duo access security

Expression

product = "duo access security"

Fields

Field	Core	Detection	Informational
result			✓
src_ip		✓
os			✓
location_country			✓
location_city			✓
location_state			✓
user_agent			✓
object			✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
app-activity	auth_method	Default			✓
	domain	Default			✓
	domain_user_name
	user	Default	✓	✓
app-authentication	new_enrollment	Default			✓
	session_id	Default			✓
app-login	additional_info	Default			✓
user-create	additional_info				✓
	factor				✓
	alert_type				✓
vpn-login	additional_info	Default			✓
	service_name	Default			✓