Exemples de messages d'événement Cisco Duo
Utilisez ces exemples de messages d'événement pour vérifier la réussite de l'intégration avec IBM QRadar.
Important: En raison de problèmes de formatage, collez le format de message dans un éditeur de texte, puis supprimez les caractères de retour chariot ou de saut de ligne.
Exemple de message Cisco Duo lorsque vous utilisez le protocole Cisco Duo
Exemple 1: L'exemple de message d'événement suivant indique qu'un client s'est inscrit avec Cisco Duo.
{"access_device":{"browser":"Firefox","browser_version":"84.0","epkey":null,"flash_version":"uninstalled","hostname":null,"ip":"10.120.139.72","is_encryption_enabled":"unknown","is_firewall_enabled":"unknown","is_password_set":"unknown","java_version":"uninstalled","location":{"city":"city","country":"country","state":"state"},"os":"Mac OS X","os_version":"11.0","security_agents":"unknown"},"alias":"unknown","application":{"key":"1111111111AAAAAAAAAA","name":"1Password"},"auth_device":{"ip":null,"location":{"city":null,"country":null,"state":null},"name":"514-894-3479"},"email":null,"event_type":"enrollment","factor":"sms_passcode","isotimestamp":"2021-10-04T19:40:32.385977+00:00","ood_software":null,"reason":null,"result":"success","timestamp":1633376432,"trusted_endpoint_status":"unknown","txid":"1a32fe06-cc6c-4a34-9f08-43e23fb1f4b3","user":{"groups":[],"key":"1111111111AAAAAAAABB","name":"test.user@example.com"}}| Nom de zone QRadar | Nom de zone de contenu mise en évidence |
|---|---|
| ID d'événement | event_type |
| IP source | ip |
| Nom d'utilisateur | name |
Exemple 2: L'exemple de message d'événement suivant indique qu'un utilisateur final a approuvé une demande d'authentification.
{"access_device":{"browser":null,"browser_version":null,"epkey":null,"flash_version":null,"hostname":null,"ip":"10.10.10.10","is_encryption_enabled":"unknown","is_firewall_enabled":"unknown","is_password_set":"unknown","java_version":null,"location":{"city":null,"country":null,"state":null},"os":null,"os_version":null,"security_agents":"unknown"},"alias":"testuser","application":{"key":"1111111111AAAAAAAAAA","name":"macOS"},"auth_device":{"ip":"142.120.139.72","location":{"city":"Ottawa","country":"Canada","state":"Ontario"},"name":"514-894-3479"},"email":"test.user@example.com","event_type":"authentication","factor":"duo_push","isotimestamp":"2021-10-06T14:22:47.921053+00:00","ood_software":null,"reason":"user_approved","result":"success","timestamp":1633530167,"trusted_endpoint_status":"unknown","txid":"73eb9ca7-45d1-4f97-af0b-7c15700f6f2f","user":{"groups":[],"key":"1111111111AAAAAAAABB","name":"testuser"}}| Nom de zone QRadar | Nom de zone de contenu mise en évidence |
|---|---|
| ID d'événement | reason |
| IP source | ip |
| Nom d'utilisateur | name |
| IP d'identité | ip |
| Nom d'utilisateur d'identité | name |