Event Actor Fields
DEVICE and
AUDIT events may include an
actor block that describes the source of the event. If present, it contains the fields below:
"actor": {
"type": "ADMIN",
"id": "d527d274-483f-4403-ae29-b9397c56bf47"
}| Field | Type | Description |
|---|---|---|
|
enum | The type of actor triggering the change. One of
ADMIN, SYSTEM, DEVICE. |
|
String | Unique ID that identifies the actor triggering the change. This value is omitted if the
actor:type is
SYSTEM. |
