity_id

• Description: OCSF severity identifier for the event.
• Literal: 1
• Usage: all events in this service

status_id

• Description: Normalized status of the activity (1=Success, 2=Failure).
• Source: success
• Transform:
• success → boolean_to_status_id; true→1, false→2 (all events in this service)
• Usage: all events in this service

time

• Description: Event time, in epoch milliseconds (OCSF time).
• Source: timestamp
• Transform:
• timestamp → iso8601_to_epoch_millis (all events in this service)
• Usage: all events in this service

type_uid

• Description: The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.
• Literal: 300401, 300403, 300404
• Usage: all events in this service

Metadata

metadata.event_code

• Description: JumpCloud event type code.
• Source: event_type
• Usage: all events in this service

metadata.product.name

• Description: Originating JumpCloud service that produced the event.
• Source: service
• Usage: all events in this service

metadata.tenant_uid

• Description: JumpCloud organization (tenant) identifier.
• Source: organization
• Usage: all events in this service

metadata.uid

• Description: Unique event identifier assigned by JumpCloud.
• Source: id
• Usage: all events in this service

metadata.version

• Description: OCSF schema version used for this event.
• Literal: 1.8.0
• Usage: all events in this service

Actor

actor.user.email_addr

• Description: Email address of the actor who initiated the event.
• Source: initiated_by.email
• Usage: all events in this service

actor.user.type_id

• Description: OCSF user type of the actor (1=User, 2=Admin, 3=System, 4=Service).
• Source: initiated_by.type
• Transform:
• initiated_by.type → enum; enumValues: {'user': 1, 'admin': 2, 'system': 3, 'service': 4, 'device': 99}; default: 99 (all events in this service)
• Usage: all events in this service

actor.user.uid

• Description: Unique identifier of the actor who initiated the event.
• Source: initiated_by.id
• Usage: all events in this service

Entity

entity.data.application_id

• Description: JumpCloud extension data on the managed entity: application_id.
• Source: resource.application_id
• Usage: server_create, server_update

entity.data.auth_config.api_token

• Description: JumpCloud extension data on the managed entity: auth_config.api_token.
• Source: resource.auth_config.api_token
• Usage: server_create, server_update

entity.data.auth_config.oauth.client_id

• Description: JumpCloud extension data on the managed entity: auth_config.oauth.client_id.
• Source: resource.auth_config.oauth.client_id
• Usage: server_create, server_update

entity.data.auth_config.oauth.client_secret

• Description: JumpCloud extension data on the managed entity: auth_config.oauth.client_secret.
• Source: resource.auth_config.oauth.client_secret
• Usage: server_update

entity.data.auth_config.oauth.client_secret_hint

• Description: JumpCloud extension data on the managed entity: auth_config.oauth.client_secret_hint.
• Source: resource.auth_config.oauth.client_secret_hint
• Usage: server_create, server_update

entity.data.auth_config.oauth.scope

• Description: JumpCloud extension data on the managed entity: auth_config.oauth.scope.
• Source: resource.auth_config.oauth.scope
• Usage: server_create, server_update

entity.data.auth_method

• Description: JumpCloud extension data on the managed entity: auth_method.
• Source: auth_method
• Usage: all events in this service

entity.data.changed_field

• Description: JumpCloud extension data on the managed entity: changed_field.
• Source: changes.field
• Usage: redirect_uri_delete, redirect_uri_update, server_delete, server_update

entity.data.changes_from

• Description: JumpCloud extension data on the managed entity: changes_from.
• Source: changes.from
• Usage: redirect_uri_delete, redirect_uri_update, server_update

entity.data.changes_from_api_token

• Description: JumpCloud extension data on the managed entity: changes_from_api_token.
• Source: changes.from.api_token
• Usage: server_delete

entity.data.changes_from_oauth

• Description: JumpCloud extension data on the managed entity: changes_from_oauth.
• Source: changes.from.oauth
• Usage: server_delete

entity.data.description

• Description: JumpCloud extension data on the managed entity: description.
• Source: resource.description
• Usage: redirect_uri_update

entity.data.prefix

• Description: JumpCloud extension data on the managed entity: prefix.
• Source: resource.prefix
• Usage: server_create, server_update

entity.data.target_url

• Description: JumpCloud extension data on the managed entity: target_url.
• Source: resource.target_url
• Usage: server_create, server_update

entity.data.uri

• Description: JumpCloud extension data on the managed entity: uri.
• Source: resource.uri
• Usage: redirect_uri_create, redirect_uri_update

entity.name

• Description: The name of the managed entity. It should match the name of the specific entity object's name if populated, or the name of the managed entity if the type_id is 'Other'.
• Source: resource.name
• Usage: redirect_uri_update, server_create, server_update

entity.org.uid

• Description: The unique identifier of the organization, Oracle Cloud Tenancy, Google Cloud Organization, or AWS Organization. For example, an AWS Org ID or Oracle Cloud Domain ID .
• Source: resource.organization_id
• Usage: all events in this service

entity.uid

• Description: The identifier of the managed entity. It should match the uid of the specific entity's object UID if populated, or the source specific ID if the type_id is 'Other'.
• Source: resource.id
• Usage: all events in this service

entity_result.data.changes_to

• Description: JumpCloud extension data on the managed entity: changes_to.
• Source: changes.to
• Usage: redirect_uri_delete, redirect_uri_update, server_delete

entity_result.data.changes_to_client_id

• Description: JumpCloud extension data on the managed entity: changes_to_client_id.
• Source: changes.to.client_id
• Usage: server_update

entity_result.data.changes_to_client_secret_hint

• Description: JumpCloud extension data on the managed entity: changes_to_client_secret_hint.
• Source: changes.to.client_secret_hint
• Usage: server_update

entity_result.data.changes_to_scope

• Description: JumpCloud extension data on the managed entity: changes_to_scope.
• Source: changes.to.scope
• Usage: server_update

Src Endpoint

src_endpoint.ip

• Description: Source IP address the request originated from.
• Source: client_ip
• Usage: all events in this service

src_endpoint.location.city

• Description: The name of the city.
• Source: geoip.city
• Usage: all events in this service

src_endpoint.location.continent

• Description: The name of the continent.
• Source: geoip.continent_code
• Usage: all events in this service

src_endpoint.location.country

• Description: The ISO 3166-1 Alpha-2 country code.

  Note: The two letter country code should be capitalized. For example: US or CA.

• Source: geoip.country_code
• Usage: all events in this service

src_endpoint.location.lat

• Description: The geographical Latitude coordinate represented in Decimal Degrees (DD). For example: 42.361145.
• Source: geoip.latitude
• Transform:
• geoip.latitude → double (all events in this service)
• Usage: all events in this service

src_endpoint.location.long

• Description: The geographical Longitude coordinate represented in Decimal Degrees (DD). For example: -71.057083.
• Source: geoip.longitude
• Transform:
• geoip.longitude → double (all events in this service)
• Usage: all events in this service

src_endpoint.location.region

• Description: The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. For example, 'CH-VD' for the Canton of Vaud, Switzerland
• Source: geoip.region_code
• Usage: all events in this service

Http Request

http_request.user_agent

• Description: The request header that identifies the operating system and web browser.
• Source: useragent.raw
• Usage: all events in this service

Observables

observables[].name

• Description: The full name of the observable attribute. The name is a pointer/reference to an attribute within the OCSF event data. For example: file.name. Array attributes may be represented in one of three ways. For example: resources.uid, resources[].uid, resources[0].uid.
• Literal: actor.user.email_addr, actor.user.uid, http_request.user_agent, src_endpoint.ip, src_endpoint.location.country
• Usage: all events in this service

observables[].type_id

• Description: The observable value type identifier.
• Literal: 14, 16, 2, 31, 5
• Usage: all events in this service

observables[].value

• Description: The value associated with the observable attribute. The meaning of the value depends on the observable type.
  If the name refers to a scalar attribute, then the value is the value of the attribute.
  If the name refers to an object attribute, then the value is not populated.
• Source: client_ip, geoip.country_code, initiated_by.email, initiated_by.id, useragent.raw
• Usage: all events in this service

Unmapped

unmapped.changes

• Description: JumpCloud Directory Insights field changes preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: changes
• Usage: redirect_uri_create, server_create

unmapped.geoip.region_name

• Description: JumpCloud Directory Insights field geoip.region_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: geoip.region_name
• Usage: all events in this service

unmapped.geoip.timezone

• Description: JumpCloud Directory Insights field geoip.timezone preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: geoip.timezone
• Usage: all events in this service

unmapped.initiated_by.source

• Description: JumpCloud Directory Insights field initiated_by.source preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: initiated_by.source
• Usage: all events in this service

unmapped.initiated_by.source_metadata

• Description: JumpCloud Directory Insights field initiated_by.source_metadata preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: initiated_by.source_metadata
• Usage: all events in this service

unmapped.is_out_of_bound

• Description: JumpCloud Directory Insights field is_out_of_bound preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: is_out_of_bound
• Usage: all events in this service

unmapped.jc_organization_name

• Description: JumpCloud Directory Insights field jc_organization_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_organization_name
• Usage: redirect_uri_update, server_create, server_delete, server_update

unmapped.jc_provider_id

• Description: JumpCloud Directory Insights field jc_provider_id preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_provider_id
• Usage: server_create, server_delete, server_update

unmapped.jc_transformation_ts

• Description: JumpCloud Directory Insights field jc_transformation_ts preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_transformation_ts
• Usage: all events in this service

unmapped.jcdataprevious

• Description: JumpCloud Directory Insights field jcdataprevious preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jcdataprevious
• Usage: redirect_uri_delete, redirect_uri_update

unmapped.provider

• Description: JumpCloud Directory Insights field provider preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: provider
• Usage: all events in this service

unmapped.useragent.device

• Description: JumpCloud Directory Insights field useragent.device preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.device
• Usage: all events in this service

unmapped.useragent.major

• Description: JumpCloud Directory Insights field useragent.major preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.major
• Usage: all events in this service

unmapped.useragent.minor

• Description: JumpCloud Directory Insights field useragent.minor preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.minor
• Usage: all events in this service

unmapped.useragent.name

• Description: JumpCloud Directory Insights field useragent.name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.name
• Usage: all events in this service

unmapped.useragent.os

• Description: JumpCloud Directory Insights field useragent.os preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.os
• Usage: all events in this service

unmapped.useragent.os_full

• Description: JumpCloud Directory Insights field useragent.os_full preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.os_full
• Usage: all events in this service

unmapped.useragent.os_major

• Description: JumpCloud Directory Insights field useragent.os_major preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.os_major
• Usage: all events in this service

unmapped.useragent.os_minor

• Description: JumpCloud Directory Insights field useragent.os_minor preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.os_minor
• Usage: all events in this service

unmapped.useragent.os_name

• Description: JumpCloud Directory Insights field useragent.os_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.os_name
• Usage: all events in this service

unmapped.useragent.os_patch

• Description: JumpCloud Directory Insights field useragent.os_patch preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.os_patch
• Usage: all events in this service

unmapped.useragent.os_version

• Description: JumpCloud Directory Insights field useragent.os_version preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.os_version
• Usage: all events in this service

unmapped.useragent.patch

• Description: JumpCloud Directory Insights field useragent.patch preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.patch
• Usage: all events in this service

unmapped.useragent.version

• Description: JumpCloud Directory Insights field useragent.version preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.version
• Usage: all events in this service

AI Gateway#

aigw · 3 events

OCSF field mappings#

Legend

• Description: what the OCSF field represents (from OCSF schema v1.8.0)
• Source: raw JumpCloud event field(s) mapped via ${{placeholder}} template
• Transform: fieldMappings entry applied at runtime (cast, enum, etc.)
• Literal: static value set in the mapping template
• Usage: event types in this service that include this field

Core

activity_id

• Description: The normalized identifier of the activity that triggered the event.
• Literal: 1, 2
• Usage: all events in this service

activity_name

• Description: The event activity name, as defined by the activity_id.
• Literal: Logoff, Logon, Read
• Usage: all events in this service

category_name

• Description: The event category name, as defined by category_uid value: Discovery.
• Literal: Application Activity, Identity & Access Management
• Usage: all events in this service

category_uid

• Description: The category unique identifier of the event.
• Literal: 3, 6
• Usage: all events in this service

class_name

• Description: The event class name, as defined by class_uid value: User Inventory Info.
• Literal: API Activity, Authentication
• Usage: all events in this service

class_uid

• Description: The unique identifier of a class. A class describes the attributes available in an event.
• Literal: 3002, 6003
• Usage: all events in this service

severity_id

• Description: OCSF severity identifier for the event.
• Literal: 1
• Usage: all events in this service

status_detail

• Description: The status detail contains additional information about the event/finding outcome.
• Source: aigw_detail.outcome
• Usage: aigw_session_activity

status_id

• Description: Normalized status of the activity (1=Success, 2=Failure).
• Source: success
• Transform:
• success → boolean_to_status_id; true→1, false→2 (all events in this service)
• Usage: all events in this service

time

• Description: Event time, in epoch milliseconds (OCSF time).
• Source: timestamp
• Usage: all events in this service

type_uid

• Description: The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.
• Literal: 300201, 300202, 600302
• Usage: all events in this service

Metadata

metadata.event_code

• Description: JumpCloud event type code.
• Source: event_type
• Usage: all events in this service

metadata.processed_time

• Description: The event processed time, such as an ETL operation.
• Source: jc_transformation_ts
• Usage: all events in this service

metadata.product.name

• Description: Originating JumpCloud service that produced the event.
• Source: service
• Usage: all events in this service

metadata.tenant_uid

• Description: JumpCloud organization (tenant) identifier.
• Source: organization
• Usage: all events in this service

metadata.uid

• Description: Unique event identifier assigned by JumpCloud.
• Source: id
• Usage: all events in this service

metadata.version

• Description: OCSF schema version used for this event.
• Literal: 1.8.0
• Usage: all events in this service

Actor

actor.user.email_addr

• Description: Email address of the actor who initiated the event.
• Source: initiated_by.email
• Usage: aigw_session_activity

actor.user.type_id

• Description: OCSF user type of the actor (1=User, 2=Admin, 3=System, 4=Service).
• Source: initiated_by.type
• Usage: aigw_session_activity

actor.user.uid

• Description: Unique identifier of the actor who initiated the event.
• Source: initiated_by.id
• Usage: aigw_session_activity

User

user.email_addr

• Description: Email address of the user associated with the event.
• Source: initiated_by.email
• Usage: aigw_session_closed, aigw_session_opened

user.type_id

• Description: OCSF user type (1=User, 2=Admin, 3=System, 4=Service).
• Source: initiated_by.type
• Usage: aigw_session_closed, aigw_session_opened

user.uid

• Description: Unique identifier of the user associated with the event.
• Source: initiated_by.id
• Usage: aigw_session_closed, aigw_session_opened

Src Endpoint

src_endpoint.autonomous_system.name

• Description: Organization name for the Autonomous System.
• Source: asn.organization
• Usage: aigw_session_closed, aigw_session_opened

src_endpoint.autonomous_system.number

• Description: Unique number that the AS is identified by.
• Source: asn.number
• Transform:
• asn.number → int (aigw_session_closed, aigw_session_opened)
• Usage: aigw_session_closed, aigw_session_opened

src_endpoint.ip

• Description: Source IP address the request originated from.
• Source: client_ip
• Usage: all events in this service

src_endpoint.location.city

• Description: The name of the city.
• Source: geoip.city
• Usage: all events in this service

src_endpoint.location.continent

• Description: The name of the continent.
• Source: geoip.continent_code
• Usage: all events in this service

src_endpoint.location.country

• Description: The ISO 3166-1 Alpha-2 country code.

  Note: The two letter country code should be capitalized. For example: US or CA.

• Source: geoip.country_code
• Usage: all events in this service

src_endpoint.location.lat

• Description: The geographical Latitude coordinate represented in Decimal Degrees (DD). For example: 42.361145.
• Source: geoip.latitude
• Transform:
• geoip.latitude → double (all events in this service)
• Usage: all events in this service

src_endpoint.location.long

• Description: The geographical Longitude coordinate represented in Decimal Degrees (DD). For example: -71.057083.
• Source: geoip.longitude
• Transform:
• geoip.longitude → double (all events in this service)
• Usage: all events in this service

src_endpoint.location.region

• Description: The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. For example, 'CH-VD' for the Canton of Vaud, Switzerland
• Source: geoip.region_code
• Usage: all events in this service

Http Request

http_request.user_agent

• Description: The request header that identifies the operating system and web browser.
• Source: useragent.raw
• Usage: all events in this service

Observables

observables[].name

• Description: The full name of the observable attribute. The name is a pointer/reference to an attribute within the OCSF event data. For example: file.name. Array attributes may be represented in one of three ways. For example: resources.uid, resources[].uid, resources[0].uid.
• Literal: actor.user.email_addr, actor.user.uid, http_request.user_agent, src_endpoint.ip, src_endpoint.location.country, user.email_addr, user.uid
• Usage: all events in this service

observables[].type_id

• Description: The observable value type identifier.
• Literal: 14, 16, 2, 31, 5
• Usage: all events in this service

observables[].value

• Description: The value associated with the observable attribute. The meaning of the value depends on the observable type.
  If the name refers to a scalar attribute, then the value is the value of the attribute.
  If the name refers to an object attribute, then the value is not populated.
• Source: client_ip, geoip.country_code, initiated_by.email, initiated_by.id, useragent.raw
• Usage: all events in this service

Other

api.operation

• Description: Verb/Operation associated with the request
• Source: aigw_detail.activity_kind
• Usage: aigw_session_activity

api.request.uid

• Description: The unique request identifier.
• Source: aigw_detail.mcp_session_id
• Usage: aigw_session_activity

auth_protocol

• Description: The authentication protocol as defined by the caption of auth_protocol_id. In the case of Other, it is defined by the event source.
• Source: auth_method
• Usage: aigw_session_closed, aigw_session_opened

duration

• Description: The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.
• Source: aigw_detail.duration_ms
• Usage: aigw_session_activity, aigw_session_opened

session.expiration_reason

• Description: The reason which triggered the session expiration.
• Source: aigw_detail.close_reason
• Usage: aigw_session_closed

session.uid

• Description: The unique identifier of the session.
• Source: aigw_detail.mcp_session_id
• Usage: aigw_session_closed, aigw_session_opened

Unmapped

unmapped.@version

• Description: JumpCloud Directory Insights field @version preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: @version
• Usage: all events in this service

unmapped.aigw_detail.backend_tool_name

• Description: JumpCloud Directory Insights field aigw_detail.backend_tool_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: aigw_detail.backend_tool_name
• Usage: aigw_session_activity

unmapped.aigw_detail.backends.name

• Description: JumpCloud Directory Insights field aigw_detail.backends.name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: aigw_detail.backends.name
• Usage: aigw_session_opened

unmapped.aigw_detail.backends.server_object_id

• Description: JumpCloud Directory Insights field aigw_detail.backends.server_object_id preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: aigw_detail.backends.server_object_id
• Usage: aigw_session_opened

unmapped.aigw_detail.server_object_id

• Description: JumpCloud Directory Insights field aigw_detail.server_object_id preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: aigw_detail.server_object_id
• Usage: aigw_session_activity

unmapped.aigw_detail.tool_name

• Description: JumpCloud Directory Insights field aigw_detail.tool_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: aigw_detail.tool_name
• Usage: aigw_session_activity

unmapped.aigw_detail.transport

• Description: JumpCloud Directory Insights field aigw_detail.transport preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: aigw_detail.transport
• Usage: aigw_session_opened

unmapped.asn.error

• Description: JumpCloud Directory Insights field asn.error preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: asn.error
• Usage: aigw_session_opened

unmapped.asn.ip_address

• Description: JumpCloud Directory Insights field asn.ip_address preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: asn.ip_address
• Usage: aigw_session_opened

unmapped.asn.network

• Description: JumpCloud Directory Insights field asn.network preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: asn.network
• Usage: aigw_session_closed, aigw_session_opened

unmapped.auth_method

• Description: JumpCloud Directory Insights field auth_method preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: auth_method
• Usage: aigw_session_activity

unmapped.geoip.region_name

• Description: JumpCloud Directory Insights field geoip.region_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: geoip.region_name
• Usage: all events in this service

unmapped.geoip.timezone

• Description: JumpCloud Directory Insights field geoip.timezone preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: geoip.timezone
• Usage: all events in this service

unmapped.initiated_by.source

• Description: JumpCloud Directory Insights field initiated_by.source preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: initiated_by.source
• Usage: all events in this service

unmapped.initiated_by.source_metadata

• Description: JumpCloud Directory Insights field initiated_by.source_metadata preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: initiated_by.source_metadata
• Usage: all events in this service

unmapped.initiated_by_id_hash

• Description: JumpCloud Directory Insights field initiated_by_id_hash preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: initiated_by_id_hash
• Usage: all events in this service

unmapped.is_out_of_bound

• Description: JumpCloud Directory Insights field is_out_of_bound preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: is_out_of_bound
• Usage: all events in this service

unmapped.provider

• Description: JumpCloud Directory Insights field provider preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: provider
• Usage: all events in this service

unmapped.resource.id

• Description: JumpCloud Directory Insights field resource.id preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.id
• Usage: all events in this service

unmapped.resource.name

• Description: JumpCloud Directory Insights field resource.name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.name
• Usage: all events in this service

unmapped.resource.type

• Description: JumpCloud Directory Insights field resource.type preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.type
• Usage: all events in this service

unmapped.useragent.device

• Description: JumpCloud Directory Insights field useragent.device preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.device
• Usage: all events in this service

unmapped.useragent.major

• Description: JumpCloud Directory Insights field useragent.major preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.major
• Usage: aigw_session_closed

unmapped.useragent.minor

• Description: JumpCloud Directory Insights field useragent.minor preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.minor
• Usage: aigw_session_closed

unmapped.useragent.name

• Description: JumpCloud Directory Insights field useragent.name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.name
• Usage: all events in this service

unmapped.useragent.os

• Description: JumpCloud Directory Insights field useragent.os preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.os
• Usage: all events in this service

unmapped.useragent.os_full

• Description: JumpCloud Directory Insights field useragent.os_full preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.os_full
• Usage: all events in this service

unmapped.useragent.os_name

• Description: JumpCloud Directory Insights field useragent.os_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.os_name
• Usage: all events in this service

unmapped.useragent.version

• Description: JumpCloud Directory Insights field useragent.version preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: useragent.version
• Usage: aigw_session_closed

Alerts#

alert · 8 events

OCSF field mappings#

Legend

• Description: what the OCSF field represents (from OCSF schema v1.8.0)
• Source: raw JumpCloud event field(s) mapped via ${{placeholder}} template
• Transform: fieldMappings entry applied at runtime (cast, enum, etc.)
• Literal: static value set in the mapping template
• Usage: event types in this service that include this field

Core

activity_id

• Description: The normalized identifier of the activity that triggered the event.
• Literal: 1, 2, 3, 4
• Usage: all events in this service

activity_name

• Description: The event activity name, as defined by the activity_id.
• Literal: Create, Delete, Update
• Usage: all events in this service

category_name

• Description: The event category name, as defined by category_uid value: Discovery.
• Literal: Findings, Identity & Access Management
• Usage: all events in this service

category_uid

• Description: The category unique identifier of the event.
• Literal: 2, 3
• Usage: all events in this service

class_name

• Description: The event class name, as defined by class_uid value: User Inventory Info.
• Literal: Detection Finding, Entity Management
• Usage: all events in this service

class_uid

• Description: The unique identifier of a class. A class describes the attributes available in an event.
• Literal: 2004, 3004
• Usage: all events in this service

message

• Description: The description of the event/finding, as defined by the source.
• Source: bulk_ops_remark
• Usage: bulk_delete_alerts, bulk_update_alerts

severity_id

• Description: OCSF severity identifier for the event.
• Literal: 1
• Usage: all events in this service

status_detail

• Description: The status detail contains additional information about the event/finding outcome.
• Source: error_message
• Usage: all events in this service

status_id

• Description: Normalized status of the activity (1=Success, 2=Failure).
• Source: success
• Transform:
• success → boolean_to_status_id; true→1, false→2 (all events in this service)
• Usage: all events in this service

time

• Description: Event time, in epoch milliseconds (OCSF time).
• Source: timestamp
• Transform:
• timestamp → iso8601_to_epoch_millis (all events in this service)
• Usage: all events in this service

type_uid

• Description: The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.
• Literal: 200401, 200402, 300401, 300403, 300404
• Usage: all events in this service

Metadata

metadata.event_code

• Description: JumpCloud event type code.
• Source: event_type
• Usage: all events in this service

metadata.original_time

• Description: The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs.
• Source: server_timestamp
• Usage: all events in this service

metadata.processed_time

• Description: The event processed time, such as an ETL operation.
• Source: jc_transformation_ts
• Usage: all events in this service

metadata.product.name

• Description: Originating JumpCloud service that produced the event.
• Source: service
• Usage: all events in this service

metadata.tenant_uid

• Description: JumpCloud organization (tenant) identifier.
• Source: organization
• Usage: all events in this service

metadata.uid

• Description: Unique event identifier assigned by JumpCloud.
• Source: id
• Usage: all events in this service

metadata.version

• Description: OCSF schema version used for this event.
• Literal: 1.8.0
• Usage: all events in this service

Actor

actor.user.email_addr

• Description: Email address of the actor who initiated the event.
• Source: initiated_by.email
• Usage: alert_status_updated, bulk_delete_alerts, bulk_update_alerts, rule_config_created, rule_config_deleted, rule_config_updated

actor.user.type_id

• Description: OCSF user type of the actor (1=User, 2=Admin, 3=System, 4=Service).
• Source: initiated_by.type
• Transform:
• initiated_by.type → enum; enumValues: {'user': 1, 'admin': 2, 'system': 3, 'service': 4, 'device': 99}; default: 99 (alert_status_updated, bulk_delete_alerts, bulk_update_alerts, rule_config_created, rule_config_deleted, rule_config_updated)
• Usage: alert_status_updated, bulk_delete_alerts, bulk_update_alerts, rule_config_created, rule_config_deleted, rule_config_updated

actor.user.uid

• Description: Unique identifier of the actor who initiated the event.
• Source: initiated_by.id
• Usage: alert_status_updated, bulk_delete_alerts, bulk_update_alerts, rule_config_created, rule_config_deleted, rule_config_updated

Entity

entity.data.alerts_enabled

• Description: JumpCloud extension data on the managed entity: alerts_enabled.
• Source: alerts_enabled
• Usage: rule_config_created, rule_config_deleted, rule_config_updated

entity.data.category

• Description: JumpCloud extension data on the managed entity: category.
• Source: category
• Usage: alert_status_updated

entity.data.changed_field

• Description: JumpCloud extension data on the managed entity: changed_field.
• Source: changes.field
• Usage: alert_status_updated, bulk_update_alerts, rule_config_updated

entity.data.changes_from

• Description: JumpCloud extension data on the managed entity: changes_from.
• Source: changes.from
• Usage: alert_status_updated, rule_config_updated

entity.data.changes_removed.condition_object_id

• Description: JumpCloud extension data on the managed entity: changes_removed.condition_object_id.
• Source: changes.removed.condition_object_id
• Usage: rule_config_updated

entity.data.changes_removed.filter_name

• Description: JumpCloud extension data on the managed entity: changes_removed.filter_name.
• Source: changes.removed.filter_name
• Usage: rule_config_updated

entity.data.changes_removed.match_type

• Description: JumpCloud extension data on the managed entity: changes_removed.match_type.
• Source: changes.removed.match_type
• Usage: rule_config_updated

entity.data.changes_removed.value

• Description: JumpCloud extension data on the managed entity: changes_removed.value.
• Source: changes.removed.value
• Usage: rule_config_updated

entity.data.condition_object_id

• Description: JumpCloud extension data on the managed entity: condition_object_id.
• Source: rule_conditions.condition_object_id
• Usage: rule_config_created, rule_config_updated

entity.data.context.already_expired

• Description: JumpCloud extension data on the managed entity: context.already_expired.
• Source: resource.context.already_expired
• Usage: alert_status_updated

entity.data.context.app_id

• Description: JumpCloud extension data on the managed entity: context.app_id.
• Source: resource.context.app_id
• Usage: alert_status_updated

entity.data.context.app_name

• Description: JumpCloud extension data on the managed entity: context.app_name.
• Source: resource.context.app_name
• Usage: alert_status_updated

entity.data.context.certificates.certificate_name

• Description: JumpCloud extension data on the managed entity: context.certificates.certificate_name.
• Source: resource.context.certificates.certificate_name
• Usage: alert_status_updated

entity.data.context.certificates.certificate_type

• Description: JumpCloud extension data on the managed entity: context.certificates.certificate_type.
• Source: resource.context.certificates.certificate_type
• Usage: alert_status_updated

entity.data.context.certificates.expiry_date

• Description: JumpCloud extension data on the managed entity: context.certificates.expiry_date.
• Source: resource.context.certificates.expiry_date
• Usage: alert_status_updated

entity.data.context.certificates.id

• Description: JumpCloud extension data on the managed entity: context.certificates.id.
• Source: resource.context.certificates.id
• Usage: alert_status_updated

entity.data.context.command_id

• Description: JumpCloud extension data on the managed entity: context.command_id.
• Source: resource.context.command_id
• Usage: alert_status_updated

entity.data.context.command_name

• Description: JumpCloud extension data on the managed entity: context.command_name.
• Source: resource.context.command_name
• Usage: alert_status_updated

entity.data.context.condition_id

• Description: JumpCloud extension data on the managed entity: context.condition_id.
• Source: resource.context.condition_id
• Usage: alert_status_updated

entity.data.context.days_until_expiry

• Description: JumpCloud extension data on the managed entity: context.days_until_expiry.
• Source: resource.context.days_until_expiry
• Usage: alert_status_updated

entity.data.context.device.display_name

• Description: JumpCloud extension data on the managed entity: context.device.display_name.
• Source: resource.context.device.display_name
• Usage: alert_status_updated

entity.data.context.device.id

• Description: JumpCloud extension data on the managed entity: context.device.id.
• Source: resource.context.device.id
• Usage: alert_status_updated

entity.data.context.device_group.name

• Description: JumpCloud extension data on the managed entity: context.device_group.name.
• Source: resource.context.device_group.name
• Usage: alert_status_updated

entity.data.context.device_id

• Description: JumpCloud extension data on the managed entity: context.device_id.
• Source: resource.context.device_id
• Usage: alert_status_updated

entity.data.context.di_event

• Description: JumpCloud extension data on the managed entity: context.di_event.
• Source: resource.context.di_event
• Usage: alert_status_updated

entity.data.context.event_description

• Description: JumpCloud extension data on the managed entity: context.event_description.
• Source: resource.context.event_description
• Usage: alert_status_updated

entity.data.context.existing_condition

• Description: JumpCloud extension data on the managed entity: context.existing_condition.
• Source: resource.context.existing_condition
• Usage: alert_status_updated

entity.data.context.expires_at

• Description: JumpCloud extension data on the managed entity: context.expires_at.
• Source: resource.context.expires_at
• Usage: alert_status_updated

entity.data.context.href_enabled

• Description: JumpCloud extension data on the managed entity: context.href_enabled.
• Source: resource.context.href_enabled
• Usage: alert_status_updated

entity.data.context.label

• Description: JumpCloud extension data on the managed entity: context.label.
• Source: resource.context.label
• Usage: alert_status_updated

entity.data.context.last_contact_time

• Description: JumpCloud extension data on the managed entity: context.last_contact_time.
• Source: resource.context.last_contact_time
• Usage: alert_status_updated

entity.data.context.name

• Description: JumpCloud extension data on the managed entity: context.name.
• Source: resource.context.name
• Usage: alert_status_updated

entity.data.context.notify_config.channel_object_ids

• Description: JumpCloud extension data on the managed entity: context.notify_config.channel_object_ids.
• Source: resource.context.notify_config.channel_object_ids
• Usage: alert_status_updated

entity.data.context.notify_config.notify_on_acknowledgment

• Description: JumpCloud extension data on the managed entity: context.notify_config.notify_on_acknowledgment.
• Source: resource.context.notify_config.notify_on_acknowledgment
• Usage: alert_status_updated

entity.data.context.notify_config.notify_on_resolution

• Description: JumpCloud extension data on the managed entity: context.notify_config.notify_on_resolution.
• Source: resource.context.notify_config.notify_on_resolution
• Usage: alert_status_updated

entity.data.context.notify_config.notify_on_violation

• Description: JumpCloud extension data on the managed entity: context.notify_config.notify_on_violation.
• Source: resource.context.notify_config.notify_on_violation
• Usage: alert_status_updated

entity.data.context.notify_config.notify_primary_user_of_device

• Description: JumpCloud extension data on the managed entity: context.notify_config.notify_primary_user_of_device.
• Source: resource.context.notify_config.notify_primary_user_of_device
• Usage: alert_status_updated

entity.data.context.notify_config.primary_user_email

• Description: JumpCloud extension data on the managed entity: context.notify_config.primary_user_email.
• Source: resource.context.notify_config.primary_user_email
• Usage: alert_status_updated

entity.data.context.notify_config.primary_user_id

• Description: JumpCloud extension data on the managed entity: context.notify_config.primary_user_id.
• Source: resource.context.notify_config.primary_user_id
• Usage: alert_status_updated

entity.data.context.notify_config.primary_user_resolved

• Description: JumpCloud extension data on the managed entity: context.notify_config.primary_user_resolved.
• Source: resource.context.notify_config.primary_user_resolved
• Usage: alert_status_updated

entity.data.context.policy_id

• Description: JumpCloud extension data on the managed entity: context.policy_id.
• Source: resource.context.policy_id
• Usage: alert_status_updated

entity.data.context.policy_name

• Description: JumpCloud extension data on the managed entity: context.policy_name.
• Source: resource.context.policy_name
• Usage: alert_status_updated

entity.data.context.poll_event_type

• Description: JumpCloud extension data on the managed entity: context.poll_event_type.
• Source: resource.context.poll_event_type
• Usage: alert_status_updated

entity.data.context.raw_event_key

• Description: JumpCloud extension data on the managed entity: context.raw_event_key.
• Source: resource.context.raw_event_key
• Usage: alert_status_updated

entity.data.context.resolution_condition

• Description: JumpCloud extension data on the managed entity: context.resolution_condition.
• Source: resource.context.resolution_condition
• Usage: alert_status_updated

entity.data.context.resource_id

• Description: JumpCloud extension data on the managed entity: context.resource_id.
• Source: resource.context.resource_id
• Usage: alert_status_updated

entity.data.context.resource_type

• Description: JumpCloud extension data on the managed entity: context.resource_type.
• Source: resource.context.resource_type
• Usage: alert_status_updated

entity.data.context.rule_name

• Description: JumpCloud extension data on the managed entity: context.rule_name.
• Source: resource.context.rule_name
• Usage: alert_status_updated

entity.data.context.rule_object_id

• Description: JumpCloud extension data on the managed entity: context.rule_object_id.
• Source: resource.context.rule_object_id
• Usage: alert_status_updated

entity.data.context.rule_template_name

• Description: JumpCloud extension data on the managed entity: context.rule_template_name.
• Source: resource.context.rule_template_name
• Usage: alert_status_updated

entity.data.context.source_name

• Description: JumpCloud extension data on the managed entity: context.source_name.
• Source: resource.context.source_name
• Usage: alert_status_updated

entity.data.context.source_url

• Description: JumpCloud extension data on the managed entity: context.source_url.
• Source: resource.context.source_url
• Usage: alert_status_updated

entity.data.context.template_type

• Description: JumpCloud extension data on the managed entity: context.template_type.
• Source: resource.context.template_type
• Usage: alert_status_updated

entity.data.context.threshold_value

• Description: JumpCloud extension data on the managed entity: context.threshold_value.
• Source: resource.context.threshold_value
• Usage: alert_status_updated

entity.data.context.type

• Description: JumpCloud extension data on the managed entity: context.type.
• Source: resource.context.type
• Usage: alert_status_updated

entity.data.context.uptime_total_seconds

• Description: JumpCloud extension data on the managed entity: context.uptime_total_seconds.
• Source: resource.context.uptime_total_seconds
• Usage: alert_status_updated

entity.data.context.user_id

• Description: JumpCloud extension data on the managed entity: context.user_id.
• Source: resource.context.user_id
• Usage: alert_status_updated

entity.data.context.violation_condition

• Description: JumpCloud extension data on the managed entity: context.violation_condition.
• Source: resource.context.violation_condition
• Usage: alert_status_updated

entity.data.correlation.id

• Description: JumpCloud extension data on the managed entity: correlation.id.
• Source: correlation.id
• Usage: rule_config_created, rule_config_deleted, rule_config_updated

entity.data.created_by_object_id

• Description: JumpCloud extension data on the managed entity: created_by_object_id.
• Source: created_by_object_id
• Usage: rule_config_created, rule_config_deleted, rule_config_updated

entity.data.enable_bootstrap

• Description: JumpCloud extension data on the managed entity: enable_bootstrap.
• Source: enable_bootstrap
• Usage: rule_config_created, rule_config_deleted, rule_config_updated

entity.data.event_types

• Description: JumpCloud extension data on the managed entity: event_types.
• Source: event_filters.event_types
• Usage: rule_config_created, rule_config_updated

entity.data.filter_name

• Description: JumpCloud extension data on the managed entity: filter_name.
• Source: rule_conditions.filter_name
• Usage: rule_config_created, rule_config_updated

entity.data.filter_source

• Description: JumpCloud extension data on the managed entity: filter_source.
• Source: event_filters.filter_source
• Usage: rule_config_created, rule_config_updated

entity.data.initiated_from_slack_app_id

• Description: JumpCloud extension data on the managed entity: initiated_from_slack_app_id.
• Source: initiated_from.slack.app_id
• Usage: alert_status_updated

entity.data.initiated_from_slack_channel_id

• Description: JumpCloud extension data on the managed entity: initiated_from_slack_channel_id.
• Source: initiated_from.slack.channel_id
• Usage: alert_status_updated

entity.data.initiated_from_slack_channel_name

• Description: JumpCloud extension data on the managed entity: initiated_from_slack_channel_name.
• Source: initiated_from.slack.channel_name
• Usage: alert_status_updated

entity.data.initiated_from_slack_source

• Description: JumpCloud extension data on the managed entity: initiated_from_slack_source.
• Source: initiated_from.slack.source
• Usage: alert_status_updated

entity.data.initiated_from_slack_team_id

• Description: JumpCloud extension data on the managed entity: initiated_from_slack_team_id.
• Source: initiated_from.slack.team_id
• Usage: alert_status_updated

entity.data.initiated_from_slack_user_id

• Description: JumpCloud extension data on the managed entity: initiated_from_slack_user_id.
• Source: initiated_from.slack.user_id
• Usage: alert_status_updated

entity.data.match_type

• Description: JumpCloud extension data on the managed entity: match_type.
• Source: rule_conditions.match_type
• Usage: rule_config_created, rule_config_updated

entity.data.notification_channel_object_ids

• Description: JumpCloud extension data on the managed entity: notification_channel_object_ids.
• Source: notification_channel_object_ids
• Usage: rule_config_created, rule_config_deleted, rule_config_updated

entity.data.notify_on_acknowledgment

• Description: JumpCloud extension data on the managed entity: notify_on_acknowledgment.
• Source: notify_on_acknowledgment
• Usage: rule_config_created, rule_config_deleted, rule_config_updated

entity.data.notify_on_resolution

• Description: JumpCloud extension data on the managed entity: notify_on_resolution.
• Source: notify_on_resolution
• Usage: rule_config_created, rule_config_deleted, rule_config_updated

entity.data.notify_on_violation

• Description: JumpCloud extension data on the managed entity: notify_on_violation.
• Source: notify_on_violation
• Usage: rule_config_created, rule_config_deleted, rule_config_updated

entity.data.reference_fields

• Description: JumpCloud extension data on the managed entity: reference_fields.
• Source: event_filters.reference_fields
• Usage: rule_config_created, rule_config_updated

entity.data.reference_id

• Description: JumpCloud extension data on the managed entity: reference_id.
• Source: resource.reference_id
• Usage: alert_status_updated

entity.data.removed_event_filters_event_types

• Description: JumpCloud extension data on the managed entity: removed_event_filters_event_types.
• Source: changes.removed_event_filters.event_types
• Usage: rule_config_updated

entity.data.removed_event_filters_filter_source

• Description: JumpCloud extension data on the managed entity: removed_event_filters_filter_source.
• Source: changes.removed_event_filters.filter_source
• Usage: rule_config_updated

entity.data.removed_event_filters_reference_fields

• Description: JumpCloud extension data on the managed entity: removed_event_filters_reference_fields.
• Source: changes.removed_event_filters.reference_fields
• Usage: rule_config_updated

entity.data.removed_event_filters_violation_condition

• Description: JumpCloud extension data on the managed entity: removed_event_filters_violation_condition.
• Source: changes.removed_event_filters.violation_condition
• Usage: rule_config_updated

entity.data.rule_event_type

• Description: JumpCloud extension data on the managed entity: rule_event_type.
• Source: rule_event_type
• Usage: rule_config_created, rule_config_deleted, rule_config_updated

entity.data.rule_severity

• Description: JumpCloud extension data on the managed entity: rule_severity.
• Source: rule_severity
• Usage: rule_config_created, rule_config_deleted, rule_config_updated

entity.data.rule_status

• Description: JumpCloud extension data on the managed entity: rule_status.
• Source: rule_status
• Usage: rule_config_created, rule_config_deleted, rule_config_updated

entity.data.rule_type

• Description: JumpCloud extension data on the managed entity: rule_type.
• Source: rule_type
• Usage: rule_config_created, rule_config_deleted, rule_config_updated

entity.data.source_id

• Description: JumpCloud extension data on the managed entity: source_id.
• Source: resource.source_id
• Usage: alert_status_updated

entity.data.value

• Description: JumpCloud extension data on the managed entity: value.
• Source: rule_conditions.value
• Usage: rule_config_created, rule_config_updated

entity.data.violation_condition

• Description: JumpCloud extension data on the managed entity: violation_condition.
• Source: event_filters.violation_condition
• Usage: rule_config_created, rule_config_updated

entity.name

• Description: The name of the managed entity. It should match the name of the specific entity object's name if populated, or the name of the managed entity if the type_id is 'Other'.
• Source: resource.source_name
• Usage: alert_status_updated

entity.type

• Description: The managed entity type. For example: Policy, User, Organization, Device.
• Source: resource.source_type, rule_category
• Usage: alert_status_updated, rule_config_created, rule_config_deleted, rule_config_updated

entity.uid

• Description: The identifier of the managed entity. It should match the uid of the specific entity's object UID if populated, or the source specific ID if the type_id is 'Other'.
• Source: resource.alert_object_id, rule_object_id
• Usage: alert_status_updated, rule_config_created, rule_config_deleted, rule_config_updated

entity_result.data.added_event_filters_event_types

• Description: JumpCloud extension data on the managed entity: added_event_filters_event_types.
• Source: changes.added_event_filters.event_types
• Usage: rule_config_updated

entity_result.data.added_event_filters_filter_source

• Description: JumpCloud extension data on the managed entity: added_event_filters_filter_source.
• Source: changes.added_event_filters.filter_source
• Usage: rule_config_updated

entity_result.data.added_event_filters_reference_fields

• Description: JumpCloud extension data on the managed entity: added_event_filters_reference_fields.
• Source: changes.added_event_filters.reference_fields
• Usage: rule_config_updated

entity_result.data.added_event_filters_violation_condition

• Description: JumpCloud extension data on the managed entity: added_event_filters_violation_condition.
• Source: changes.added_event_filters.violation_condition
• Usage: rule_config_updated

entity_result.data.added_notification_channels

• Description: JumpCloud extension data on the managed entity: added_notification_channels.
• Source: changes.added_notification_channels
• Usage: rule_config_updated

entity_result.data.changes_added.condition_object_id

• Description: JumpCloud extension data on the managed entity: changes_added.condition_object_id.
• Source: changes.added.condition_object_id
• Usage: rule_config_updated

entity_result.data.changes_added.filter_name

• Description: JumpCloud extension data on the managed entity: changes_added.filter_name.
• Source: changes.added.filter_name
• Usage: rule_config_updated

entity_result.data.changes_added.match_type

• Description: JumpCloud extension data on the managed entity: changes_added.match_type.
• Source: changes.added.match_type
• Usage: rule_config_updated

entity_result.data.changes_added.value

• Description: JumpCloud extension data on the managed entity: changes_added.value.
• Source: changes.added.value
• Usage: rule_config_updated

entity_result.data.changes_to

• Description: JumpCloud extension data on the managed entity: changes_to.
• Source: changes.to
• Usage: alert_status_updated, bulk_update_alerts, rule_config_updated

Src Endpoint

src_endpoint.autonomous_system.name

• Description: Organization name for the Autonomous System.
• Source: asn.organization
• Usage: bulk_delete_alerts, bulk_update_alerts

src_endpoint.autonomous_system.number

• Description: Unique number that the AS is identified by.
• Source: asn.number
• Transform:
• asn.number → int (bulk_delete_alerts, bulk_update_alerts)
• Usage: bulk_delete_alerts, bulk_update_alerts

src_endpoint.ip

• Description: Source IP address the request originated from.
• Source: client_ip
• Usage: alert_status_updated, bulk_delete_alerts, bulk_update_alerts, rule_config_created, rule_config_deleted, rule_config_updated

src_endpoint.location.city

• Description: The name of the city.
• Source: geoip.city
• Usage: alert_status_updated, bulk_delete_alerts, bulk_update_alerts, rule_config_created, rule_config_deleted, rule_config_updated

src_endpoint.location.continent

• Description: The name of the continent.
• Source: geoip.continent_code
• Usage: alert_status_updated, bulk_delete_alerts, bulk_update_alerts, rule_config_created, rule_config_deleted, rule_config_updated

src_endpoint.location.country

• Description: The ISO 3166-1 Alpha-2 country code.

  Note: The two letter country code should be capitalized. For example: US or CA.

• Source: geoip.country_code
• Usage: alert_status_updated, bulk_delete_alerts, bulk_update_alerts, rule_config_created, rule_config_deleted, rule_config_updated

src_endpoint.location.lat

• Description: The geographical Latitude coordinate represented in Decimal Degrees (DD). For example: 42.361145.
• Source: geoip.latitude
• Transform:
• geoip.latitude → double (alert_status_updated, bulk_delete_alerts, bulk_update_alerts, rule_config_created, rule_config_deleted, rule_config_updated)
• Usage: alert_status_updated, bulk_delete_alerts, bulk_update_alerts, rule_config_created, rule_config_deleted, rule_config_updated

src_endpoint.location.long

• Description: The geographical Longitude coordinate represented in Decimal Degrees (DD). For example: -71.057083.
• Source: geoip.longitude
• Transform:
• geoip.longitude → double (alert_status_updated, bulk_delete_alerts, bulk_update_alerts, rule_config_created, rule_config_deleted, rule_config_updated)
• Usage: alert_status_updated, bulk_delete_alerts, bulk_update_alerts, rule_config_created, rule_config_deleted, rule_config_updated

src_endpoint.location.region

• Description: The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. For example, 'CH-VD' for the Canton of Vaud, Switzerland
• Source: geoip.region_code
• Usage: alert_status_updated, bulk_delete_alerts, bulk_update_alerts, rule_config_created, rule_config_deleted, rule_config_updated

Http Request

http_request.user_agent

• Description: The request header that identifies the operating system and web browser.
• Source: user_agent
• Usage: alert_status_updated, bulk_delete_alerts, bulk_update_alerts, rule_config_created, rule_config_deleted, rule_config_updated

Observables

observables[].name

• Description: The full name of the observable attribute. The name is a pointer/reference to an attribute within the OCSF event data. For example: file.name. Array attributes may be represented in one of three ways. For example: resources.uid, resources[].uid, resources[0].uid.
• Literal: actor.user.email_addr, actor.user.uid, http_request.user_agent, src_endpoint.ip, src_endpoint.location.country, src_url
• Usage: all events in this service

observables[].type_id

• Description: The observable value type identifier.
• Literal: 14, 16, 2, 31, 5, 6
• Usage: all events in this service

observables[].value

• Description: The value associated with the observable attribute. The meaning of the value depends on the observable type.
  If the name refers to a scalar attribute, then the value is the value of the attribute.
  If the name refers to an object attribute, then the value is not populated.
• Source: client_ip, geoip.country_code, initiated_by.email, initiated_by.id, resource.context.source_url, user_agent
• Usage: all events in this service

Other

finding_info.analytic.name

• Description: The name of the analytic that generated the finding.
• Source: resource.context.rule_name
• Usage: alert_created, alert_updated

finding_info.desc

• Description: The description of the reported finding.
• Source: resource.context.event_description
• Usage: alert_created, alert_updated

finding_info.title

• Description: A title or a brief phrase summarizing the reported finding.
• Source: resource.source_name
• Usage: alert_created, alert_updated

finding_info.uid

• Description: The unique identifier of the reported finding.
• Source: resource.alert_object_id
• Usage: alert_created, alert_updated

policy.uid

• Description: A unique identifier of the policy instance.
• Source: resource.context.rule_object_id
• Usage: alert_created, alert_updated

severity

• Description: The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.
• Source: severity
• Usage: alert_created, alert_status_updated, alert_updated

src_url

• Description: A Url link used to access the original incident.
• Source: resource.context.source_url
• Usage: alert_created, alert_updated

status

• Description: The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.
• Source: status
• Usage: alert_created, alert_status_updated, alert_updated

Unmapped

unmapped.@version

• Description: JumpCloud Directory Insights field @version preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: @version
• Usage: all events in this service

unmapped.asn.network

• Description: JumpCloud Directory Insights field asn.network preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: asn.network
• Usage: bulk_delete_alerts, bulk_update_alerts

unmapped.category

• Description: JumpCloud Directory Insights field category preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: category
• Usage: alert_created, alert_updated

unmapped.client_ip

• Description: JumpCloud Directory Insights field client_ip preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: client_ip
• Usage: alert_created, alert_updated

unmapped.file_input_timestamp

• Description: JumpCloud Directory Insights field file_input_timestamp preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: file_input_timestamp
• Usage: bulk_delete_alerts, bulk_update_alerts

unmapped.geoip.city

• Description: JumpCloud Directory Insights field geoip.city preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: geoip.city
• Usage: alert_created

unmapped.geoip.continent_code

• Description: JumpCloud Directory Insights field geoip.continent_code preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: geoip.continent_code
• Usage: alert_created

unmapped.geoip.country_code

• Description: JumpCloud Directory Insights field geoip.country_code preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: geoip.country_code
• Usage: alert_created

unmapped.geoip.latitude

• Description: JumpCloud Directory Insights field geoip.latitude preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: geoip.latitude
• Usage: alert_created

unmapped.geoip.longitude

• Description: JumpCloud Directory Insights field geoip.longitude preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: geoip.longitude
• Usage: alert_created

unmapped.geoip.region_code

• Description: JumpCloud Directory Insights field geoip.region_code preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: geoip.region_code
• Usage: alert_created

unmapped.geoip.region_name

• Description: JumpCloud Directory Insights field geoip.region_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: geoip.region_name
• Usage: alert_created, alert_status_updated, bulk_delete_alerts, bulk_update_alerts, rule_config_created, rule_config_deleted, rule_config_updated

unmapped.geoip.timezone

• Description: JumpCloud Directory Insights field geoip.timezone preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: geoip.timezone
• Usage: alert_created, alert_status_updated, bulk_delete_alerts, bulk_update_alerts, rule_config_created, rule_config_deleted, rule_config_updated

unmapped.initiated_by

• Description: JumpCloud Directory Insights field initiated_by preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: initiated_by
• Usage: alert_created, alert_updated

unmapped.initiated_by_email_hash

• Description: JumpCloud Directory Insights field initiated_by_email_hash preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: initiated_by_email_hash
• Usage: alert_status_updated, bulk_delete_alerts, bulk_update_alerts, rule_config_created, rule_config_deleted, rule_config_updated

unmapped.initiated_by_id_hash

• Description: JumpCloud Directory Insights field initiated_by_id_hash preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: initiated_by_id_hash
• Usage: alert_status_updated, bulk_delete_alerts, bulk_update_alerts, rule_config_created, rule_config_deleted, rule_config_updated

unmapped.is_out_of_bound

• Description: JumpCloud Directory Insights field is_out_of_bound preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: is_out_of_bound
• Usage: all events in this service

unmapped.jc_application_name

• Description: JumpCloud Directory Insights field jc_application_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_application_name
• Usage: all events in this service

unmapped.resource.context.already_expired

• Description: JumpCloud Directory Insights field resource.context.already_expired preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.already_expired
• Usage: alert_created, alert_updated

unmapped.resource.context.certificates.certificate_name

• Description: JumpCloud Directory Insights field resource.context.certificates.certificate_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.certificates.certificate_name
• Usage: alert_created, alert_updated

unmapped.resource.context.certificates.certificate_type

• Description: JumpCloud Directory Insights field resource.context.certificates.certificate_type preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.certificates.certificate_type
• Usage: alert_created, alert_updated

unmapped.resource.context.certificates.expiry_date

• Description: JumpCloud Directory Insights field resource.context.certificates.expiry_date preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.certificates.expiry_date
• Usage: alert_created, alert_updated

unmapped.resource.context.certificates.id

• Description: JumpCloud Directory Insights field resource.context.certificates.id preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.certificates.id
• Usage: alert_created, alert_updated

unmapped.resource.context.condition_id

• Description: JumpCloud Directory Insights field resource.context.condition_id preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.condition_id
• Usage: alert_created, alert_updated

unmapped.resource.context.days_until_expiry

• Description: JumpCloud Directory Insights field resource.context.days_until_expiry preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.days_until_expiry
• Usage: alert_created, alert_updated

unmapped.resource.context.di_event

• Description: JumpCloud Directory Insights field resource.context.di_event preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.di_event
• Usage: alert_created, alert_updated

unmapped.resource.context.existing_condition

• Description: JumpCloud Directory Insights field resource.context.existing_condition preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.existing_condition
• Usage: alert_created, alert_updated

unmapped.resource.context.expires_at

• Description: JumpCloud Directory Insights field resource.context.expires_at preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.expires_at
• Usage: alert_created, alert_updated

unmapped.resource.context.key1

• Description: JumpCloud Directory Insights field resource.context.key1 preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.key1
• Usage: alert_created

unmapped.resource.context.key2

• Description: JumpCloud Directory Insights field resource.context.key2 preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.key2
• Usage: alert_created

unmapped.resource.context.label

• Description: JumpCloud Directory Insights field resource.context.label preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.label
• Usage: alert_created, alert_updated

unmapped.resource.context.notify_config.channel_object_ids

• Description: JumpCloud Directory Insights field resource.context.notify_config.channel_object_ids preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.notify_config.channel_object_ids
• Usage: alert_created, alert_updated

unmapped.resource.context.notify_config.notify_on_acknowledgment

• Description: JumpCloud Directory Insights field resource.context.notify_config.notify_on_acknowledgment preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.notify_config.notify_on_acknowledgment
• Usage: alert_created, alert_updated

unmapped.resource.context.notify_config.notify_on_resolution

• Description: JumpCloud Directory Insights field resource.context.notify_config.notify_on_resolution preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.notify_config.notify_on_resolution
• Usage: alert_created, alert_updated

unmapped.resource.context.notify_config.notify_on_violation

• Description: JumpCloud Directory Insights field resource.context.notify_config.notify_on_violation preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.notify_config.notify_on_violation
• Usage: alert_created, alert_updated

unmapped.resource.context.poll_event_type

• Description: JumpCloud Directory Insights field resource.context.poll_event_type preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.poll_event_type
• Usage: alert_created, alert_updated

unmapped.resource.context.raw_event_key

• Description: JumpCloud Directory Insights field resource.context.raw_event_key preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.raw_event_key
• Usage: alert_created, alert_updated

unmapped.resource.context.resolution_condition

• Description: JumpCloud Directory Insights field resource.context.resolution_condition preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.resolution_condition
• Usage: alert_created, alert_updated

unmapped.resource.context.resource_id

• Description: JumpCloud Directory Insights field resource.context.resource_id preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.resource_id
• Usage: alert_created, alert_updated

unmapped.resource.context.resource_type

• Description: JumpCloud Directory Insights field resource.context.resource_type preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.resource_type
• Usage: alert_created, alert_updated

unmapped.resource.context.rule_template_name

• Description: JumpCloud Directory Insights field resource.context.rule_template_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.rule_template_name
• Usage: alert_created, alert_updated

unmapped.resource.context.source_name

• Description: JumpCloud Directory Insights field resource.context.source_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.source_name
• Usage: alert_created, alert_updated

unmapped.resource.context.template_type

• Description: JumpCloud Directory Insights field resource.context.template_type preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.template_type
• Usage: alert_created, alert_updated

unmapped.resource.context.threshold_value

• Description: JumpCloud Directory Insights field resource.context.threshold_value preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.threshold_value
• Usage: alert_created, alert_updated

unmapped.resource.context.type

• Description: JumpCloud Directory Insights field resource.context.type preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.type
• Usage: alert_updated

unmapped.resource.context.uptime_total_seconds

• Description: JumpCloud Directory Insights field resource.context.uptime_total_seconds preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.uptime_total_seconds
• Usage: alert_updated

unmapped.resource.context.violation_condition

• Description: JumpCloud Directory Insights field resource.context.violation_condition preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.context.violation_condition
• Usage: alert_created, alert_updated

unmapped.resource.reference_id

• Description: JumpCloud Directory Insights field resource.reference_id preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.reference_id
• Usage: alert_created, alert_updated

unmapped.resource.source_id

• Description: JumpCloud Directory Insights field resource.source_id preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.source_id
• Usage: alert_created, alert_updated

unmapped.resource.source_type

• Description: JumpCloud Directory Insights field resource.source_type preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource.source_type
• Usage: alert_created, alert_updated

unmapped.timestamp_source

• Description: JumpCloud Directory Insights field timestamp_source preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: timestamp_source
• Usage: all events in this service

unmapped.user_agent

• Description: JumpCloud Directory Insights field user_agent preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: user_agent
• Usage: alert_created, alert_updated

Asset Management#

asset_management · 9 events

OCSF field mappings#

Legend

• Description: what the OCSF field represents (from OCSF schema v1.8.0)
• Source: raw JumpCloud event field(s) mapped via ${{placeholder}} template
• Transform: fieldMappings entry applied at runtime (cast, enum, etc.)
• Literal: static value set in the mapping template
• Usage: event types in this service that include this field

Core

activity_id

• Description: The normalized identifier of the activity that triggered the event.
• Literal: 1, 3, 4, 8, 9
• Usage: all events in this service

activity_name

• Description: The event activity name, as defined by the activity_id.
• Literal: Create, Delete, Disable, Enable, Update
• Usage: all events in this service

category_name

• Description: The event category name, as defined by category_uid value: Discovery.
• Literal: Identity & Access Management
• Usage: all events in this service

category_uid

• Description: The category unique identifier of the event.
• Literal: 3
• Usage: all events in this service

class_name

• Description: The event class name, as defined by class_uid value: User Inventory Info.
• Literal: Entity Management
• Usage: all events in this service

class_uid

• Description: The unique identifier of a class. A class describes the attributes available in an event.
• Literal: 3004
• Usage: all events in this service

message

• Description: The description of the event/finding, as defined by the source.
• Source: detail
• Usage: all events in this service

severity_id

• Description: OCSF severity identifier for the event.
• Literal: 1
• Usage: all events in this service

status_detail

• Description: The status detail contains additional information about the event/finding outcome.
• Source: error_message
• Usage: all events in this service

status_id

• Description: Normalized status of the activity (1=Success, 2=Failure).
• Source: success
• Transform:
• success → boolean_to_status_id; true→1, false→2 (all events in this service)
• Usage: all events in this service

time

• Description: Event time, in epoch milliseconds (OCSF time).
• Source: timestamp
• Transform:
• timestamp → iso8601_to_epoch_millis (all events in this service)
• Usage: all events in this service

type_uid

• Description: The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.
• Literal: 300401, 300403, 300404, 300408, 300409
• Usage: all events in this service

Metadata

metadata.event_code

• Description: JumpCloud event type code.
• Source: event_type
• Usage: all events in this service

metadata.original_time

• Description: The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs.
• Source: server_timestamp
• Usage: all events in this service

metadata.processed_time

• Description: The event processed time, such as an ETL operation.
• Source: jc_transformation_ts
• Usage: all events in this service

metadata.product.name

• Description: Originating JumpCloud service that produced the event.
• Source: service
• Usage: all events in this service

metadata.tenant_uid

• Description: JumpCloud organization (tenant) identifier.
• Source: organization
• Usage: all events in this service

metadata.uid

• Description: Unique event identifier assigned by JumpCloud.
• Source: id
• Usage: all events in this service

metadata.version

• Description: OCSF schema version used for this event.
• Literal: 1.8.0
• Usage: all events in this service

Actor

actor.user.email_addr

• Description: Email address of the actor who initiated the event.
• Source: initiated_by.email
• Usage: all events in this service

actor.user.type_id

• Description: OCSF user type of the actor (1=User, 2=Admin, 3=System, 4=Service).
• Source: initiated_by.type
• Transform:
• initiated_by.type → enum; enumValues: {'user': 1, 'admin': 2, 'system': 3, 'service': 4, 'device': 99}; default: 99 (all events in this service)
• Usage: all events in this service

actor.user.uid

• Description: Unique identifier of the actor who initiated the event.
• Source: initiated_by.id
• Usage: all events in this service

Entity

entity.data.agent_status

• Description: JumpCloud extension data on the managed entity: agent_status.
• Source: resource.agent_status
• Usage: asset_management_asset_create

entity.data.agent_version

• Description: JumpCloud extension data on the managed entity: agent_version.
• Source: resource.agent_version
• Usage: asset_management_asset_create

entity.data.battery_current_capacity

• Description: JumpCloud extension data on the managed entity: battery_current_capacity.
• Source: resource.battery_current_capacity
• Usage: asset_management_asset_create

entity.data.battery_max_capacity

• Description: JumpCloud extension data on the managed entity: battery_max_capacity.
• Source: resource.battery_max_capacity
• Usage: asset_management_asset_create

entity.data.changed_field

• Description: JumpCloud extension data on the managed entity: changed_field.
• Source: changes.field
• Usage: asset_management_asset_update, asset_management_field_setting_update, asset_management_general_settings_update

entity.data.changes_from

• Description: JumpCloud extension data on the managed entity: changes_from.
• Source: changes.from
• Usage: asset_management_asset_update, asset_management_field_setting_update, asset_management_general_settings_update

entity.data.country

• Description: JumpCloud extension data on the managed entity: country.
• Source: resource.country
• Usage: asset_management_asset_create

entity.data.currency_code

• Description: JumpCloud extension data on the managed entity: currency_code.
• Source: resource.currency_code
• Usage: asset_management_asset_create

entity.data.data_source

• Description: JumpCloud extension data on the managed entity: data_source.
• Source: resource.data_source
• Usage: asset_management_asset_create, asset_management_asset_delete

entity.data.deployed_at

• Description: JumpCloud extension data on the managed entity: deployed_at.
• Source: resource.deployed_at
• Usage: asset_management_asset_create

entity.data.device_groups

• Description: JumpCloud extension data on the managed entity: device_groups.
• Source: resource.device_groups
• Usage: asset_management_asset_create

entity.data.disk_encrypted

• Description: JumpCloud extension data on the managed entity: disk_encrypted.
• Source: resource.disk_encrypted
• Usage: asset_management_asset_create

entity.data.field_type

• Description: JumpCloud extension data on the managed entity: field_type.
• Source: resource.type
• Usage: asset_management_field_setting_create, asset_management_field_setting_delete, asset_management_field_setting_update

entity.data.mandatory

• Description: JumpCloud extension data on the managed entity: mandatory.
• Source: resource.mandatory
• Usage: asset_management_field_setting_create

entity.data.mdm_provider

• Description: JumpCloud extension data on the managed entity: mdm_provider.
• Source: resource.mdm_provider
• Usage: asset_management_asset_create

entity.data.mfa_status

• Description: JumpCloud extension data on the managed entity: mfa_status.
• Source: resource.mfa_status
• Usage: asset_management_asset_create

entity.data.multiple

• Description: JumpCloud extension data on the managed entity: multiple.
• Source: resource.multiple
• Usage: asset_management_field_setting_create

entity.data.options_id

• Description: JumpCloud extension data on the managed entity: options_id.
• Source: resource.options.id
• Usage: asset_management_field_setting_create

entity.data.options_value

• Description: JumpCloud extension data on the managed entity: options_value.
• Source: resource.options.value
• Usage: asset_management_field_setting_create

entity.data.ownership_type

• Description: JumpCloud extension data on the managed entity: ownership_type.
• Source: resource.ownership_type
• Usage: asset_management_asset_create

entity.data.po_number

• Description: JumpCloud extension data on the managed entity: po_number.
• Source: resource.po_number
• Usage: asset_management_asset_create

entity.data.purchase_cost

• Description: JumpCloud extension data on the managed entity: purchase_cost.
• Source: resource.purchase_cost
• Usage: asset_management_asset_create

entity.data.purchased_at

• Description: JumpCloud extension data on the managed entity: purchased_at.
• Source: resource.purchased_at
• Usage: asset_management_asset_create

entity.data.section

• Description: JumpCloud extension data on the managed entity: section.
• Source: resource.section
• Usage: asset_management_field_setting_create

entity.data.status

• Description: JumpCloud extension data on the managed entity: status.
• Source: resource.status
• Usage: asset_management_asset_create

entity.data.supplier

• Description: JumpCloud extension data on the managed entity: supplier.
• Source: resource.supplier
• Usage: asset_management_asset_create

entity.data.system_insights_enabled

• Description: JumpCloud extension data on the managed entity: system_insights_enabled.
• Source: resource.system_insights_enabled
• Usage: asset_management_asset_create

entity.data.tag

• Description: JumpCloud extension data on the managed entity: tag.
• Source: resource.tag
• Usage: asset_management_asset_create

entity.data.tooltip

• Description: JumpCloud extension data on the managed entity: tooltip.
• Source: resource.tooltip
• Usage: asset_management_field_setting_create

entity.data.unique

• Description: JumpCloud extension data on the managed entity: unique.
• Source: resource.unique
• Usage: asset_management_field_setting_create

entity.data.users

• Description: JumpCloud extension data on the managed entity: users.
• Source: resource.users
• Usage: asset_management_asset_create

entity.data.warranty_expired_at

• Description: JumpCloud extension data on the managed entity: warranty_expired_at.
• Source: resource.warranty_expired_at
• Usage: asset_management_asset_create

entity.data.warranty_period_months

• Description: JumpCloud extension data on the managed entity: warranty_period_months.
• Source: resource.warranty_period_months
• Usage: asset_management_asset_create

entity.device.hw_info.cpu_type

• Description: The processor type. For example: x86 Family 6 Model 37 Stepping 5.
• Source: resource.cpu
• Usage: asset_management_asset_create

entity.device.hw_info.ram_size

• Description: The total amount of installed RAM, in Megabytes. For example: 2048.
• Source: resource.rammb
• Usage: asset_management_asset_create

entity.device.hw_info.serial_number

• Description: The device manufacturer serial number.
• Source: resource.serial
• Usage: asset_management_asset_create

entity.device.is_managed

• Description: The event occurred on a managed device.
• Source: resource.mdm_status
• Usage: asset_management_asset_create

entity.device.last_seen_time

• Description: The most recent discovery time of the device.
• Source: resource.last_contact
• Usage: asset_management_asset_create

entity.device.model

• Description: The model of the device. For example ThinkPad X1 Carbon.
• Source: resource.model
• Usage: asset_management_asset_create

entity.device.os.name

• Description: The operating system name.
• Source: resource.os
• Usage: asset_management_asset_create

entity.device.os.type

• Description: The type of the operating system.
• Source: resource.os_family
• Usage: asset_management_asset_create

entity.device.os.version

• Description: The version of the OS running on the device that originated the event. For example: "Windows 10", "OS X 10.7", or "iOS 9".
• Source: resource.os_version
• Usage: asset_management_asset_create

entity.device.owner.name

• Description: The username. For example, janedoe1.
• Source: resource.owner_user
• Usage: asset_management_asset_create

entity.device.type

• Description: The device type. For example: unknown, server, desktop, laptop, tablet, mobile, virtual, browser, or other.
• Source: resource.type
• Usage: asset_management_asset_create, asset_management_asset_delete

entity.device.uid

• Description: The unique identifier of the device. For example the Windows TargetSID or AWS EC2 ARN.
• Source: resource.system_id
• Usage: asset_management_asset_create

entity.device.vendor_name

• Description: The vendor for the device. For example Dell or Lenovo.
• Source: resource.vendor
• Usage: asset_management_asset_create

entity.name

• Description: The name of the managed entity. It should match the name of the specific entity object's name if populated, or the name of the managed entity if the type_id is 'Other'.
• Source: resource.label, resource.name
• Usage: asset_management_asset_create, asset_management_asset_delete, asset_management_field_setting_create, asset_management_field_setting_delete, asset_management_field_setting_update

entity.type

• Description: The managed entity type. For example: Policy, User, Organization, Device.
• Source: resource.asset_type, resource.scope, resource.type
• Usage: asset_management_asset_create, asset_management_asset_delete, asset_management_asset_update, asset_management_field_setting_create, asset_management_field_setting_delete, asset_management_field_setting_update

entity.uid

• Description: The identifier of the managed entity. It should match the uid of the specific entity's object UID if populated, or the source specific ID if the type_id is 'Other'.
• Source: resource.id, service
• Usage: all events in this service

entity_result.data.changes_to

• Description: JumpCloud extension data on the managed entity: changes_to.
• Source: changes.to
• Usage: asset_management_asset_update, asset_management_field_setting_update, asset_management_general_settings_update

Src Endpoint

src_endpoint.autonomous_system.name

• Description: Organization name for the Autonomous System.
• Source: asn.organization
• Usage: asset_management_asset_create, asset_management_asset_delete, asset_management_disable, asset_management_enable, asset_management_field_setting_create, asset_management_field_setting_delete, asset_management_field_setting_update, asset_management_general_settings_update

src_endpoint.autonomous_system.number

• Description: Unique number that the AS is identified by.
• Source: asn.number
• Transform:
• asn.number → int (asset_management_asset_create, asset_management_asset_delete, asset_management_disable, asset_management_enable, asset_management_field_setting_create, asset_management_field_setting_delete, asset_management_field_setting_update, asset_management_general_settings_update)
• Usage: asset_management_asset_create, asset_management_asset_delete, asset_management_disable, asset_management_enable, asset_management_field_setting_create, asset_management_field_setting_delete, asset_management_field_setting_update, asset_management_general_settings_update

src_endpoint.ip

• Description: Source IP address the request originated from.
• Source: client_ip
• Usage: all events in this service

src_endpoint.location.city

• Description: The name of the city.
• Source: geoip.city
• Usage: all events in this service

src_endpoint.location.continent

• Description: The name of the continent.
• Source: geoip.continent_code
• Usage: all events in this service

src_endpoint.location.country

• Description: The ISO 3166-1 Alpha-2 country code.

  Note: The two letter country code should be capitalized. For example: US or CA.

• Source: geoip.country_code
• Usage: all events in this service

src_endpoint.location.lat

• Description: The geographical Latitude coordinate represented in Decimal Degrees (DD). For example: 42.361145.
• Source: geoip.latitude
• Transform:
• geoip.latitude → double (all events in this service)
• Usage: all events in this service

src_endpoint.location.long

• Description: The geographical Longitude coordinate represented in Decimal Degrees (DD). For example: -71.057083.
• Source: geoip.longitude
• Transform:
• geoip.longitude → double (all events in this service)
• Usage: all events in this service

src_endpoint.location.region

• Description: The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. For example, 'CH-VD' for the Canton of Vaud, Switzerland
• Source: geoip.region_code
• Usage: all events in this service

Http Request

http_request.user_agent

• Description: The request header that identifies the operating system and web browser.
• Source: user_agent
• Usage: all events in this service

Observables

observables[].name

• Description: The full name of the observable attribute. The name is a pointer/reference to an attribute within the OCSF event data. For example: file.name. Array attributes may be represented in one of three ways. For example: resources.uid, resources[].uid, resources[0].uid.
• Literal: actor.user.email_addr, actor.user.uid, entity.device.hw_info.serial_number, entity.device.owner.name, entity.device.uid, http_request.user_agent, src_endpoint.ip, src_endpoint.location.country
• Usage: all events in this service

observables[].type_id

• Description: The observable value type identifier.
• Literal: 14, 16, 2, 31, 37, 4, 47, 5
• Usage: all events in this service

observables[].value

• Description: The value associated with the observable attribute. The meaning of the value depends on the observable type.
  If the name refers to a scalar attribute, then the value is the value of the attribute.
  If the name refers to an object attribute, then the value is not populated.
• Source: client_ip, geoip.country_code, initiated_by.email, initiated_by.id, resource.owner_user, resource.serial, resource.system_id, user_agent
• Usage: all events in this service

Unmapped

unmapped.@version

• Description: JumpCloud Directory Insights field @version preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: @version
• Usage: all events in this service

unmapped.asn.network

• Description: JumpCloud Directory Insights field asn.network preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: asn.network
• Usage: asset_management_asset_create, asset_management_asset_delete, asset_management_disable, asset_management_enable, asset_management_field_setting_create, asset_management_field_setting_delete, asset_management_field_setting_update, asset_management_general_settings_update

unmapped.geoip.region_name

• Description: JumpCloud Directory Insights field geoip.region_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: geoip.region_name
• Usage: all events in this service

unmapped.geoip.timezone

• Description: JumpCloud Directory Insights field geoip.timezone preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: geoip.timezone
• Usage: all events in this service

unmapped.initiated_by_email_hash

• Description: JumpCloud Directory Insights field initiated_by_email_hash preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: initiated_by_email_hash
• Usage: all events in this service

unmapped.initiated_by_id_hash

• Description: JumpCloud Directory Insights field initiated_by_id_hash preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: initiated_by_id_hash
• Usage: all events in this service

unmapped.is_out_of_bound

• Description: JumpCloud Directory Insights field is_out_of_bound preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: is_out_of_bound
• Usage: all events in this service

unmapped.jc_application_name

• Description: JumpCloud Directory Insights field jc_application_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_application_name
• Usage: all events in this service

unmapped.jc_initiated_by_email

• Description: JumpCloud Directory Insights field jc_initiated_by_email preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_initiated_by_email
• Usage: asset_management_asset_delete, asset_management_disable, asset_management_enable, asset_management_general_settings_update

unmapped.jc_initiated_by_id

• Description: JumpCloud Directory Insights field jc_initiated_by_id preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_initiated_by_id
• Usage: asset_management_asset_delete, asset_management_disable, asset_management_enable, asset_management_general_settings_update

unmapped.jc_initiated_by_username

• Description: JumpCloud Directory Insights field jc_initiated_by_username preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_initiated_by_username
• Usage: asset_management_asset_delete, asset_management_disable, asset_management_enable, asset_management_general_settings_update

unmapped.jc_organization_name

• Description: JumpCloud Directory Insights field jc_organization_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_organization_name
• Usage: asset_management_asset_delete, asset_management_disable, asset_management_enable, asset_management_general_settings_update

unmapped.jc_provider_id

• Description: JumpCloud Directory Insights field jc_provider_id preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_provider_id
• Usage: asset_management_enable

unmapped.jc_system_display_name

• Description: JumpCloud Directory Insights field jc_system_display_name preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_system_display_name
• Usage: asset_management_asset_delete, asset_management_disable, asset_management_enable, asset_management_general_settings_update

unmapped.jc_system_hostname

• Description: JumpCloud Directory Insights field jc_system_hostname preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: jc_system_hostname
• Usage: asset_management_asset_delete, asset_management_disable, asset_management_enable, asset_management_general_settings_update

unmapped.resource_id_hash

• Description: JumpCloud Directory Insights field resource_id_hash preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource_id_hash
• Usage: asset_management_asset_create, asset_management_asset_delete, asset_management_asset_update, asset_management_field_setting_create, asset_management_field_setting_delete, asset_management_field_setting_update

unmapped.resource_name_hash

• Description: JumpCloud Directory Insights field resource_name_hash preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: resource_name_hash
• Usage: asset_management_asset_delete

unmapped.timestamp_source

• Description: JumpCloud Directory Insights field timestamp_source preserved in the OCSF unmapped object (no dedicated OCSF mapping).
• Source: timestamp_source
• Usage: all events in this service

Directory — Command and Policy Events#

directory_command_policy · 35 events

OCSF field mappings#

Legend

• Description: what the OCSF field represents (from OCSF schema v1.8.0)
• Source: raw JumpCloud event field(s) mapped via ${{placeholder}} template
• Transform: fieldMappings entry applied at runtime (cast, enum, etc.)
• Literal: static value set in the mapping template
• Usage: event types in this service that include this field

Core

activity_id

• Description: The normalized identifier of the activity that triggered the event.
• Literal: 1, 3, 4, 6
• Usage: all events in this service

activity_name

• Description: The event activity name, as defined by the activity_id.
• Literal: Create, Delete, Launch, Log, Open, Start, Update
• Usage: all events in this service

category_name

• Description: The event category name, as defined by category_uid value: Discovery.
• Literal: Discovery, Identity & Access Management, System Activity
• Usage: all events in this service

category_uid

• Description: The category unique identifier of the event.
• Literal: 1, 3, 5
• Usage: all events in this service

class_name

• Description: The event class name, as defined by class_uid value: User Inventory Info.
• Literal: Device Config State Change, Entity Management, Process Activity, Scheduled Job Activity
• Usage: all events in this service

class_uid

• Description: The unique identifier of a class. A class describes the attributes available in an event.
• Literal: 1006, 1007, 3004, 5019
• Usage: all events in this service

message

• Description: The description of the event/finding, as defined by the source.
• Source: message
• Usage: background_access_file, background_access_shell

severity_id

• Description: OCSF severity identifier for the event.
• Literal: 1
• Usage: all events in this service

status_detail

• Description: The status detail contains additional information about the event/finding outcome.
• Source: error_message
• Usage: 29 events: authnfallbackpolicy_delete, authnfallbackpolicy_update, authnpolicy_create, authnpolicy_delete, authnpolicy_mfa_factor_selection_update, authnpolicy_update, background_access_file, background_access_shell, ... (+21 more)

status_id

• Description: Normalized status of the activity (1=Success, 2=Failure).
• Source: success
• Transform:
• success → boolean_to_status_id; true→1, false→2 (26 events: authnfallbackpolicy_delete, authnfallbackpolicy_update, authnpolicy_mfa_factor_selection_update, background_access_file, background_access_shell, command_delete, command_result, command_run, ... (+18 more))
• Usage: 26 events: authnfallbackpolicy_delete, authnfallbackpolicy_update, authnpolicy_mfa_factor_selection_update, background_access_file, background_access_shell, command_delete, command_result, command_run, ... (+18 more)

time

• Description: Event time, in epoch milliseconds (OCSF time).
• Source: timestamp
• Transform:
• timestamp → iso8601_to_epoch_millis (all events in this service)
• Usage: all events in this service

type_uid

• Description: The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.
• Literal: 100606, 100701, 100703, 300401, 300403, 300404, 501901
• Usage: all events in this service

Metadata

metadata.event_code

• Description: JumpCloud event type code.
• Source: event_type
• Usage: all events in this service

metadata.original_time

• Description: The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs.
• Source: server_timestamp
• Usage: background_access_file, background_access_shell, command_result, passwordpolicy_create, passwordpolicy_delete, passwordpolicy_update, policy_result

metadata.processed_time

• Description: The event processed time, such as an ETL operation.
• Source: jc_transformation_ts
• Usage: 26 events: authnfallbackpolicy_delete, authnfallbackpolicy_update, authnpolicy_mfa_factor_selection_update, background_access_file, background_access_shell, command_delete, command_result, command_run, ... (+18 more)

metadata.product.name

• Description: Originating JumpCloud service that produced the event.
• Source: service
• Usage: all events in this service

metadata.tenant_uid

• Description: JumpCloud organization (tenant) identifier.
• Source: organization
• Usage: all events in this service

metadata.uid

• Description: Unique event identifier assigned by JumpCloud.
• Source: id
• Usage: all events in this service

metadata.version

• Description: OCSF schema version used for this event.
• Literal: 1.8.0
• Usage: all events in this service

Actor

actor.user.email_addr

• Description: Email address of the actor who initiated the event.
• Source: initiated_by.email
• Usage: 33 events (missing: command_result, policy_result)

actor.user.name

• Description: Display name of the actor who initiated the event.
• Source: initiated_by.name
• Usage: background_access_file, background_access_shell, command_run

actor.user.type_id

• Description: OCSF user type of the actor (1=User, 2=Admin, 3=System, 4=Service).
• Source: initiated_by.type
• Transform:
• initiated_by.type → enum; enumValues: {'user': 1, 'admin': 2, 'system': 3, 'service': 4, 'device': 99}; default: 99 (33 events (missing: command_result, policy_result))
• Usage: 33 events (missing: command_result, policy_result)

actor.user.uid

• Description: Unique identifier of the actor who initiated the event.
• Source: initiated_by.id
• Usage: 33 events (missing: command_result, policy_result)

Device

device.hostname

• Description: The device hostname.
• Source: system.hostname
• Usage: background_access_file, background_access_shell

device.hw_info.serial_number

• Description: The device manufacturer serial number.
• Source: system.serialno
• Usage: background_access_file, background_access_shell

device.name

• Description: The alternate device name, ordinarily as assigned by an administrator.

  Note: The Name could be any other string that helps to identify the device, such as a phone number; for example 310-555-1234.

• Source: system.displayName
• Usage: background_access_file, background_access_shell

device.uid

• Description: The unique identifier of the device. For example the Windows TargetSID or AWS EC2 ARN.
• Source: resource.id, system.id
• Usage: background_access_file, background_access_shell, command_result, policy_result

Entity

entity.data.auth_method

• Description: JumpCloud extension data on the managed entity: auth_method.
• Source: auth_method
• Usage: 28 events: authnfallbackpolicy_create, authnfallbackpolicy_delete, authnfallbackpolicy_update, authnpolicy_create, authnpolicy_delete, authnpolicy_mfa_factor_selection_update, authnpolicy_update, command_create, ... (+20 more)

entity.data.changed_field

• Description: JumpCloud extension data on the managed entity: changed_field.
• Source: changes.field
• Usage: 27 events: authnfallbackpolicy_create, authnfallbackpolicy_delete, authnfallbackpolicy_update, authnpolicy_create, authnpolicy_delete, authnpolicy_mfa_factor_selection_update, authnpolicy_update, command_create, ... (+19 more)

entity.data.changes_from

• Description: JumpCloud extension data on the managed entity: changes_from.
• Source: changes.from
• Usage: authnpolicy_mfa_factor_selection_update, command_delete, command_update, commandtemplate_delete, file_delete, file_update, iplist_delete, iplist_update, policy_delete, policy_update

entity.data.changes_from_all_deviceEncrypted

• Description: JumpCloud extension data on the managed entity: changes_from_all_deviceEncrypted.
• Source: changes.from.all.deviceEncrypted
• Usage: authnpolicy_delete

entity.data.changes_from_all_deviceManaged

• Description: JumpCloud extension data on the managed entity: changes_from_all_deviceManaged.
• Source: changes.from.all.deviceManaged
• Usage: authnpolicy_delete, authnpolicy_update

entity.data.changes_from_all_ipAddressIn

• Description: JumpCloud extension data on the managed entity: changes_from_all_ipAddressIn.
• Source: changes.from.all.ipAddressIn
• Usage: authnpolicy_delete, authnpolicy_update

entity.data.changes_from_all_locationIn_countries

• Description: JumpCloud extension data on the managed entity: changes_from_all_locationIn_countries.
• Source: changes.from.all.locationIn.countries
• Usage: authnpolicy_delete, authnpolicy_update

entity.data.changes_from_any_deviceEncrypted

• Description: JumpCloud extension data on the managed entity: changes_from_any_deviceEncrypted.
• Source: changes.from.any.deviceEncrypted
• Usage: authnpolicy_delete

entity.data.changes_from_any_deviceManaged

• Description: JumpCloud extension data on the managed entity: changes_from_any_deviceManaged.
• Source: changes.from.any.deviceManaged
• Usage: authnpolicy_delete

entity.data.changes_from_any_not_ipAddressIn

• Description: JumpCloud extension data on the managed entity: changes_from_any_not_ipAddressIn.
• Source: changes.from.any.not.ipAddressIn
• Usage: authnpolicy_delete

entity.data.changes_from_any_not_locationIn_countries

• Description: JumpCloud extension data on the managed entity: changes_from_any_not_locationIn_countries.
• Source: changes.from.any.not.locationIn.countries
• Usage: authnpolicy_delete

entity.data.changes_from_exclusions

• Description: JumpCloud extension data on the managed entity: changes_from_exclusions.
• Source: changes.from.exclusions
• Usage: authnpolicy_delete

entity.data.changes_from_id

• Description: JumpCloud extension data on the managed entity: changes_from_id.
• Source: changes.from.id
• Usage: authnpolicy_delete

entity.data.changes_from_inclusions

• Description: JumpCloud extension data on the managed entity: changes_from_inclusions.
• Source: changes.from.inclusions
• Usage: authnpolicy_delete

entity.data.changes_from_locationIn_countries

• Description: JumpCloud extension data on the managed entity: changes_from_locationIn_countries.
• Source: changes.from.locationIn.countries
• Usage: authnpolicy_delete

entity.data.changes_from_mfaFactors

• Description: JumpCloud extension data on the managed entity: changes_from_mfaFactors.
• Source: changes.from.mfaFactors
• Usage: authnfallbackpolicy_update

entity.data.changes_from_mfaFactors_id_data

• Description: JumpCloud extension data on the managed entity: changes_from_mfaFactors_id_data.
• Source: changes.from.mfaFactors.id.data
• Usage: authnfallbackpolicy_delete

entity.data.changes_from_mfaFactors_id_type

• Description: JumpCloud extension data on the managed entity: changes_from_mfaFactors_id_type.
• Source: changes.from.mfaFactors.id.type
• Usage: authnfallbackpolicy_delete

entity.data.changes_from_mfaFactors_type

• Description: JumpCloud extension data on the managed entity: changes_from_mfaFactors_type.
• Source: changes.from.mfaFactors.type
• Usage: authnfallbackpolicy_delete

entity.data.changes_from_mfa_required

• Description: JumpCloud extension data on the managed entity: changes_from_mfa_required.
• Source: changes.from.mfa.required
• Usage: authnfallbackpolicy_delete, authnfallbackpolicy_update, authnpolicy_delete

entity.data.changes_from_type

• Description: JumpCloud extension data on the managed entity: changes_from_type.
• Source: changes.from.type
• Usage: authnpolicy_delete

entity.data.changes_from_userVerification_requirement

• Description: JumpCloud extension data on the managed entity: changes_from_userVerification_requirement.
• Source: changes.from.userVerification.requirement
• Usage: authnfallbackpolicy_delete, authnfallbackpolicy_update

entity.data.changes_to

• Description: JumpCloud extension data on the managed entity: changes_to.
• Source: changes.to
• Usage: policygrouptemplate_delete

entity.data.command

• Description: JumpCloud extension data on the managed entity: command.
• Source: resource.command
• Usage: commandresult_delete

entity.data.initiated_by_provider

• Description: JumpCloud extension data on the managed entity: initiated_by_provider.
• Source: initiated_by.provider
• Usage: 14 events: authnfallbackpolicy_delete, authnpolicy_mfa_factor_selection_update, command_run, command_update, commandtemplate_create, commandtemplate_delete, commandtemplate_update, configuredpolicytemplate_create, ... (+6 more)

entity.data.initiated_by_user_id

• Description: JumpCloud extension data on the managed entity: initiated_by_user_id.
• Source: initiated_by.user_id
• Usage: command_run, file_delete, file_update

entity.data.metadata.action

• Description: JumpCloud extension data on the managed entity: metadata.action.
• Source: resource.metadata.action
• Usage: authnpolicy_create, authnpolicy_delete, authnpolicy_update

entity.data.metadata.conditions

• Description: JumpCloud extension data on the managed entity: metadata.conditions.
• Source: resource.metadata.conditions
• Usage: authnpolicy_create, authnpolicy_delete, authnpolicy_update

entity.data.metadata.resource_type

• Description: JumpCloud extension data on the managed entity: metadata.resource_type.
• Source: resource.metadata.resource_type
• Usage: authnpolicy_create, authnpolicy_delete, authnpolicy_update

entity.data.metadata.targets

• Description: JumpCloud extension data on the managed entity: metadata.targets.
• Source: resource.metadata.targets
• Usage: authnpolicy_create, authnpolicy_delete, authnpolicy_update

entity.data.os_meta_family

• Description: JumpCloud extension data on the managed entity: os_meta_family.
• Source: os_meta_family
• Usage: policy_create, policy_delete, policy_update

entity.data.provider

• Description: JumpCloud extension data on the managed entity: provider.
• Source: provider
• Usage: 27 events: authnfallbackpolicy_create, authnfallbackpolicy_delete, authnfallbackpolicy_update, authnpolicy_create, authnpolicy_delete, authnpolicy_mfa_factor_selection_update, authnpolicy_update, command_create, ... (+19 more)

entity.data.resourceType

• Description: JumpCloud extension data on the managed entity: resourceType.
• Source: resource.resourceType
• Usage: authnfallbackpolicy_create, authnfallbackpolicy_delete, authnfallbackpolicy_update

entity.data.workflow_id

• Description: JumpCloud extension data on the managed entity: workflow_id.
• Source: initiated_by.source_metadata.workflow.id
• Usage: command_run

entity.data.workflow_run_id

• Description: JumpCloud extension data on the managed entity: workflow_run_id.
• Source: initiated_by.source_metadata.workflow.run_id
• Usage: command_run

entity.data.workflow_type

• Description: JumpCloud extension data on the managed entity: workflow_type.
• Source: initiated_by.source_metadata.workflow.type
• Usage: command_run

entity.name

• Description: The name of the managed entity. It should match the name of the specific entity object's name if populated, or the name of the managed entity if the type_id is 'Other'.
• Source: resource.name
• Usage: 23 events: authnpolicy_create, authnpolicy_delete, authnpolicy_mfa_factor_selection_update, authnpolicy_update, command_create, command_delete, command_run, command_update, ... (+15 more)

entity.type

• Description: The managed entity type. For example: Policy, User, Organization, Device.
• Source: resource.type
• Usage: 31 events: authnfallbackpolicy_create, authnfallbackpolicy_delete, authnfallbackpolicy_update, authnpolicy_create, authnpolicy_delete, authnpolicy_mfa_factor_selection_update, authnpolicy_update, command_create, ... (+23 more)

entity.uid