Log Export Data Definitions - Cirrus Documentation

Common Data Elements

Each downloaded log file will include the following data elements:

Data Element	Description
`timestamp`	The date and time of the event in UTC.
`tenant`	The logical instance of the service - for example if there is a production and a UAT proxy, there will be two different tenants.
`orgdomain`	The organization's domain as configured in Cirrus Identity.
`orgurl`	The organization's orgURL as configured in Cirrus Identity – this will usually match what is registered with InCommon for InCommon members.
`orgid`	Future attribute.
`service`	The Cirrus Service being reported on - Event Types section.
`clientip`	The IP address of the browser agent accessing the service.
`correlationid`	An internal identifier generated by the Cirrus Identity logging infrastructure used to correlate transitions across services.
`logtype`	The Cirrus Type being reported on - See Event Types section
`logsubtype`	The Cirrus Subtype being reported on - See Event Types section
`logdata`	Appears when the report format is “raw”. Contains additional data elements specific to each event - see Log Data Elements section

Event Types

The following table is a current inventory of the logtype and logsubtype values you will find by service:

Service	Log Type	Log Sub-Type	Description
`bridge`	`authentication`	`request`	SAML authentication requests made through the Cirrus Bridge
`bridge`	`authentication`	`success`	Successful SAML authentications made through the Cirrus Bridge
`bridge`	`cas`	`request`	CAS authentication requests made through the Cirrus Bridge
`bridge`	`cas`	`login`	Successful CAS authentications made through the Cirrus Bridge using the ‘login’ method
`bridge`	`cas`	`validate`	Successful CAS ticket validations made through the Cirrus Bridge using the ‘validate’ method
`bridge`	`cas`	`serviceValidate`	Successful CAS ticket validations made through the Cirrus Bridge using the ‘serviceValidate’ method
`bridge`	`cas`	`samlValidate`	Successful CAS ticket validations made through the Cirrus Bridge using the ‘samlValidate’ method
`gateway`	`authentication`	`request`	SAML authentication requests made through the Cirrus Gateway
`gateway`	`authentication`	`success`	Successful SAML authentications made through the Cirrus Gateway
`idp`	`authentication`	`request`	SAML authentication requests made through the Cirrus OrgBrandedID
`idp`	`authentication`	`success`	Successful SAML authentications made through the Cirrus OrgBrandedID
`proxy`	`authentication`	`request`	SAML authentication requests made through the Cirrus Proxy
`proxy`	`authentication`	`success`	Successful SAML authentications made through the Cirrus Proxy
`proxy`	`cas`	`request`	CAS authentication requests made through the Cirrus Bridge
`proxy`	`cas`	`login`	Successful CAS authentications made through the Cirrus Bridge using the ‘login’ method
`proxy`	`cas`	`validate`	Successful CAS ticket validations made through the Cirrus Bridge using the ‘validate’ method
`proxy`	`cas`	`serviceValidate`	Successful CAS ticket validations made through the Cirrus Bridge using the ‘serviceValidate’ method
`proxy`	`cas`	`samlValidate`	Successful CAS ticket validations made through the Cirrus Bridge using the ‘samlValidate’ method

Log Data Elements

The following is a dictionary of additional data available. Not all combinations of service, type, and subtype will report all of these data elements. Please submit a support ticket if you have any questions on these data elements.

When the report format is "parsed", these elements appear as as individual fields with corresponding headers in the csv file. When the report format is "raw", these elements appear in JSON format within the logData field.

Data Element	Description
`spentityid`	The entityId of the service provider making the request - used by some services, blank for others.
`cas_service`	The service URL when using the CAS protocol - blank when the protocol is SAML.
`cas_idp_hostname`	The fully qualified domain name of the CAS identity provider when using the CAS protocol - blank when the protocol is SAML.
`cas_client_ip`	The IP address of the browser agent accessing the service using CAS.
`user`	A calculated value from a cascade of evaluating the ePPN and mail attributes - if there is neither value, the IP address is used. Used for counting traffic.
`cas_ticketprefix`	The prefix of the CAS protocol ticket.
`cas_isproxied`	Indicator if the CAS transaction was proxied.
`saml_idp`	The entityId of the SAML identity provider fulfilling the request (used by some services, blank for others).
`sp`	The entityId of the SAML service provider making the request (used by some services, blank for others).
`saml_idpchain0`	For transactions traversing a Proxy or Bridge, the last IdP to make the SAML assertion.
`saml_idpchain1`	For transactions traversing a Proxy or Bridge, the upstream IdP to make the SAML assertion.
`saml_spchain0`	For transactions traversing a Proxy or Bridge, the last SP to request the SAML assertion.
`saml_spchain1`	For transactions traversing a Proxy or Bridge, the downstream SP that requested the SAML assertion.
`eppn`	The eduPersonPrincipalName attribute associated with the assertion. If blank, was not part of the assertion.
`mail`	The mail attribute associated with the assertion. If blank, was not part of the assertion.
`uid`	The uid attribute associated with the assertion. If blank, was not part of the assertion.