IBM_SECURITY_WORKFLOW events
This event type is generated by the authentication service when an authenticator or authenticator method action takes place.
IBM_SECURITY_WORKFLOW event. All elements are included in the output, unless
indicated otherwise.| Element | Description |
|---|---|
| action | Specifies the operation that is performed. Potential values
include: 'getAuthenticators' 'getAuthenticator' 'updateAuthenticator' 'deleteAuthenticator' 'createAuthenticator' 'getAuthMethods' 'getAuthMethod' 'updateAuthMethod' 'deleteAuthMethod' 'createAuthMethod' The
XPath
is: |
| userInfo.appUserName | Optionally specifies information about the user who owns the data or the user that is
performing the action. The XPath
is: |
| userInfo.registryUserName | The authentication service does not utilize this element and appears in the
IBM_SECURITY_WORKFLOW event as ‘Not Available’.The XPath
is: |
| workItemInfo.id | Specifies the ID of the work item, that is the source of the event. Potential values
include: 'getAuthenticators' 'getAuthenticator' 'updateAuthenticator' 'deleteAuthenticator' 'createAuthenticator' 'getAuthMethods' 'getAuthMethod' 'updateAuthMethod' 'deleteAuthMethod' 'createAuthMethod' The XPath
is: |
| workItemInfo.type | Specifies the type of the work item, that is the action that was performed. Potential values
include: ‘authenticator', ‘authenticatorMethod’The XPath
is: |
| authenticators.authenticator.id | Optionally specifies the ID of an authenticator. The XPath
is: |
| authenticators.authenticator.oauthGrant | Optionally specifies the OAuth grant of an authenticator. The XPath
is: |
| authenticators.authenticator.enabled | Optionally specifies whether the authenticator is enabled or disabled. The XPath
is: |
| authenticators.authenticator.deviceName | Optionally specifies the device name of an authenticator. The XPath
is: |
| authenticators.authenticator.deviceType | Optionally specifies the device type of an authenticator. The XPath
is: |
| authenticators.authenticator.osVersion |
Optionally specifies the OS version of an authenticator. The XPath
is:
|
| authenticators.authenticator.applicationId | Optionally specifies the application ID of an authenticator. The XPath
is: |
| authenticators.authenticator.authMethods.authMethod.id
or authMethods.authMethod.id |
Optionally specifies the ID of an authenticator method. The XPath
is: Or |
| authenticators.authenticator.authMethods.authMethod.type
or authMethods.authMethod.type |
Optionally specifies the type of an authenticator method. Usually
‘fingerprint’ or ‘user_presence’.The XPath
is: Or |
| authenticators.authenticator.authMethods.authMethod.algorithm
or authMethods.authMethod.algorithm |
Optionally specifies the algorithm of an authenticator method. The XPath
is: Or |
| authenticators.authenticator.authMethods.authMethod.enabled
or authMethods.authMethod.enabled |
Optionally specifies whether the authenticator method is enabled or disabled. The XPath
is: Or |
| authenticators.authenticator.authMethods.authMethod.keyHandle
or authMethods.authMethod.keyHandle |
Optionally specifies the key handle of an authenticator method. The XPath
is: Or |
| authenticators.authenticator.authMethods.authMethod.publicKey
or authMethods.authMethod.publicKey |
Optionally specifies the public key of an authenticator method. The XPath
is: Or |
Sample of an IBM_SECURITY_WORKFLOW event
The following example shows one event generated when a list of all authenticators was requested:
<CommonBaseEvent creationTime="2020-05-20T03:04:55.136Z" extensionName="IBM_SECURITY_WORKFLOW" globalInstanceId="FIM300a846101721f3ea4caa20cec6d4" sequenceNumber="34" version="1.1">
<extendedDataElements name="EventName" type="string">
<values>MMFAAuditEvent</values>
</extendedDataElements>
<extendedDataElements name="authenticators" type="noValue">
<children name="authenticator" type="noValue">
<children name="id" type="string">
<values>uuid59694905-9dd6-427f-b5a4-0b45209914d4</values>
</children>
<children name="oauthGrant" type="string">
<values>uuid2fb6fa34-0172-18e2-aec0-f9773093af33</values>
</children>
<children name="enabled" type="boolean">
<values>true</values>
</children>
<children name="deviceName" type="string">
<values>JessicasIphone</values>
</children>
<children name="deviceType" type="string">
<values>iphone</values>
</children>
<children name="osVersion" type="string">
<values>10</values>
</children>
<children name="authMethods" type="noValue">
<children name="authMethod" type="noValue">
<children name="id" type="string">
<values>uuid21b9cc7e-7dd0-4288-bf0f-2c2f98e45698</values>
</children>
<children name="enabled" type="boolean">
<values>true</values>
</children>
</children>
<children name="authMethod" type="noValue">
<children name="id" type="string">
<values>uuidea5e94e3-ae48-44b1-8859-bf2a9e0f69d3</values>
</children>
<children name="enabled" type="boolean">
<values>true</values>
</children>
</children>
</children>
</children>
</extendedDataElements>
<extendedDataElements name="userInfo" type="noValue">
<children name="registryUserName" type="string">
<values>Not Available</values>
</children>
<children name="appUserName" type="string">
<values>testuser</values>
</children>
</extendedDataElements>
<extendedDataElements name="workItemInfo" type="noValue">
<children name="id" type="string">
<values>authenticator</values>
</children>
<children name="type" type="string">
<values>getAuthenticators</values>
</children>
</extendedDataElements>
<extendedDataElements name="action" type="string">
<values>getAuthenticators</values>
</extendedDataElements>
<extendedDataElements name="outcome" type="noValue">
<children name="result" type="string">
<values>SUCCESSFUL</values>
</children>
<children name="majorStatus" type="int">
<values>0</values>
</children>
</extendedDataElements>
<sourceComponentId application="IBM® Verify Identity Access" component="Authentication and Federated Identity" componentIdType="ProductName" executionEnvironment="Linux[amd64]#3.10.0-862.14.4.el7_1.iss8_1.28.x86_64" location="dev" locationType="FQHostname" subComponent="UserAuthenticatorHandler" threadId="Default Executor-thread-1546" componentType="http://www.ibm.com/namespaces/autonomic/Tivoli_componentTypes"/>
<situation categoryName="ReportSituation">
<situationType
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="ReportSituation" reasoningScope="INTERNAL" reportCategory="SECURITY"/>
</situation>
</CommonBaseEvent>