{
"allowlisted": true,
"authentication_details": [
{
"authentication_method": "Password",
"authentication_method_detail": "Password in the cloud",
"authentication_step_result_detail": "MFA requirement satisfied by claim in the token",
"succeeded": true
}
],
"challenge_method_kinds": [
"security_key",
"password"
],
"client_app": "Browser",
"conditional_access_status": "failure",
"device_id": "device-123456",
"employee_email": "john.doe@example.com",
"employee_name": "John Doe",
"external_id": "login_success/user@example.com/2025-01-15T14:30:00Z",
"high_prevalence": true,
"id": "8CA67511-744C-4D74-B26E-7281CF88712F",
"impossible_travel_detail": {
"distance_miles": 5823.4,
"from_city": "San Francisco",
"from_country": "US",
"speed_mph": 1250.7,
"to_city": "Amsterdam",
"to_country": "NL"
},
"ip_address": "192.168.1.100",
"ip_chain": [
{
"city": "Amsterdam",
"country": "NL",
"ip": "203.0.113.45",
"source": "proxy",
"version": "V4"
}
],
"is_allowed_vpn": true,
"is_foreign_country": false,
"is_impossible_travel": false,
"is_new_ip_network": false,
"is_off_hours": false,
"is_proxy_login": false,
"is_service_account": false,
"is_suspicious_client": false,
"location_city": "San Francisco",
"location_country": "USA",
"location_state": "CA",
"login_audit_kind": "failed_login",
"login_time": "2025-01-15T14:30:00Z",
"network_context": {
"as_number": 14061,
"as_org": "DigitalOcean, LLC",
"domain": "digitalocean.com",
"isp": "Comcast Cable"
},
"proxy_detail": {
"kind": "vpn",
"source": "NordVPN"
},
"risk_factors": [
{
"magnitude": 40,
"type": "sensitive_file"
}
],
"risk_level": "high",
"risk_score": 25.5,
"sign_on_mode": "auto_login",
"source": "unspecified",
"token_protection": "bound",
"user_agent": {
"browser": "Chrome",
"os": "Mac OS X",
"raw": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"
},
"vpn_operators": [
"GLOBAL_PROTECT_CLOUD_VPN"
]
}