Skip to content

HYPR MFA

HYPR MFA

About

The security of a smart card meets the convenience of a smartphone. Eliminate passwords and enhance employee productivity with HYPR. HYPR’s patented mobile-initiated login prevents phishing and PUSH attacks that come with legacy MFA. Authentication is then extended to your SSO, creating a modern login experience unlike any other.

Product Details

Vendor URL: HYPR Passwordless Authentication

Product Type: MFA / Authentication

Product Tier: Tier III

Integration Method: Custom

Parser Details

Log Guide: Sample Logs

Log Format: JSON

Expected Normalization Rate: near 100%

Data Label: HYPR_MFA

UDM Fields (list of all UDM fields leveraged in the Parser):

Log File Field UDM Field
traceId metadata.product_log_id
eventTimeInUTC metadata.event_timestamp
"GENERIC_EVENT" metadata.event_type
"HYPR" metadata.vendor_name
"MFA" metadata.product_name
version metadata.product_version
eventName metadata.product_event_type
message metadata.description
machineUserName principal.user.userid
tenantId principal.namespace
ASSET:{machineId} principal.asset.asset_id
server.node observer.ip
isSuccessful = True[ALLOW]/False[BLOCKED] security_result.action
isSuccessful security_result.action_details

Product Event Types

Event UDM Event Classification
All Events GENERIC_EVENT

Log Sample

{"id":"12822885REDACTED","version":4,"type":"AUDIT","eventName":"WORKSTATION_AUTH_COMPLETE","subName":"device/authorize/ws/complete/{sessionId}","eventLoggedBy":"RELYING_PARTY_SERVER","eventTimeInUTC":1654599863382,"loggedTimeInUTC":1654599863382,"deviceId":"00000000-AF70-46FC-9598-REDACTED","rpAppId":"windowsLogin","machineId":"REDACTED-dfc9-4d82-9ea9-REDACTED","sessionId":"22b64ddc9572fa5ee4c7c0d392a0431a01cff0290867de695155cddcbd8ee735","fidoUser":"User_6EB5C33D-8CD7-4CA4-80BE-REDACTED","message":"Final step in Workstation login. Login confirmation sent to device.   Completed","isSuccessful":true,"machineUserName":"HOSTNAME","errorCode":null,"additionalDetails":{"mobileDevice":null,"workstation":null,"server":{"node":"/10.10.10.203","version":"7.1.0","extras":{}},"web":null,"smartKey":null,"magicLink":null,"featureFlag":null,"createUser":null,"deleteUser":null,"fido2Setting":null,"metadataCertExpiry":null,"extras":{}},"authenticator":null,"os":null,"traceId":"5c39REDACTED","appVersion":null,"tenantId":"tenantdomain"}

Sample Parsing

metadata.product_log_id = "5c39REDACTED"
metadata.event_timestamp = "2022-06-07T11:04:23.382Z"
metadata.event_type = "GENERIC_EVENT"
metadata.vendor_name = "HYPR"
metadata.product_name = "MFA"
metadata.product_version = "7.1.0"
metadata.product_event_type = "WORKSTATION_AUTH_COMPLETE"
metadata.description = "Final step in Workstation login. Login confirmation sent to device.   Completed"
principal.user.userid = "HOSTNAME"
principal.namespace = "tenantdomain"
principal.asset.asset_id = "ASSET:REDACTED-dfc9-4d82-9ea9-REDACTED"
observer.ip = "10.10.10.203"
security_result.action = "ALLOW"
security_result.action_details = "true"

Parser Alerting

This product currently does not have any Parser-based Alerting

Rules

Coming Soon