Web application monitoring
The following set of tables can help you monitor different aspects of the web application itself. This may be useful in case you want to have a general overview of the web application normal development, extract specific information or identify abnormal situations that might require corrective measures.
All domains
siem.logtrust.web.activity
In this table, you can find detailed information about everything that happened in the current domain. You can see below the most relevant columns included in this table along with a brief explanation.
| domain | username | userId | sessionId | |
|---|---|---|---|---|
Domain in which the action takes place (if the table is open in the self domain, the search extends to all domains) | User who performed the action | Id associated with the user | Session in which the action is framed | |
| srcHost, srcPort | serverHost, serverPort | type | method | |
IP address and port from which the connection to Devo is requested | Server address and port through which the connection to Devo is established | Nature of the task performed | Data transfer method used | |
| useragent | locale | country, region, city | contentLength, responseLength | |
Web browser used to access Devo | Language-variant combination employed by the user | Geographic location of the source connection established by the user | Number of data bytes contained in the request from the source and the response from the server | |
| responseTime | Isp, org | |||
Total amount of time (in milliseconds) it takes to respond to the request | Internet provider | |||
siem.logtrust.web.navigation
In this table, you can find specific information about user activity. It contains a data structure similar to the siem.logtrust.web.activity with the difference that it includes only activity triggered by users and excludes platform and server response. You can see below the most relevant columns included in this table along with a brief explanation.
| domain | userId | sessionId | userEmail |
|---|---|---|---|
Domain in which the action takes place (if the table is open in the self domain, the search extends to all domains) | Id associated with the user | Session in which the action is framed | Email address employed by the user to register and log in |
| srcHost, srcPort | serverHost, serverPort | section | action |
IP address and port from which the connection to Devo is requested | Server address and port through which the connection to Devo is established | Area of the web application the user accessed | Task performed |
| method | useragent | locale | country, region, city |
Data transfer method used | Web browser used to access Devo | Language-variant combination employed by the user | Geographic location of the source connection established by the user |
| contentLength, responseLength | responseTime | Isp, org | |
Number of data bytes contained in the request from the source and the response from the server | Total amount of time (in milliseconds) it takes to respond to the request | Internet provider | |
siem.logtrust.web.info
In this table, you can find information about the development of the web application. It can be used to analyze the different events that take place in the platform to have an overview of the global situation. You can see below the most relevant columns included in this table along with a brief explanation.
| level | domain | userId |
|---|---|---|
Level of importance or urgency of the event
| Domain in which the error occurred (if the table is open in the self domain, the search extends to all domains) | Id associated with the user |
| sessionId | message | |
Session in which the action is framed | Full text describing the nature and content of the error |
siem.logtrust.web.error
In this table, you can find information about the errors that occurred in the web application. It can be used to analyze common errors to possibly identify the cause. It is very similar to the siem.logtrust.web.info table with the difference that it includes only events that contain errors and excludes the rest of the levels. You can see below the most relevant columns included in this table along with a brief explanation.
| level | domain | userId |
|---|---|---|
Level of importance or urgency of the event (in this case only error) | Domain in which the error occurred (if the table is open in the self domain, the search extends to all domains) | Id associated with the user |
| sessionId | message | |
Session in which the action is framed | Full text describing the nature and content of the error |
Self domain
siem.logtrust.web.activityAll
In this table, you can find detailed information about what has happened in all domains. It is essentially the same as the siem.logtrust.web.activity table with the difference that the search extends to all domains so they can be monitored at the same time. You can see below the most relevant columns included in this table along with a brief explanation.
| domain | username | userId | sessionId | |
|---|---|---|---|---|
Domain in which the action takes place (the search extends to all domains) | User who performed the action | Id associated with the user | Session in which the action is framed | |
| srcHost, srcPort | serverHost, serverPort | type | method | |
IP address and port from which the connection to Devo is requested | Server address and port through which the connection to Devo is established | Nature of the task performed | Data transfer method used | |
| useragent | locale | country, region, city | contentLength, responseLength | |
Web browser used to access Devo | Language-variant combination employed by the user | Geographic location of the source connection established by the user | Number of data bytes contained in the request from the source and the response from the server | |
| responseTime | Isp, org | |||
Total amount of time (in milliseconds) it takes to respond to the request | Internet provider | |||
siem.logtrust.web.connection
In this table, you can find information about the activities in the platform related to logins and logouts. It is a more concise version of the siem.logtrust.web.navigation in which the activity triggered by the user is limited to only logins, logouts and domain changes. It can be used to analyze connection trends or platform capacity congestion. You can see below the most relevant columns included in this table along with a brief explanation.
| domain | inputDomain | inputUser |
|---|---|---|
Domain to which the user requests to connect (it will be empty in case the action is a logout or an invalid login) | Domain to which the user connects (it will be empty in case the action is an invalid login) | User who performed the action |
| action | sessionId | srcHost, srcPort |
Specific action performed (login, logout, change domain, invalid login, invalid change domain, etc.) | Session in which the action is framed | IP address and port from which the connection to Devo is requested |
| serverHost, serverPort | useragent | |
Server address and port through which the connection to Devo is established | Web browser used to access Devo | |
| country, region, city | Isp, org | |
Geographic location of the source connection established by the user | Internet provider | |