The following are details for the Silo log types:
Log Type | Feature | What it records |
| A8SS | Silo Drive / Cloud Secure Storage | File and folder actions in Silo Drive storage |
| ADMIN_AUDIT | Admin Console Changes | Changes made by Silo Admins in the Admin Console |
| APP_LAUNCH | Silo Apps | Silo App launches and exits |
| AUTH | Authentication | Login attempts (PIN, SAML, OOB, password reset) |
| BLOCKED URL | Blocked Websites | Websites blocked by URL Category or Domain Filtering policy |
| CASE MANAGER | Case Manager | Case and note changes, and pages captured to a case |
| CLIPBOARD | Copy and Paste | Text copied into or out of a session |
| COOKIES | Website Cookies | Website cookies (requires Log Encryption) |
| DOWNLOAD | File Downloads | Files downloaded, with file details |
| ENC | Encrypted Logs | Encrypted entries, when Log Encryption is enabled |
| EVENT | Event Manager | Event Manager keyword matches |
| EXPLOIT | Malicious File Detection | Malicious files detected before download |
| EXTENSION | Browser Extensions | Browser extension installs, removals and policy |
| HARVEST | Harvester and Collector | Harvester and Collector tasks |
| ISOLATE_BYPASS | Isolation Bypass | Navigation handled by the Isolation Bypass policy |
| LAUNCHER | Launcher Shortcuts | Launching, creating, updating and deleting user shortcuts |
| LOCATION CHANGE | Address Bar Navigation | Address bar navigation, including Google searches |
| NEXUS | Nexus AI | Nexus AI conversation messages |
| POST DATA | Form Submissions | Form submissions (requires Log Encryption) |
| Printing | Printing and saving pages as PDF | |
| SESSION | Silo Sessions | Session start and end details |
| SMS | SMS Inbox | SMS Inbox messages received and deleted |
| TRAFFICMAN | Traffic Manager | Traffic Manager proxy and header rule matches |
| TRANSLATION | Page Translation | Page and text translation |
| UPLOAD | File Uploads | Files uploaded, with file details |
| URL | Websites Visited | Websites visited |
Please refer to the Log Extract API guideline for information on how to programmatically retrieve the logs. Our Splunk Enterprise Technical Add-on is also available as an alternative method
Each heading shows the log type value, which appears in the type field and is used for filtering, followed by the feature name in parentheses. Some fields contain sensitive content and are recorded only when Log Encryption is enabled; this is noted on each log type. When Log Encryption is enabled, every entry is stored encrypted and returned as the ENC log type; the fields described below, including the sensitive ones, are inside the decrypted payload. Fields that do not apply to a particular event may be empty
Log Type: A8SS (Silo Drive / Cloud Secure Storage)
Log information pertaining to events involving Cloud Secure Storage
Field Name | Definition | Sample Result |
| action | File action. Values include: create bucket, create directory, create file, view file, file available, open file for upload, file added to zip, delete file, delete directory, rename file, rename directory, move file, move directory, download to client machine started / completed / canceled, upload from client machine started / completed / canceled, put file with external api, get file with external api | rename file |
| bucket_id | The storage bucket ID where the action was performed | 5113d1da4e4d0c523b170310341b7415 |
| client_ip | IP address of the Silo client which originated the request | 203.0.113.20 |
| content_type | the file type | image/tiff |
| create_ts | timestamp of the create time of the file | 1436215447.527693 |
| create_user | The internal user ID who created the file | d0dd8b47b28057322925v428d9d07a58 |
| file_id | the unique Cloud Secure Storage file identifier | 3b94ae0ebcdc7e926ddddcddfd8cf18c |
| file_size | Size of the file in bytes | 1002365 |
| name | the regular name of the file | TestFile.tiff |
| new_name | Name file was renamed to | TestFile_renamed.tiff |
| org_id | The opaque string identifier of the Silo organization | 4ca51853dcfef8c08a4bbbf168af7f3e |
| seq_id | log entry sequence ID | 13382766 |
| session_id | An opaque string that identifies the Silo for Safe Access or Silo for Research session | f1b3310c0422f847446fe7661d896c6a |
| type | Log Type | A8SS |
| uploading_until | Indication of file save status. If a file save action is complete, this field will be null. If the file is currently being written or is in some incomplete state, you will see a time stamp | "2015-07-06 21:00:26" or 'Null' |
| user_id | The opaque string identifier of the Silo account | c8cd4252f8b15bdbc9c3e7c53d73f562 |
| username | The login name of the Silo account who initiated the session | silotestaccount |
| bucket_name | Name of the storage space where the action was performed | My Drive |
| bucket_type | Kind of storage space | User Storage, Session Storage or Pooled Storage |
| file_path | Folder path of the file within the storage space | /reports/ |
| new_file_path | Destination folder of a move file or move directory action | /archive/ |
| reason | Why the file was deleted automatically (with action delete file and no user session) | file expired or upload expired |
| tab_id | Browser tab identifier within the session. For some events this is the tab in focus when the event was logged | 1843 |
Log Type: ADMIN_AUDIT (Admin Console Changes)
Log information pertaining to Silo Administrator changes performed within the Silo Admin Console
The data logged includes:
- Who made the change (username)
- When the change was made (timestamp)
- What was changed (including before and after values)
More Info:
- Credential changes will be tracked and listed but actual data will NOT be logged
- Admin Audit logs usually contain any of the 4 audit_type USER, WEB_APP, POLICY, ORG
Field Name | Definition | Sample Result |
| admin_fullname | Full name of Silo Admin who made the changes | Silo Admin |
| audit_type | Type of changes made | POLICY |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411623446.621668 |
| message | Any Silo Admin executed action details | Changed org name from \"Untitled Org\" to \"test\" |
| org_id | The opaque string identifier of the Silo organization | 4a6ca40fc47ab8655f85b4cc6d6139e0 |
| org_name | Name of the Silo organization | Admin Org |
| seq_id | Sequence number of log entry | 23691402 |
| source | Source of the Silo Admin changes | Admin Console |
| type | Log type | ADMIN_AUDIT |
| username | The login name of the Silo Admin who made the changes | silotestaccount |
| old_values | Value before change | "email": "user@example.com” |
| new_values | Value after change | "email": "user@new.example.com” |
| client_ip | The IP address the Silo Admin connected from (Admin Console or External API) | 203.0.113.10 |
| changed_fields | Which settings the Silo Admin changed | ["name", "url"] |
| users | Silo accounts affected by the change | ["silotestaccount"] |
Log Type: APP_LAUNCH (Silo Apps)
Log information pertaining to use of Silo Apps within a workspace.
Field Name | Definition | Sample Result |
| session_id | An opaque string that identifies the Silo for Safe Access session | a62f8860f76650380e09d366557e3751 |
| action | Type of actions | launch; exit |
| app_name | Silo App name | Telegram |
| org_id | The opaque string identifier of the Silo organization | 4a6ca40fc47ab8655f85b4cc6d6139e0 |
| client_ip | The IP address of the user's machine as seen as by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.10 |
| username | The login name of the Silo account who initiated the session | silotestaccount |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411567747.400867 |
| user_id | The opaque string identifier of the Silo account | a62f8860f76650380e09d366557e3751 |
| event_ts | The floating point UNIX Epoch time of the event | 1767941620 |
| type | Log type | APP_LAUNCH |
| seq_id | Sequence number of log entry | 23686753 |
| toolbox_name | The assigned name of the workspace used | "Research Workspace" |
| primary_session_id | Identifier of the primary session when the event was logged in a subsession (for example a Toolbox as an App subsession, whose session_id carries a :1 suffix). Empty for events in the primary session | bd1dfccc8b4c98c79085d78b0aab96e6 |
Log Type: AUTH (Authentication)
Log information pertaining to authentication attempts such as SAML, PIN, OOB (out of band), and Reset user login with temporary password
Authentication Summary:
Field Name | Definition | Sample Result |
| action | Type of authentication actions | PIN; PIC (grandfathered authentication method for users created prior since early 2013); SAML SSO |
| client_ip | The IP address of the user's machine as seen as by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.10 |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411567747.400867 |
| org_id | The opaque string identifier of the Silo organization | 4a6ca40fc47ab8655f85b4cc6d6139e0 |
| reason | Any available detailed reason for authentication action results | Incorrect credentials; "Signature data missing" |
| result | Result of authentication actions | success; failure |
| seq_id | Sequence number of log entry | 23686753 |
| session_id | An opaque string that identifies the Silo for Safe Access session | ec3d9b11ff7eb00d6f55f773ba057583 |
| type | Log type | AUTH |
| user_id | The opaque string identifier of the Silo account | a62f8860f76650380e09d366557e3751 |
| username | The login name of the Silo account who initiated the session | silotestaccount |
Action | Result | Reason |
| PIN Auth | success | |
| failure | Incorrect credentials | |
| failure | Booted after three failed attempts | |
| failure | Locked out after three login failures over two consecutive sessions | |
| SAML Auth | success | |
| failure | Signature expired | |
| failure | Signature invalid | |
| failure | Signature data missing | |
| OOB (out of band) | success | |
| failure | Incorrect OOB code | |
| failure | Phone modification disabled after three failed attempts | |
| failure | Unable to send code, incorrect phone number: 9999999999 | |
| Reset (user login using temporary password) | success | |
| failure | Invalid reset code | |
| failure | Booting user after three failed attempts | |
| failure | Locked out after three reset code failures over two consecutive sessions | |
| New User Create PIN | success | Created new pin code |
| User changed PIN | success | Changed pin code |
Log Type: BLOCKED URL (Blocked Websites)
Log information pertaining to blocked URLs or domains per the URL Category or Domain Filtering policies
Field Name | Definition | Sample Result |
| client_ip | The IP address of the local machine as seen as by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.10 |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411481216.764143 |
| user_id | The opaque string identifier of the Silo account | db51b9038ddc66641381c4628bcb8ee1 |
| domain | The domain name of the URL | www.google.com |
| org_id | The opaque string identifier of the Silo organization | 64bb2da94d49648b75e3b3b82338086e |
| path | The path of the URL | /maps/search/news/@34.736297,-84.007953,5z/data=!3m1!4b1 |
| port | The Network port of the URL | 80 or 443 |
| scheme | The protocol specifier in a URL | usually http or https |
| seq_id | Sequence number of log entry | 12988378 |
| session_id | An opaque string that identifies the Silo for Safe Access session | c516a4417c72673478dea4186ea6d35e |
| type | Log type | BLOCKED URL |
| url | Website address | https://www.google.com/?gws_rd=ssl#q=cats |
| username | The login name of the Silo account who initiated the session | silotestaccount |
| reject_type | The policy reason access was prevented | url block list or category |
| micro_category | Specific filtering category reason | Social Networking |
| macro_category | General filtering category name | Productivity Drains |
| primary_session_id | Identifier of the primary session when the event was logged in a subsession (for example a Toolbox as an App subsession, whose session_id carries a :1 suffix). Empty for events in the primary session | bd1dfccc8b4c98c79085d78b0aab96e6 |
| tab_id | Browser tab identifier within the session. For some events this is the tab in focus when the event was logged | 1843 |
| query | The query of the URL | "p=v" in "https://example.com:81/path?p=v" |
Log Type: CASE MANAGER (Case Manager)
Log information pertaining to Case Manager activities: case and note changes, and pages captured to a case
Field Name | Definition | Sample Result |
| action_type | Case Manager action performed | Case created, Case renamed, Case deleted, Case started, Case paused, Case resumed, Case stopped, Note created, Note updated, Note deleted, Data captured manually, Data captured automatically |
| case_id | Identifier of the case | 1f3c9a2e4b7d4e0f9a8b6c5d4e3f2a1b |
| case_name | Name of the case (the new name after a rename) | Example Investigation |
| old_case_name | Previous name of the case (Case renamed only) | Old Case Name |
| client_ip | The IP address of the local machine as seen by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.10 |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411481216.764143 |
| filename | Name of the stored capture file (capture entries only) | 1f3c9a2e4b7d4e0f9a8b6c5d4e3f2a1b-aB3dE5fG7h.mhtml |
| sha256 | SHA-256 hash of the capture file in hex (capture entries only) | d262d17ab180800703ad2a65a29643c72c7ebfeb1a6431d34e19561c0e50cc41 |
| url | Website address of the captured page (capture entries only) | https://www.example.com/a |
| referrer_url | Referring page of the captured page | https://www.example.com/ |
| page_title | Title of the captured page | Example Domain |
| transition_type | How the user reached the captured page | link, typed, reload, form_submit, tab_switch |
| org_id | The opaque string identifier of the Silo organization | 64bb2da94d49648b75e3b3b82338086e |
| seq_id | Sequence number of log entry | 12627567 |
| session_id | An opaque string that identifies the Silo for Safe Access or Silo for Research session | f1b3310c0422f847446fe7661d896c6a |
| type | Log type | CASE MANAGER |
| user_id | The opaque string identifier of the Silo account | c8cd4252f8b15bdbc9c3e7c53d73f562 |
| username | The login name of the Silo account who initiated the session | silotestaccount |
| scheme | The protocol specifier in a URL | usually http or https |
| domain | The domain name of the URL | "example.com" in "https://example.com:81/path?p=v" |
| port | The Network port of the URL | "81" in "https://example.com:81/path?p=v". If the Network port is 80 or 443, this value would be null |
| path | The path of the URL | "/path" in "https://example.com:81/path?p=v" |
| query | The query of the URL | "p=v" in "https://example.com:81/path?p=v" |
Log Type: CLIPBOARD (Copy and Paste)
Log information pertaining to text copied into or out of a Silo session
The contents field holds the copied text and is recorded only when Log Encryption and clipboard logging are both enabled. Text longer than 102,400 characters is truncated
Field Name | Definition | Sample Result |
| client_ip | The IP address of the local machine as seen by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.10 |
| contents | The copied text | Example copied text |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411481216.764143 |
| direction | Which way the text moved | local-remote (pasted from the local machine into Silo) or remote-local (copied out of Silo to the local machine) |
| mime_type | Format of the clipboard content | text/plain; charset=utf-8 |
| org_id | The opaque string identifier of the Silo organization | 64bb2da94d49648b75e3b3b82338086e |
| seq_id | Sequence number of log entry | 12627567 |
| session_id | An opaque string that identifies the Silo for Safe Access or Silo for Research session | f1b3310c0422f847446fe7661d896c6a |
| source_url | Website address of the page the text was copied from (remote-local only) | https://www.example.com/page |
| type | Log type | CLIPBOARD |
| username | The login name of the Silo account who initiated the session | silotestaccount |
Log Type: COOKIES (Website Cookies)
Web cookies may contain confidential and sensitive information — Log Encryption must be enabled in order to record this log type
Field Name | Definition | Sample Result |
| client_ip | The IP address of the local machine as seen as by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.10 |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411481216.764143 |
| cookies | Cookie data log entries | actual data blog |
| domain | The domain name of the URL | "example.com" in "https://example.com:81/path?p=v" |
| method | HTTP request method | GET, POST |
| org_id | The opaque string identifier of the Silo organization | 64bb2da94d49648b75e3b3b82338086e |
| path | The path of the URL | "/path" in "https://example.com:81/path?p=v" |
| port | The Network port of the URL | "81" in "https://example.com:81/path?p=v". If the Network port is 80 or 443, this value would be null |
| response_code | The HTTP response code from the website | usually 200 |
| scheme | The protocol specifier in a URL | usually http or https |
| seq_id | Sequence number of log entry | 12627567 |
| session_id | An opaque string that identifies the Silo for Safe Access session | f1b3310c0422f847446fe7661d896c6a |
| type | Log type | COOKIES |
| url | Website address | https://login.example.com/ |
| username | The login name of the Silo account who initiated the session | silotestaccount |
| tab_id | Browser tab identifier within the session. For some events this is the tab in focus when the event was logged | 1843 |
| query | The query of the URL | "p=v" in "https://example.com:81/path?p=v" |
Log Type: DOWNLOAD (File Downloads)
Log information pertaining to file download activities, along with the file details
Field Name | Definition | Sample Result |
| client_ip | The IP address of the local machine as seen as by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.10 |
| bytes | Downloaded file size in bytes | 92108 |
| target | Destination path of downloaded file | /tmp/download-0/Extract_Log_Samples.txt |
| contentType | Data type of the downloaded file | text/plain |
| hash | SHA-256 hash of the file in hex | d262d17ab180800703ad2a65a29643c72c7ebfeb1a6431d34e19561c0e50cc41 |
| url | Source of the downloaded file | https://mail-attachment.googleusercontent.com/attachment/u/0/? ui=2&ik=9f0c44d8c2&view= att&th=1489b4c8d5929ac4&attid=0.1 &disp=safe&realattid= f_i0d86brx0&zw&saduie=AG9B_P_EV24vE6QEP8oX6jRL1kF -&sadet=1411404392213&sads=M8j4UFPeIEoD7EnKT_iP5IFQspk |
| username | The login name of the Silo account who initiated the session | silotestaccount |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411408790.093198 |
| org_id | The opaque string identifier of the Silo organization | 64bb2da94d49648b75e3b3b82338086e |
| seq_id | Sequence number of log entry | 12625480 |
| session_id | An opaque string that identifies the Silo for Safe Access session | 9d1d78fe0c999429fcce590358ec5ca5 |
| type | Log type | DOWNLOAD |
| scheme | The protocol specifier of the source site | usually http or https |
| domain | The domain of the source website | mail-attachment.googleusercontent.com |
| port | Network port of the source website | 443 |
| path | Source path of the website | /attachment/u/0/ |
| query | Source query of the downloaded file | ui=2&ik=9f0c44d8c2&view=att&th=1489b4c8d5929ac4&attid=0.1 &disp=safe&realattid=f_i0d86brx0&zw&saduie=AG9B_ P_EV24vE6QEP8oX6jRL1kF-&sadet=1411404392213&sads=M8j4UFPeIEoD7EnKT_iP5IFQspk |
| action | Where the file was transferred from and to | webToClient (website to local machine), webToCloud (website to Cloud Secure Storage), cloudToClient (Cloud Secure Storage to local machine) |
| file_id | The unique Cloud Secure Storage file identifier, when storage is involved | 3b94ae0ebcdc7e926ddddcddfd8cf18c |
| tab_id | Browser tab identifier within the session. For some events this is the tab in focus when the event was logged | 1843 |
| user_id | The opaque string identifier of the Silo account | c8cd4252f8b15bdbc9c3e7c53d73f562 |
Log Type: ENC (Encrypted Logs)
Log information pertaining to Encrypted Logs, which can be enabled via the Silo Admin Console. See Log Encryption
Field Name | Definition | Sample Result |
| enc | Payload of encrypted logs | base64 encoded encrypted serialized JSON object |
| key_name | Name of Asymmetric Key used to encrypt symmetric key | Test Public Key |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411623446.621668 |
| org_id | The opaque string identifier of the Authentic8 org | 4a6ca40fc47ab8655f85b4cc6d6139e0 |
| seq_id | Sequence number of log entry | 23691402 |
| type | Log type | ENC |
| encryption_type | Encryption scheme used for the payload | Standard or Legacy |
Log Type: EVENT (Event Manager)
Log information pertaining to Event Manager. An entry is logged when an event defined by a Silo Admin matches keywords in a URL, page content, form data or another Silo log
Event Manager must be enabled by policy and at least one event must be defined
Field Name | Definition | Sample Result |
| client_ip | The IP address of the local machine as seen by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.10 |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411481216.764143 |
| data_source | Where the match was found | url, webPage, formData or siloLogs |
| egress_location | Egress region of the session | Region tag |
| event_comment | Log comment defined by the Silo Admin for the event | Review per policy 4.2 |
| event_name | Name of the event defined by the Silo Admin | Restricted Keywords |
| log_type | Type of the Silo log that matched (siloLogs only) | UPLOAD |
| org_id | The opaque string identifier of the Silo organization | 64bb2da94d49648b75e3b3b82338086e |
| primary_session_id | Identifier of the primary session when the event was logged in a subsession (for example a Toolbox as an App subsession, whose session_id carries a :1 suffix). Empty for events in the primary session | bd1dfccc8b4c98c79085d78b0aab96e6 |
| seq_id | Sequence number of log entry | 12627567 |
| session_id | An opaque string that identifies the Silo for Safe Access or Silo for Research session | f1b3310c0422f847446fe7661d896c6a |
| type | Log type | EVENT |
| url | Website address where the match occurred (for siloLogs, the URL of the matching log) | https://www.example.com/news |
| user_id | The opaque string identifier of the Silo account | c8cd4252f8b15bdbc9c3e7c53d73f562 |
| username | The login name of the Silo account who initiated the session | silotestaccount |
| scheme | The protocol specifier in a URL | usually http or https |
| domain | The domain name of the URL | "example.com" in "https://example.com:81/path?p=v" |
| port | The Network port of the URL | "81" in "https://example.com:81/path?p=v". If the Network port is 80 or 443, this value would be null |
| path | The path of the URL | "/path" in "https://example.com:81/path?p=v" |
| query | The query of the URL | "p=v" in "https://example.com:81/path?p=v" |
Log Type: EXPLOIT (Malicious File Detection)
Log information pertaining to malicious files detected before files are downloaded to the local machine
Field Name | Definition | Sample Result |
| origin | Source of the file | unknown |
| delivered | The file delivered to the Silo account | false |
| client_ip | The IP address of the local machine as seen by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.20 |
| user_id | The opaque string identifier of the Silo account | dbc9c3e7c5c8cd4252f8b15b3d73f562 |
| seq_id | Sequence number of the log entry | 24744695 |
| filetype | The type of file | CL_TYPE_TEXT_ASCII |
| org_id | The opaque string identifier of the Silo organization | 5db51853edgff8c08a4bbbf168af7f3e |
| exploit_name | The name of the malicious file | Eicar-Test-Signature |
| session_id | An opaque string that identifies the Silo for Safe Access or Silo for Research session | 20c33d188fd56351cc451d7819cb2681 |
| filename | The name of the downloaded file | "eicar.com test" |
| username | The login name of the Silo account that initiated the session | silotestaccount |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1427175692.787294 |
| type | Log type | EXPLOIT |
Log Type: EXTENSION (Browser Extensions)
Log information pertaining to Silo Extension activities
Extension install and uninstall events carry the action, id, name and version fields. Session events carry the extension_list, extension_policy and extension_status fields
Field Name | Definition | Sample Result |
| type | Log type identifier | EXTENSION |
| user_id | The opaque string identifier of the Silo account | c8cd4252f8b15bdbc9c3e7c53d73f562 |
| org_id | The opaque string identifier of the Silo organization | 64bb2da94d49648b75e3b3b82338086e |
| username | The login name of the Silo account that initiated the session | silotestaccount |
| session_id | An opaque string that identifies the Silo for Safe Access or Silo for Research session | f1b3310c0422f847446fe7661d896c6a |
| client_ip | The IP address of the local machine as seen as by Authentic8. This is frequently the NAT address of the local network rather than the actual IP address of the local machine | 203.0.113.10 |
| create_ts | The floating-point UNIX Epoch time of the log event creation | 1411481216.764143 |
| seq_id | Sequence number of the log entry | 12627567 |
| extension_list | List of extensions involved in the event; may include details such as name and version | { "dlbdalfhhfecaekoakmanjflmdhmgpea": { "name": "Extension Source Downloader", "version": "0.1.5" } } |
| extension_policy | Policy governing extensions, including admin-provisioned, blocked, allowed, and whether user enablement is permitted | { "admin_provisioned": [ "dlbdalfhhfecaekoakmanjflmdhmgpea" ], "block_list": ["ookdjilphngeeeghgngjabigmpepanpl"], "user_enabled": true } |
| extension_status | Current status of extensions: added, removed, installed lists for both admin and user | { "admin_provisioned": { "added": ["gaidoampbkcknofoejhnhbhbhhifgdop"], "installed_list": ["gaidoampbkcknofoejhnhbhbhhifgdop"], "removed": [] } } |
| toolbox_name | Name of toolbox associated with the event (if any) | Research Workspace |
| action | Extension action | installed or uninstalled |
| id | Chrome Web Store identifier of the extension | dlbdalfhhfecaekoakmanjflmdhmgpea |
| name | Display name of the extension | Extension Source Downloader |
| version | Version of the extension | 0.1.5 |
Log Type: HARVEST (Harvester and Collector)
Log information pertaining to Harvester API and Collector activities
Field Name | Definition | Sample Result |
| type | Log type | HARVEST |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411481216.764143 |
| seq_id | Sequence number of the log entry | 3676798503 |
| org_id | The opaque string identifier of the Silo organization | 64bb2da94d49648b75e3b3b82338086e |
| username | The login name of the user who initiated the session | silotestaccount |
| user_id | The opaque string identifier of the Silo account | dbc9c3e7c5c8cd4252f8b15b3d73f562 |
| session_id | An opaque string that identifies the Silo for Safe Access or Silo for Research session | 20c33d188fd56351cc451d7819cb2681 |
| egress_info | Egress location type: Datacenter, Wireless, ISP | {"availability":null,"connectivity":"datacenter","protocol":"direct"} |
| action | Harvester/Collector action type | create, delete, complete or error |
| egress | Egress location | City, State |
| task_id | Harvester/Collector identifier value | de7af08fade751fed33b6126a01e8e4b |
| task_params | Harvester/Collector task parameters | {"request_type":"visual","urls":["https://www.authentic8.com"],"vis_params":[{"name":"user_agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"},{"name":"output_pdf"},{"name":"scale","value":"1.0"}],"vid_params":[],"wget_params":[]} |
| url | Target URL | https://www.authentic8.com |
| destination_bucket | Cloud Secure Storage identifier of the target storage bucket | 5113d1da4e4d0c523b170310341b7415 |
| destination_name | Filename of Harvester/Collector task output | Collector.zip |
| destination_path | Cloud Secure Storage folder path | / |
| started | Harvester/Collector task start time in UNIX Epoch | 1753983509 |
| duration | Task duration measured in seconds | 28.0476954 |
| file_id | Unique Cloud Secure Storage file identifier | 3b94ae0ebcdc7e926ddddcddfd8cf18c |
| error | Error text when a Harvester/Collector task fails | Task timed out |
| metadata | Output metadata of the Harvester/Collector task, as JSON | {"urls":["https://www.authentic8.com"],"status":"complete"} |
Log Type: ISOLATE_BYPASS (Isolation Bypass)
Log information pertaining to website navigation details as designated in the Isolation Bypass policy
Note: the type value for this log is ISOLATE_BYPASS. Use this exact value when filtering
Field Name | Definition | Sample Result |
| type | Log type | ISOLATE_BYPASS |
| user_id | The opaque string identifier of the Silo account | db51b9038ddcxyz12345c4628bcb8ee1 |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411481216.764143 |
| username | The login name of the user who initiated the session | silotestaccount |
| scheme | The protocol specifier in a URL | usually "http" or "https" |
| port | The Network port of the URL | "81" in "https://example.com:81/path?p=v". If the Network port is 80 or 443, this value would be null |
| client_ip | The IP address of the local machine as seen by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.10 |
| headers | Components of the header section of request and response messages | Host: login.example.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0 Authentic8/1.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nReferer: https://login.example.com/config/login_verify2?&.src=ym\r\nDNT: 1\r\nConnection: keep-alive\r\n" |
| bypass_type | Type of URL bypass | isolate list or bypass list |
| domain | The domain of the source website | "example.com" in "https://example.com:81/path?p=v" |
| session_id | An opaque string that identifies the Silo for Safe Access or Silo for Research session | 20c33d188fd56351cc451d7819cb2681 |
| org_id | The opaque string identifier of the Silo organization | db51b9038ddcxyz12345c4628bcb8ee1 |
| path | The path of the URL | "/path" in "https://example.com:81/path?p=v" |
| seq_id | Sequence number of log entry | 12627567 |
| url | Website address | https://login.example.com/ |
| primary_session_id | Identifier of the primary session when the event was logged in a subsession (for example a Toolbox as an App subsession, whose session_id carries a :1 suffix). Empty for events in the primary session | bd1dfccc8b4c98c79085d78b0aab96e6 |
| tab_id | Browser tab identifier within the session. For some events this is the tab in focus when the event was logged | 1843 |
| query | The query of the URL | "p=v" in "https://example.com:81/path?p=v" |
Log Type: LAUNCHER (Launcher Shortcuts)
Log information pertaining to Launcher activities: launching a session from a user-created shortcut, and creating, updating or deleting one. Shortcuts provisioned by a Silo Admin are not logged
On an Update, each setting that changed is logged twice: the field holds the new value and the matching field ending in _old holds the previous value (for example network_type and network_type_old). Settings that did not change are omitted, and name_old appears only on a rename
Field Name | Definition | Sample Result |
| type | Log type identifier | LAUNCHER |
| user_id | The opaque string identifier of the Silo account | c8cd4252f8b15bdbc9c3e7c53d73f562 |
| org_id | The opaque string identifier of the Silo organization | 64bb2da94d49648b75e3b3b82338086e |
| username | The login name of the Silo account that initiated the session | silotestaccount |
| session_id | An opaque string that identifies the Silo for Safe Access or Silo for Research session | f1b3310c0422f847446fe7661d896c6a |
| client_ip | The IP address of the local machine as seen by Authentic8. This is frequently the NAT address of the local network rather than the actual IP address of the local machine | 203.0.113.10 |
| create_ts | The floating-point UNIX Epoch time of the log event creation | 1411481216.764143 |
| action | Launcher action performed | Launch, Create, Update or Delete |
| name | Label of the launch type | One Time Launch |
| fingerprint | Browser and OS fingerprint of the client environment | Chrome on Linux |
| egress_region | Selected egress node’s geographic region | World / Region / Country / City |
| egress_availability | Whether the selected egress node was shared or private | Shared or Private |
| dark_web_enabled | Indicates if the Dark Web option was enabled during the launch | True or false |
| network_type | Egress node type selected | Any egress node type, Data Center, ISP, Mobile - Fixed Wireless or Mobile - Wireless Carrier |
| browser_persistence_enabled | Whether browsing data is saved between sessions | True or false |
| sovereign_enabled | Whether Sovereign Access egress is used (only for organizations with Sovereign Access) | True or false |
| primary_session_id | Identifier of the primary session when the event was logged in a subsession (for example a Toolbox as an App subsession, whose session_id carries a :1 suffix). Empty for events in the primary session | bd1dfccc8b4c98c79085d78b0aab96e6 |
| seq_id | Sequence number of log entry | 12627567 |
| *_old | Previous value of a setting changed by an Update (name_old, fingerprint_old, egress_region_old, egress_availability_old, dark_web_enabled_old, network_type_old, browser_persistence_enabled_old, sovereign_enabled_old) | network_type_old: ISP |
Log Type: LOCATION CHANGE (Address Bar Navigation)
Log information pertaining to location changes detected in the address bar. Websites accessed via Google search queries are also tracked
Field Name | Definition | Sample Result |
| client_ip | The IP address of the local machine as seen as by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.10 |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411481216.764143 |
| user_id | The opaque string identifier of the Silo account | db51b9038ddc66641381c4628bcb8ee1 |
| domain | The domain name of the URL | www.google.com |
| org_id | The opaque string identifier of the Silo organization | 64bb2da94d49648b75e3b3b82338086e |
| path | The path of the URL | /maps/search/news/@34.736297,-84.007953,5z/data=!3m1!4b1 |
| port | The Network port of the URL | 80 or 443 |
| query | The query of the URL | gws_rd=ssl#q=cats |
| scheme | The protocol specifier in a URL | usually http or https |
| seq_id | Sequence number of log entry | 12988378 |
| session_id | An opaque string that identifies the Silo for Safe Access session | c516a4417c72673478dea4186ea6d35e |
| type | Log type | LOCATION CHANGE |
| url | Website address | https://www.google.com/?gws_rd=ssl#q=cats |
| username | The login name of the Silo account who initiated the session | silotestaccount |
| primary_session_id | Identifier of the primary session when the event was logged in a subsession (for example a Toolbox as an App subsession, whose session_id carries a :1 suffix). Empty for events in the primary session | bd1dfccc8b4c98c79085d78b0aab96e6 |
| tab_id | Browser tab identifier within the session. For some events this is the tab in focus when the event was logged | 1843 |
Log Type: NEXUS (Nexus AI)
Records individual messages exchanged in Nexus AI assistant conversations within a Silo session. Each log entry represents a single message, either sent by the user or generated by the AI assistant, along with metadata about the session and toolbox configuration used.
The chat_name and text fields contain conversation content and are recorded only when Log Encryption is enabled
Field Name | Definition | Sample Result |
| client_ip | The IP address of the local machine as seen by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.40 |
| conversation_id | Unique identifier for the Nexus AI conversation thread | 3f2a1b9c-7d4e-4a6b-8c5d-1e2f3a4b5c6d |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411481216.764143 |
| message_type | Indicates whether the message originated from the user or was generated by the AI assistant | user; assistant |
| mime_type | MIME type of content uploaded to the conversation; empty for text-only messages | image/png |
| org_id | The opaque string identifier of the organization | 64bb2da94d49648b75e3b3b82338086e |
| org_name | The full organizational hierarchy path of the user account | Example Org |
| seq_id | Sequential identifier for the log entry | 4292355809 |
| session_id | Session identifier; includes a version suffix separated by a colon | bd1dfccc8b4c98c79085d78b0aab96e6:1 |
| toolbox_name | Name of the Nexus AI toolbox configuration used for the conversation | Workstation |
| type | Log classification | NEXUS |
| user_id | The opaque string identifier of the Silo account | a62f8860346650380e09d366457e3751 |
| username | The login name of the Silo account | silotestaccount |
| chat_name | Title of the Nexus AI conversation. Requires Log Encryption | unnamed chat |
| text | Text of the message (the user's prompt or the assistant's reply, per message_type). Requires Log Encryption | Summarize this page |
| primary_session_id | Identifier of the primary session when the event was logged in a subsession (for example a Toolbox as an App subsession, whose session_id carries a :1 suffix). Empty for events in the primary session | bd1dfccc8b4c98c79085d78b0aab96e6 |
Log Type: POST DATA (Form Submissions)
POST data (form posts only) may contain confidential and sensitive information — Log Encryption must be enabled in order to record this log type. The POST method specifies a destination, but the response page is usually different than the target of the POST. Not all form posts result in a traditional post, and it may not always map to a URL entry. By design, Silo for Safe Access does not record all XHR posts because this would result in a large amount of irrelevant data
Field Name | Definition | Sample Result |
| client_ip | The IP address of the local machine as seen as by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.10 |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411481216.764143 |
| postData | POST data log entries | actual data blog |
| domain | The domain name of the URL | "example.com" in "https://example.com:81/path?p=v" |
| org_id | The opaque string identifier of the Silo organization | 64bb2da94d49648b75e3b3b82338086e |
| path | The path of the URL | "/path" in "https://example.com:81/path?p=v" |
| port | The Network port of the URL | "81" in "https://example.com:81/path?p=v". If port would have been 80 or 443, this is null. |
| query | The query of the URL | "p=v" in "https://example.com:81/path?p=v" |
| scheme | The protocol specifier in a URL | usually http or https |
| seq_id | Sequence number of log entry | 12627567 |
| session_id | An opaque string that identifies the Silo for Safe Access or Silo for Research session | f1b3310c0422f847446fe7661d896c6a |
| type | Log type | POST DATA |
| url | Website address | https://login.example.com/ |
| username | The login name of the Silo account who initiated the session | silotestaccount |
| tab_id | Browser tab identifier within the session; the tab that made the request | 1843 |
Log Type: PRINT (Printing)
Log information pertaining to printing activities
Field Name | Definition | Sample Result |
| client_ip | The IP address of the local machine as seen by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.20 |
| mime_type | the file mime type | text/html |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411481216.764143 |
| org_id | The opaque string identifier of the Silo organization | 4ca51853dcfef8c08a4bbbf168af7f3e |
| seq_id | log entry sequence ID | 13382766 |
| session_id | An opaque string that identifies the Silo for Safe Access or Silo for Research session | f1b3310c0422f847446fe7661d896c6a |
| type | Log type | |
| username | The login name of the Silo account who initiated the session | silotestaccount |
| url | Website address | https://login.example.com/ |
| domain | The domain name of the URL | "example.com" in "https://example.com:81/path?p=v" |
| path | The path of the URL | "/path" in "https://example.com:81/path?p=v" |
| operation | The operation performed | PDF to device or PDF to storage |
| scheme | The protocol specifier in a URL | usually http or https |
| port | The Network port of the URL | "81" in "https://example.com:81/path?p=v". If the Network port is 80 or 443, this value would be null |
| tab_id | Browser tab identifier within the session. For some events this is the tab in focus when the event was logged | 1843 |
| query | The query of the URL | "p=v" in "https://example.com:81/path?p=v" |
Log Type: SESSION (Silo Sessions)
Log information pertaining to Silo for Safe Access and Silo for Research (Toolbox) sessions
Field Name | Definition | Sample Result |
| client_ip | The IP address of the user's machine as seen as by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.10 |
| client_machine_name | System name retrieved from local machine factors (if a system has obscured machine factors, the obscured name will be shown) | MacBook Pro |
| client_timezone | The timezone of either the host session and Toolbox session | America/New_York |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411568275.720287 |
| egress_ip | IP address of the egress location | 198.51.100.22 |
| egress_location | Region identifier for the egress location | Country (country code) |
| execution_location | Region identifier for the Toolbox as an App session | Country (country code) |
| execution_server_ip | IP address of the server hosting the session | 198.51.100.87 |
| execution_server_name | Hostname of the server hosting the Toolbox as an App session | app-server-01.example.com |
| exit_reason | The reason for the session termination | User Exit |
| languages | The language set under Browser Fingerprint Management | en |
| org_id | The opaque string identifier of the Silo organization | 64bb2da94d49648b75e3b3b82338086e |
| seq_id | Sequence number of log entry | 12630308 |
| session_end_time | UNIX Epoch time of session end | 1411568275 |
| session_id | An opaque string that identifies the Silo for Safe Access session | bd1dfccc8b4c98c79085d78b0aab96e6 |
| session_start_time | UNIX Epoch time of session start | 1411567938 |
| session_type | Type of sessions logged | Silo; Toolbox |
| type | Log type | SESSION |
| toolbox_name | Name of the Toolbox | Research Toolbox |
| user_agent_label | The selected User Agent | Chrome (Windows) |
| user_agent_value | The complete Browser Fingerprint information | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome /125.0.0.0 Safari/537.36 |
| user_id | The opaque string identifier of the Silo account | dbc9c3e7c5c8cd4252f8b15b3d73f562 |
| user_type | Indicator of standard user or Silo Administrator | admin |
| username | The login name of the Silo account who initiated the session | silotestaccount |
| primary_session_id | Unique identifier of the Authentic8 session. If this is not null, the log entry was made in a subsession, so this identifies the primary session. This would typically be non-null in a Toolbox as an App subsession | "primary_session_id": "bd1dfccc8b4c98c79085d78b0aab96e6" Toolbox as an App session "session_id": "bd1dfccc8b4c98c79085d78b0aab96e6:1" |
| browse_context | Settings of the browsing context used to launch the session, as JSON. Present only for sessions launched through the External API, and recorded only when Log Encryption is enabled | {"session_type":"silo","urls":["https://www.example.com"],"egress_region":"World-Region"} |
Log Type: SMS (SMS Inbox)
Log information pertaining to SMS Inbox activities
Message received entries are logged when a message arrives and carry no user or session fields. Message deleted entries are logged when a user deletes a message from the SMS Inbox
The content, source_number, destination_number, imei, imsi and iccd fields are recorded only when Log Encryption is enabled. The content field also requires SMS capture to be enabled in the Log Encryption policy
Field Name | Definition | Sample Result |
| action | SMS Inbox activity | Message received or Message deleted |
| content | Text of the SMS message | Your verification code is 123456 |
| source_number | Phone number that sent the message | +15555550123 |
| destination_number | Silo SMS number that received the message | +15555550199 |
| receive_ts | Time the message was received | 2023-02-11 16:22:27 |
| delete_ts | Time the message was deleted (Message deleted only) | 2023-02-12 09:15:03 |
| imei | Hardware identifier of the receiving modem | 356938035643809 |
| imsi | Subscriber identifier of the receiving SIM | 310150123456789 |
| iccd | Serial number (ICCID) of the receiving SIM | 8901260123456789012 |
| client_ip | The IP address of the local machine as seen by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.10 |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411481216.764143 |
| org_id | The opaque string identifier of the Silo organization | 64bb2da94d49648b75e3b3b82338086e |
| primary_session_id | Identifier of the primary session when the event was logged in a subsession (for example a Toolbox as an App subsession, whose session_id carries a :1 suffix). Empty for events in the primary session | bd1dfccc8b4c98c79085d78b0aab96e6 |
| seq_id | Sequence number of log entry | 219995045627 |
| session_id | An opaque string that identifies the Silo for Safe Access or Silo for Research session | f1b3310c0422f847446fe7661d896c6a |
| type | Log type | SMS |
| user_id | The opaque string identifier of the Silo account | c8cd4252f8b15bdbc9c3e7c53d73f562 |
| username | The login name of the Silo account who initiated the session | silotestaccount |
Log Type: TRAFFICMAN (Traffic Manager)
Log information pertaining to Traffic Manager. An entry is logged when a page navigation matches a Traffic Manager proxy rule or header rule configured by a Silo Admin. Proxy and header matches are logged as separate entries
Field Name | Definition | Sample Result |
| client_ip | The IP address of the local machine as seen by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.10 |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411481216.764143 |
| header_rule_likely_match | The header rule or rules that matched, as JSON, including the header value inserted | [{"kind":"domain","match":"example.com","name":"X-Example","value":"abc123","url":"https://www.example.com/"}] |
| org_id | The opaque string identifier of the Silo organization | 64bb2da94d49648b75e3b3b82338086e |
| primary_session_id | Identifier of the primary session when the event was logged in a subsession (for example a Toolbox as an App subsession, whose session_id carries a :1 suffix). Empty for events in the primary session | bd1dfccc8b4c98c79085d78b0aab96e6 |
| proxy_rule_likely_match | The proxy rule that matched, as JSON | {"condition":"dnsDomainIs","match":"example.com","return":"PROXY proxy.example.com:8080","url":"https://www.example.com/"} |
| seq_id | Sequence number of log entry | 12627567 |
| session_id | An opaque string that identifies the Silo for Safe Access or Silo for Research session | f1b3310c0422f847446fe7661d896c6a |
| type | Log type | TRAFFICMAN |
| url | Website address that matched the rule | https://www.example.com/ |
| user_id | The opaque string identifier of the Silo account | c8cd4252f8b15bdbc9c3e7c53d73f562 |
| username | The login name of the Silo account who initiated the session | silotestaccount |
| scheme | The protocol specifier in a URL | usually http or https |
| domain | The domain name of the URL | "example.com" in "https://example.com:81/path?p=v" |
| port | The Network port of the URL | "81" in "https://example.com:81/path?p=v". If the Network port is 80 or 443, this value would be null |
| path | The path of the URL | "/path" in "https://example.com:81/path?p=v" |
| query | The query of the URL | "p=v" in "https://example.com:81/path?p=v" |
Log Type: TRANSLATION (Page Translation)
Log information pertaining to page or context translation within Silo for Safe Access and Silo for Research sessions
Field Name | Definition | Sample Result |
| client_ip | The IP address of the local machine as seen as by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.30 |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1427175692.787294 |
| length | Number of characters translated | 28283 |
| service | Translation service/api used | |
| org_id | The opaque string identifier of the Silo organization | 64bb2da94d49648b75e3b3b82338086e |
| source | Source language translated from | null or English |
| target | Destination language translated to | null or Foreign Language |
| translation_type | Type of translation processed | selection, ad hoc or full_page |
| seq_id | Sequence number of log entry | 24744695 |
| session_id | An opaque string that identifies the Silo for Safe Access or Silo for Research session | 20d33f188fe56351dd451d7819da2681 |
| type | Log type | TRANSLATION |
| url | Website address OR empty for text selection | http://www.cnbc.com/id/102528156 |
| username | The login name of the user who initiated the session | silotestaccount |
| tab_id | Browser tab identifier within the session. For some events this is the tab in focus when the event was logged | 1843 |
Log Type: UPLOAD (File Uploads)
Log information pertaining to file upload activities, along with the file details
Field Name | Definition | Sample Result |
| client_ip | The IP address of the local machine as seen as by Authentic8. This is frequently the NAT address of the network rather than the actual IP address of the local machine | 203.0.113.10 |
| bytes | Uploaded file size in bytes | 4403457 |
| target | Path of the temporary transfer destination on the Authentic8 server | /tmp/upload-0/37a9be56c22de501a6fee0d6bd70cf26-Logs.txt" |
| contentType | Data type of the uploaded file | image/png |
| hash | SHA-256 hash of the file in hex | c7ebfeb1a6431d34e19561c0e50cc41d262d17ab180800703ad2a65a29643c72 |
| url | Destination of the uploaded file | https://mail.google.com/mail/u/0/?ui=2&ik=9f0c44d8c2&view=up&fcid=i0d86bs2dkg5&rt=j&act= fup&oauth=AG9B_P_EV24vE6QEP8oX6jRL1kF-%7Cb54078f6cd20dc2a&attid=f_i0d86brx0 |
| username | The login name of the Silo account who initiated the session | silotestaccount |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411408790.093198 |
| org_id | The opaque string identifier of the Silo organization | 64bb2da94d49648b75e3b3b82338086e |
| seq_id | Sequence number of log entry | 12625195 |
| session_id | An opaque string that identifies the Silo for Safe Access or Silo for Research session | f9567c931b7dc6a4e5299e8c862011fe |
| type | Log type | UPLOAD |
| scheme | The protocol specifier of the destination site | https |
| domain | The domain of the website file uploaded to | mail.google.com |
| port | Network port of the source website | 443 |
| path | Source path of the website | /attachment/u/0/ |
| query | Source query of the uploaded file | ui=2&ik=9f0c44d8c2&view=up&fcid=i0d86bs2dkg5&rt=j& act=fup&oauth=AG9B_P_EV24vE6QEP8oX6jRL1kF-%7Cb54078f6cd20dc2a&attid=f_i0d86brx0 |
| action | Where the file was transferred from and to | clientToWeb (local machine to website), cloudToWeb (Cloud Secure Storage to website), clientToCloud (local machine to Cloud Secure Storage) |
| file_id | The unique Cloud Secure Storage file identifier, when storage is involved | 3b94ae0ebcdc7e926ddddcddfd8cf18c |
| tab_id | Browser tab identifier within the session; the tab that made the request | 1843 |
| user_id | The opaque string identifier of the Silo account | c8cd4252f8b15bdbc9c3e7c53d73f562 |
Log Type: URL (Websites Visited)
Log information pertaining to visited websites and navigation details
More Info: To enable the micro_category and macro_category fields, ensure that the URL Category Filtering policy is configured in the Silo Admin Console. No categories need to be selected for Allow or Block settings
Field Name | Definition | Sample Result |
| client_ip | The IP address of the local machine as seen as by Authentic8. This is frequently the NAT address of the local network rather than the actual IP address of the local machine | 203.0.113.10 |
| create_ts | The floating point UNIX Epoch time of the log event creation | 1411481216.764143 |
| domain | The domain name of the URL | "example.com" in "https://example.com:81/path?p=v" |
| headers | Components of the header section of request and response messages | Host: login.example.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:30.0) Gecko/20100101 Firefox/30.0 Authentic8/1.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate\r\nReferer: https://login.example.com/config/login_verify2?&.src=ym\r\nDNT: 1\r\nConnection: keep-alive\r\n" |
| method | HTTP request method | GET, POST |
| org_id | The opaque string identifier of the Silo organization | 64bb2da94d49648b75e3b3b82338086e |
| page_title | The title of a web page, the text shown in the browser tab or search engine result | Submit a ticket: Authentic8 Support |
| path | The path of the URL | "/path" in "https://example.com:81/path?p=v" |
| port | The Network port of the URL | "81" in "https://example.com:81/path?p=v". If the Network port is set to 80 or 443, this value would be null |
| response_code | The HTTP response code from the website | usually 200 |
| response_headers | Components of the header section of request and response messages | Date: Tue, 23 July 2025 14:13:37 GMT\r\nP3P: policyref=\"http://info.example.com/w3c/p3p.xml\", CP=\"CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV\"\r\nX-Frame-Options: DENY\r\nCache-Control: private\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nContent-Length: 32723\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Security-Policy-Report-Only: default-src https: 'unsafe-inline' 'unsafe-eval'; report-uri http://b.login.example.com/beacon/csp\r\nAge: 0\r\nConnection: close\r\nStrict-Transport-Security: max-age=15552000\r\nServer: ATS\r\n" |
| response_size | If known, the size of the response in bytes. Otherwise, null | 3655 |
| scheme | The protocol specifier in a URL | usually http or https |
| seq_id | Sequence number of log entry | 12627567 |
| session_id | An opaque string that identifies the Silo for Safe Access or Silo for Research session | f1b3310c0422f847446fe7661d896c6a |
| primary_session_id | Unique identifier of the Silo for Safe Access session. If this is not null, the log entry was made in a subsession, so this identifies the primary session. This would typically be non-null in a Toolbox as an App subsession | "primary_session_id": "bd1dfccc8b4c98c79085d78b0aab96e6" Toolbox as an App session "session_id": "bd1dfccc8b4c98c79085d78b0aab96e6:1" |
| type | Log type | URL |
| url | Website address | https://login.example.com/ |
| user_id | The opaque string identifier of the Silo account | c8cd4252f8b15bdbc9c3e7c53d73f562 |
| username | The login name of the Silo account who initiated the session | silotestaccount |
| query | The query of the URL | "p=v" in "https://example.com:81/path?p=v" |
| micro_category | Specific filtering category reason | Social Networking |
| macro_category | General filtering category name | Productivity Drains |
| egress_ip | Public IP address the session browsed from. Empty when the request was routed through a proxy | 198.51.100.22 |
| egress_location | Egress location of the session | World / Region / Country |
| session_type | Type of session that made the request | Silo Chromium or Toolbox Chromium |
| tab_id | Browser tab identifier within the session; the tab that made the request | 1843 |
Please contact Support for any additional questions