Stax Events - Event Schemas

Stax Events - Event Schemas

Article Tags
On This Page
Stax Events schema: Security Events (v1.0.0)Security: UserAuthenticationEventSecurity: APITokenAuthenticationEventSee also

Stax Events follow a defined schema which allows for event content to be predictable and consistent.

Stax Events schema: Security Events (v1.0.0)

Security: UserAuthenticationEvent

{
  "version": "0",
  "id": "8309d283-775a-29bc-9b9d-f6589ecc3541",
  "detail-type": "Security: UserAuthenticationEvent",
  "source": "aws.partner/stax.io/123456789012/default",
  "account": "123456789012",
  "time": "2019-08-24T14:15:22Z",
  "region": "string",
  "resources": [],
  "detail": {
    "meta": {
      "customer": {
        "id": "string",
        "name": "string"
      },
      "organization": {
        "id": "string",
        "name": "string",
        "alias": "string"
      },
      "user": {
        "id": "string",
        "username": "string"
      },
      "aws": {
        "accountId": "string",
        "accountName": "string",
        "region": "string"
      }
    },
    "staxEventVersion": "string",
    "staxEventID": "string",
    "staxEventTime": "2019-08-24T14:15:22Z",
    "staxEventSource": "string",
    "staxEventType": "Security",
    "staxEventName": "UserAuthenticationEvent",
    "userID": "string",
    "username": "string",
    "email": "user@example.com",
    "role": "string",
    "status": "string",
    "firstName": "string",
    "lastName": "string",
    "message": "string",
    "authMethod": "Login"
  }
}

Properties

allOf

NameTypeRequiredRestrictionsDescription
» metaobjecttruenonenone
»» customerobjecttruenoneCustomer attributes
»»» idstringtruenoneStax customer ID
»»» namestringfalsenoneStax customer Name
»» organizationobjecttruenoneOrganization attributes
»»» idstringtruenoneStax Organization ID
»»» namestringfalsenoneStax organization Name
»»» aliasstringfalsenoneStax organization Alias
»» userobjectfalsenoneuser attributes
»»» idstringtruenoneStax User ID
»»» usernamestringfalsenoneStax username
»» awsobjectfalsenoneaws attributes
»»» accountIdstringtruenoneAWS account ID of account where event was triggered
»»» accountNamestringfalsenoneAWS account name of account where event was triggered
»»» regionstringfalsenoneAWS region of account where event was triggered
» staxEventVersionstringtruenoneStax event version
» staxEventIDstringtruenoneUnique event ID
» staxEventTimestring(date-time)truenoneThe timestamp of the event. Should be set by the publisher of the event - not the transport timestamp
» staxEventSourcestringtruenoneStax component name that publishes the event. e.g., stax.networking, stax.auth
» staxEventTypestringtruenoneHigh level event type, typically mirrors Stax high-level feature name
» staxEventNamestringtruenoneSpecific name of event; e.g., UserAuthenticationEvent, AccountCreated, CISNonCompliantRuleEvent

and

NameTypeRequiredRestrictionsDescription
» userIDstringtruenonenone
» usernamestringtruenonenone
» emailstring(email)truenonenone
» rolestringtruenonenone
» statusstringfalsenonenone
» firstNamestringfalsenonenone
» lastNamestringfalsenonenone
» messagestringfalsenonenone
» authMethodstringtruenonenone

Enumerated Values

PropertyValue
staxEventTypeAccountManagement
staxEventTypeCost
staxEventTypeCompliance
staxEventTypeNetworking
staxEventTypeSecurity
staxEventTypeWorkload
staxEventNameUserAuthenticationEvent
staxEventNameAPITokenAuthenticationEvent
authMethodLogin
authMethodRefreshToken

Security: APITokenAuthenticationEvent

{
  "version": "0",
  "id": "8309d283-775a-29bc-9b9d-f6589ecc3541",
  "detail-type": "Security: APITokenAuthenticationEvent",
  "source": "aws.partner/stax.io/123456789012/default",
  "account": "123456789012",
  "time": "2019-08-24T14:15:22Z",
  "region": "string",
  "resources": [],
  "detail": {
    "meta": {
      "customer": {
        "id": "string",
        "name": "string"
      },
      "organization": {
        "id": "string",
        "name": "string",
        "alias": "string"
      },
      "user": {
        "id": "string",
        "username": "string"
      },
      "aws": {
        "accountId": "string",
        "accountName": "string",
        "region": "string"
      }
    },
    "staxEventVersion": "string",
    "staxEventID": "string",
    "staxEventTime": "2019-08-24T14:15:22Z",
    "staxEventSource": "string",
    "staxEventType": "Security",
    "staxEventName": "APITokenAuthenticationEvent",
    "userID": "string",
    "role": "string",
    "status": "string",
    "name": "string",
    "message": "string",
    "authMethod": "Login"
  }
}

Properties

allOf

NameTypeRequiredRestrictionsDescription
anonymousobjectfalsenonenone
» metaobjecttruenonenone
»» customerobjecttruenoneCustomer attributes
»»» idstringtruenoneStax customer ID
»»» namestringfalsenoneStax customer Name
»» organizationobjecttruenoneOrganization attributes
»»» idstringtruenoneStax Organization ID
»»» namestringfalsenoneStax organization Name
»»» aliasstringfalsenoneStax organization Alias
»» userobjectfalsenoneuser attributes
»»» idstringtruenoneStax User ID
»»» usernamestringfalsenoneStax username
»» awsobjectfalsenoneaws attributes
»»» accountIdstringtruenoneAWS account ID of account where event was triggered
»»» accountNamestringfalsenoneAWS account name of account where event was triggered
»»» regionstringfalsenoneAWS region of account where event was triggered
» staxEventVersionstringtruenoneStax event version
» staxEventIDstringtruenoneUnique event ID
» staxEventTimestring(date-time)truenoneThe timestamp of the event. Should be set by the publisher of the event - not the transport timestamp
» staxEventSourcestringtruenoneStax component name that publishes the event. e.g., stax.networking, stax.auth
» staxEventTypestringtruenoneHigh level event type, typically mirrors Stax high-level feature name
» staxEventNamestringtruenoneSpecific name of event; e.g., UserAuthenticationEvent, AccountCreated, CISNonCompliantRuleEvent

and

NameTypeRequiredRestrictionsDescription
» userIDstringtruenonenone
» rolestringtruenonenone
» statusstringfalsenonenone
» namestringtruenonenone
» messagestringfalsenonenone
» authMethodstringtruenonenone

Enumerated Values

PropertyValue
staxEventTypeAccountManagement
staxEventTypeCost
staxEventTypeCompliance
staxEventTypeNetworking
staxEventTypeSecurity
staxEventTypeWorkload
staxEventNameUserAuthenticationEvent
staxEventNameAPITokenAuthenticationEvent
authMethodLogin
authMethodRefreshToken

See also