Stax Events - Event Schemas

Article Tags

On This Page

Stax Events schema: Security Events (v1.0.0)Security: UserAuthenticationEvent Security: APITokenAuthenticationEvent See also

Stax Events follow a defined schema which allows for event content to be predictable and consistent.

Stax Events schema: Security Events (v1.0.0)

Security: UserAuthenticationEvent

{
  "version": "0",
  "id": "8309d283-775a-29bc-9b9d-f6589ecc3541",
  "detail-type": "Security: UserAuthenticationEvent",
  "source": "aws.partner/stax.io/123456789012/default",
  "account": "123456789012",
  "time": "2019-08-24T14:15:22Z",
  "region": "string",
  "resources": [],
  "detail": {
    "meta": {
      "customer": {
        "id": "string",
        "name": "string"
      },
      "organization": {
        "id": "string",
        "name": "string",
        "alias": "string"
      },
      "user": {
        "id": "string",
        "username": "string"
      },
      "aws": {
        "accountId": "string",
        "accountName": "string",
        "region": "string"
      }
    },
    "staxEventVersion": "string",
    "staxEventID": "string",
    "staxEventTime": "2019-08-24T14:15:22Z",
    "staxEventSource": "string",
    "staxEventType": "Security",
    "staxEventName": "UserAuthenticationEvent",
    "userID": "string",
    "username": "string",
    "email": "user@example.com",
    "role": "string",
    "status": "string",
    "firstName": "string",
    "lastName": "string",
    "message": "string",
    "authMethod": "Login"
  }
}

Properties

allOf

Name	Type	Required	Restrictions	Description
» meta	object	true	none	none
»» customer	object	true	none	Customer attributes
»»» id	string	true	none	Stax customer ID
»»» name	string	false	none	Stax customer Name
»» organization	object	true	none	Organization attributes
»»» id	string	true	none	Stax Organization ID
»»» name	string	false	none	Stax organization Name
»»» alias	string	false	none	Stax organization Alias
»» user	object	false	none	user attributes
»»» id	string	true	none	Stax User ID
»»» username	string	false	none	Stax username
»» aws	object	false	none	aws attributes
»»» accountId	string	true	none	AWS account ID of account where event was triggered
»»» accountName	string	false	none	AWS account name of account where event was triggered
»»» region	string	false	none	AWS region of account where event was triggered
» staxEventVersion	string	true	none	Stax event version
» staxEventID	string	true	none	Unique event ID
» staxEventTime	string(date-time)	true	none	The timestamp of the event. Should be set by the publisher of the event - not the transport timestamp
» staxEventSource	string	true	none	Stax component name that publishes the event. e.g., stax.networking, stax.auth
» staxEventType	string	true	none	High level event type, typically mirrors Stax high-level feature name
» staxEventName	string	true	none	Specific name of event; e.g., UserAuthenticationEvent, AccountCreated, CISNonCompliantRuleEvent

and

Name	Type	Required	Restrictions	Description
» userID	string	true	none	none
» username	string	true	none	none
» email	string(email)	true	none	none
» role	string	true	none	none
» status	string	false	none	none
» firstName	string	false	none	none
» lastName	string	false	none	none
» message	string	false	none	none
» authMethod	string	true	none	none

Enumerated Values

Property	Value
staxEventType	AccountManagement
staxEventType	Cost
staxEventType	Compliance
staxEventType	Networking
staxEventType	Security
staxEventType	Workload
staxEventName	UserAuthenticationEvent
staxEventName	APITokenAuthenticationEvent
authMethod	Login
authMethod	RefreshToken

Security: APITokenAuthenticationEvent

{
  "version": "0",
  "id": "8309d283-775a-29bc-9b9d-f6589ecc3541",
  "detail-type": "Security: APITokenAuthenticationEvent",
  "source": "aws.partner/stax.io/123456789012/default",
  "account": "123456789012",
  "time": "2019-08-24T14:15:22Z",
  "region": "string",
  "resources": [],
  "detail": {
    "meta": {
      "customer": {
        "id": "string",
        "name": "string"
      },
      "organization": {
        "id": "string",
        "name": "string",
        "alias": "string"
      },
      "user": {
        "id": "string",
        "username": "string"
      },
      "aws": {
        "accountId": "string",
        "accountName": "string",
        "region": "string"
      }
    },
    "staxEventVersion": "string",
    "staxEventID": "string",
    "staxEventTime": "2019-08-24T14:15:22Z",
    "staxEventSource": "string",
    "staxEventType": "Security",
    "staxEventName": "APITokenAuthenticationEvent",
    "userID": "string",
    "role": "string",
    "status": "string",
    "name": "string",
    "message": "string",
    "authMethod": "Login"
  }
}

Properties

allOf

Name	Type	Required	Restrictions	Description
anonymous	object	false	none	none
» meta	object	true	none	none
»» customer	object	true	none	Customer attributes
»»» id	string	true	none	Stax customer ID
»»» name	string	false	none	Stax customer Name
»» organization	object	true	none	Organization attributes
»»» id	string	true	none	Stax Organization ID
»»» name	string	false	none	Stax organization Name
»»» alias	string	false	none	Stax organization Alias
»» user	object	false	none	user attributes
»»» id	string	true	none	Stax User ID
»»» username	string	false	none	Stax username
»» aws	object	false	none	aws attributes
»»» accountId	string	true	none	AWS account ID of account where event was triggered
»»» accountName	string	false	none	AWS account name of account where event was triggered
»»» region	string	false	none	AWS region of account where event was triggered
» staxEventVersion	string	true	none	Stax event version
» staxEventID	string	true	none	Unique event ID
» staxEventTime	string(date-time)	true	none	The timestamp of the event. Should be set by the publisher of the event - not the transport timestamp
» staxEventSource	string	true	none	Stax component name that publishes the event. e.g., stax.networking, stax.auth
» staxEventType	string	true	none	High level event type, typically mirrors Stax high-level feature name
» staxEventName	string	true	none	Specific name of event; e.g., UserAuthenticationEvent, AccountCreated, CISNonCompliantRuleEvent

and

Name	Type	Required	Restrictions	Description
» userID	string	true	none	none
» role	string	true	none	none
» status	string	false	none	none
» name	string	true	none	none
» message	string	false	none	none
» authMethod	string	true	none	none

Enumerated Values

Property	Value
staxEventType	AccountManagement
staxEventType	Cost
staxEventType	Compliance
staxEventType	Networking
staxEventType	Security
staxEventType	Workload
staxEventName	UserAuthenticationEvent
staxEventName	APITokenAuthenticationEvent
authMethod	Login
authMethod	RefreshToken