Vendors / Slack / Slack Enterprise / Slack Enterprise user login

Event type

Slack Enterprise user login

Slack Audit API v1 user_login: identical registry actor/entity, enterprise context, mapped client, fresh UUID/session ID and Unix seconds.

JSON 24 fields Generator

slack audit authentication

Preview Sample View Schema

CLI Install

meltr templates install slack

Overview

What this event covers

One unwrapped user_login audit entry with enterprise context. Uses schema-standard registry fields plus generated vendor-specific IDs. Works with the default MELTr entity sample.yaml; example configuration: configs/slack/enterprise/audit.yaml. Tested with MELTr rc3 commit 1e14e5defb66f6ac24decbe59c1c4f4e64877618. Entity fixtures must be selected per source; generic registry preview entities are not sufficient.

When generated

›A user logs in.

Security relevance

Informational

Frequency notes

One event/second local test rate; independent sessions, no session lifecycle.

Resources

Docs and tools

Complete event and actor/entity/context definitions official

Generation

Configuration

Base frequency: 3600 events/hour
Business hours: 1.0x
Night hours: 1.0x
Weekend: 1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

id

String Optional

`fake.uuid4()`, new synthetic event UUID.

Source: `fake.uuid4()`, new synthetic event UUID.

Example 7a11005a-772a-46b9-a05e-50b67def9ca3

date_create

Integer Optional

One `now()` through `unix_timestamp` then `int`, Unix seconds.

Source: One `now()` through `unix_timestamp` then `int`, Unix seconds.

Example 1790894900

action

String Optional

Fixed `user_login`.

Source: Fixed `user_login`.

Example user_login

actor

Object Optional

Each contains type and user.

Source: Each contains type and user.

Example {"type":"user","user":{"email":"ben.rivera@example.com","id":"W123456781","name":"Ben Rivera"}}

entity

Object Optional

Each contains type and user.

Source: Each contains type and user.

Example {"type":"user","user":{"email":"ben.rivera@example.com","id":"W123456781","name":"Ben Rivera"}}

actor.type

String Optional

Fixed `user`.

Source: Fixed `user`.

Example user

entity.type

String Optional

Fixed `user`.

Source: Fixed `user`.

Example user

actor.user

Object Optional

Same identity object, constructed once from selected registry user.

Source: Same identity object, constructed once from selected registry user.

Example {"email":"ben.rivera@example.com","id":"W123456781","name":"Ben Rivera"}

entity.user

Object Optional

Same identity object, constructed once from selected registry user.

Source: Same identity object, constructed once from selected registry user.

Example {"email":"ben.rivera@example.com","id":"W123456781","name":"Ben Rivera"}

actor.user.id

String Optional

User `slack_id`; local W plus 8–10 uppercase alphanumeric characters.

Source: User `slack_id`; local W plus 8–10 uppercase alphanumeric characters.

Example W123456781

entity.user.id

String Optional

User `slack_id`; local W plus 8–10 uppercase alphanumeric characters.

Source: User `slack_id`; local W plus 8–10 uppercase alphanumeric characters.

Example W123456781

actor.user.name

String Optional

User `full_name`; nonempty, JSON-escaped.

Source: User `full_name`; nonempty, JSON-escaped.

Example Ben Rivera

entity.user.name

String Optional

User `full_name`; nonempty, JSON-escaped.

Source: User `full_name`; nonempty, JSON-escaped.

Example Ben Rivera

actor.user.email

String Optional

User `email`; nonempty email format.

Source: User `email`; nonempty email format.

Example ben.rivera@example.com

entity.user.email

String Optional

User `email`; nonempty email format.

Source: User `email`; nonempty email format.

Example ben.rivera@example.com

context

Object Optional

Location, ua, session_id and ip_address.

Source: Location, ua, session_id and ip_address.

Example

{"ip_address":"192.0.2.51","location":{"domain":"example-corp","id":"E0123456789","name":"Example Corp","type":"enterprise"},"session_id":"913203824962","ua":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36"}

context.location

Object Optional

Four fields below from one organization.

Source: Four fields below from one organization.

Example {"domain":"example-corp","id":"E0123456789","name":"Example Corp","type":"enterprise"}

context.location.type

String Optional

Fixed `enterprise`.

Source: Fixed `enterprise`.

Example enterprise

context.location.id

String Optional

Organization `slack_enterprise_id`; local E plus 8–10 uppercase alphanumeric characters.

Source: Organization `slack_enterprise_id`; local E plus 8–10 uppercase alphanumeric characters.

Example E0123456789

context.location.name

String Optional

Organization `name`; nonempty.

Source: Organization `name`; nonempty.

Example Example Corp

context.location.domain

String Optional

Organization `slack_domain`; local lowercase hyphenated slug, distinct from email domain.

Source: Organization `slack_domain`; local lowercase hyphenated slug, distinct from email domain.

Example example-corp

context.ua

String Optional

Named service `slack-browser` attribute `user_agent`, constrained to published browser string.

Source: Named service `slack-browser` attribute `user_agent`, constrained to published browser string.

Example

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36

context.session_id

String Optional

`fake.numerify(text='############')`, a new 12-digit local string subset matching sample shape; leading zeros retained.

Source: `fake.numerify(text='############')`, a new 12-digit local string subset matching sample shape; leading zeros retained.

Example 913203824962

context.ip_address

String Optional

Mapped client device `ip_address`.

Source: Mapped client device `ip_address`.

Example 192.0.2.51