Skip to content




Oscar Health, Inc. (“Oscar”) is the first health insurance company built around a full stack technology platform and a relentless focus on serving its members. Our mission is to make a healthier life accessible and affordable for all.

Headquartered in New York City, Oscar has been challenging the health care system's status quo since its founding in 2012. Our member-first philosophy and innovative approach to care has earned us the trust of approximately 529,000 Americans across 291 counties in 18 states, as of January 31, 2021. We offer Individual & Family, Small Group and Medicare Advantage plans.

Product Details

Vendor URL: Oscar | Health insurance that just makes sense

Product Type: Healthcare Administration

Product Tier: Tier III

Integration Method: custom

Integration URL: N/A

Log Guide: N/A

Parser Details

Log Format: JSON

Expected Normalization Rate: 75%


UDM Fields (list of all UDM fields leveraged in the Parser):

Log File Field UDM Field
vendor metadata.vendor_name
product metadata.product_name
version metadata.product_version
product_event metadata.product_event_type
GENERIC_EVENT metadata.event_type
length additional.fields
file_name src.file.full_path
src principal.hostname
src principal.ip
dst target.hostname
dst target.ip
dhost target.hostname
dhost target.ip
shost principal.hostname
shost principal.ip
suser principal.user.userid
request target.url
INFORMATIONAL/LOW/MEDIUM/HIGH security_result.severity
observer observer.hostname
observer observer.ip

Product Event Types

Event UDM Event Classification

Log Sample

{"msg": "123456789|john.doe|2021-12-01 15:24:32|9|\n", "length": 40, "file_name": "claims_screen_logs.gz", "product": "Claims", "vendor": "Oscar"}

Sample Parsing

metadata.event_timestamp = "2021-12-01T15:24:32Z"
metadata.event_type = "GENERIC_EVENT"
metadata.vendor_name = "Oscar"
metadata.product_name = "Claims"
metadata.product_event_type = "123456789"
metadata.ingested_timestamp = "2021-12-01T16:09:34.967431Z"
additional.length = "40"
principal.user.userid = "john.doe"
principal.namespace = "domain"
src.file.full_path = "claims_screen_logs.gz"
src.namespace = "domain"
observer.namespace = "domain"

Parser Alerting

This product currently does not have any Parser-based Alerting


Coming Soon