A user switched into another user account
| Parameter | Value |
|---|
| Subject | user |
| Activity | switch |
| Activity Type | user-switch |
| Pretty Name | User Switch |
| Success | Fail |
|---|
account-switch
| account-switch
|
The possible fields for this activity type will vary depending on whether the activity was a success or a fail.
| Field | Core | Detection | Informational |
|---|
| dest_user_type | | ✓ | |
| source_user_entity_id | | | |
| user_type | | ✓ | |
| source_device_entity_id | | | |
| domain | | | ✓ |
| domain_user_name | | | |
| src_host | | ✓ | |
| user | ✓ | ✓ | |
| Field | Core | Detection | Informational |
|---|
| dest_user_type | | ✓ | |
| failure_code | | ✓ | |
| user_type | | ✓ | |
| domain | | | ✓ |
| domain_user_name | | | |
| failure_reason | | ✓ | |
| src_host | | ✓ | |
| user | ✓ | ✓ | |