Variables available in audit notification channels

Access Manager provides a comprehensive set of variables you can use in your audit notifications.

See the guides on PowerShell auditing scripts and HTML and JSON audit templates to learn how to use these variables in your audit scripts and templates.

Global properties

Property	Format/Type	Description
DateTime	string	The current date and time, in local server time
DateTimeUtc	string	The current date and time, in UTC time

Request element

This group of attributes represents the incoming request

Property	Format/Type	Description
Request.Target	string	The name of the target that the user requested access to
Request.TargetType	Computer or Role	The type of resource the user requested access to
Request.Reason	string	The reason that the user provided when requesting access
Request.IPAddress	IPv4 or IPv6 address string	The IP address of requestor
Request.HostName	string	The host name of the requestor, if available via reverse DNS lookup
Request.RequestedDuration	TimeSpan	The requested duration of access

Response element

This group of attributes represents the result of the access evaluation

Property	Format/Type	Description
Response.Target	string	The name of the target that the access request was evaluated against
Response.TargetType	Computer or Role	The type of resource that was evaluated
Response.IsSuccess	true or false	Indicates if access was granted to the resource
Response.IsFailure	true or false	Indicates if access was denied to the resource
Response.IsApproved	true or false	Indicates if access was approved to the resource
Response.NotificationChannels	string	A comma-separated list of audit channels IDs that apply to this access response
Response.MatchedRule	string	The ID of the authorization rule that was used to make the access decision
Response.MatchedRuleDescription	string	The 'description' field from the authorization rule that was used to make the access decision
Response.ExpireAfter	TimeSpan	The duration of time that access was granted for
Response.Code	Success, NoMatchingRuleForTarget, NoMatchingRuleForUser, ExplicitlyDenied, UserRateLimitExceeded, IpRateLimitExceeded	The result of the authorization decision. Codes other than Success represent an 'access denied' response.
Response.AccessType	None, LocalAdminPassword, LocalAdminPasswordHistory, Jit, Bitlocker, DeviceLogin, DeviceElevation	The type of access that was granted
Response.AccessTypeDescription	string	The friendly name of the type of access that was granted
Response.AccessExpiryDate	DateTime	The date and time when the user's access will expire, expressed in local server time
Response.Message	string	A user-friendly message describing the outcome of the access decision
Response.WorkflowResult	None, Approved, Rejected, Pending	The approval result of the workflow operation

User element

This group of attributes represents the user who performed the access request

Property	Format/Type	Description
User.Username	string	The samAccountName of the user requesting access
User.FullyQualifiedName	string	The user's username in domain\username format
User.DisplayName	string	The display name of the user
User.Sid	string	The user's security identifier
User.EmailAddress	string	The user's email address

Role element

If the authorization request was for a role, then this property will be populated with information about the role authorization rule

Property	Format/Type	Description
Role.Name	string	The name of the role
Role.Description	string	The description of the role
Role.MaximumAllowedDuration	TimeSpan	The maximum amount of time that the user can request for the role according to the authorization rule

Computer element

If the authorization request was for a computer, then this property will be populated with information about the computer

Property	Format/Type	Description
Computer.Name	string	The short name of the computer
Computer.Description	string	The description of the computer
Computer.FullyQualifiedName	string	The name of the computer in domain\computer format
Computer.DnsHostName	string	The computer's DNS host name, if known
Computer.DisplayName	string	The computer's display name
Computer.ObjectId	string	A unique identifier for the computer
Computer.Sid	string	The computer's security identifier
Computer.AuthorityType	ActiveDirectory, AzureActiveDirectory, Ams	The authoritative directory where this computer is located
Computer.AuthorityId	string	The ID of the authority where the computer is located
Computer.AuthorityDeviceId	string	The unique ID for the device, specific to the device's authority

RapidLapsLogin element

If the authorization request was for workstation login/unlock via RapidLAPS, then this property will be populated with information about the RapidLAPS login request

Property	Format/Type	Description
RapidLapsLogin.Type	string	The type of RapidLAPS request, will always be Logon
RapidLapsLogin.DeviceLoginAccountName	string	The local account used for RapidLAPS login
RapidLapsLogin.UsageScenario	string	A description of where in the operating system the request occurred from (e.g., Logon, UnlockWorkstation)
RapidLapsLogin.Responses	Response[]	See below
RapidLapsLogin.LoggedOnUsers	LoggedOnUser[]	See below

RapidLapsElevation element

If the authorization request was for UAC elevation via RapidLAPS, then this property will be populated with information about the RapidLAPS elevation request

Property	Format/Type	Description
RapidLapsElevation.Type	string	The type of RapidLAPS request, will always be "Elevation"
RapidLapsElevation.DeviceLoginAccountName	string	The local account used for RapidLAPS elevation
RapidLapsElevation.ComOperationName	string	The name of the COM operation the user is attempting to elevate (if applicable)
RapidLapsElevation.SessionID	string	The requesting user's Session ID
RapidLapsElevation.ProcessID	string	The parent process ID of the elevation (if applicable)
RapidLapsElevation.ProcessName	string	The parent process name of the elevation (if applicable)
RapidLapsElevation.ElevationType	string
RapidLapsElevation.RequesterUsername	string	The username of the user requesting elevation
RapidLapsElevation.RequesterSid	string	The security identifier (SID) of the user requesting elevation
RapidLapsElevation.RequesterDisplayName	string	The display name of the user requesting elevation
RapidLapsElevation.ProductName	string	The product name of the executable being elevated (if applicable)
RapidLapsElevation.Publisher	string	The publisher name of the executable being elevated (if applicable)
RapidLapsElevation.FileDescription	string	The file description of the executable being elevated (if applicable)
RapidLapsElevation.CredUIFlags	string	The internal flags passed to CredUI (e.g., the credential selector in UAC). GitHub
RapidLapsElevation.ConsentUIFlags	string	The internal flags passed to ConsentUI (e.g., UAC). For more information, see our windows-credential-provider repository on GitHub
RapidLapsElevation.UsageScenario	string	A description of where in the operating system the request occurred from; will always be "CredUI"
RapidLapsElevation.Responses	Response[]	See below
RapidLapsElevation.LoggedOnUsers	LoggedOnUser[]	See below
RapidLapsElevation.Hashes	string[]	A list of hashes of the executable the user is attempting to run
RapidLapsElevation.Signature	Signature	Contains signing information

Signature data structure

The RapidLapsElevation.Signature field contains information about the code signing of the executable run by the user.

Property	Format/Type	Description
State	string	The status of the digital signature (e.g. Valid, Invalid, etc.)
Signers	Signer[]	A list of each code signing certificate used to sign the executable

Signer data structure

The Signer data structure is used to represent an entity that has digitally singed an executable.

Property	Format/Type	Description
SignerCertificate	SignatureCertificate	The certificate used for code signing
CounterSignerCertificates	SignatureCertificate[]	All countersigner certificates used for code signing

SignatureCertificate data structure

The SignatureCertificate data structure represents the elements of an X.509 code signing certificate.

Property	Format/Type	Description
Thumbprint	string	The certificate's thumbprint
SerialNumber	string	The certificate's serial number
Subject	string	The certificate's subject
DisplayName	string	The certificate's display name
Issuer	string	The certificate issuer's distinguished name
IssuerDisplayName	string	The certificate issuer's display name
NotBefore	DateTime	The issuance date of the certificate
NotAfter	DateTime	The expiry date of the certificate

Response data structure

The RapidLapsLogin.Responses and RapidLapsElevation.Responses fields contain a list of responses to any prompts defined in the RapidLAPS policy.

Property	Format/Type	Description
Id	string	Unique identifier for the prompt message
Label	string	The human-readable label for the prompt
Type	string	The type of prompt (e.g., Text, Checkbox, etc.)
Value	string	The value provided as an answer to the prompt

LoggedOnUser data structure

The RapidLapsLogin.LoggedOnUsers and RapidLapsElevation.Responses fields contain a list of users logged into the machine at the time of the request.

Property	Format/Type	Description
UserName	string	The user's username
SessionID	integer	The user's Windows Session ID
IsRemoteSession	boolean	Indicates if the user was logged in remotely