Loading table information…

Structured examples

Contribute a synthetic example using PowerShell or an export from the hunting portal. Contributions are reviewed before publication.

Submit an example for RawEventData

These examples use synthetic values and cover only some possible event variants. Use them as a reference, never as ground truth or a complete schema. Fields can vary between events; a field shown here is not necessarily required.

Available payload examples

Application	Action	Available payload examples
Microsoft OneDrive for Business	AnonymousLinkCreated	1
Amazon Web Services	Assume role with web identity	1
Microsoft SharePoint Online	FileDownloaded	1
Amazon Web Services	Get policy	1
Amazon Web Services	Get role	1
Amazon Web Services	Get service last accessed details	1
Amazon Web Services	GetBucketLocation	1
Amazon Web Services	List attached role policies	2
Amazon Web Services	List entities for policy	1
Amazon Web Services	List role policies	2
Amazon Web Services	ListApplications	3
Amazon Web Services	ListCertificates	2
Amazon Web Services	ListClusters	1
Amazon Web Services	ListDetectors	2
Amazon Web Services	ListDomains	1
Amazon Web Services	ListFunctions20150331	1
Amazon Web Services	ListKeys	1
Amazon Web Services	ListMalwareProtectionPlans	2
Microsoft Exchange Online	New-InboxRule	1
Office 365	UserLoggedIn	1

Application Action

`RawEventData`

Application: Amazon Web Services · Action: ListApplications

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_7",
    "clientProvidedHostHeader": "VALUE_8",
    "tlsVersion": "VALUE_9"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_10",
    "accountId": "1",
    "arn": "VALUE_11",
    "principalId": "VALUE_12",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_13",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_14",
        "principalId": "VALUE_15",
        "type": "VALUE_16",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_17"
      }
    },
    "type": "VALUE_18"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.clientProvidedHostHeader`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: List attached role policies

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "requestParameters": {
    "maxItems": 1,
    "roleName": "VALUE_8"
  },
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_9",
    "clientProvidedHostHeader": "VALUE_5",
    "tlsVersion": "VALUE_10"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_11",
    "accountId": "1",
    "arn": "VALUE_12",
    "principalId": "VALUE_13",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_14",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_15",
        "principalId": "VALUE_16",
        "type": "VALUE_17",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_18"
      }
    },
    "type": "VALUE_19"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.requestParameters`	object
`$.requestParameters.maxItems`	integer
`$.requestParameters.roleName`	string
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.clientProvidedHostHeader`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: List entities for policy

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "requestParameters": {
    "maxItems": 1,
    "policyArn": "VALUE_8"
  },
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_9",
    "clientProvidedHostHeader": "VALUE_5",
    "tlsVersion": "VALUE_10"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_11",
    "accountId": "1",
    "arn": "VALUE_12",
    "principalId": "VALUE_13",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_14",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_15",
        "principalId": "VALUE_16",
        "type": "VALUE_17",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_18"
      }
    },
    "type": "VALUE_19"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.requestParameters`	object
`$.requestParameters.maxItems`	integer
`$.requestParameters.policyArn`	string
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.clientProvidedHostHeader`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: ListDetectors

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_7",
    "tlsVersion": "VALUE_8"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_9",
    "accountId": "1",
    "arn": "VALUE_10",
    "principalId": "VALUE_11",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_12",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_13",
        "principalId": "VALUE_14",
        "type": "VALUE_15",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_16"
      }
    },
    "type": "VALUE_17"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: List role policies

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "requestParameters": {
    "roleName": "VALUE_7"
  },
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_8",
    "clientProvidedHostHeader": "VALUE_5",
    "tlsVersion": "VALUE_9"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_10",
    "accountId": "1",
    "arn": "VALUE_11",
    "principalId": "VALUE_12",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_13",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_14",
        "principalId": "VALUE_15",
        "type": "VALUE_16",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_17"
      }
    },
    "type": "VALUE_18"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.requestParameters`	object
`$.requestParameters.roleName`	string
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.clientProvidedHostHeader`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: ListFunctions20150331

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "requestParameters": {
    "maxItems": 1
  },
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_8",
    "clientProvidedHostHeader": "VALUE_9",
    "tlsVersion": "VALUE_10"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_11",
    "accountId": "1",
    "arn": "VALUE_12",
    "principalId": "VALUE_13",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_14",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_15",
        "principalId": "VALUE_16",
        "type": "VALUE_17",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_18"
      }
    },
    "type": "VALUE_19"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.requestParameters`	object
`$.requestParameters.maxItems`	integer
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.clientProvidedHostHeader`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Microsoft SharePoint Online · Action: FileDownloaded

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "ClientIP": "192.0.2.1",
  "CreationTime": "2026-01-01T00:00:00Z",
  "ObjectId": "https://example.invalid/SAMPLE_1",
  "Operation": "FileDownloaded",
  "SiteUrl": "https://example.invalid/SAMPLE_2",
  "SourceFileName": "SAMPLEFILE_1.txt",
  "UserId": "USERNAME_1@example.invalid"
}

Payload fields and types

Path	Type
`$`	object
`$.ClientIP`	string
`$.CreationTime`	string
`$.ObjectId`	string
`$.Operation`	string
`$.SiteUrl`	string
`$.SourceFileName`	string
`$.UserId`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Microsoft OneDrive for Business · Action: AnonymousLinkCreated

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "CreationTime": "2026-01-01T00:00:00Z",
  "ObjectId": "https://example.invalid/SAMPLE_1",
  "Operation": "AnonymousLinkCreated",
  "SharingType": "VALUE_1",
  "SiteUrl": "https://example.invalid/SAMPLE_2",
  "SourceFileName": "SAMPLEFILE_1.txt",
  "TargetUserOrGroupType": "USERNAME_1",
  "UniqueSharingId": "00000000-0000-4000-8000-000000000001",
  "UserId": "USERNAME_1@example.invalid",
  "Workload": "OneDrive"
}

Payload fields and types

Path	Type
`$`	object
`$.CreationTime`	string
`$.ObjectId`	string
`$.Operation`	string
`$.SharingType`	string
`$.SiteUrl`	string
`$.SourceFileName`	string
`$.TargetUserOrGroupType`	string
`$.UniqueSharingId`	string
`$.UserId`	string
`$.Workload`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: GetBucketLocation

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "additionalEventData": {
    "AuthenticationMethod": "VALUE_2",
    "CipherSuite": "VALUE_3",
    "SignatureVersion": "VALUE_4",
    "bytesTransferredIn": 1,
    "bytesTransferredOut": 1,
    "endTime": 1,
    "httpStatusCode": 1,
    "startTime": 1,
    "x-amz-id-2": "VALUE_6"
  },
  "awsRegion": "VALUE_7",
  "eventCategory": "VALUE_8",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_9",
  "eventSource": "VALUE_10",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_11",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "VALUE_12",
  "requestParameters": {
    "Host": "VALUE_13",
    "bucketName": "VALUE_14",
    "location": "VALUE_15"
  },
  "resources": [
    "{\"ARN\":\"VALUE_16\",\"accountId\":\"1\",\"type\":\"VALUE_17\"}"
  ],
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_3",
    "clientProvidedHostHeader": "VALUE_13",
    "tlsVersion": "VALUE_19"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_20",
    "accountId": "1",
    "arn": "VALUE_21",
    "principalId": "VALUE_22",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_23",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_24",
        "principalId": "VALUE_25",
        "type": "VALUE_26",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_27"
      }
    },
    "type": "VALUE_28"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.additionalEventData`	object
`$.additionalEventData.AuthenticationMethod`	string
`$.additionalEventData.CipherSuite`	string
`$.additionalEventData.SignatureVersion`	string
`$.additionalEventData.bytesTransferredIn`	integer
`$.additionalEventData.bytesTransferredOut`	integer
`$.additionalEventData.endTime`	integer
`$.additionalEventData.httpStatusCode`	integer
`$.additionalEventData.startTime`	integer
`$.additionalEventData["x-amz-id-2"]`	string
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.requestParameters`	object
`$.requestParameters.Host`	string
`$.requestParameters.bucketName`	string
`$.requestParameters.location`	string
`$.resources`	array
`$.resources[]`	encoded-json
`$.resources[]`	string
`$.resources[]::<json>`	object
`$.resources[]::<json>.ARN`	string
`$.resources[]::<json>.accountId`	encoded-json
`$.resources[]::<json>.accountId`	string
`$.resources[]::<json>.accountId::<json>`	integer
`$.resources[]::<json>.type`	string
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.clientProvidedHostHeader`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: ListCertificates

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "requestParameters": {
    "includes": {
      "hasDnsFqdn": false,
      "keyTypes": [
        "VALUE_7"
      ]
    },
    "maxItems": 1
  },
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_16",
    "clientProvidedHostHeader": "VALUE_17",
    "keyExchange": "VALUE_18",
    "tlsVersion": "VALUE_19"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_20",
    "accountId": "1",
    "arn": "VALUE_21",
    "principalId": "VALUE_22",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_23",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_24",
        "principalId": "VALUE_25",
        "type": "VALUE_26",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_27"
      }
    },
    "type": "VALUE_28"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.requestParameters`	object
`$.requestParameters.includes`	object
`$.requestParameters.includes.hasDnsFqdn`	boolean
`$.requestParameters.includes.keyTypes`	array
`$.requestParameters.includes.keyTypes[]`	string
`$.requestParameters.maxItems`	integer
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.clientProvidedHostHeader`	string
`$.tlsDetails.keyExchange`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: ListApplications

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_7",
    "tlsVersion": "VALUE_8"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_9",
    "accountId": "1",
    "arn": "VALUE_10",
    "principalId": "VALUE_11",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_12",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_13",
        "principalId": "VALUE_14",
        "type": "VALUE_15",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_16"
      }
    },
    "type": "VALUE_17"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Office 365 · Action: UserLoggedIn

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "Actor": [
    {
      "ID": "USERNAME_1@example.invalid",
      "Type": 1
    }
  ],
  "ClientIP": "192.0.2.1",
  "CreationTime": "2026-01-01T00:00:00Z",
  "ExtendedProperties": [
    {
      "Name": "UserAgent",
      "Value": "VALUE_1"
    }
  ],
  "Operation": "UserLoggedIn",
  "ResultStatus": "Succeeded",
  "UserId": "USERNAME_1@example.invalid",
  "Workload": "AzureActiveDirectory"
}

Payload fields and types

Path	Type
`$`	object
`$.Actor`	array
`$.Actor[]`	object
`$.Actor[].ID`	string
`$.Actor[].Type`	integer
`$.ClientIP`	string
`$.CreationTime`	string
`$.ExtendedProperties`	array
`$.ExtendedProperties[]`	object
`$.ExtendedProperties[].Name`	string
`$.ExtendedProperties[].Value`	string
`$.ExtendedProperties[][Name=UserAgent]`	named-property
`$.Operation`	string
`$.ResultStatus`	string
`$.UserId`	string
`$.Workload`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: Get role

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "requestParameters": {
    "roleName": "VALUE_7"
  },
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_8",
    "clientProvidedHostHeader": "VALUE_5",
    "tlsVersion": "VALUE_9"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_10",
    "accountId": "1",
    "arn": "VALUE_11",
    "principalId": "VALUE_12",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_13",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_14",
        "principalId": "VALUE_15",
        "type": "VALUE_16",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_17"
      }
    },
    "type": "VALUE_18"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.requestParameters`	object
`$.requestParameters.roleName`	string
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.clientProvidedHostHeader`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: Assume role with web identity

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "additionalEventData": {
    "ExtendedRequestId": "VALUE_2",
    "RequestDetails": {
      "awsServingRegion": "VALUE_3",
      "endpointType": "VALUE_4"
    },
    "identityProviderConnectionVerificationMethod": "VALUE_5"
  },
  "awsRegion": "VALUE_3",
  "eventCategory": "VALUE_6",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_7",
  "eventSource": "VALUE_8",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_9",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "requestParameters": {
    "roleArn": "VALUE_10",
    "roleSessionName": "VALUE_11"
  },
  "resources": [
    "{\"ARN\":\"VALUE_10\",\"accountId\":\"1\",\"type\":\"VALUE_12\"}"
  ],
  "responseElements": {
    "assumedRoleUser": {
      "arn": "VALUE_14",
      "assumedRoleId": "VALUE_15"
    },
    "audience": "VALUE_16",
    "credentials": {
      "accessKeyId": "VALUE_17",
      "expiration": "VALUE_18",
      "sessionToken": "VALUE_19"
    },
    "packedPolicySize": 1,
    "provider": "VALUE_21",
    "sessionTokenSize": 1,
    "sessionTokenUtilization": 1,
    "subjectFromWebIdentityToken": "00000000-0000-4000-8000-000000000003"
  },
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_22",
    "clientProvidedHostHeader": "VALUE_23",
    "keyExchange": "VALUE_24",
    "tlsVersion": "VALUE_25"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "identityProvider": "VALUE_21",
    "principalId": "VALUE_26",
    "type": "VALUE_27",
    "userName": "00000000-0000-4000-8000-000000000003"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.additionalEventData`	object
`$.additionalEventData.ExtendedRequestId`	string
`$.additionalEventData.RequestDetails`	object
`$.additionalEventData.RequestDetails.awsServingRegion`	string
`$.additionalEventData.RequestDetails.endpointType`	string
`$.additionalEventData.identityProviderConnectionVerificationMethod`	string
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.requestParameters`	object
`$.requestParameters.roleArn`	string
`$.requestParameters.roleSessionName`	string
`$.resources`	array
`$.resources[]`	encoded-json
`$.resources[]`	string
`$.resources[]::<json>`	object
`$.resources[]::<json>.ARN`	string
`$.resources[]::<json>.accountId`	encoded-json
`$.resources[]::<json>.accountId`	string
`$.resources[]::<json>.accountId::<json>`	integer
`$.resources[]::<json>.type`	string
`$.responseElements`	object
`$.responseElements.assumedRoleUser`	object
`$.responseElements.assumedRoleUser.arn`	string
`$.responseElements.assumedRoleUser.assumedRoleId`	string
`$.responseElements.audience`	string
`$.responseElements.credentials`	object
`$.responseElements.credentials.accessKeyId`	string
`$.responseElements.credentials.expiration`	string
`$.responseElements.credentials.sessionToken`	string
`$.responseElements.packedPolicySize`	integer
`$.responseElements.provider`	string
`$.responseElements.sessionTokenSize`	integer
`$.responseElements.sessionTokenUtilization`	integer
`$.responseElements.subjectFromWebIdentityToken`	string
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.clientProvidedHostHeader`	string
`$.tlsDetails.keyExchange`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.identityProvider`	string
`$.userIdentity.principalId`	string
`$.userIdentity.type`	string
`$.userIdentity.userName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: Get policy

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "requestParameters": {
    "policyArn": "VALUE_7"
  },
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_8",
    "clientProvidedHostHeader": "VALUE_5",
    "tlsVersion": "VALUE_9"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_10",
    "accountId": "1",
    "arn": "VALUE_11",
    "principalId": "VALUE_12",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_13",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_14",
        "principalId": "VALUE_15",
        "type": "VALUE_16",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_17"
      }
    },
    "type": "VALUE_18"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.requestParameters`	object
`$.requestParameters.policyArn`	string
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.clientProvidedHostHeader`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Microsoft Exchange Online · Action: New-InboxRule

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "CreationTime": "2026-01-01T00:00:00Z",
  "ObjectId": "VALUE_1",
  "Operation": "New-InboxRule",
  "Parameters": [
    {
      "Name": "ForwardTo",
      "Value": "USERNAME_1@example.invalid"
    },
    {
      "Name": "Identity",
      "Value": "VALUE_1"
    }
  ],
  "UserId": "USERNAME_2@example.invalid",
  "Workload": "Exchange"
}

Payload fields and types

Path	Type
`$`	object
`$.CreationTime`	string
`$.ObjectId`	string
`$.Operation`	string
`$.Parameters`	array
`$.Parameters[]`	object
`$.Parameters[].Name`	string
`$.Parameters[].Value`	string
`$.Parameters[][Name=ForwardTo]`	named-property
`$.Parameters[][Name=Identity]`	named-property
`$.UserId`	string
`$.Workload`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: List role policies

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "requestParameters": {
    "maxItems": 1,
    "roleName": "VALUE_8"
  },
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_9",
    "clientProvidedHostHeader": "VALUE_5",
    "tlsVersion": "VALUE_10"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_11",
    "accountId": "1",
    "arn": "VALUE_12",
    "principalId": "VALUE_13",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_14",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_15",
        "principalId": "VALUE_16",
        "type": "VALUE_17",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_18"
      }
    },
    "type": "VALUE_19"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.requestParameters`	object
`$.requestParameters.maxItems`	integer
`$.requestParameters.roleName`	string
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.clientProvidedHostHeader`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: ListDomains

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_7",
    "clientProvidedHostHeader": "VALUE_8",
    "tlsVersion": "VALUE_9"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_10",
    "accountId": "1",
    "arn": "VALUE_11",
    "principalId": "VALUE_12",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_13",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_14",
        "principalId": "VALUE_15",
        "type": "VALUE_16",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_17"
      }
    },
    "type": "VALUE_18"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.clientProvidedHostHeader`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: ListMalwareProtectionPlans

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "sourceIPAddress": "192.0.2.1",
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_7",
    "accountId": "1",
    "arn": "VALUE_8",
    "principalId": "VALUE_9",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_10",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_11",
        "principalId": "VALUE_12",
        "type": "VALUE_13",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_14"
      }
    },
    "type": "VALUE_15"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.sourceIPAddress`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: ListApplications

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "sourceIPAddress": "192.0.2.1",
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_7",
    "accountId": "1",
    "arn": "VALUE_8",
    "principalId": "VALUE_9",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_10",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_11",
        "principalId": "VALUE_12",
        "type": "VALUE_13",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_14"
      }
    },
    "type": "VALUE_15"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.sourceIPAddress`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: ListKeys

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "requestParameters": {
    "limit": 1
  },
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_8",
    "clientProvidedHostHeader": "VALUE_9",
    "keyExchange": "VALUE_10",
    "tlsVersion": "VALUE_11"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_12",
    "accountId": "1",
    "arn": "VALUE_13",
    "principalId": "VALUE_14",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_15",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_16",
        "principalId": "VALUE_17",
        "type": "VALUE_18",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_19"
      }
    },
    "type": "VALUE_20"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.requestParameters`	object
`$.requestParameters.limit`	integer
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.clientProvidedHostHeader`	string
`$.tlsDetails.keyExchange`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: ListMalwareProtectionPlans

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_7",
    "tlsVersion": "VALUE_8"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_9",
    "accountId": "1",
    "arn": "VALUE_10",
    "principalId": "VALUE_11",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_12",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_13",
        "principalId": "VALUE_14",
        "type": "VALUE_15",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_16"
      }
    },
    "type": "VALUE_17"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: ListDetectors

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "sourceIPAddress": "192.0.2.1",
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_7",
    "accountId": "1",
    "arn": "VALUE_8",
    "principalId": "VALUE_9",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_10",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_11",
        "principalId": "VALUE_12",
        "type": "VALUE_13",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_14"
      }
    },
    "type": "VALUE_15"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.sourceIPAddress`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: ListCertificates

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_7",
    "clientProvidedHostHeader": "VALUE_8",
    "keyExchange": "VALUE_9",
    "tlsVersion": "VALUE_10"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_11",
    "accountId": "1",
    "arn": "VALUE_12",
    "principalId": "VALUE_13",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_14",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_15",
        "principalId": "VALUE_16",
        "type": "VALUE_17",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_18"
      }
    },
    "type": "VALUE_19"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.clientProvidedHostHeader`	string
`$.tlsDetails.keyExchange`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: ListClusters

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "requestParameters": {
    "maxResults": "1"
  },
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_7",
    "tlsVersion": "VALUE_8"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_9",
    "accountId": "1",
    "arn": "VALUE_10",
    "principalId": "VALUE_11",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_12",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_13",
        "principalId": "VALUE_14",
        "type": "VALUE_15",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_16"
      }
    },
    "type": "VALUE_17"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.requestParameters`	object
`$.requestParameters.maxResults`	encoded-json
`$.requestParameters.maxResults`	string
`$.requestParameters.maxResults::<json>`	integer
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: List attached role policies

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "requestParameters": {
    "roleName": "VALUE_7"
  },
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_8",
    "clientProvidedHostHeader": "VALUE_5",
    "tlsVersion": "VALUE_9"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_10",
    "accountId": "1",
    "arn": "VALUE_11",
    "principalId": "VALUE_12",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_13",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_14",
        "principalId": "VALUE_15",
        "type": "VALUE_16",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_17"
      }
    },
    "type": "VALUE_18"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.requestParameters`	object
`$.requestParameters.roleName`	string
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.clientProvidedHostHeader`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Application: Amazon Web Services · Action: Get service last accessed details

All values in this example are synthetic. Format: JSON; column encoding: native-json.

{
  "awsRegion": "VALUE_2",
  "eventCategory": "VALUE_3",
  "eventID": "00000000-0000-4000-8000-000000000001",
  "eventName": "VALUE_4",
  "eventSource": "VALUE_5",
  "eventTime": "2026-01-01T00:00:00Z",
  "eventType": "VALUE_6",
  "eventVersion": "1.5",
  "managementEvent": false,
  "readOnly": false,
  "recipientAccountId": "1",
  "requestID": "00000000-0000-4000-8000-000000000002",
  "requestParameters": {
    "jobId": "00000000-0000-4000-8000-000000000003",
    "maxItems": 1
  },
  "sourceIPAddress": "192.0.2.1",
  "tlsDetails": {
    "cipherSuite": "VALUE_8",
    "clientProvidedHostHeader": "VALUE_5",
    "tlsVersion": "VALUE_9"
  },
  "userAgent": "USERNAME_1",
  "userIdentity": {
    "accessKeyId": "VALUE_10",
    "accountId": "1",
    "arn": "VALUE_11",
    "principalId": "VALUE_12",
    "sessionContext": {
      "attributes": {
        "creationDate": "VALUE_13",
        "mfaAuthenticated": "false"
      },
      "sessionIssuer": {
        "accountId": "1",
        "arn": "VALUE_14",
        "principalId": "VALUE_15",
        "type": "VALUE_16",
        "userName": "USERNAME_2"
      },
      "webIdFederationData": {
        "attributes": {},
        "federatedProvider": "VALUE_17"
      }
    },
    "type": "VALUE_18"
  }
}

Payload fields and types

Path	Type
`$`	object
`$.awsRegion`	string
`$.eventCategory`	string
`$.eventID`	string
`$.eventName`	string
`$.eventSource`	string
`$.eventTime`	string
`$.eventType`	string
`$.eventVersion`	encoded-json
`$.eventVersion`	string
`$.eventVersion::<json>`	number
`$.managementEvent`	boolean
`$.readOnly`	boolean
`$.recipientAccountId`	encoded-json
`$.recipientAccountId`	string
`$.recipientAccountId::<json>`	integer
`$.requestID`	string
`$.requestParameters`	object
`$.requestParameters.jobId`	string
`$.requestParameters.maxItems`	integer
`$.sourceIPAddress`	string
`$.tlsDetails`	object
`$.tlsDetails.cipherSuite`	string
`$.tlsDetails.clientProvidedHostHeader`	string
`$.tlsDetails.tlsVersion`	string
`$.userAgent`	string
`$.userIdentity`	object
`$.userIdentity.accessKeyId`	string
`$.userIdentity.accountId`	encoded-json
`$.userIdentity.accountId`	string
`$.userIdentity.accountId::<json>`	integer
`$.userIdentity.arn`	string
`$.userIdentity.principalId`	string
`$.userIdentity.sessionContext`	object
`$.userIdentity.sessionContext.attributes`	object
`$.userIdentity.sessionContext.attributes.creationDate`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	encoded-json
`$.userIdentity.sessionContext.attributes.mfaAuthenticated`	string
`$.userIdentity.sessionContext.attributes.mfaAuthenticated::<json>`	boolean
`$.userIdentity.sessionContext.sessionIssuer`	object
`$.userIdentity.sessionContext.sessionIssuer.accountId`	encoded-json
`$.userIdentity.sessionContext.sessionIssuer.accountId`	string
`$.userIdentity.sessionContext.sessionIssuer.accountId::<json>`	integer
`$.userIdentity.sessionContext.sessionIssuer.arn`	string
`$.userIdentity.sessionContext.sessionIssuer.principalId`	string
`$.userIdentity.sessionContext.sessionIssuer.type`	string
`$.userIdentity.sessionContext.sessionIssuer.userName`	string
`$.userIdentity.sessionContext.webIdFederationData`	object
`$.userIdentity.sessionContext.webIdFederationData.attributes`	object
`$.userIdentity.sessionContext.webIdFederationData.federatedProvider`	string
`$.userIdentity.type`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

CloudAppEvents Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Itp	Regular		Events involving accounts and objects in Office 365 and other cloud apps and services	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
AccountDisplayName	Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user.	String
AccountId	An identifier for the account as found by Microsoft Cloud App Security. Could be Microsoft Entra ID, user principal name, or other identifiers.	String
AccountObjectId	Unique identifier for the account in Microsoft Entra ID	String
AccountType	Type of user account, indicating its general role and access levels, such as Regular, System, Admin, Application	String
ActionType	Type of activity that triggered the event	String
ActivityObjects	List of objects, such as files or folders, that were involved in the recorded activity	Object
ActivityType	Type of activity that triggered the event	String
AdditionalFields	Additional information about the entity or event	Object
AppInstanceId	Unique identifier for the instance of an application	Int32
Application	Application that performed the recorded action	String
ApplicationId	Unique identifier for the application	Int32
AuditSource	Cloud enviorment source of the cloud audit event. Cloud be Azure, AWS, GCP, AliCloud or other	String
City	City where the client IP address is geolocated	String
CountryCode	Two-letter code indicating the country where the client IP address is geolocated	String
DeviceType	Type of device based on purpose and functionality, such as network device, workstation, server, mobile, gaming console, or printer	String
IPAddress	IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts	String
IPCategory	Additional information about the IP address	String
IPTags	Customer-defined information applied to specific IP addresses and IP address ranges	Object
IsAdminOperation	Indicates whether the activity was performed by an administrator	Boolean
IsAnonymousProxy	Indicates whether the IP address belongs to a known anonymous proxy	Boolean
IsExternalUser	Indicates whether a user inside the network does not belong to the organization’s domain	Boolean
IsImpersonated	Indicates whether the activity was performed by one user on behalf of another (impersonated) user	Boolean
ISP	Internet service provider associated with the IP address	String
LastSeenForUser	Number of days since each statistical feature for the user was last seen	Object
OAuthAppId	A unique identifier that’s assigned to an application when it’s registered to Entra with OAuth 2.0.	String
ObjectId	Unique identifier of the object that the recorded action was applied to, in case of files it includes the extension	String
ObjectName	Name of the object that the recorded action was applied to	String
ObjectType	The type of object, such as a file or a folder, that the recorded action was applied to	String
OSPlatform	Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7	String
RawEventData	Full raw event information from the source application or service in JSON format	Object
ReportId	Unique identifier for the event	String
SessionData	Session identifiers (if provided by the audit source)	Object
SourceSystem		String
TenantId		String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
Type		String
UncommonForUser	List of features observed to be statistically uncommon for the user that performed the activity	Object
UserAgent	User agent information from the web browser or other client application	String
UserAgentTags	More information provided by Microsoft Cloud App Security in a tag in the user agent field. Can have any of the following values: Native client, Outdated browser, Outdated operating system, Robot	Object

Schema changes

Date	Action
2026-10-07	Column TenantId added
2026-10-07	Column Type added
2026-10-07	Column SourceSystem added
2026-10-07	Column TimeGenerated added
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column TimeGenerated removed
2026-01-02	Column _IsBillable removed
2026-01-02	Column _BilledSize removed
2026-01-02	Column SessionData added
2026-01-02	Column AuditSource added
2026-01-02	Column OAuthAppId added
2026-01-02	Column UncommonForUser added
2026-01-02	Column LastSeenForUser added
2024-10-18	Table added to tracking

CloudAppEvents Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Itp	Regular		Events involving accounts and objects in Office 365 and other cloud apps and services	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
AccountDisplayName	Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user.	String
AccountId	An identifier for the account as found by Microsoft Cloud App Security. Could be Microsoft Entra ID, user principal name, or other identifiers.	String
AccountObjectId	Unique identifier for the account in Microsoft Entra ID	String
AccountType	Type of user account, indicating its general role and access levels, such as Regular, System, Admin, Application	String
ActionType	Type of activity that triggered the event	String
ActivityObjects	List of objects, such as files or folders, that were involved in the recorded activity	Object
ActivityType	Type of activity that triggered the event	String
AdditionalFields	Additional information about the entity or event	Object
AppInstanceId	Unique identifier for the instance of an application	Int32
Application	Application that performed the recorded action	String
ApplicationId	Unique identifier for the application	Int32
AuditSource	Cloud enviorment source of the cloud audit event. Cloud be Azure, AWS, GCP, AliCloud or other	String
City	City where the client IP address is geolocated	String
CountryCode	Two-letter code indicating the country where the client IP address is geolocated	String
DeviceType	Type of device based on purpose and functionality, such as network device, workstation, server, mobile, gaming console, or printer	String
IPAddress	IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts	String
IPCategory	Additional information about the IP address	String
IPTags	Customer-defined information applied to specific IP addresses and IP address ranges	Object
IsAdminOperation	Indicates whether the activity was performed by an administrator	Boolean
IsAnonymousProxy	Indicates whether the IP address belongs to a known anonymous proxy	Boolean
IsExternalUser	Indicates whether a user inside the network does not belong to the organization’s domain	Boolean
IsImpersonated	Indicates whether the activity was performed by one user on behalf of another (impersonated) user	Boolean
ISP	Internet service provider associated with the IP address	String
LastSeenForUser	Number of days since each statistical feature for the user was last seen	Object
OAuthAppId	A unique identifier that’s assigned to an application when it’s registered to Entra with OAuth 2.0.	String
ObjectId	Unique identifier of the object that the recorded action was applied to, in case of files it includes the extension	String
ObjectName	Name of the object that the recorded action was applied to	String
ObjectType	The type of object, such as a file or a folder, that the recorded action was applied to	String
OSPlatform	Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7	String
RawEventData	Full raw event information from the source application or service in JSON format	Object
ReportId	Unique identifier for the event	String
SessionData	Session identifiers (if provided by the audit source)	Object
SourceSystem		String
TenantId		String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
Type		String
UncommonForUser	List of features observed to be statistically uncommon for the user that performed the activity	Object
UserAgent	User agent information from the web browser or other client application	String
UserAgentTags	More information provided by Microsoft Cloud App Security in a tag in the user agent field. Can have any of the following values: Native client, Outdated browser, Outdated operating system, Robot	Object

Schema changes

Date	Action
2026-10-07	Column TenantId added
2026-10-07	Column Type added
2026-10-07	Column SourceSystem added
2026-10-07	Column TimeGenerated added
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column TimeGenerated removed
2026-01-02	Column _IsBillable removed
2026-01-02	Column _BilledSize removed
2026-01-02	Column SessionData added
2026-01-02	Column AuditSource added
2026-01-02	Column OAuthAppId added
2026-01-02	Column UncommonForUser added
2026-01-02	Column LastSeenForUser added
2024-10-18	Table added to tracking