Spectrum events
The descriptions below detail the fields available for spectrum_events.
| Field | Value | Type |
|---|---|---|
| Application | The unique public ID of the application on which the event occurred | string |
| ClientAsn | Client AS number | int |
| ClientBytes | The number of bytes read from the client by the Spectrum service | int |
| ClientCountry | Country of the client IP address | string |
| ClientIP | Client IP address | string |
| ClientMatchedIpFirewall | Whether the connection matched any IP Firewall rules. UNKNOWN = No match or Firewall not enabled for spectrum; UNKNOWN | ALLOW | BLOCK_ERROR | BLOCK_IP | BLOCK_COUNTRY | BLOCK_ASN | WHITELIST_IP | WHITELIST_COUNTRY | WHITELIST_ASN | string |
| ClientPort | Client port | int |
| ClientProto | Transport protocol used by client; tcp | udp | unix | string |
| ClientTcpRtt | The TCP round-trip time in nanoseconds between the client and Spectrum | int |
| ClientTlsCipher | The cipher negotiated between the client and Spectrum. In v1, an unknown cipher returned as “Unknown.” In v2, it’s returned as “UNK.” | string |
| ClientTlsClientHelloServerName | The server name in the Client Hello message from client to Spectrum | string |
| ClientTlsProtocol | The TLS version negotiated between the client and Spectrum; unknown | none | SSLv3 | TLSv1 | TLSv1.1 | TLSv1.2 | TLSv1.3 | string |
| ClientTlsStatus | Indicates state of TLS session from the client to Spectrum; UNKNOWN | OK | INTERNAL_ERROR | INVALID_CONFIG | INVALID_SNI | HANDSHAKE_FAILED | KEYLESS_RPC | string |
| ColoCode | IATA airport code of data center that received the request | string |
| ConnectTimestamp | Timestamp at which both legs of the connection (client/edge, edge/origin or nexthop) were established | int or string |
| DisconnectTimestamp | Timestamp at which the connection was closed | int or string |
| Event | connect | disconnect | clientFiltered | tlsError | resolveOrigin | originError | string |
| IpFirewall | Whether IP Firewall was enabled at time of connection | bool |
| OriginBytes | The number of bytes read from the origin by Spectrum | int |
| OriginIP | Origin IP address | string |
| OriginPort | Origin port | int |
| OriginProto | Transport protocol used by origin; tcp | udp | unix | string |
| OriginTcpRtt | The TCP round-trip time in nanoseconds between Spectrum and the origin | int |
| OriginTlsCipher | The cipher negotiated between Spectrum and the origin. In v1, an unknown cipher returned as “Unknown.” In v2, it’s returned as “UNK.” | string |
| OriginTlsFingerprint | SHA256 hash of origin certificate. In v1, an unknown SHA256 hash is returned as “0000000000000000000000000000000000000000000000000000000000000000.” In v2, it’s returned as an empty string. | string |
| OriginTlsMode | If and how the upstream connection is encrypted; unknown | off | flexible | full | strict | string |
| OriginTlsProtocol | The TLS version negotiated between Spectrum and the origin; unknown | none | SSLv3 | TLSv1 | TLSv1.1 | TLSv1.2 | TLSv1.3 | string |
| OriginTlsStatus | The state of the TLS session from Spectrum to the origin; UNKNOWN | OK | INTERNAL_ERROR | INVALID_CONFIG | INVALID_SNI | HANDSHAKE_FAILED | KEYLESS_RPC | string |
| ProxyProtocol | Which form of proxy protocol is applied to the given connection; off | v1 | v2 | simple | string |
| Status | A code indicating reason for connection closure | int |
| Timestamp | Timestamp at which the event took place | int or string |