PingFederate
Overview
PingFederate is an enterprise federation server from Ping Identity that provides secure single sign-on (SSO), API security, and identity bridging. It generates audit and operational logs (authentication events, token lifecycle actions, administrative changes) that can be forwarded via Syslog for centralized monitoring and detection.
In this documentation, you will learn how to collect and send PingFederate logs to Sekoia.io.
- Vendor: Ping Identity
- Supported environment: On Premise
- Detection based on: Telemetry
- Supported application or feature: Authentication, Authorization, Token lifecycle, Administrative audit logs
Warning
This format is currently in beta. We highly value your feedback to improve its performance.
High-Level Architecture Diagram
- Type of integration: Outbound (PUSH to Sekoia.io)
- Schema
Specification
Prerequisites
- Resource:
- Self-managed syslog forwarder (e.g. rsyslog, syslog-ng)
- Network:
- Outbound TCP allowed from the PingFederate appliance to the forwarder on your chosen port
- Permissions:
- Root (or equivalent) access on the PingFederate appliance
- Root (or equivalent) access on the Linux server hosting the syslog forwarder
Transport Protocol/Method
- Indirect Syslog (RFC5424)
Logs details
- Supported functionalities: See section Overview
- Supported type(s) of structure: Syslog messages (RFC5424)
- Supported verbosity level: Informational / Audit
Note
Log levels follow the RFC5424 taxonomy. Adapt your forwarder's parsing rules accordingly.
Step-by-Step Configuration Procedure
Instructions on the 3rd Party Solution
Forward PingFederate Logs to a syslog forwarder
This setup guide will lead you into forwarding PingFederate's logs to Sekoia.io by means of a syslog transport channel.
Detailed Procedure:
- Prerequisites:
-
An internal syslog concentrator is required to collect and forward events to Sekoia.io.
-
Create the Intake in Sekoia.io:
-
Go to the intake page and create a new intake from the format
PingFederate. Copy the intake key. -
Configure Log4j2 for Syslog Forwarding:
On the system hosting PingFederate:
-
SSH into your PingFederate server and open the Log4j2 configuration file:
vi /opt/pingfederate/server/default/conf/log4j2.xml -
Enable tracking ID correlation (recommended for event correlation):
Tracking IDs (
tid) allow you to correlate events across multiple log entries for the same transaction. Ensure theTrackingIdSupportis enabled in your PingFederate configuration. -
Add or modify the Syslog appender to forward logs with the proper format. The pattern must match the format expected by Sekoia.io's parser:
<Configuration> <Appenders> <!-- Existing appenders ... --> <!-- Syslog appender for Sekoia.io --> <Syslog name="SekoiaSyslog" format="RFC5424" host="<concentrator-ip-address>" port="<concentrator-port>" protocol="TCP" facility="LOCAL0" appName="pingfederate"> <!-- CRITICAL: Use this exact pattern for proper parsing --> <PatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss,SSS} tid:%X{trackingid} %-5level [%c] %msg%n"/> </Syslog> <!-- Optional: HTTP access logs appender (if using embedded Jetty logging) --> <Syslog name="SekoiaHttpAccess" format="RFC5424" host="<concentrator-ip-address>" port="<concentrator-port>" protocol="TCP" facility="LOCAL1" appName="pingfederate-http"> <PatternLayout pattern="%msg%n"/> </Syslog> </Appenders> <Loggers> <!-- Application logs: audit, authentication, token lifecycle --> <Root level="info"> <AppenderRef ref="SekoiaSyslog"/> </Root> <!-- Capture detailed authentication events --> <Logger name="org.sourceid.saml20.domain.mgmt.impl" level="info" additivity="false"> <AppenderRef ref="SekoiaSyslog"/> </Logger> <!-- Capture OAuth/OIDC token events --> <Logger name="org.sourceid.oauth20" level="info" additivity="false"> <AppenderRef ref="SekoiaSyslog"/> </Logger> <!-- Capture session and SSO events --> <Logger name="org.sourceid.websso" level="info" additivity="false"> <AppenderRef ref="SekoiaSyslog"/> </Logger> <!-- Capture administrative audit events --> <Logger name="com.pingidentity.console.audit" level="info" additivity="false"> <AppenderRef ref="SekoiaSyslog"/> </Logger> <!-- Optional: Capture DEBUG level for troubleshooting (generates more logs) --> <!-- Uncomment if needed for detailed debugging --> <!-- <Logger name="org.sourceid" level="debug" additivity="false"> <AppenderRef ref="SekoiaSyslog"/> </Logger> --> </Loggers> </Configuration>Key Configuration Notes:
- Pattern Layout: The pattern
%d{yyyy-MM-dd HH:mm:ss,SSS} tid:%X{trackingid} %-5level [%c] %msg%nensures compatibility with Sekoia.io's parser - Tracking ID:
%X{trackingid}includes the correlation ID in every log entry (appears astid:in logs) - Timestamp format:
yyyy-MM-dd HH:mm:ss,SSSmatches the expected ISO8601-like format with milliseconds - Logger name:
[%c]includes the full Java class name for better event categorization
- Pattern Layout: The pattern
-
Configure HTTP access logs (optional but recommended):
If you want to capture HTTP access logs separately, edit the Jetty configuration:
vi /opt/pingfederate/server/default/conf/jetty-runtime.xmlEnable request logging with the Common Log Format (CLF):
<Set name="RequestLog"> <New class="org.eclipse.jetty.server.NCSARequestLog"> <Arg> <SystemProperty name="pf.log.dir" default="<pf_install>/pingfederate/log"/> /pf-http-access.log </Arg> <Set name="extended">false</Set> <Set name="append">true</Set> <Set name="LogTimeZone">GMT</Set> </New> </Set>Then configure rsyslog on the PingFederate host to forward these logs to your concentrator (see step 5).
-
Forward HTTP access logs via rsyslog (if using file-based HTTP logs):
On the PingFederate host, configure rsyslog to monitor the HTTP access log file:
vi /etc/rsyslog.d/10-pingfederate-http.confAdd:
# Monitor PingFederate HTTP access logs module(load="imfile" PollingInterval="10") input(type="imfile" File="/opt/pingfederate/log/pf-http-access.log" Tag="pingfederate-http:" Severity="info" Facility="local1") # Forward to concentrator local1.* @@<concentrator-ip-address>:<concentrator-port>Restart rsyslog:
systemctl restart rsyslog -
Save
log4j2.xmland restart PingFederate:systemctl restart pingfederate -
Verify log format by checking the syslog output:
tail -f /var/log/messages | grep pingfederateYou should see logs in this format:
2025-09-02 11:02:32,869 tid:Z8I1vdotGu084PB7b2HrQ0A1kKU INFO [org.sourceid.saml20.service.impl.AuthnRequestProcessorImpl] Processing authentication request
Note
Important Pattern Requirements:
- The timestamp must use the format
yyyy-MM-dd HH:mm:ss,SSS(comma before milliseconds) - The tracking ID must appear as
tid:XXXXX(with the colon) - The log level must be 5 characters wide with left padding (
%-5level) - The logger name must be enclosed in brackets
[%c]
Any deviation from this pattern will cause parsing failures in Sekoia.io.
Instruction on Sekoia
Configure Your Intake
This section will guide you through creating the intake object in Sekoia, which provides a unique identifier called the "Intake key." The Intake key is essential for later configuration, as it references the Community, Entity, and Parser (Intake Format) used when receiving raw events on Sekoia.
- Go to the Sekoia Intake page.
- Click on the
+ New Intakebutton at the top right of the page. - Search for your Intake by the product name in the search bar.
- Give it a Name and associate it with an Entity (and a Community if using multi-tenant mode).
- Click on
Create.
Note
For more details on how to use the Intake page and to find the Intake key you just created, refer to this documentation.
Configure a forwarder
To forward events using syslog to Sekoia.io, you need to update the syslog header with the intake key you previously created. Here is an example of your message before the forwarder
<%pri%>1 %timestamp:::date-rfc3339% %hostname% %app-name% %procid% LOG RAW_MESSAGE
<%pri%>1 %timestamp:::date-rfc3339% %hostname% %app-name% %procid% LOG [SEKOIA@53288 intake_key=\"YOUR_INTAKE_KEY\"] RAW_MESSAGE
To achieve this you can:
- Use the Sekoia.io forwarder which is the official supported way to collect data using the syslog protocol in Sekoia.io. In charge of centralizing data coming from many equipments/sources and forwarding them to Sekoia.io with the apporpriated format, it is a prepackaged option. You only have to provide your intake key as parameter.
- Use your own Syslog service instance. Maybe you already have an intance of one of these components on your side and want to reuse it in order to centralize data before forwarding them to Sekoia.io. When using this mode, you have to configure and maintain your component in order to respect the expected Sekoia.io format.
Warning
Only the Sekoia.io forwarder is officially supported. Other options are documented for reference purposes but do not have official support.
Raw Events Samples
In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.
2025-12-09 08:23:52,682 trackingid="tid:D68VmhNKbQi3z3csgj0Hn_lc3iM" transactionid="2zjC3jlLX20MRKHaYiRX2ukOo" event="AUTHN_ATTEMPT" subject="" ip="192.0.2.11" connectionid="https://testcorpx.testsite.com" protocol="SAML20" pfhost="host06.test.internal.testcorp" role="IdP" status="success" responsetime="5" assertionid="" attrackingid="" attributes="" authenticationsourceid="adapter.AdpUserIdentificationForm" authnsessionexpiry="" connectionname="TestLearn" granttype="" X-Forwarded-Vip="hub-mtls.auth.infra.abc.cloud.testcorpx" X-Forwarded-Host="hub-mtls.auth.testcorpx.com" trustedNetwork="YES" requestid="" sri="D68VmhNKaQi3z3csgj0Hn_lc3iM" virtualserverid=https://hub-mtls.auth.testcorpx.com
2025-08-30 22:27:50,026 trackingid="tid:EfRuCLHmleA0JggggnFQHAaUiKI" transactionid="sbK3tzaevezYmWSQcJgCoJppH" event="AUTHN_REQUEST" subject="testuser1" ip="192.0.2.10" connectionid="https://eu.testapp.com/auth/saml/sp/metadata/ag9lfndlYmZpbGluZ3MtZXVyFAsSB0FjY291bnQYgIDA8syI6ggM/" protocol="SAML20" pfhost="host05.test.internal.testcorp" role="SP" status="inprogress" responsetime="6" assertionid="" attrackingid="" attributes="" authenticationsourceid="idpConnection.https://login.auth.example.com/PasswordProtectedTransport" authnsessionexpiry="" connectionname="TestApp (Vendor)" granttype="" X-Forwarded-Vip="hub-mtls.auth.infra.cloud.test.testcorp" X-Forwarded-Host="hub-mtls.auth.example.com" trustedNetwork="YES" requestid="wXY3g0jmB0nnThH_bfO-z.Y82Lo" sri="EfRuCLHmleA0JggggnFQHAaUiKI" virtualserverid="https://hub-mtls.auth.example.com"
2025-09-01 15:15:34,068 trackingid="tid:nkWHFLhf2dsvdFckMbwF1NU_j8g" transactionid="snJEcQqMQvYQe2WIsraji9ZtK" event="AUTHN_SESSIONS_DELETED" subject="" ip="192.0.2.12" connectionid="" protocol="" pfhost="host01.test.internal.testcorp" role="IdP" status="success" responsetime="44" assertionid="" attrackingid="" attributes="" authenticationsourceid="" authnsessionexpiry="" connectionname="" granttype="" X-Forwarded-Vip="hub-mtls.auth.test.internal.testcorp" X-Forwarded-Host="hub-mtls.auth.example.com" trustedNetwork="YES" requestid="" sri="nkWHFLhf2dsvdFckMbwF1NU_j8g..tbPV" virtualserverid=""
2025-08-30 22:27:50,474 trackingid="tid:vpYkkHbUv895EJQob3vhMrTbIgc" transactionid="DW83XpRRPgoKBAY7gru6YIR81" event="AUTHN_SESSION_CREATED" subject="" ip="192.0.2.10" connectionid="https://hub.auth.example.com/PasswordProtectedTransport" protocol="SAML20" pfhost="host03.test.internal.testcorp" role="IdP" status="" responsetime="50" assertionid="" attrackingid="" attributes="" authenticationsourceid="adapter.AdpRequestedUser" authnsessionexpiry="2025-08-30 23:27:50.474+0000" connectionname="HUB Password Only" granttype="" X-Forwarded-Vip="login.auth.test.internal.testcorp" X-Forwarded-Host="login.auth.example.com" trustedNetwork="YES" requestid="" sri="vpYkkHbUv895EJQob3vhMrTbIgc..s3rm" virtualserverid="https://login.auth.example.com/PasswordProtectedTransport"
2025-09-02 12:08:59,880 trackingid="tid:fu6aEL29MEj1AKRn3_wSMGWwo5A" transactionid="wHZWQNR6r0JHSW9yizXSXC8zD" event="AUTHN_SESSION_USED" subject="" ip="192.0.2.16" connectionid="https://testapp-uat.corp.testcorp/" protocol="SAML20" pfhost="host04.test.internal.testcorp" role="IdP" status="" responsetime="30" assertionid="" attrackingid="" attributes="" authenticationsourceid="idpConnection.https://login.auth.example.com/strong" authnsessionexpiry="2025-09-02 14:35:59.863+0000" connectionname="TestID UAT saml" granttype="" X-Forwarded-Vip="hub-mtls.auth.test.internal.testcorp" X-Forwarded-Host="hub-mtls.auth.example.com" trustedNetwork="YES" requestid="HqFnER4GNYadajPW5xa6.JSIr-A" sri="fu6aEL29MEj1AKRn3_wSMGWwo5A..trpv" virtualserverid="https://hub-mtls.auth.example.com"
2025-09-02 04:49:16,008 trackingid="tid:SA-zhKZOqk6yVnZo5ldqkPBGfRQ" transactionid="Jk8NwdiVkax3KfSl9AtzarYxC" event="OAuth" subject="testuser1" ip="192.0.2.14" connectionid="01957ee4-3206-7f2b-a0c5-d6794cd50d40" protocol="OAuth20" pfhost="host04.test.internal.testcorp" role="AS" status="failure" responsetime="88" assertionid="e-x8HOQUiqLKkGO-Qjsn5G4ySqZ" attrackingid="" attributes="SAML_AUTHN_INSTANT=2025-09-02T04:49:15.745Z, SAML_AUTHN_CTX=urn:testcorp:oneaccess:ac:classes:strong, SAML_SUBJECT=testuser2, SAML_NAME_FORMAT=urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" authenticationsourceid="" authnsessionexpiry="" connectionname="TestPortal" granttype="" X-Forwarded-Vip="hub-mtls.auth.test.internal.testcorp" X-Forwarded-Host="hub-mtls.auth.example.com" trustedNetwork="YES" requestid="Zu-.Wa5Gz5dCfoJ1MXO5dN7yzQH" sri="SA-zhKZOqk6yVnZo5ldqkPBGfRQ..tndL" virtualserverid="https://hub.auth.example.com/strong"
2025-09-01 17:03:55,086 trackingid="tid:4QVg-5IEEJKY_3L7G70fbISqvZQ" transactionid="kYweNpnacjZIqO2hVKMiz2GSN" event="SLO" subject="" ip="192.0.2.13" connectionid="01957ee4-3206-7f2b-a0c5-d6794cd50d40" protocol="OIDC" pfhost="host02.test.internal.testcorp" role="AS" status="success" responsetime="17" assertionid="" attrackingid="" attributes="" authenticationsourceid="" authnsessionexpiry="" connectionname="TestPortal" granttype="" X-Forwarded-Vip="hub-mtls.auth.infra.cloud.test.testcorp" X-Forwarded-Host="hub-mtls.auth.example.com" trustedNetwork="YES" requestid="" sri="4QVg-5IEEJKY_3L7G70fbISqvZQ..tdGP" virtualserverid="https://hub-mtls.auth.example.com"
2025-09-01 17:03:57,186 trackingid="tid:4QVg-5IEEJKY_3L7G70fbISqvZQ" transactionid="BPMc3SYoQHrXqskFsBQVe1bVR" event="SRI_REVOKED" subject="" ip="192.0.2.13" connectionid="" protocol="" pfhost="host02.test.internal.testcorp" role="IdP" status="success" responsetime="57" assertionid="" attrackingid="" attributes="" authenticationsourceid="" authnsessionexpiry="" connectionname="" granttype="" X-Forwarded-Vip="hub-mtls.auth.infra.cloud.test.testcorp" X-Forwarded-Host="hub-mtls.auth.example.com" trustedNetwork="YES" requestid="" sri="4QVg-5IEEJKY_3L7G70fbISqvZQ..tdGP" virtualserverid=""
2025-09-02 02:10:08,024 trackingid="tid:ehyqnk7ad5LMT2Cy03kgCgx2wPg" transactionid="LyPg0FbetfoyVw624lDxuktdk" event="SSO" subject="testuser1" ip="192.0.2.15" connectionid="https://app01.testvendor.com/ssoagent" protocol="SAML20" pfhost="host04.test.internal.testcorp" role="IdP" status="failure" responsetime="86" assertionid="sC7AvBm1doxsGBy7ehlR1ik.4ZS" attrackingid="" attributes="SAML_AUTHN_INSTANT=2025-09-02T02:10:07.629Z, SAML_AUTHN_CTX=urn:testcorp:oneaccess:ac:classes:strong, SAML_SUBJECT=testuser2, SAML_NAME_FORMAT=urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" authenticationsourceid="" authnsessionexpiry="" connectionname="TestRegion_HRM" granttype="" X-Forwarded-Vip="hub-mtls.auth.test.internal.testcorp" X-Forwarded-Host="hub-mtls.auth.example.com" trustedNetwork="YES" requestid="o8ere_Dij45ft_zFRmzhBt6wimN" sri="ehyqnk7ad5LMT2Cy03kgCgx2wPg..tlH_" virtualserverid="https://hub-mtls.auth.example.com"
2025-09-02 11:02:32,869 tid:Z8I1vdotGu084PB7b2HrQ0A1kKU DEBUG [org.sourceid.servlet.HttpServletRespProxy] flush cookies: adding Cookie{OXS-U2A=hashedValue:Z8I1vdotGu084PB7b2HrQ0A1kKU; path=/; maxAge=-1; domain=.auth-int.example.com}
2025-09-02 11:02:34,353 tid:Q08PzbPCjfSJL8sbIj88OLO5YWg DEBUG [org.sourceid.websso.servlet.IntegrationControllerServlet] GET: https://hub-mtls.auth-int.test.internal.testcorp/pf/heartbeat.ping
192.168.1.100 - john.doe [02/Sep/2025:13:02:34 +0000] "GET /pf/heartbeat.ping HTTP/1.1" 200 156
2025-09-02 11:02:34,353 tid:Q08PzbPCjfSJL8sbIj88OLO5YWg DEBUG [com.pingidentity.locale.LocaleUtil] Locale Override: none
2025-09-02 11:02:34,352 DEBUG [org.sourceid.util.log.internal.TrackingIdSupport] The incoming request does not contain a unique identifier. Assigning auto-generated request ID: C1CjegPq3VckLYpvYlzZEGTBe
Detection section
The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.
No related built-in rules was found. This message is automatically generated.
Event Categories
The following table lists the data source offered by this integration.
| Data Source | Description |
|---|---|
Authentication logs |
authentication and SSO events including login attempts, session management, and federation transactions |
Application logs |
administrative actions, configuration changes, and security-related events |
Network device logs |
SAML, OAuth, OpenID Connect, and other federation protocol interactions |
Web logs |
Access logs |
In details, the following table denotes the type of events produced by this integration.
| Name | Values |
|---|---|
| Kind | event |
| Category | authentication, configuration, web |
| Type | access, end, info, start |
Transformed Events Samples after Ingestion
This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.
{
"message": "2025-12-09 08:23:52,682 trackingid=\"tid:D68VmhNKbQi3z3csgj0Hn_lc3iM\" transactionid=\"2zjC3jlLX20MRKHaYiRX2ukOo\" event=\"AUTHN_ATTEMPT\" subject=\"\" ip=\"192.0.2.11\" connectionid=\"https://testcorpx.testsite.com\" protocol=\"SAML20\" pfhost=\"host06.test.internal.testcorp\" role=\"IdP\" status=\"success\" responsetime=\"5\" assertionid=\"\" attrackingid=\"\" attributes=\"\" authenticationsourceid=\"adapter.AdpUserIdentificationForm\" authnsessionexpiry=\"\" connectionname=\"TestLearn\" granttype=\"\" X-Forwarded-Vip=\"hub-mtls.auth.infra.abc.cloud.testcorpx\" X-Forwarded-Host=\"hub-mtls.auth.testcorpx.com\" trustedNetwork=\"YES\" requestid=\"\" sri=\"D68VmhNKaQi3z3csgj0Hn_lc3iM\" virtualserverid=https://hub-mtls.auth.testcorpx.com",
"event": {
"category": [
"authentication"
],
"dataset": "pingfederate",
"duration": 5000000,
"kind": "event",
"module": "pingfederate",
"outcome": "success",
"reason": "trackingid=\"tid:D68VmhNKbQi3z3csgj0Hn_lc3iM\" transactionid=\"2zjC3jlLX20MRKHaYiRX2ukOo\" event=\"AUTHN_ATTEMPT\" subject=\"\" ip=\"192.0.2.11\" connectionid=\"https://testcorpx.testsite.com\" protocol=\"SAML20\" pfhost=\"host06.test.internal.testcorp\" role=\"IdP\" status=\"success\" responsetime=\"5\" assertionid=\"\" attrackingid=\"\" attributes=\"\" authenticationsourceid=\"adapter.AdpUserIdentificationForm\" authnsessionexpiry=\"\" connectionname=\"TestLearn\" granttype=\"\" X-Forwarded-Vip=\"hub-mtls.auth.infra.abc.cloud.testcorpx\" X-Forwarded-Host=\"hub-mtls.auth.testcorpx.com\" trustedNetwork=\"YES\" requestid=\"\" sri=\"D68VmhNKaQi3z3csgj0Hn_lc3iM\" virtualserverid=https://hub-mtls.auth.testcorpx.com",
"type": [
"start"
]
},
"@timestamp": "2025-12-09T08:23:52.682000Z",
"destination": {
"address": "hub-mtls.auth.testcorpx.com",
"domain": "hub-mtls.auth.testcorpx.com",
"registered_domain": "testcorpx.com",
"subdomain": "hub-mtls.auth",
"top_level_domain": "com"
},
"host": {
"name": "host06.test.internal.testcorp"
},
"network": {
"protocol": "saml20"
},
"pingfederate": {
"attributes": "\"\"",
"authenticationsourceid": "adapter.AdpUserIdentificationForm",
"connectionid": "https://testcorpx.testsite.com",
"connectionname": "TestLearn",
"event": "AUTHN_ATTEMPT",
"protocol": "SAML20",
"responsetime": 5,
"role": "IdP",
"sri": "D68VmhNKaQi3z3csgj0Hn_lc3iM",
"status": "success",
"trackingid": "tid:D68VmhNKbQi3z3csgj0Hn_lc3iM",
"transactionid": "2zjC3jlLX20MRKHaYiRX2ukOo",
"trusted_network": "YES",
"virtualserverid": "https://hub-mtls.auth.testcorpx.com",
"x_forwarded_host": "hub-mtls.auth.testcorpx.com",
"x_forwarded_vip": "hub-mtls.auth.infra.abc.cloud.testcorpx"
},
"related": {
"hosts": [
"hub-mtls.auth.testcorpx.com"
],
"ip": [
"192.0.2.11"
]
},
"source": {
"address": "192.0.2.11",
"ip": "192.0.2.11"
},
"url": {
"domain": "testcorpx.testsite.com",
"original": "https://testcorpx.testsite.com",
"port": 443,
"registered_domain": "testsite.com",
"scheme": "https",
"subdomain": "testcorpx",
"top_level_domain": "com"
}
}
{
"message": "2025-08-30 22:27:50,026 trackingid=\"tid:EfRuCLHmleA0JggggnFQHAaUiKI\" transactionid=\"sbK3tzaevezYmWSQcJgCoJppH\" event=\"AUTHN_REQUEST\" subject=\"testuser1\" ip=\"192.0.2.10\" connectionid=\"https://eu.testapp.com/auth/saml/sp/metadata/ag9lfndlYmZpbGluZ3MtZXVyFAsSB0FjY291bnQYgIDA8syI6ggM/\" protocol=\"SAML20\" pfhost=\"host05.test.internal.testcorp\" role=\"SP\" status=\"inprogress\" responsetime=\"6\" assertionid=\"\" attrackingid=\"\" attributes=\"\" authenticationsourceid=\"idpConnection.https://login.auth.example.com/PasswordProtectedTransport\" authnsessionexpiry=\"\" connectionname=\"TestApp (Vendor)\" granttype=\"\" X-Forwarded-Vip=\"hub-mtls.auth.infra.cloud.test.testcorp\" X-Forwarded-Host=\"hub-mtls.auth.example.com\" trustedNetwork=\"YES\" requestid=\"wXY3g0jmB0nnThH_bfO-z.Y82Lo\" sri=\"EfRuCLHmleA0JggggnFQHAaUiKI\" virtualserverid=\"https://hub-mtls.auth.example.com\"",
"event": {
"category": [
"authentication"
],
"dataset": "pingfederate",
"duration": 6000000,
"kind": "event",
"module": "pingfederate",
"outcome": "unknown",
"reason": "trackingid=\"tid:EfRuCLHmleA0JggggnFQHAaUiKI\" transactionid=\"sbK3tzaevezYmWSQcJgCoJppH\" event=\"AUTHN_REQUEST\" subject=\"testuser1\" ip=\"192.0.2.10\" connectionid=\"https://eu.testapp.com/auth/saml/sp/metadata/ag9lfndlYmZpbGluZ3MtZXVyFAsSB0FjY291bnQYgIDA8syI6ggM/\" protocol=\"SAML20\" pfhost=\"host05.test.internal.testcorp\" role=\"SP\" status=\"inprogress\" responsetime=\"6\" assertionid=\"\" attrackingid=\"\" attributes=\"\" authenticationsourceid=\"idpConnection.https://login.auth.example.com/PasswordProtectedTransport\" authnsessionexpiry=\"\" connectionname=\"TestApp (Vendor)\" granttype=\"\" X-Forwarded-Vip=\"hub-mtls.auth.infra.cloud.test.testcorp\" X-Forwarded-Host=\"hub-mtls.auth.example.com\" trustedNetwork=\"YES\" requestid=\"wXY3g0jmB0nnThH_bfO-z.Y82Lo\" sri=\"EfRuCLHmleA0JggggnFQHAaUiKI\" virtualserverid=\"https://hub-mtls.auth.example.com\"",
"type": [
"start"
]
},
"@timestamp": "2025-08-30T22:27:50.026000Z",
"destination": {
"address": "hub-mtls.auth.example.com",
"domain": "hub-mtls.auth.example.com",
"registered_domain": "example.com",
"subdomain": "hub-mtls.auth",
"top_level_domain": "com"
},
"host": {
"name": "host05.test.internal.testcorp"
},
"network": {
"protocol": "saml20"
},
"pingfederate": {
"attributes": "\"\"",
"authenticationsourceid": "idpConnection.https://login.auth.example.com/PasswordProtectedTransport",
"connectionid": "https://eu.testapp.com/auth/saml/sp/metadata/ag9lfndlYmZpbGluZ3MtZXVyFAsSB0FjY291bnQYgIDA8syI6ggM/",
"connectionname": "TestApp (Vendor)",
"event": "AUTHN_REQUEST",
"protocol": "SAML20",
"requestid": "wXY3g0jmB0nnThH_bfO-z.Y82Lo",
"responsetime": 6,
"role": "SP",
"sri": "EfRuCLHmleA0JggggnFQHAaUiKI",
"status": "inprogress",
"trackingid": "tid:EfRuCLHmleA0JggggnFQHAaUiKI",
"transactionid": "sbK3tzaevezYmWSQcJgCoJppH",
"trusted_network": "YES",
"virtualserverid": "https://hub-mtls.auth.example.com",
"x_forwarded_host": "hub-mtls.auth.example.com",
"x_forwarded_vip": "hub-mtls.auth.infra.cloud.test.testcorp"
},
"related": {
"hosts": [
"hub-mtls.auth.example.com"
],
"ip": [
"192.0.2.10"
],
"user": [
"testuser1"
]
},
"source": {
"address": "192.0.2.10",
"ip": "192.0.2.10"
},
"url": {
"domain": "eu.testapp.com",
"original": "https://eu.testapp.com/auth/saml/sp/metadata/ag9lfndlYmZpbGluZ3MtZXVyFAsSB0FjY291bnQYgIDA8syI6ggM/",
"path": "/auth/saml/sp/metadata/ag9lfndlYmZpbGluZ3MtZXVyFAsSB0FjY291bnQYgIDA8syI6ggM/",
"port": 443,
"registered_domain": "testapp.com",
"scheme": "https",
"subdomain": "eu",
"top_level_domain": "com"
},
"user": {
"name": "testuser1"
}
}
{
"message": "2025-09-01 15:15:34,068 trackingid=\"tid:nkWHFLhf2dsvdFckMbwF1NU_j8g\" transactionid=\"snJEcQqMQvYQe2WIsraji9ZtK\" event=\"AUTHN_SESSIONS_DELETED\" subject=\"\" ip=\"192.0.2.12\" connectionid=\"\" protocol=\"\" pfhost=\"host01.test.internal.testcorp\" role=\"IdP\" status=\"success\" responsetime=\"44\" assertionid=\"\" attrackingid=\"\" attributes=\"\" authenticationsourceid=\"\" authnsessionexpiry=\"\" connectionname=\"\" granttype=\"\" X-Forwarded-Vip=\"hub-mtls.auth.test.internal.testcorp\" X-Forwarded-Host=\"hub-mtls.auth.example.com\" trustedNetwork=\"YES\" requestid=\"\" sri=\"nkWHFLhf2dsvdFckMbwF1NU_j8g..tbPV\" virtualserverid=\"\"",
"event": {
"category": [
"authentication"
],
"dataset": "pingfederate",
"duration": 44000000,
"kind": "event",
"module": "pingfederate",
"outcome": "success",
"reason": "trackingid=\"tid:nkWHFLhf2dsvdFckMbwF1NU_j8g\" transactionid=\"snJEcQqMQvYQe2WIsraji9ZtK\" event=\"AUTHN_SESSIONS_DELETED\" subject=\"\" ip=\"192.0.2.12\" connectionid=\"\" protocol=\"\" pfhost=\"host01.test.internal.testcorp\" role=\"IdP\" status=\"success\" responsetime=\"44\" assertionid=\"\" attrackingid=\"\" attributes=\"\" authenticationsourceid=\"\" authnsessionexpiry=\"\" connectionname=\"\" granttype=\"\" X-Forwarded-Vip=\"hub-mtls.auth.test.internal.testcorp\" X-Forwarded-Host=\"hub-mtls.auth.example.com\" trustedNetwork=\"YES\" requestid=\"\" sri=\"nkWHFLhf2dsvdFckMbwF1NU_j8g..tbPV\" virtualserverid=\"\"",
"type": [
"end"
]
},
"@timestamp": "2025-09-01T15:15:34.068000Z",
"destination": {
"address": "hub-mtls.auth.example.com",
"domain": "hub-mtls.auth.example.com",
"registered_domain": "example.com",
"subdomain": "hub-mtls.auth",
"top_level_domain": "com"
},
"host": {
"name": "host01.test.internal.testcorp"
},
"pingfederate": {
"attributes": "\"\"",
"event": "AUTHN_SESSIONS_DELETED",
"responsetime": 44,
"role": "IdP",
"sri": "nkWHFLhf2dsvdFckMbwF1NU_j8g..tbPV",
"status": "success",
"trackingid": "tid:nkWHFLhf2dsvdFckMbwF1NU_j8g",
"transactionid": "snJEcQqMQvYQe2WIsraji9ZtK",
"trusted_network": "YES",
"x_forwarded_host": "hub-mtls.auth.example.com",
"x_forwarded_vip": "hub-mtls.auth.test.internal.testcorp"
},
"related": {
"hosts": [
"hub-mtls.auth.example.com"
],
"ip": [
"192.0.2.12"
]
},
"source": {
"address": "192.0.2.12",
"ip": "192.0.2.12"
}
}
{
"message": "2025-08-30 22:27:50,474 trackingid=\"tid:vpYkkHbUv895EJQob3vhMrTbIgc\" transactionid=\"DW83XpRRPgoKBAY7gru6YIR81\" event=\"AUTHN_SESSION_CREATED\" subject=\"\" ip=\"192.0.2.10\" connectionid=\"https://hub.auth.example.com/PasswordProtectedTransport\" protocol=\"SAML20\" pfhost=\"host03.test.internal.testcorp\" role=\"IdP\" status=\"\" responsetime=\"50\" assertionid=\"\" attrackingid=\"\" attributes=\"\" authenticationsourceid=\"adapter.AdpRequestedUser\" authnsessionexpiry=\"2025-08-30 23:27:50.474+0000\" connectionname=\"HUB Password Only\" granttype=\"\" X-Forwarded-Vip=\"login.auth.test.internal.testcorp\" X-Forwarded-Host=\"login.auth.example.com\" trustedNetwork=\"YES\" requestid=\"\" sri=\"vpYkkHbUv895EJQob3vhMrTbIgc..s3rm\" virtualserverid=\"https://login.auth.example.com/PasswordProtectedTransport\"",
"event": {
"category": [
"authentication"
],
"dataset": "pingfederate",
"duration": 50000000,
"kind": "event",
"module": "pingfederate",
"reason": "trackingid=\"tid:vpYkkHbUv895EJQob3vhMrTbIgc\" transactionid=\"DW83XpRRPgoKBAY7gru6YIR81\" event=\"AUTHN_SESSION_CREATED\" subject=\"\" ip=\"192.0.2.10\" connectionid=\"https://hub.auth.example.com/PasswordProtectedTransport\" protocol=\"SAML20\" pfhost=\"host03.test.internal.testcorp\" role=\"IdP\" status=\"\" responsetime=\"50\" assertionid=\"\" attrackingid=\"\" attributes=\"\" authenticationsourceid=\"adapter.AdpRequestedUser\" authnsessionexpiry=\"2025-08-30 23:27:50.474+0000\" connectionname=\"HUB Password Only\" granttype=\"\" X-Forwarded-Vip=\"login.auth.test.internal.testcorp\" X-Forwarded-Host=\"login.auth.example.com\" trustedNetwork=\"YES\" requestid=\"\" sri=\"vpYkkHbUv895EJQob3vhMrTbIgc..s3rm\" virtualserverid=\"https://login.auth.example.com/PasswordProtectedTransport\"",
"type": [
"start"
]
},
"@timestamp": "2025-08-30T22:27:50.474000Z",
"destination": {
"address": "login.auth.example.com",
"domain": "login.auth.example.com",
"registered_domain": "example.com",
"subdomain": "login.auth",
"top_level_domain": "com"
},
"host": {
"name": "host03.test.internal.testcorp"
},
"network": {
"protocol": "saml20"
},
"pingfederate": {
"attributes": "\"\"",
"authenticationsourceid": "adapter.AdpRequestedUser",
"authnsessionexpiry": "2025-08-30 23:27:50.474+0000",
"connectionid": "https://hub.auth.example.com/PasswordProtectedTransport",
"connectionname": "HUB Password Only",
"event": "AUTHN_SESSION_CREATED",
"protocol": "SAML20",
"responsetime": 50,
"role": "IdP",
"sri": "vpYkkHbUv895EJQob3vhMrTbIgc..s3rm",
"trackingid": "tid:vpYkkHbUv895EJQob3vhMrTbIgc",
"transactionid": "DW83XpRRPgoKBAY7gru6YIR81",
"trusted_network": "YES",
"virtualserverid": "https://login.auth.example.com/PasswordProtectedTransport",
"x_forwarded_host": "login.auth.example.com",
"x_forwarded_vip": "login.auth.test.internal.testcorp"
},
"related": {
"hosts": [
"login.auth.example.com"
],
"ip": [
"192.0.2.10"
]
},
"source": {
"address": "192.0.2.10",
"ip": "192.0.2.10"
},
"url": {
"domain": "hub.auth.example.com",
"original": "https://hub.auth.example.com/PasswordProtectedTransport",
"path": "/PasswordProtectedTransport",
"port": 443,
"registered_domain": "example.com",
"scheme": "https",
"subdomain": "hub.auth",
"top_level_domain": "com"
}
}
{
"message": "2025-09-02 12:08:59,880 trackingid=\"tid:fu6aEL29MEj1AKRn3_wSMGWwo5A\" transactionid=\"wHZWQNR6r0JHSW9yizXSXC8zD\" event=\"AUTHN_SESSION_USED\" subject=\"\" ip=\"192.0.2.16\" connectionid=\"https://testapp-uat.corp.testcorp/\" protocol=\"SAML20\" pfhost=\"host04.test.internal.testcorp\" role=\"IdP\" status=\"\" responsetime=\"30\" assertionid=\"\" attrackingid=\"\" attributes=\"\" authenticationsourceid=\"idpConnection.https://login.auth.example.com/strong\" authnsessionexpiry=\"2025-09-02 14:35:59.863+0000\" connectionname=\"TestID UAT saml\" granttype=\"\" X-Forwarded-Vip=\"hub-mtls.auth.test.internal.testcorp\" X-Forwarded-Host=\"hub-mtls.auth.example.com\" trustedNetwork=\"YES\" requestid=\"HqFnER4GNYadajPW5xa6.JSIr-A\" sri=\"fu6aEL29MEj1AKRn3_wSMGWwo5A..trpv\" virtualserverid=\"https://hub-mtls.auth.example.com\"",
"event": {
"category": [
"authentication"
],
"dataset": "pingfederate",
"duration": 30000000,
"kind": "event",
"module": "pingfederate",
"reason": "trackingid=\"tid:fu6aEL29MEj1AKRn3_wSMGWwo5A\" transactionid=\"wHZWQNR6r0JHSW9yizXSXC8zD\" event=\"AUTHN_SESSION_USED\" subject=\"\" ip=\"192.0.2.16\" connectionid=\"https://testapp-uat.corp.testcorp/\" protocol=\"SAML20\" pfhost=\"host04.test.internal.testcorp\" role=\"IdP\" status=\"\" responsetime=\"30\" assertionid=\"\" attrackingid=\"\" attributes=\"\" authenticationsourceid=\"idpConnection.https://login.auth.example.com/strong\" authnsessionexpiry=\"2025-09-02 14:35:59.863+0000\" connectionname=\"TestID UAT saml\" granttype=\"\" X-Forwarded-Vip=\"hub-mtls.auth.test.internal.testcorp\" X-Forwarded-Host=\"hub-mtls.auth.example.com\" trustedNetwork=\"YES\" requestid=\"HqFnER4GNYadajPW5xa6.JSIr-A\" sri=\"fu6aEL29MEj1AKRn3_wSMGWwo5A..trpv\" virtualserverid=\"https://hub-mtls.auth.example.com\"",
"type": [
"info"
]
},
"@timestamp": "2025-09-02T12:08:59.880000Z",
"destination": {
"address": "hub-mtls.auth.example.com",
"domain": "hub-mtls.auth.example.com",
"registered_domain": "example.com",
"subdomain": "hub-mtls.auth",
"top_level_domain": "com"
},
"host": {
"name": "host04.test.internal.testcorp"
},
"network": {
"protocol": "saml20"
},
"pingfederate": {
"attributes": "\"\"",
"authenticationsourceid": "idpConnection.https://login.auth.example.com/strong",
"authnsessionexpiry": "2025-09-02 14:35:59.863+0000",
"connectionid": "https://testapp-uat.corp.testcorp/",
"connectionname": "TestID UAT saml",
"event": "AUTHN_SESSION_USED",
"protocol": "SAML20",
"requestid": "HqFnER4GNYadajPW5xa6.JSIr-A",
"responsetime": 30,
"role": "IdP",
"sri": "fu6aEL29MEj1AKRn3_wSMGWwo5A..trpv",
"trackingid": "tid:fu6aEL29MEj1AKRn3_wSMGWwo5A",
"transactionid": "wHZWQNR6r0JHSW9yizXSXC8zD",
"trusted_network": "YES",
"virtualserverid": "https://hub-mtls.auth.example.com",
"x_forwarded_host": "hub-mtls.auth.example.com",
"x_forwarded_vip": "hub-mtls.auth.test.internal.testcorp"
},
"related": {
"hosts": [
"hub-mtls.auth.example.com"
],
"ip": [
"192.0.2.16"
]
},
"source": {
"address": "192.0.2.16",
"ip": "192.0.2.16"
},
"url": {
"domain": "testapp-uat.corp.testcorp",
"original": "https://testapp-uat.corp.testcorp/",
"path": "/",
"port": 443,
"scheme": "https",
"subdomain": "testapp-uat.corp"
}
}
{
"message": "2025-09-02 04:49:16,008 trackingid=\"tid:SA-zhKZOqk6yVnZo5ldqkPBGfRQ\" transactionid=\"Jk8NwdiVkax3KfSl9AtzarYxC\" event=\"OAuth\" subject=\"testuser1\" ip=\"192.0.2.14\" connectionid=\"01957ee4-3206-7f2b-a0c5-d6794cd50d40\" protocol=\"OAuth20\" pfhost=\"host04.test.internal.testcorp\" role=\"AS\" status=\"failure\" responsetime=\"88\" assertionid=\"e-x8HOQUiqLKkGO-Qjsn5G4ySqZ\" attrackingid=\"\" attributes=\"SAML_AUTHN_INSTANT=2025-09-02T04:49:15.745Z, SAML_AUTHN_CTX=urn:testcorp:oneaccess:ac:classes:strong, SAML_SUBJECT=testuser2, SAML_NAME_FORMAT=urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\" authenticationsourceid=\"\" authnsessionexpiry=\"\" connectionname=\"TestPortal\" granttype=\"\" X-Forwarded-Vip=\"hub-mtls.auth.test.internal.testcorp\" X-Forwarded-Host=\"hub-mtls.auth.example.com\" trustedNetwork=\"YES\" requestid=\"Zu-.Wa5Gz5dCfoJ1MXO5dN7yzQH\" sri=\"SA-zhKZOqk6yVnZo5ldqkPBGfRQ..tndL\" virtualserverid=\"https://hub.auth.example.com/strong\"",
"event": {
"category": [
"authentication"
],
"dataset": "pingfederate",
"duration": 88000000,
"kind": "event",
"module": "pingfederate",
"outcome": "failure",
"reason": "trackingid=\"tid:SA-zhKZOqk6yVnZo5ldqkPBGfRQ\" transactionid=\"Jk8NwdiVkax3KfSl9AtzarYxC\" event=\"OAuth\" subject=\"testuser1\" ip=\"192.0.2.14\" connectionid=\"01957ee4-3206-7f2b-a0c5-d6794cd50d40\" protocol=\"OAuth20\" pfhost=\"host04.test.internal.testcorp\" role=\"AS\" status=\"failure\" responsetime=\"88\" assertionid=\"e-x8HOQUiqLKkGO-Qjsn5G4ySqZ\" attrackingid=\"\" attributes=\"SAML_AUTHN_INSTANT=2025-09-02T04:49:15.745Z, SAML_AUTHN_CTX=urn:testcorp:oneaccess:ac:classes:strong, SAML_SUBJECT=testuser2, SAML_NAME_FORMAT=urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\" authenticationsourceid=\"\" authnsessionexpiry=\"\" connectionname=\"TestPortal\" granttype=\"\" X-Forwarded-Vip=\"hub-mtls.auth.test.internal.testcorp\" X-Forwarded-Host=\"hub-mtls.auth.example.com\" trustedNetwork=\"YES\" requestid=\"Zu-.Wa5Gz5dCfoJ1MXO5dN7yzQH\" sri=\"SA-zhKZOqk6yVnZo5ldqkPBGfRQ..tndL\" virtualserverid=\"https://hub.auth.example.com/strong\"",
"type": [
"start"
]
},
"@timestamp": "2025-09-02T04:49:16.008000Z",
"destination": {
"address": "hub-mtls.auth.example.com",
"domain": "hub-mtls.auth.example.com",
"registered_domain": "example.com",
"subdomain": "hub-mtls.auth",
"top_level_domain": "com"
},
"host": {
"name": "host04.test.internal.testcorp"
},
"network": {
"protocol": "oauth20"
},
"pingfederate": {
"assertionid": "e-x8HOQUiqLKkGO-Qjsn5G4ySqZ",
"attributes": "\"SAML_AUTHN_INSTANT=2025-09-02T04:49:15.745Z,",
"connectionid": "01957ee4-3206-7f2b-a0c5-d6794cd50d40",
"connectionname": "TestPortal",
"event": "OAuth",
"protocol": "OAuth20",
"requestid": "Zu-.Wa5Gz5dCfoJ1MXO5dN7yzQH",
"responsetime": 88,
"role": "AS",
"sri": "SA-zhKZOqk6yVnZo5ldqkPBGfRQ..tndL",
"status": "failure",
"trackingid": "tid:SA-zhKZOqk6yVnZo5ldqkPBGfRQ",
"transactionid": "Jk8NwdiVkax3KfSl9AtzarYxC",
"trusted_network": "YES",
"virtualserverid": "https://hub.auth.example.com/strong",
"x_forwarded_host": "hub-mtls.auth.example.com",
"x_forwarded_vip": "hub-mtls.auth.test.internal.testcorp"
},
"related": {
"hosts": [
"hub-mtls.auth.example.com"
],
"ip": [
"192.0.2.14"
],
"user": [
"testuser1"
]
},
"source": {
"address": "192.0.2.14",
"ip": "192.0.2.14"
},
"user": {
"name": "testuser1"
}
}
{
"message": "2025-09-01 17:03:55,086 trackingid=\"tid:4QVg-5IEEJKY_3L7G70fbISqvZQ\" transactionid=\"kYweNpnacjZIqO2hVKMiz2GSN\" event=\"SLO\" subject=\"\" ip=\"192.0.2.13\" connectionid=\"01957ee4-3206-7f2b-a0c5-d6794cd50d40\" protocol=\"OIDC\" pfhost=\"host02.test.internal.testcorp\" role=\"AS\" status=\"success\" responsetime=\"17\" assertionid=\"\" attrackingid=\"\" attributes=\"\" authenticationsourceid=\"\" authnsessionexpiry=\"\" connectionname=\"TestPortal\" granttype=\"\" X-Forwarded-Vip=\"hub-mtls.auth.infra.cloud.test.testcorp\" X-Forwarded-Host=\"hub-mtls.auth.example.com\" trustedNetwork=\"YES\" requestid=\"\" sri=\"4QVg-5IEEJKY_3L7G70fbISqvZQ..tdGP\" virtualserverid=\"https://hub-mtls.auth.example.com\"",
"event": {
"category": [
"authentication"
],
"dataset": "pingfederate",
"duration": 17000000,
"kind": "event",
"module": "pingfederate",
"outcome": "success",
"reason": "trackingid=\"tid:4QVg-5IEEJKY_3L7G70fbISqvZQ\" transactionid=\"kYweNpnacjZIqO2hVKMiz2GSN\" event=\"SLO\" subject=\"\" ip=\"192.0.2.13\" connectionid=\"01957ee4-3206-7f2b-a0c5-d6794cd50d40\" protocol=\"OIDC\" pfhost=\"host02.test.internal.testcorp\" role=\"AS\" status=\"success\" responsetime=\"17\" assertionid=\"\" attrackingid=\"\" attributes=\"\" authenticationsourceid=\"\" authnsessionexpiry=\"\" connectionname=\"TestPortal\" granttype=\"\" X-Forwarded-Vip=\"hub-mtls.auth.infra.cloud.test.testcorp\" X-Forwarded-Host=\"hub-mtls.auth.example.com\" trustedNetwork=\"YES\" requestid=\"\" sri=\"4QVg-5IEEJKY_3L7G70fbISqvZQ..tdGP\" virtualserverid=\"https://hub-mtls.auth.example.com\"",
"type": [
"end"
]
},
"@timestamp": "2025-09-01T17:03:55.086000Z",
"destination": {
"address": "hub-mtls.auth.example.com",
"domain": "hub-mtls.auth.example.com",
"registered_domain": "example.com",
"subdomain": "hub-mtls.auth",
"top_level_domain": "com"
},
"host": {
"name": "host02.test.internal.testcorp"
},
"network": {
"protocol": "oidc"
},
"pingfederate": {
"attributes": "\"\"",
"connectionid": "01957ee4-3206-7f2b-a0c5-d6794cd50d40",
"connectionname": "TestPortal",
"event": "SLO",
"protocol": "OIDC",
"responsetime": 17,
"role": "AS",
"sri": "4QVg-5IEEJKY_3L7G70fbISqvZQ..tdGP",
"status": "success",
"trackingid": "tid:4QVg-5IEEJKY_3L7G70fbISqvZQ",
"transactionid": "kYweNpnacjZIqO2hVKMiz2GSN",
"trusted_network": "YES",
"virtualserverid": "https://hub-mtls.auth.example.com",
"x_forwarded_host": "hub-mtls.auth.example.com",
"x_forwarded_vip": "hub-mtls.auth.infra.cloud.test.testcorp"
},
"related": {
"hosts": [
"hub-mtls.auth.example.com"
],
"ip": [
"192.0.2.13"
]
},
"source": {
"address": "192.0.2.13",
"ip": "192.0.2.13"
}
}
{
"message": "2025-09-01 17:03:57,186 trackingid=\"tid:4QVg-5IEEJKY_3L7G70fbISqvZQ\" transactionid=\"BPMc3SYoQHrXqskFsBQVe1bVR\" event=\"SRI_REVOKED\" subject=\"\" ip=\"192.0.2.13\" connectionid=\"\" protocol=\"\" pfhost=\"host02.test.internal.testcorp\" role=\"IdP\" status=\"success\" responsetime=\"57\" assertionid=\"\" attrackingid=\"\" attributes=\"\" authenticationsourceid=\"\" authnsessionexpiry=\"\" connectionname=\"\" granttype=\"\" X-Forwarded-Vip=\"hub-mtls.auth.infra.cloud.test.testcorp\" X-Forwarded-Host=\"hub-mtls.auth.example.com\" trustedNetwork=\"YES\" requestid=\"\" sri=\"4QVg-5IEEJKY_3L7G70fbISqvZQ..tdGP\" virtualserverid=\"\"",
"event": {
"category": [
"authentication"
],
"dataset": "pingfederate",
"duration": 57000000,
"kind": "event",
"module": "pingfederate",
"outcome": "success",
"reason": "trackingid=\"tid:4QVg-5IEEJKY_3L7G70fbISqvZQ\" transactionid=\"BPMc3SYoQHrXqskFsBQVe1bVR\" event=\"SRI_REVOKED\" subject=\"\" ip=\"192.0.2.13\" connectionid=\"\" protocol=\"\" pfhost=\"host02.test.internal.testcorp\" role=\"IdP\" status=\"success\" responsetime=\"57\" assertionid=\"\" attrackingid=\"\" attributes=\"\" authenticationsourceid=\"\" authnsessionexpiry=\"\" connectionname=\"\" granttype=\"\" X-Forwarded-Vip=\"hub-mtls.auth.infra.cloud.test.testcorp\" X-Forwarded-Host=\"hub-mtls.auth.example.com\" trustedNetwork=\"YES\" requestid=\"\" sri=\"4QVg-5IEEJKY_3L7G70fbISqvZQ..tdGP\" virtualserverid=\"\"",
"type": [
"end"
]
},
"@timestamp": "2025-09-01T17:03:57.186000Z",
"destination": {
"address": "hub-mtls.auth.example.com",
"domain": "hub-mtls.auth.example.com",
"registered_domain": "example.com",
"subdomain": "hub-mtls.auth",
"top_level_domain": "com"
},
"host": {
"name": "host02.test.internal.testcorp"
},
"pingfederate": {
"attributes": "\"\"",
"event": "SRI_REVOKED",
"responsetime": 57,
"role": "IdP",
"sri": "4QVg-5IEEJKY_3L7G70fbISqvZQ..tdGP",
"status": "success",
"trackingid": "tid:4QVg-5IEEJKY_3L7G70fbISqvZQ",
"transactionid": "BPMc3SYoQHrXqskFsBQVe1bVR",
"trusted_network": "YES",
"x_forwarded_host": "hub-mtls.auth.example.com",
"x_forwarded_vip": "hub-mtls.auth.infra.cloud.test.testcorp"
},
"related": {
"hosts": [
"hub-mtls.auth.example.com"
],
"ip": [
"192.0.2.13"
]
},
"source": {
"address": "192.0.2.13",
"ip": "192.0.2.13"
}
}
{
"message": "2025-09-02 02:10:08,024 trackingid=\"tid:ehyqnk7ad5LMT2Cy03kgCgx2wPg\" transactionid=\"LyPg0FbetfoyVw624lDxuktdk\" event=\"SSO\" subject=\"testuser1\" ip=\"192.0.2.15\" connectionid=\"https://app01.testvendor.com/ssoagent\" protocol=\"SAML20\" pfhost=\"host04.test.internal.testcorp\" role=\"IdP\" status=\"failure\" responsetime=\"86\" assertionid=\"sC7AvBm1doxsGBy7ehlR1ik.4ZS\" attrackingid=\"\" attributes=\"SAML_AUTHN_INSTANT=2025-09-02T02:10:07.629Z, SAML_AUTHN_CTX=urn:testcorp:oneaccess:ac:classes:strong, SAML_SUBJECT=testuser2, SAML_NAME_FORMAT=urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\" authenticationsourceid=\"\" authnsessionexpiry=\"\" connectionname=\"TestRegion_HRM\" granttype=\"\" X-Forwarded-Vip=\"hub-mtls.auth.test.internal.testcorp\" X-Forwarded-Host=\"hub-mtls.auth.example.com\" trustedNetwork=\"YES\" requestid=\"o8ere_Dij45ft_zFRmzhBt6wimN\" sri=\"ehyqnk7ad5LMT2Cy03kgCgx2wPg..tlH_\" virtualserverid=\"https://hub-mtls.auth.example.com\"",
"event": {
"category": [
"authentication"
],
"dataset": "pingfederate",
"duration": 86000000,
"kind": "event",
"module": "pingfederate",
"outcome": "failure",
"reason": "trackingid=\"tid:ehyqnk7ad5LMT2Cy03kgCgx2wPg\" transactionid=\"LyPg0FbetfoyVw624lDxuktdk\" event=\"SSO\" subject=\"testuser1\" ip=\"192.0.2.15\" connectionid=\"https://app01.testvendor.com/ssoagent\" protocol=\"SAML20\" pfhost=\"host04.test.internal.testcorp\" role=\"IdP\" status=\"failure\" responsetime=\"86\" assertionid=\"sC7AvBm1doxsGBy7ehlR1ik.4ZS\" attrackingid=\"\" attributes=\"SAML_AUTHN_INSTANT=2025-09-02T02:10:07.629Z, SAML_AUTHN_CTX=urn:testcorp:oneaccess:ac:classes:strong, SAML_SUBJECT=testuser2, SAML_NAME_FORMAT=urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified\" authenticationsourceid=\"\" authnsessionexpiry=\"\" connectionname=\"TestRegion_HRM\" granttype=\"\" X-Forwarded-Vip=\"hub-mtls.auth.test.internal.testcorp\" X-Forwarded-Host=\"hub-mtls.auth.example.com\" trustedNetwork=\"YES\" requestid=\"o8ere_Dij45ft_zFRmzhBt6wimN\" sri=\"ehyqnk7ad5LMT2Cy03kgCgx2wPg..tlH_\" virtualserverid=\"https://hub-mtls.auth.example.com\"",
"type": [
"start"
]
},
"@timestamp": "2025-09-02T02:10:08.024000Z",
"destination": {
"address": "hub-mtls.auth.example.com",
"domain": "hub-mtls.auth.example.com",
"registered_domain": "example.com",
"subdomain": "hub-mtls.auth",
"top_level_domain": "com"
},
"host": {
"name": "host04.test.internal.testcorp"
},
"network": {
"protocol": "saml20"
},
"pingfederate": {
"assertionid": "sC7AvBm1doxsGBy7ehlR1ik.4ZS",
"attributes": "\"SAML_AUTHN_INSTANT=2025-09-02T02:10:07.629Z,",
"connectionid": "https://app01.testvendor.com/ssoagent",
"connectionname": "TestRegion_HRM",
"event": "SSO",
"protocol": "SAML20",
"requestid": "o8ere_Dij45ft_zFRmzhBt6wimN",
"responsetime": 86,
"role": "IdP",
"sri": "ehyqnk7ad5LMT2Cy03kgCgx2wPg..tlH_",
"status": "failure",
"trackingid": "tid:ehyqnk7ad5LMT2Cy03kgCgx2wPg",
"transactionid": "LyPg0FbetfoyVw624lDxuktdk",
"trusted_network": "YES",
"virtualserverid": "https://hub-mtls.auth.example.com",
"x_forwarded_host": "hub-mtls.auth.example.com",
"x_forwarded_vip": "hub-mtls.auth.test.internal.testcorp"
},
"related": {
"hosts": [
"hub-mtls.auth.example.com"
],
"ip": [
"192.0.2.15"
],
"user": [
"testuser1"
]
},
"source": {
"address": "192.0.2.15",
"ip": "192.0.2.15"
},
"url": {
"domain": "app01.testvendor.com",
"original": "https://app01.testvendor.com/ssoagent",
"path": "/ssoagent",
"port": 443,
"registered_domain": "testvendor.com",
"scheme": "https",
"subdomain": "app01",
"top_level_domain": "com"
},
"user": {
"name": "testuser1"
}
}
{
"message": "2025-09-02 11:02:32,869 tid:Z8I1vdotGu084PB7b2HrQ0A1kKU DEBUG [org.sourceid.servlet.HttpServletRespProxy] flush cookies: adding Cookie{OXS-U2A=hashedValue:Z8I1vdotGu084PB7b2HrQ0A1kKU; path=/; maxAge=-1; domain=.auth-int.example.com}",
"event": {
"category": [
"web"
],
"dataset": "pingfederate",
"kind": "event",
"module": "pingfederate",
"reason": "flush cookies: adding Cookie{OXS-U2A=hashedValue:Z8I1vdotGu084PB7b2HrQ0A1kKU; path=/; maxAge=-1; domain=.auth-int.example.com}",
"type": [
"info"
]
},
"@timestamp": "2025-09-02T11:02:32.869000Z",
"log": {
"level": "DEBUG",
"logger": "org.sourceid.servlet.HttpServletRespProxy"
},
"pingfederate": {
"trackingid": "tid:Z8I1vdotGu084PB7b2HrQ0A1kKU"
}
}
{
"message": "2025-09-02 11:02:34,353 tid:Q08PzbPCjfSJL8sbIj88OLO5YWg DEBUG [org.sourceid.websso.servlet.IntegrationControllerServlet] GET: https://hub-mtls.auth-int.test.internal.testcorp/pf/heartbeat.ping",
"event": {
"category": [
"web"
],
"dataset": "pingfederate",
"kind": "event",
"module": "pingfederate",
"reason": "GET: https://hub-mtls.auth-int.test.internal.testcorp/pf/heartbeat.ping",
"type": [
"access"
]
},
"@timestamp": "2025-09-02T11:02:34.353000Z",
"host": {
"name": "hub-mtls.auth-int.test.internal.testcorp"
},
"http": {
"request": {
"method": "GET"
}
},
"log": {
"level": "DEBUG",
"logger": "org.sourceid.websso.servlet.IntegrationControllerServlet"
},
"pingfederate": {
"trackingid": "tid:Q08PzbPCjfSJL8sbIj88OLO5YWg"
},
"url": {
"domain": "hub-mtls.auth-int.test.internal.testcorp",
"original": "https://hub-mtls.auth-int.test.internal.testcorp/pf/heartbeat.ping",
"path": "/pf/heartbeat.ping",
"port": 443,
"scheme": "https",
"subdomain": "hub-mtls.auth-int.test.internal"
}
}
{
"message": "192.168.1.100 - john.doe [02/Sep/2025:13:02:34 +0000] \"GET /pf/heartbeat.ping HTTP/1.1\" 200 156",
"event": {
"category": [
"web"
],
"dataset": "pingfederate",
"kind": "event",
"module": "pingfederate",
"type": [
"access"
]
},
"host": {
"name": "192.168.1.100"
},
"http": {
"request": {
"method": "GET"
},
"response": {
"body": {
"bytes": 156
},
"status_code": 200
},
"version": "1.1"
},
"related": {
"ip": [
"192.168.1.100"
],
"user": [
"john.doe"
]
},
"source": {
"address": "192.168.1.100",
"ip": "192.168.1.100"
},
"url": {
"original": "/pf/heartbeat.ping",
"path": "/pf/heartbeat.ping"
},
"user": {
"name": "john.doe"
}
}
{
"message": "2025-09-02 11:02:34,353 tid:Q08PzbPCjfSJL8sbIj88OLO5YWg DEBUG [com.pingidentity.locale.LocaleUtil] Locale Override: none",
"event": {
"category": [
"configuration"
],
"dataset": "pingfederate",
"kind": "event",
"module": "pingfederate",
"reason": "Locale Override: none",
"type": [
"info"
]
},
"@timestamp": "2025-09-02T11:02:34.353000Z",
"log": {
"level": "DEBUG",
"logger": "com.pingidentity.locale.LocaleUtil"
},
"pingfederate": {
"trackingid": "tid:Q08PzbPCjfSJL8sbIj88OLO5YWg"
}
}
{
"message": "2025-09-02 11:02:34,352 DEBUG [org.sourceid.util.log.internal.TrackingIdSupport] The incoming request does not contain a unique identifier. Assigning auto-generated request ID: C1CjegPq3VckLYpvYlzZEGTBe",
"event": {
"category": [
"web"
],
"dataset": "pingfederate",
"kind": "event",
"module": "pingfederate",
"reason": "The incoming request does not contain a unique identifier. Assigning auto-generated request ID: C1CjegPq3VckLYpvYlzZEGTBe",
"type": [
"info"
]
},
"@timestamp": "2025-09-02T11:02:34.352000Z",
"log": {
"level": "DEBUG",
"logger": "org.sourceid.util.log.internal.TrackingIdSupport"
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
| Name | Type | Description |
|---|---|---|
@timestamp |
date |
Date/time when the event originated. |
destination.domain |
keyword |
The domain name of the destination. |
event.category |
keyword |
Event category. The second categorization field in the hierarchy. |
event.dataset |
keyword |
Name of the dataset. |
event.duration |
long |
Duration of the event in nanoseconds. |
event.kind |
keyword |
The kind of the event. The highest categorization field in the hierarchy. |
event.module |
keyword |
Name of the module this data is coming from. |
event.outcome |
keyword |
The outcome of the event. The lowest level categorization field in the hierarchy. |
event.reason |
keyword |
Reason why this event happened, according to the source |
event.type |
keyword |
Event type. The third categorization field in the hierarchy. |
host.name |
keyword |
Name of the host. |
http.request.method |
keyword |
HTTP request method. |
http.response.body.bytes |
long |
Size in bytes of the response body. |
http.response.status_code |
long |
HTTP response status code. |
http.version |
keyword |
HTTP version. |
log.level |
keyword |
Log level of the log event. |
log.logger |
keyword |
Name of the logger. |
network.protocol |
keyword |
Application protocol name. |
pingfederate.assertionid |
keyword |
SAML assertion ID |
pingfederate.attrackingid |
keyword |
Attribute tracking ID |
pingfederate.attributes |
keyword |
Additional attributes associated with the event |
pingfederate.authenticationsourceid |
keyword |
ID of the authentication adapter or source |
pingfederate.authnsessionexpiry |
keyword |
Authentication session expiry information |
pingfederate.connectionid |
keyword |
Connection identifier or URL |
pingfederate.connectionname |
keyword |
Human-readable name of the connection |
pingfederate.event |
keyword |
Type of event being logged |
pingfederate.granttype |
keyword |
OAuth grant type |
pingfederate.protocol |
keyword |
Authentication protocol used |
pingfederate.requestid |
keyword |
Request ID for tracking |
pingfederate.responsetime |
long |
Response time in milliseconds |
pingfederate.role |
keyword |
Role of the PingFederate instance in the transaction |
pingfederate.sri |
keyword |
Session reference identifier |
pingfederate.status |
keyword |
Status of the authentication or request |
pingfederate.trackingid |
keyword |
Tracking ID associated with the PingFederate event (contains the tid prefix) |
pingfederate.transactionid |
keyword |
Transaction ID for the authentication or request flow |
pingfederate.trusted_network |
keyword |
Indicates if the request came from a trusted network |
pingfederate.virtualserverid |
keyword |
Virtual server identifier |
pingfederate.x_forwarded_host |
keyword |
X-Forwarded-Host header value |
pingfederate.x_forwarded_vip |
keyword |
X-Forwarded-Vip header value |
source.domain |
keyword |
The domain name of the source. |
source.ip |
ip |
IP address of the source. |
url.original |
wildcard |
Unmodified original url as seen in the event source. |
user.name |
keyword |
Short name or login of the user. |
For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.