Blue41 Detections and Audit
Overview
Blue41 secures AI agents at runtime. This integration collects two Blue41 streams: detections, as firing, no-data and resolve transitions, and the audit trail of configuration, access-control and data-access actions on the Blue41 platform.
- Vendor: Blue41
- Supported environment: Blue41-hosted (a dedicated deployment per customer) or self-hosted
- Detection based on: Alert, Audit
- Supported application or feature: AI agent detections, platform audit trail
The full trace history stays in Blue41. Each event's event.url links back to it: the trace and span for a detection, the rule overview when no single span applies, or the audit log for an audit record.
Prerequisites
- A Blue41 deployment.
- Permission to create an intake in the target Sekoia community.
Blue41 sends events directly to Sekoia over HTTPS. No collector or polling connector is required.
Configure
Create the intake in Sekoia
- Open Intakes in the Operations Center and click New intake.
- Search for and select Blue41 Detections and Audit.
- Enter a name, select the entity, and save the intake.
- Copy the intake key from the intake details page.
Allow time for a newly created intake to become available to the HTTPS collector before enabling delivery. During activation, the collector can temporarily reject the new key.
See Manage intakes for more information.
Enable delivery from Blue41
For a deployment hosted by Blue41, send the Blue41 team the intake key through your agreed secure channel, along with your Sekoia region if it is not FRA1. The Blue41 team configures delivery.
For a self-hosted deployment, set these variables on the Blue41 platform:
| Variable | Value |
|---|---|
SEKOIA__INTAKE_KEY |
The intake key. |
SEKOIA__INTAKE_URL |
https://intake.sekoia.io/batch for FRA1. For other regions, https://intake.<region>.sekoia.io/api/v1/intake-http/batch. |
EXPORT__UI_BASE_URL |
The base URL of your Blue41 deployment. Without it, events carry no event.url. |
Once delivery is enabled, new detections and audit records are forwarded automatically. Earlier activity is not backfilled.
Enable the detection rules
Blue41 detections arrive as events. A Sekoia alert is raised only when an event matches a detection rule.
The Rules Catalog provides one built-in rule per Blue41 severity, because severity is set on a Sekoia rule rather than on the matched event:
| Blue41 severity | event.severity |
Built-in rule |
|---|---|---|
| critical | 99 |
Blue41 Detection Critical Severity |
| error | 75 |
Blue41 Detection Error Severity |
| warning | 50 |
Blue41 Detection Warning Severity |
| info | 25 |
Blue41 Detection Info Severity |
Detections with no Blue41 severity, such as no-data detections, or with any other value score 25 and match the info rule.
Search the Rules Catalog for Blue41 and enable the four rules. Whether they are enabled automatically depends on the effort level configured for your community.
The rules match firing and no-data detections only. Resolves and audit records never raise alerts. Each Blue41 detection gets its own Sekoia alert, grouped on rule.id and blue41.alert.fingerprint.
Verify collection
- Trigger a detection in Blue41, or perform an audited action such as updating an alert rule.
- Open Sekoia's events page, search for
sekoiaio.intake.uuid:"<intake UUID>"using the UUID of your Blue41 intake, and use a time range covering the activity. - Verify the event timestamp,
event.action,rule.name(detections) oruser.name(audit records), andevent.urlagainst the activity in Blue41. - For a firing or no-data detection, check that the matching rule raised one Sekoia alert.
A resolve appears on the events page but never raises a second alert.
Interpret the events
event.dataset separates the two streams: blue41.detection for detections and blue41.audit for audit records.
| Event | event.kind |
event.action |
event.outcome |
|---|---|---|---|
| Detection fires | alert |
alert-fired |
unknown |
| Detection fires because data stopped arriving | alert |
alert-no-data |
unknown |
| Detection resolves | event |
alert-resolved |
unknown |
| Audit record | event |
The audited verb, for example create, read, update or delete |
success or failure |
log.level carries the Blue41 severity, and event.severity its score. rule.id and rule.name identify the Blue41 rule. trace.id and span.id identify the matched trace and span.
Blue41 maps AI agent concepts onto these ECS fields so Sekoia can build assets and the investigation graph:
| Field | Meaning |
|---|---|
host.name |
The AI agent. |
process.name |
The tool the agent called. |
destination.domain |
The flagged domain, for example a link returned by a tool. |
Audit records carry the actor in user.id, user.email and user.name, and the client in source.ip and user_agent.original.
The format adds these custom fields:
| Field | Meaning |
|---|---|
blue41.event_id |
Blue41 event identifier, stable across redeliveries. Sekoia assigns its own event.id. |
blue41.alert.fingerprint |
Identifies what the detection matched, such as a span. Two rules matching the same span share a fingerprint, so pair it with rule.id. |
blue41.actor.type |
Principal that performed an audited action: user, service_account, system or anonymous. |
blue41.audit.resource_kind |
Kind of resource the audited action targeted, for example rule, dashboard or session. |
blue41.audit.resource_id |
Identifier of the resource the audited action targeted. |
A resolve carries the same rule.id and blue41.alert.fingerprint as the detection it closes. Correlate them on those two fields.
Troubleshooting
| Symptom | Checks |
|---|---|
| No events arrive | Confirm that the intake key and regional URL match, and that a detection or audit record has occurred since delivery was enabled. On a Blue41-hosted deployment, ask the Blue41 team to check delivery errors. |
Sekoia returns a 422 response with INVALID_INTAKE_KEY |
Verify the key and regional URL. If the intake was just created, allow time for activation. Blue41 retries delivery. On a Blue41-hosted deployment, ask the Blue41 team to check delivery errors. |
| Events arrive but parsing fails | Check that the intake uses Blue41 Detections and Audit. Share an anonymized failing event with support. |
| Events arrive but no alert is raised | Check that the Blue41 rule for the event's event.severity is enabled in the Rules Catalog. Resolves and audit records never raise alerts. |
event.url is missing |
On a self-hosted deployment, set EXPORT__UI_BASE_URL. |
Event samples and extracted fields
The following samples use synthetic data.
Raw Events Samples
In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.
More than 5% of support-agent.example.com spans ended in error over the last 15 minutes.
research-agent.example.com used more than its 150k-token budget over the last 15 minutes.
A response from get_customer_kyc (agent: support-agent.example.com) contained sensitive data flagged as PERSON. This may mean personally identifiable or otherwise sensitive information was exposed through a tool's output -- review the trace to confirm whether this was expected.
The injection_scan guardrail flagged the input to read_calendar as a prompt-injection attempt and blocked the call.
A call to get_recent_transactions by support-agent.example.com returned a link to evil.example.com. This may indicate the agent is exposing, following, or being redirected to an unexpected external destination -- worth checking whether this domain is expected for this tool.
URL in tool response received no data since 2026-10-01 09:45:03
URL in tool response receives data again
A call to get_recent_transactions by support-agent.example.com returned a link to evil.example.com. This may indicate the agent is exposing, following, or being redirected to an unexpected external destination -- worth checking whether this domain is expected for this tool.
A call to fetch_invoice by billing-agent.example.com returned a link to cdn.example.net. This may indicate the agent is exposing, following, or being redirected to an unexpected external destination -- worth checking whether this domain is expected for this tool.
alice@example.com (11111111-1111-1111-1111-111111111111) created dashboard (0199e3e1-6b2d-7f35-a9c4-8e1b0d7f2a63)
alice@example.com failed to create session
alice@example.com (11111111-1111-1111-1111-111111111111) updated rule (0199e3c4-5b7a-7d21-9f4e-2a6c8b1d3e57)
alice@example.com (11111111-1111-1111-1111-111111111111) updated rule (0199e3c9-12f0-7a44-b3d8-6e0f9c27a1b4)
updated rule (0199e3d2-8c41-7e09-a5b6-3f7d1e48c920)
alice@example.com (11111111-1111-1111-1111-111111111111) read traces
Detection section
The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.
No related built-in rules was found. This message is automatically generated.
Event Categories
The following table lists the data source offered by this integration.
| Data Source | Description |
|---|---|
API monitoring |
Detections raised on AI agent tool calls and responses observed by Blue41. |
Application logs |
Configuration, access-control and data-access actions performed on the Blue41 platform. |
Transformed Events Samples after Ingestion
This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.
{
"message": "More than 5% of support-agent.example.com spans ended in error over the last 15 minutes.",
"event": {
"action": "alert-fired",
"category": [
"intrusion_detection"
],
"dataset": "blue41.detection",
"kind": "alert",
"module": "blue41",
"outcome": "unknown",
"reason": "A rising error rate usually means a broken tool or dependency.",
"severity": 75,
"type": [
"info"
],
"url": "https://blue41.example.com/alerts/overview?ruleId=0199e3d2-8c41-7e09-a5b6-3f7d1e48c920"
},
"@timestamp": "2026-10-01T09:55:40.284000Z",
"blue41": {
"alert": {
"fingerprint": "15987518118162428587"
},
"event_id": "9bd9960267a2909d402fdc6ee07b01d1be54b38b49d02bf68988946f139cea46"
},
"host": {
"name": "support-agent.example.com"
},
"log": {
"level": "error"
},
"observer": {
"product": "Blue41",
"type": "sensor",
"vendor": "Blue41"
},
"rule": {
"id": "0199e3d2-8c41-7e09-a5b6-3f7d1e48c920",
"name": "Agent error rate above 5%"
}
}
{
"message": "research-agent.example.com used more than its 150k-token budget over the last 15 minutes.",
"event": {
"action": "alert-fired",
"category": [
"intrusion_detection"
],
"dataset": "blue41.detection",
"kind": "alert",
"module": "blue41",
"outcome": "unknown",
"reason": "Runaway token spend often means the agent is looping.",
"severity": 75,
"type": [
"info"
]
},
"@timestamp": "2026-10-01T10:02:11.615000Z",
"blue41": {
"alert": {
"fingerprint": "9008702465939328881"
},
"event_id": "0db13497b8b988d19509d25d651fd4769ea576996ae3c14fc02d203d39cad894"
},
"host": {
"name": "research-agent.example.com"
},
"log": {
"level": "high"
},
"observer": {
"product": "Blue41",
"type": "sensor",
"vendor": "Blue41"
},
"rule": {
"id": "0199e3d7-4e19-7c62-b0a8-5d2f6e91c3a7",
"name": "Agent token spend above budget"
}
}
{
"message": "A response from get_customer_kyc (agent: support-agent.example.com) contained sensitive data flagged as PERSON. This may mean personally identifiable or otherwise sensitive information was exposed through a tool's output -- review the trace to confirm whether this was expected.",
"event": {
"action": "alert-fired",
"category": [
"intrusion_detection"
],
"dataset": "blue41.detection",
"kind": "alert",
"module": "blue41",
"outcome": "unknown",
"reason": "Customer PII should not flow back through tool responses unredacted.",
"severity": 99,
"type": [
"info"
],
"url": "https://blue41.example.com/trace-report/34eea5b65ebd36ad0bb2660fbec7741d?span=7dd49320c9b8535c&alertKey=0199e3c9-12f0-7a44-b3d8-6e0f9c27a1b4-7062205136414075777-1790847771906&startTime=1790846871906&endTime=1790848671906"
},
"@timestamp": "2026-10-01T09:42:51.906000Z",
"blue41": {
"alert": {
"fingerprint": "7062205136414075777"
},
"event_id": "74d2145bcfe1784ceab43dbf91c9d3fd44a53cf5d1d36a3304baa95909978aae"
},
"host": {
"name": "support-agent.example.com"
},
"log": {
"level": "critical"
},
"observer": {
"product": "Blue41",
"type": "sensor",
"vendor": "Blue41"
},
"process": {
"name": "get_customer_kyc"
},
"rule": {
"id": "0199e3c9-12f0-7a44-b3d8-6e0f9c27a1b4",
"name": "PII or secret in tool response"
},
"span": {
"id": "7dd49320c9b8535c"
},
"trace": {
"id": "34eea5b65ebd36ad0bb2660fbec7741d"
}
}
{
"message": "The injection_scan guardrail flagged the input to read_calendar as a prompt-injection attempt and blocked the call.",
"event": {
"action": "alert-fired",
"category": [
"intrusion_detection"
],
"dataset": "blue41.detection",
"kind": "alert",
"module": "blue41",
"outcome": "unknown",
"reason": "A blocked injection attempt is worth reviewing even when the guardrail held.",
"severity": 50,
"type": [
"info"
]
},
"@timestamp": "2026-10-01T09:45:00Z",
"blue41": {
"alert": {
"fingerprint": "5560012398765432000"
},
"event_id": "921532d8ab6b092d7c6885e74c482d6fd29172668de2822785c06b5fc512588e"
},
"host": {
"name": "internal-agent.example.com"
},
"log": {
"level": "warning"
},
"observer": {
"product": "Blue41",
"type": "sensor",
"vendor": "Blue41"
},
"organization": {
"id": "11111111"
},
"process": {
"name": "read_calendar"
},
"rule": {
"id": "0199a1f2-0000-7000-8000-000000000003",
"name": "Guardrail violation on tool",
"ruleset": "guardrail-violation-on-tool"
},
"service": {
"name": "internal-agent.example.com"
},
"span": {
"id": "f9595054fbae204e"
},
"trace": {
"id": "9dfdb0c07e8cdfb59fa0c59c77691c6e"
}
}
{
"message": "A call to get_recent_transactions by support-agent.example.com returned a link to evil.example.com. This may indicate the agent is exposing, following, or being redirected to an unexpected external destination -- worth checking whether this domain is expected for this tool.",
"event": {
"action": "alert-fired",
"category": [
"intrusion_detection"
],
"dataset": "blue41.detection",
"kind": "alert",
"module": "blue41",
"outcome": "unknown",
"reason": "Agents should not surface unexpected external destinations.",
"severity": 99,
"type": [
"info"
],
"url": "https://blue41.example.com/trace-report/744646abaa66f28ea394986a14a3d2b1?span=7ae6b434f6a12784&alertKey=0199e3c4-5b7a-7d21-9f4e-2a6c8b1d3e57-12913821843703893669-1790846067318&startTime=1790845167318&endTime=1790846967318"
},
"@timestamp": "2026-10-01T09:14:27.318000Z",
"blue41": {
"alert": {
"fingerprint": "12913821843703893669"
},
"event_id": "3f19662aa39aa9811862458b18500090f9d341971861f4a7fcf44d35b7351616"
},
"destination": {
"address": "evil.example.com",
"domain": "evil.example.com",
"registered_domain": "example.com",
"subdomain": "evil",
"top_level_domain": "com"
},
"host": {
"name": "support-agent.example.com"
},
"log": {
"level": "critical"
},
"observer": {
"product": "Blue41",
"type": "sensor",
"vendor": "Blue41"
},
"process": {
"name": "get_recent_transactions"
},
"related": {
"hosts": [
"evil.example.com"
]
},
"rule": {
"id": "0199e3c4-5b7a-7d21-9f4e-2a6c8b1d3e57",
"name": "URL in tool response"
},
"span": {
"id": "7ae6b434f6a12784"
},
"trace": {
"id": "744646abaa66f28ea394986a14a3d2b1"
}
}
{
"message": "URL in tool response received no data since 2026-10-01 09:45:03",
"event": {
"action": "alert-no-data",
"category": [
"intrusion_detection"
],
"dataset": "blue41.detection",
"kind": "event",
"module": "blue41",
"outcome": "unknown",
"reason": "Agents should not surface unexpected external destinations.",
"severity": 25,
"type": [
"info"
],
"url": "https://blue41.example.com/alerts/overview?ruleId=0199e3c4-5b7a-7d21-9f4e-2a6c8b1d3e57"
},
"@timestamp": "2026-10-01T10:00:03.552000Z",
"blue41": {
"alert": {
"fingerprint": "18425422539428604940"
},
"event_id": "2e99f0771f58873a249697e2f1dfe7d5661d0a341fadaba098c836bf42f8a1ca"
},
"observer": {
"product": "Blue41",
"type": "sensor",
"vendor": "Blue41"
},
"rule": {
"id": "0199e3c4-5b7a-7d21-9f4e-2a6c8b1d3e57",
"name": "URL in tool response"
}
}
{
"message": "URL in tool response receives data again",
"event": {
"action": "alert-resolved",
"category": [
"intrusion_detection"
],
"dataset": "blue41.detection",
"kind": "event",
"module": "blue41",
"outcome": "unknown",
"reason": "Agents should not surface unexpected external destinations.",
"severity": 25,
"type": [
"info"
],
"url": "https://blue41.example.com/alerts/overview?ruleId=0199e3c4-5b7a-7d21-9f4e-2a6c8b1d3e57"
},
"@timestamp": "2026-10-01T10:05:03.552000Z",
"blue41": {
"alert": {
"fingerprint": "18425422539428604940"
},
"event_id": "0013440f0d1d6f2bd6eec99a092599a0023c197d4bea4b692f4a5c15981177b5"
},
"observer": {
"product": "Blue41",
"type": "sensor",
"vendor": "Blue41"
},
"rule": {
"id": "0199e3c4-5b7a-7d21-9f4e-2a6c8b1d3e57",
"name": "URL in tool response"
}
}
{
"message": "A call to get_recent_transactions by support-agent.example.com returned a link to evil.example.com. This may indicate the agent is exposing, following, or being redirected to an unexpected external destination -- worth checking whether this domain is expected for this tool.",
"event": {
"action": "alert-resolved",
"category": [
"intrusion_detection"
],
"dataset": "blue41.detection",
"kind": "event",
"module": "blue41",
"outcome": "unknown",
"reason": "Agents should not surface unexpected external destinations.",
"severity": 99,
"type": [
"info"
],
"url": "https://blue41.example.com/trace-report/744646abaa66f28ea394986a14a3d2b1?span=7ae6b434f6a12784&alertKey=0199e3c4-5b7a-7d21-9f4e-2a6c8b1d3e57-12913821843703893669-1790847867318&startTime=1790846967318&endTime=1790848767318"
},
"@timestamp": "2026-10-01T09:44:27.318000Z",
"blue41": {
"alert": {
"fingerprint": "12913821843703893669"
},
"event_id": "aa6ba3a00485d865daccf32f299c49af2801d7140a709a4a42a9697f6659f67a"
},
"destination": {
"address": "evil.example.com",
"domain": "evil.example.com",
"registered_domain": "example.com",
"subdomain": "evil",
"top_level_domain": "com"
},
"host": {
"name": "support-agent.example.com"
},
"log": {
"level": "critical"
},
"observer": {
"product": "Blue41",
"type": "sensor",
"vendor": "Blue41"
},
"process": {
"name": "get_recent_transactions"
},
"related": {
"hosts": [
"evil.example.com"
]
},
"rule": {
"id": "0199e3c4-5b7a-7d21-9f4e-2a6c8b1d3e57",
"name": "URL in tool response"
},
"span": {
"id": "7ae6b434f6a12784"
},
"trace": {
"id": "744646abaa66f28ea394986a14a3d2b1"
}
}
{
"message": "A call to fetch_invoice by billing-agent.example.com returned a link to cdn.example.net. This may indicate the agent is exposing, following, or being redirected to an unexpected external destination -- worth checking whether this domain is expected for this tool.",
"event": {
"action": "alert-fired",
"category": [
"intrusion_detection"
],
"dataset": "blue41.detection",
"kind": "alert",
"module": "blue41",
"outcome": "unknown",
"reason": "Staging agents should only link to approved CDNs.",
"severity": 50,
"type": [
"info"
]
},
"@timestamp": "2026-10-01T09:31:02.047000Z",
"blue41": {
"alert": {
"fingerprint": "2983060910021512851"
},
"event_id": "8aab24b3e33c400c2fe62f7bd0165157f9cc7b8d8734c8cb38a6013be584eef3"
},
"destination": {
"address": "cdn.example.net",
"domain": "cdn.example.net",
"registered_domain": "example.net",
"subdomain": "cdn",
"top_level_domain": "net"
},
"host": {
"name": "billing-agent.example.com"
},
"log": {
"level": "warning"
},
"observer": {
"product": "Blue41",
"type": "sensor",
"vendor": "Blue41"
},
"process": {
"name": "fetch_invoice"
},
"related": {
"hosts": [
"cdn.example.net"
]
},
"rule": {
"id": "0199e3c6-a7d2-7b18-8c3e-91f04d6b5a2c",
"name": "URL in tool response (staging)"
},
"span": {
"id": "578329e307b4240c"
},
"trace": {
"id": "9b0de9f867223c404f6dc01a165db75d"
}
}
{
"message": "alice@example.com (11111111-1111-1111-1111-111111111111) created dashboard (0199e3e1-6b2d-7f35-a9c4-8e1b0d7f2a63)",
"event": {
"action": "create",
"category": [
"configuration"
],
"dataset": "blue41.audit",
"kind": "event",
"module": "blue41",
"outcome": "success",
"severity": 25,
"type": [
"creation"
],
"url": "https://blue41.example.com/settings/audit-logs"
},
"@timestamp": "2026-10-01T11:20:09.650938Z",
"blue41": {
"actor": {
"type": "user"
},
"audit": {
"resource_id": "0199e3e1-6b2d-7f35-a9c4-8e1b0d7f2a63",
"resource_kind": "dashboard"
},
"event_id": "7bc539e7744c6346683d3f7865117a466e86d7c4ca0e5efa1d98984a52caff61"
},
"http": {
"request": {
"method": "POST"
},
"response": {
"status_code": 201
}
},
"log": {
"level": "info"
},
"observer": {
"product": "Blue41",
"type": "sensor",
"vendor": "Blue41"
},
"organization": {
"id": "11111111"
},
"related": {
"ip": [
"2001:db8::7"
],
"user": [
"alice"
]
},
"source": {
"address": "2001:db8::7",
"ip": "2001:db8::7",
"port": 51234
},
"span": {
"id": "970d8190a4e8ef79"
},
"trace": {
"id": "cf059fa7a04ca8f42b2084994a13a078"
},
"url": {
"path": "/api/v1/dashboards"
},
"user": {
"email": "alice@example.com",
"id": "11111111-1111-1111-1111-111111111111",
"name": "alice"
},
"user_agent": {
"device": {
"name": "Mac"
},
"name": "Chrome",
"original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36",
"os": {
"name": "Mac OS X",
"version": "10.15.7"
},
"version": "141.0.0"
}
}
{
"message": "alice@example.com failed to create session",
"event": {
"action": "create",
"category": [
"authentication"
],
"dataset": "blue41.audit",
"kind": "event",
"module": "blue41",
"outcome": "failure",
"severity": 75,
"type": [
"start"
],
"url": "https://blue41.example.com/settings/audit-logs"
},
"@timestamp": "2026-10-01T11:07:05.903117Z",
"blue41": {
"actor": {
"type": "user"
},
"audit": {
"resource_kind": "session"
},
"event_id": "26dc3f58f4fe21f7fadfdec1acfe5fad88be2fbcd7b54731238530c04d15d9c0"
},
"http": {
"request": {
"method": "POST"
},
"response": {
"status_code": 401
}
},
"log": {
"level": "error"
},
"observer": {
"product": "Blue41",
"type": "sensor",
"vendor": "Blue41"
},
"organization": {
"id": "11111111"
},
"related": {
"ip": [
"203.0.113.45"
],
"user": [
"alice"
]
},
"source": {
"address": "203.0.113.45",
"ip": "203.0.113.45",
"port": 60412
},
"span": {
"id": "3080c609747b6d1f"
},
"trace": {
"id": "699bf47499f754cb619ebe5cdea3e659"
},
"url": {
"path": "/api/v2/sessions/email_password"
},
"user": {
"email": "alice@example.com",
"name": "alice"
},
"user_agent": {
"device": {
"name": "Mac"
},
"name": "Chrome",
"original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36",
"os": {
"name": "Mac OS X",
"version": "10.15.7"
},
"version": "141.0.0"
}
}
{
"message": "alice@example.com (11111111-1111-1111-1111-111111111111) updated rule (0199e3c4-5b7a-7d21-9f4e-2a6c8b1d3e57)",
"event": {
"action": "update",
"category": [
"configuration"
],
"dataset": "blue41.audit",
"kind": "event",
"module": "blue41",
"outcome": "success",
"severity": 25,
"type": [
"change"
],
"url": "https://blue41.example.com/settings/audit-logs"
},
"@timestamp": "2026-10-01T11:02:37.418265Z",
"blue41": {
"actor": {
"type": "user"
},
"audit": {
"resource_id": "0199e3c4-5b7a-7d21-9f4e-2a6c8b1d3e57",
"resource_kind": "rule"
},
"event_id": "ede890bbeb88fddfde72523daf6f7f868c593398abb7c7bcfa9ce96a77c8958c"
},
"http": {
"request": {
"method": "PUT"
},
"response": {
"status_code": 200
}
},
"log": {
"level": "info"
},
"observer": {
"product": "Blue41",
"type": "sensor",
"vendor": "Blue41"
},
"organization": {
"id": "11111111"
},
"related": {
"ip": [
"198.51.100.7"
],
"user": [
"alice"
]
},
"source": {
"address": "198.51.100.7",
"ip": "198.51.100.7",
"port": 51234
},
"span": {
"id": "97d062ab5f8d8aad"
},
"trace": {
"id": "cae6a49390fd5beaebaab1ef670cdfd4"
},
"url": {
"path": "/api/v2/rules/0199e3c4-5b7a-7d21-9f4e-2a6c8b1d3e57"
},
"user": {
"email": "alice@example.com",
"id": "11111111-1111-1111-1111-111111111111",
"name": "alice"
},
"user_agent": {
"device": {
"name": "Mac"
},
"name": "Chrome",
"original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36",
"os": {
"name": "Mac OS X",
"version": "10.15.7"
},
"version": "141.0.0"
}
}
{
"message": "alice@example.com (11111111-1111-1111-1111-111111111111) updated rule (0199e3c9-12f0-7a44-b3d8-6e0f9c27a1b4)",
"event": {
"action": "update",
"category": [
"configuration"
],
"dataset": "blue41.audit",
"kind": "event",
"module": "blue41",
"outcome": "success",
"severity": 25,
"type": [
"change"
],
"url": "https://blue41.example.com/settings/audit-logs"
},
"@timestamp": "2026-10-01T11:31:44.210576Z",
"blue41": {
"actor": {
"type": "user"
},
"audit": {
"resource_id": "0199e3c9-12f0-7a44-b3d8-6e0f9c27a1b4",
"resource_kind": "rule"
},
"event_id": "6f128beca1763550305a238f150df4873754362bd8343c6cf46757e4d0be74b6"
},
"http": {
"request": {
"method": "PUT"
},
"response": {
"status_code": 200
}
},
"log": {
"level": "info"
},
"observer": {
"product": "Blue41",
"type": "sensor",
"vendor": "Blue41"
},
"organization": {
"id": "11111111"
},
"related": {
"user": [
"alice"
]
},
"span": {
"id": "f8490939481ee862"
},
"trace": {
"id": "624c713b18bd8db833ac3d2e1ae950c3"
},
"url": {
"path": "/api/v2/rules/0199e3c9-12f0-7a44-b3d8-6e0f9c27a1b4"
},
"user": {
"email": "alice@example.com",
"id": "11111111-1111-1111-1111-111111111111",
"name": "alice"
},
"user_agent": {
"device": {
"name": "Mac"
},
"name": "Chrome",
"original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36",
"os": {
"name": "Mac OS X",
"version": "10.15.7"
},
"version": "141.0.0"
}
}
{
"message": "updated rule (0199e3d2-8c41-7e09-a5b6-3f7d1e48c920)",
"event": {
"action": "update",
"category": [
"configuration"
],
"dataset": "blue41.audit",
"kind": "event",
"module": "blue41",
"outcome": "success",
"severity": 25,
"type": [
"change"
],
"url": "https://blue41.example.com/settings/audit-logs"
},
"@timestamp": "2026-10-01T11:40:00.004821Z",
"blue41": {
"actor": {
"type": "system"
},
"audit": {
"resource_id": "0199e3d2-8c41-7e09-a5b6-3f7d1e48c920",
"resource_kind": "rule"
},
"event_id": "8c20bdc6e17dd9c5343a1c18db8b9ed236437dfa32c7c5023a3006d9c2143709"
},
"http": {
"request": {
"method": "PUT"
},
"response": {
"status_code": 200
}
},
"log": {
"level": "info"
},
"observer": {
"product": "Blue41",
"type": "sensor",
"vendor": "Blue41"
},
"organization": {
"id": "11111111"
},
"span": {
"id": "8efb502b414ef1d9"
},
"trace": {
"id": "1ea16bb209016f68ee70659042063bbc"
},
"url": {
"path": "/api/v2/rules/0199e3d2-8c41-7e09-a5b6-3f7d1e48c920"
}
}
{
"message": "alice@example.com (11111111-1111-1111-1111-111111111111) read traces",
"event": {
"action": "read",
"category": [
"api"
],
"dataset": "blue41.audit",
"kind": "event",
"module": "blue41",
"outcome": "success",
"severity": 25,
"type": [
"access"
],
"url": "https://blue41.example.com/settings/audit-logs"
},
"@timestamp": "2026-10-01T11:12:48.077402Z",
"blue41": {
"actor": {
"type": "user"
},
"audit": {
"resource_kind": "traces"
},
"event_id": "4de73190f9dfa3e0b2bb8c47d4e4a5a98b80dac1889f82e2fa1ea35dd2bf22cd"
},
"http": {
"request": {
"method": "POST"
},
"response": {
"status_code": 200
}
},
"log": {
"level": "info"
},
"observer": {
"product": "Blue41",
"type": "sensor",
"vendor": "Blue41"
},
"organization": {
"id": "11111111"
},
"related": {
"ip": [
"198.51.100.7"
],
"user": [
"alice"
]
},
"source": {
"address": "198.51.100.7",
"ip": "198.51.100.7",
"port": 51240
},
"span": {
"id": "4e3f6b842d925420"
},
"trace": {
"id": "cfaba8ee7a9efa4b613d57b0ba796fca"
},
"url": {
"path": "/api/v1/export_raw_data"
},
"user": {
"email": "alice@example.com",
"id": "11111111-1111-1111-1111-111111111111",
"name": "alice"
},
"user_agent": {
"device": {
"name": "Mac"
},
"name": "Chrome",
"original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36",
"os": {
"name": "Mac OS X",
"version": "10.15.7"
},
"version": "141.0.0"
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
| Name | Type | Description |
|---|---|---|
@timestamp |
date |
Date/time when the event originated. |
blue41.actor.type |
keyword |
Principal class that performed an audited action. One of user, service_account, system, anonymous. |
blue41.alert.fingerprint |
keyword |
Hash of the alert's query-result labels, as a decimal string. Not unique on its own — two rules matching the same span share a fingerprint — so alert similarity must pair it with rule.id. |
blue41.audit.resource_id |
keyword |
Identifier of the resource the audited action targeted. |
blue41.audit.resource_kind |
keyword |
Kind of resource the audited action targeted, e.g. rule, dashboard, session. |
blue41.event_id |
keyword |
Identifier Blue41 assigns to the exported event, stable across redeliveries. |
destination.domain |
keyword |
The domain name of the destination. |
event.action |
keyword |
The action captured by the event. |
event.category |
keyword |
Event category. The second categorization field in the hierarchy. |
event.dataset |
keyword |
Name of the dataset. |
event.kind |
keyword |
The kind of the event. The highest categorization field in the hierarchy. |
event.module |
keyword |
Name of the module this data is coming from. |
event.outcome |
keyword |
The outcome of the event. The lowest level categorization field in the hierarchy. |
event.reason |
keyword |
Reason why this event happened, according to the source |
event.severity |
long |
Numeric severity of the event. |
event.type |
keyword |
Event type. The third categorization field in the hierarchy. |
event.url |
keyword |
Event investigation URL |
host.name |
keyword |
Name of the host. |
http.request.method |
keyword |
HTTP request method. |
http.response.status_code |
long |
HTTP response status code. |
log.level |
keyword |
Log level of the log event. |
message |
match_only_text |
Log message optimized for viewing in a log viewer. |
observer.product |
keyword |
The product name of the observer. |
observer.type |
keyword |
The type of the observer the data is coming from. |
observer.vendor |
keyword |
Vendor name of the observer. |
organization.id |
keyword |
Unique identifier for the organization. |
process.name |
keyword |
Process name. |
rule.id |
keyword |
Rule ID |
rule.name |
keyword |
Rule name |
rule.ruleset |
keyword |
Rule ruleset |
service.name |
keyword |
Name of the service. |
source.address |
keyword |
Source network address. |
source.ip |
ip |
IP address of the source. |
source.port |
long |
Port of the source. |
span.id |
keyword |
Unique identifier of the span within the scope of its trace. |
trace.id |
keyword |
Unique identifier of the trace. |
url.path |
wildcard |
Path of the request, such as "/search". |
user.email |
keyword |
User email address. |
user.id |
keyword |
Unique identifier of the user. |
user.name |
keyword |
Short name or login of the user. |
user_agent.original |
keyword |
Unparsed user_agent string. |
For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.