XML Example
Note
The examples shown have been formatted for human readability, when in reality they are one line per record with no newlines or indenting injected.
The Legacy format and the XML format are the same content, but the Legacy format does include newlines and indenting.
<record id="a21e6010-c598-11e7-bf85-005056c00008">
<product>
<id>
net.idauto.audit.product.saml
</id>
<displayName>
Federation
</displayName>
</product>
<module>
<id>
net.idauto.audit.module.idp
</id>
<displayName>
Federation Identity Provider
</displayName>
</module>
<action>
<id>
net.idauto.audit.idp.action.authentication
</id>
<displayName>
IdP Authentication
</displayName>
<classification>
<id>
net.idauto.audit.common.classification.normal
</id>
</classification>
<categories>
<category>
<id>
net.idauto.audit.common.category.systemUsage
</id>
</category>
</categories>
</action>
<hostIp>
192.168.11.101
</hostIp>
<perpetratorId>
521d7b81-ac96-4ae4-bbd2-d346d826c5d6
</perpetratorId>
<perpetratorDN>
CN=John Doe,OU=employees,OU=people,OU=idauto,DC=ad2k8,DC=local
</perpetratorDN>
<perpetratorIp>
127.0.0.1
</perpetratorIp>
<targetSystem>
DIRECTORY
</targetSystem>
<targetId>
521d7b81-ac96-4ae4-bbd2-d346d826c5d6
</targetId>
<target>
jdoe
</target>
<successful>
false
</successful>
<properties>
<property key="json_data">
<values>
<value>
{
"errorMessage": "Incorrect Username and/or Password",
"policy": {
"id": "47bf6460-3421-11e7-8178-005056c00008",
"name": "Password Only",
"version": 26
},
"methods": ["username"],
"failedStep": "password"
}
</value>
</values>
</property>
</properties>
<timestamp>
2017-11-09 15:55:00
</timestamp>
</record>