Skip to main content

Web Application Account Fields

Web application account fields can be used in search queries and detection queries within Policies. These fields represent metadata for web applications, including user account and instance information and an organization-specific business relevance score (BRS) provided by Keep Aware.

Getting Started​

To get started using web app account fields, navigate to the Events page from the menu on the left side of your console. Click the magnifying glass icon to open the search area and use the search bar to search for events and extensions with various fields. Or use the Search Builder or Filter options on the right-side of the search bar to find certain fields.

Keep Aware Events Search Image: Events Search Bar

User Account Fields​

  • account.user.email | text | The email of the user's account.
  • account.user.id | text | The user's account identifier. This field's format can vary greatly from application to application but may be the account.user.email if no unique ID is identified.
  • account.user.name | text | The user's name, if available.

Account Instance Fields​

  • account.org.domain | text | The account instance's domain.
  • account.org.id | text | The account instance's identifier. This field's format can vary greatly from application to application but may be the account.org.domain if no unique ID is identified.

General Fields​

  • account.brs | number | The quantified business relevance this web application has to your organization. Range: 0-100.
  • account.tag | text | Indicates the application (e.g., "google_workspace").

Examples​

User-specific Web App Events​

Web applications that are linked to users named "robert".

user.label:*robert* AND account.tag:*

Events on a Web Application with a Low BRS​

Search for any event to web application with a business relevance score (BRS) at or below 30.

account.brs:<=30

Upload Events to a Non-Org Google Drive Account​

Search for uploads to an instance of the Google Drive web application that is not the organization's. In this example, the organization is "certaincyber.com".

type:"upload" AND account.tag:*google* AND location:"drive.google.com" AND NOT account.org.domain:"certaincyber.com"

Shadow IT & Web Applications​

To read about how these fields aid in managing shadow IT, please refer to Shadow IT & Web Applications.

Table of Contents