HYPR MFA¶
About¶
The security of a smart card meets the convenience of a smartphone. Eliminate passwords and enhance employee productivity with HYPR. HYPR’s patented mobile-initiated login prevents phishing and PUSH attacks that come with legacy MFA. Authentication is then extended to your SSO, creating a modern login experience unlike any other.
Product Details¶
Vendor URL: HYPR Passwordless Authentication
Product Type: MFA / Authentication
Product Tier: Tier III
Integration Method: Custom
Parser Details¶
Log Guide: Sample Logs
Log Format: JSON
Expected Normalization Rate: near 100%
Data Label: HYPR_MFA
UDM Fields (list of all UDM fields leveraged in the Parser):
| Log File Field | UDM Field |
|---|---|
| traceId | metadata.product_log_id |
| eventTimeInUTC | metadata.event_timestamp |
| "GENERIC_EVENT" | metadata.event_type |
| "HYPR" | metadata.vendor_name |
| "MFA" | metadata.product_name |
| version | metadata.product_version |
| eventName | metadata.product_event_type |
| message | metadata.description |
| machineUserName | principal.user.userid |
| tenantId | principal.namespace |
| ASSET:{machineId} | principal.asset.asset_id |
| server.node | observer.ip |
| isSuccessful = True[ALLOW]/False[BLOCKED] | security_result.action |
| isSuccessful | security_result.action_details |
Product Event Types¶
| Event | UDM Event Classification |
|---|---|
| All Events | GENERIC_EVENT |
Log Sample¶
{"id":"12822885REDACTED","version":4,"type":"AUDIT","eventName":"WORKSTATION_AUTH_COMPLETE","subName":"device/authorize/ws/complete/{sessionId}","eventLoggedBy":"RELYING_PARTY_SERVER","eventTimeInUTC":1654599863382,"loggedTimeInUTC":1654599863382,"deviceId":"00000000-AF70-46FC-9598-REDACTED","rpAppId":"windowsLogin","machineId":"REDACTED-dfc9-4d82-9ea9-REDACTED","sessionId":"22b64ddc9572fa5ee4c7c0d392a0431a01cff0290867de695155cddcbd8ee735","fidoUser":"User_6EB5C33D-8CD7-4CA4-80BE-REDACTED","message":"Final step in Workstation login. Login confirmation sent to device. Completed","isSuccessful":true,"machineUserName":"HOSTNAME","errorCode":null,"additionalDetails":{"mobileDevice":null,"workstation":null,"server":{"node":"/10.10.10.203","version":"7.1.0","extras":{}},"web":null,"smartKey":null,"magicLink":null,"featureFlag":null,"createUser":null,"deleteUser":null,"fido2Setting":null,"metadataCertExpiry":null,"extras":{}},"authenticator":null,"os":null,"traceId":"5c39REDACTED","appVersion":null,"tenantId":"tenantdomain"}
Sample Parsing¶
metadata.product_log_id = "5c39REDACTED"
metadata.event_timestamp = "2022-06-07T11:04:23.382Z"
metadata.event_type = "GENERIC_EVENT"
metadata.vendor_name = "HYPR"
metadata.product_name = "MFA"
metadata.product_version = "7.1.0"
metadata.product_event_type = "WORKSTATION_AUTH_COMPLETE"
metadata.description = "Final step in Workstation login. Login confirmation sent to device. Completed"
principal.user.userid = "HOSTNAME"
principal.namespace = "tenantdomain"
principal.asset.asset_id = "ASSET:REDACTED-dfc9-4d82-9ea9-REDACTED"
observer.ip = "10.10.10.203"
security_result.action = "ALLOW"
security_result.action_details = "true"
Parser Alerting¶
This product currently does not have any Parser-based Alerting