Skip to content

Actor

The Actor object contains details about the user, role, application, service, or process that initiated or performed a specific activity.

Attributes

Section titled “Attributes”

process

  • Type: process
  • Requirement: recommended

The process that initiated the activity.

user

  • Type: user
  • Requirement: recommended

The user that initiated the activity or the user context from which the activity was initiated.

app_name

  • Type: string_t
  • Requirement: optional

The client application or service that initiated the activity. This can be in conjunction with the user if present. Note that app_name is distinct from the process if present.

app_uid

  • Type: string_t
  • Requirement: optional

The unique identifier of the client application or service that initiated the activity. This can be in conjunction with the user if present. Note that app_name is distinct from the process.pid or process.uid if present.

authorizations

Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.

idp

  • Type: idp
  • Requirement: optional

This object describes details about the Identity Provider used.

invoked_by

  • Type: string_t
  • Requirement: optional

The name of the service that invoked the activity as described in the event.

session

  • Type: session
  • Requirement: optional

The user session from which the activity was initiated.

Constraints

Section titled “Constraints”

At least one of: process, user, invoked_by, session, app_name, app_uid

Used By

Section titled “Used By”