• Events Overview
• Event Types
  • Registration
  • Identity
  • Access
  • TrustScoring
  • Audit
  • AdminLogin
  • Threat
  • Compliance
  • Malware
  • SaaSSecurity
  • NetagentRestart
  • ITPStatus
• Event JSON
  • Common Fields
  • Subject
  • Roles
  • TrustScore
  • Object
  • Service
  • Policy
  • Channel
  • Link
  • URL Filtering

Events Overview

Events in Cloud Secure Edge (CSE) are classified as types (i.e., ‘Event Type’ and ‘Event Subtype’). These types are organized as ‘Private Access’ events or ‘Internet Access’ events. Typically, an Event Type will be associated with at least one Event Subtype. The type of Event can be found under the ‘Event Type’ category in the list of events as well as in the JSON of a particular Event. A description of the Event Type can be found under the ‘Message’ category in the Events list. The filter bar can be used to quickly surface specific Event Types; admins can filter by Event Type.

Event Types can be found under Home > Events in the Command Center. A comprehensive list of Event Types and their definitions can be found below.

Event Types

CSE Events are designed to help audit end users’ device activity.

The following Event types exist:

• Registration
• Identity
• Access
• TrustScoring
• Audit
• AdminLogin
• Threat
• Compliance
• Malware
• SaaSSecurity
• NetagentRestart
• ITPStatus

Registration

Registration events are generated when an end user registers or unregisters a device using the desktop app or mobile app. The subtype is always ‘Device’.

Identity

Identity events are generated for end user authentication attempts through an IdP and for successful authentication. The subtype is always ‘UserPrincipal’.

Authentication consists of four steps:

1. Device certificate validation
2. Device compliance check with Mobile Device Manager
3. User authentication through the Single Sign-On Identity Provider, policy/TrustScore checks
4. Issuance of a CSE ID token or SAML assertion. (Reported as either an Identity Grant (issued token/assertion) or an Identity Deny (no token/assertion issued).)

An incorrect password entered at the Identity Provider is recorded by the Identity Provider, not CSE.

Access

Access events are generated by Access Tiers and HostAgents.

Each Access event is for a single incoming client connection, or for a single HTTP request over an incoming client connection. The Access event indicates whether the given connection or request was authorized or unauthorized, according to the Admin-defined security policies in the Command Center.

AccessTiers and HostAgents optionally rate limit their generation of Access events. Rate limiting can be enabled, disabled, or tuned for an AccessTier or HostAgent by adjusting its configuration parameter settings. For long-lived TCP connections, a periodic access event will be generated every 10 minutes, subject to rate limiting constraints.

These periodic events have a message field value that starts with the word PERIODIC and reports the start time of the connection as since TIME.

For Service Tunnel disconnections, the result field gives the cause, such as a user initiated disconnect, the end of the app session, or a disconnect to start a new tunnel.

TrustScoring

A TrustScoring event is generated when the Trust Level for a device changes. The subtype is always ‘Device’.

The Trust Level can change when:

• A change in the Trust Level features that are reported for a device result in a new calculated value (Action=TrustScoreCalculate)
• An external override has been applied to the device (Action=TrustScoreOverride), or
• The Trust Level for the device has expired (Action=TrustScoreExpired)

A single TrustScoreCalculate event lists every trust factor that passed and every trust factor that failed, with a description and remediation for each failure. See TrustScore.

Audit

Audit events are generated by a Service that is configured to log commands run by its users.

AdminLogin

An AdminLogin event is generated when an admin attempts to log into a CSE org (includes failed and successful login attempts). The subtype is ‘Local’ for a local admin account and ‘SAML’ for single sign-on.

Threat

A Threat event is generated when an Internet Threat Protection (ITP) policy blocks access through one of its threat-oriented rules. This includes the out-of-the-box threat protections enabled when ITP is turned on and Risk-based URL Filtering blocks.

Compliance

A Compliance event is generated when an Internet Threat Protection (ITP) policy blocks access through one of its compliance-oriented rules. This includes Category Filtering, Application Filtering, explicit Domain and URL blocks, and Geo-Blocking.

Malware

A Malware event is generated when Malware Download Protection (File Analysis) sends a file download for inspection, or blocks a file download because the file was identified as malicious.

SaaSSecurity

A SaaSSecurity event is generated when a prompt submission to an AI application (such as ChatGPT, Claude, or Gemini) is blocked because the signed-in account is not an approved account, or because no signed-in account was detected.

Threat, Compliance, Malware, and SaaSSecurity events describe the request and the decision in the URL Filtering fields.

NetagentRestart

A NetagentRestart event is generated when a netagent restarts.

ITPStatus

An ITPStatus event is generated when ITP is enabled or disabled on a device, or when a device tries to disable ITP with an invalid disable code.

Event JSON

An Event is a JSON object. The object has a set of common fields which are present in all event types. In addition, an Event can contain additional fields that describe a Subject and Object of an access.

Common Fields

Every Event contains the following fields.

In addition to these fields, Events may include a Subject and an Object.

Subject

A Subject represents an entity that is requesting access to a resource.

There are two types of subject:

• User Principals – Represents a human end user on a device.
• Workload Principals – Represents an automated process, such as a Docker container running on a virtual machine.

User Principal

A User Principal represents a human end user on a device and has three parts:

• user
• device
• client

User

Device

Client

Geo Location Data Example:

"geo_location": {
    "city": "Council Bluffs",
    "region": "Iowa",
    "country": "United States",
    "continent": "North America",
    "latitude": 41.2591,
    "longitude": -95.8517
}

Note: Location data is recorded in end user logs by default. See Event Geolocation.

Workload Principal

A Workload Principal represents an automated process that issues requests to a service. For example, a Workload Principal can represent a Docker Container running on a virtual machine along with the CSE HostAgent.

Alternatively, a Workload Principal can represent a group of non-Dockerized processes that are running on the same virtual machine. CSE HostAgent groups processes together that have the same name and treats them as a single logical “Process Container” with a name, ID, etc.

Processes with different names can additionally be grouped as a single “Application”.

Roles

Each Subject can have zero, one, or multiple CSE Roles.

TrustScore

Each Subject can have a TrustScore.

Trust Factor Names

The names in passed_factors and failed_factors are display names. The name in failed_trust_factor_details is often an internal name that differs from the display name. The CSE App Version factor is reported under the name Banyan App Version.

Note: Custom checks (File Check, Registry Check, and Property List Check) are reported under the name the admin gave the check, with no description.

Object

An Object represents a resource that a Subject is trying to access. An Object is described by Service, Policy, Channel, and Link.

Channel and Link are included only in Access Events.

Service

Service represents the CSE Service that the Subject is trying to access.

Policy

Policy represents the CSE Policy that is attached to the CSE Service that the connection or request is trying to access.

Channel

Channel describes a request that is transmitted from the Subject to the Object.

Link

Link is included in Access events and describes a network traffic flow (set of TCP connections) between a network source (client that starts the TCP connections) and a network destination (server that accepts the TCP connections).

In most scenarios it is not possible for the AccessTier or HostAgent to determine values for all of these fields, in which case the unknown field values are left empty.

URL Filtering

URL Filtering is included in Threat, Compliance, Malware, and SaaSSecurity events and describes the request and the decision made by Internet Threat Protection. These fields record the decision for every ITP rule, not only URL Filtering rules.