This page provides descriptions for Transaction Events supported fields.
To learn more about field availability: Transaction Events Formats.
Field types
The following types are currently used:
- string: A sequence of UTF-8 characters.
- uint16: Unsigned integer 16 bits
- uint32: Unsigned integer 32 bits
- uint64: Unsigned integer 64 bits
- float64: Double-precision 64-bit float
- list of string: Multiple strings
Alias fields
Some fields are described as Alias to another fields. This means they are mapped to this field in the backend and provide the same value. It is generally recommended to use to source field instead of the Alias.
Field names convention
Transactions Events field name are following W3C ELFF standard https://www.w3.org/TR/WD-logfile.
- Every field starting with x- are defined by Netskope, while other fields are defined by the standard
- after the optional x-, the combination of letters c, s, r have the following meaning:
- c refers to the Client.
- s refers to the Netskope POP (the Server from the ELFF standard)
- r refers to the Remote Server
- cs refers to the Client to POP request
- sc refers to the POP to Client response
- sr refers to the POP to Remote Server request
- rs refers to the Remote Server to POP response
Field description per section
Order of sections and fields are aligned with the Skope IT UI view.
When Name in Management Console contains a parenthesis, this text is omitted when the section title is visible. For example (Client Connection) Source IP will be displayed as Source IP in the Client Connection section.
Client Connection
| Field Name | Name in Management Console | Description | Type |
|---|
| x-cs-access-method | Access Method | Steering method used to access the POP. | string |
| x-s-dp-name | POP | POP name processing the request. | string |
| x-cs-src-ip | (Client Connection) Source IP | Source IP of the Client to POP request. This is typically the private IP of the end user device received when the request is encapsulated in a tunnel (NS Client, GRE, IPsec). For non encapsulated request, x-cs-scr-ip is equal to x-cs-src-ip-egress. This field is not updated by X-Forwarded-For processing. | string |
| x-cs-src-port | (Client Connection) Source Port | Source port of the Client to POP request. | uint16 |
| x-cs-dst-ip | (Client Connection) Destination IP | Destination IP of the Client to POP request. | string |
| x-cs-dst-port | (Client Connection) Destination Port | Destination port of the Client to POP request. | uint16 |
| x-cs-access-proxy | Access Proxy | List of Access Proxy configuration matching the request from the Client to the POP. | list of string |
| x-cs-src-ip-egress | (Client Connection) Egress Source IP | Source IP used by the Client to contact the POP. This is typically the public IP applied by firewall/router performing the NAT for the Client. | string |
| x-cs-nsclient-tunnel-type | (Client Connection) Tunnel Type | NS Client tunnel mode (TLS or DTLS). This field requires NS Client in active steering mode. | string |
| x-cs-tunnel-id | (Client Connection) Tunnel ID | VPN tunnel ID. | string |
| cs-bytes | (Client Connection) Bytes Uploaded | Bytes received from the Client to the POP. | uint64 |
| sc-bytes | (Client Connection) Bytes Downloaded | Bytes sent from the POP to the Client. Note: In Format 1 to Format 3, this field representbytes sent from Remote Server to Proxy. | uint64 |
Device
| Field Name | Name in Management Console | Description | Type |
|---|
| x-c-device-uid | (Device) UUID | Device unique identifier computed by NS Client. This field requires NS Client to be installed, both steering active and disabled are supported. | string |
| x-c-hostname | (Device) Hostname | Hostname of the Client. This field requires NS Client to be installed, both steering active and disabled are supported. | string |
| x-c-os-family | OS Family | OS Family of the Client. This field requires NS Client to be installed, both steering active and disabled are supported. | string |
| x-c-os-version | OS Version | OS Version of the Client. This field requires NS Client to be installed, both steering active and disabled are supported. | string |
| x-c-os | N/A | Operating system of the client from NS Client and User Agent information. This field can be impacted by modified User Agent, we recommend to use x-c-os-family and x-c-os-version instead. | string |
| x-c-device | N/A | Client’s device type from NS Client and User Agent information. This field can be impacted by modified User Agent, we recommend to use x-c-os-family and x-c-os-version instead. | string |
| x-c-nsclient-version | Client Version | NS Client version of the Client. This field requires NS Client to be installed, both steering active and disabled are supported. | string |
| x-c-nsclient-client-profile | Client Profile | Client Profile of NS Client. This field requires NS Client to be installed, both steering active and disabled are supported. | string |
| x-c-nsclient-steering-profile | Steering Profile | Steering Profile of NS Client. This field requires NS Client in active steering mode. | string |
| x-c-device-classification | (Device) Classification | Classification profile of NS Client. This field requires NS Client to be installed, both steering active and disabled are supported. | string |
| x-c-browser | Browser | Browser of the client computed from User Agent. This field can be impacted by modified User Agent, we recommend to use x-cs-process and x-cs-parent-process instead. | string |
| x-c-browser-version | N/A | Client’s browser version. This field can be impacted by modified User Agent, we recommend to use cs-user-agent directly. | string |
Process
| Field Name | Name in Management Console | Description | Type |
|---|
| x-cs-process | Process | Process Name on the Client. This field requires NS Client in active steering mode. | string |
| x-cs-pid | Process ID | Process ID on the Client. This field requires NS Client in active steering mode. | uint32 |
| x-cs-parent-process | Parent Process | Parent Process Name on the Client. This field requires NS Client in active steering mode. | string |
| x-cs-ppid | Parent Process ID | Parent Process ID on the Client. This field requires NS Client in active steering mode. | uint32 |
Client HTTP
| Field Name | Name in Management Console | Description | Type |
|---|
| sc-status | Status Code | HTTP status code sent to the Client. | uint16 |
| x-cs-http-version | (Client HTTP) Version | HTTP protocol version of the Client to POP request. | string |
| cs-user-agent | (Client HTTP) User Agent | User-Agent header in the HTTP request. | string |
| cs-content-type | (Client HTTP) Request Content Type | Content-Type header in the HTTP request from the Client | string |
| sc-content-type | (Client HTTP) Response Content Type | Content-Type header in the HTTP response to the Client | string |
| x-cs-ip-xff | (Client HTTP) XFF | X-Forwarded-For header value received in the Client to POP HTTP GET request. Will be empty if there is no header or if GET is not decrypted. | string |
| x-cs-xau | (Client HTTP) XAU | X-Authenticated-User header value received in the Client to POP HTTP GET request. Will be empty if there is no header or if GET is not decrypted. | string |
| x-cs-connect-host | (Client HTTP) CONNECT FQDN | Host value received in the Client to POP HTTP CONNECT request. Will be empty if there is no CONNECT. | string |
| x-cs-connect-port | (Client HTTP) CONNECT Port | Port value received in the Client to POP HTTP CONNECT request. Will be empty if there is no CONNECT. | uint16 |
| x-cs-connect-user-agent | (Client HTTP) CONNECT User Agent | User-Agent header value received in the Client to POP HTTP CONNECT request. Will be empty if there is no CONNECT or field is missing. | string |
| x-cs-ip-connect-xff | (Client HTTP) CONNECT XFF | X-Forwarded-For header value received in the Client to POP HTTP CONNECT request. Empty if there is no CONNECT or field is missing. | string |
| x-cs-connect-xau | (Client HTTP) CONNECT XAU | X-Authenticated-User header value received in the Client to POP HTTP CONNECT request. Empty if there is no CONNECT or field is missing. | string |
Client SSL
| Field Name | Name in Management Console | Description | Type |
|---|
| x-cs-sni | (Client SSL) SNI | The FQDN send by the Client in the SNI of the TLS Client Hello. | string |
| x-cs-ssl-ja3 | (Client SSL) JA3 | JA3 Fingerprints the way that the Client communicates over TLS. | string |
| x-cs-ssl-engine-action | (Client SSL) Engine Action | Indicates the result of SSL Engine processing between the Client and the POP. | string |
| x-cs-ssl-engine-action-reason | (Client SSL) Engine Action Reason | Provides details of the SSL Engine processing between the Client and the POP. | string |
| x-cs-ssl-malformed-ssl | (Client SSL) Malformed SSL | Indicates if the SSL Engine encounters malformed SSL packet during SSL/TLS negotiation between the Client and the POP. | string |
| x-cs-ssl-handshake-error | (Client SSL) Handshake Error | Indicates a problem to establish SSL/TLS negotiation between the Client and the POP. Please check x-client-ssl-err for more details. | string |
| x-cs-ssl-fronting-error | (Client SSL) Fronting Error | Indicates if the Remote Server certificate has a mismatch between the SNI (x-cs-sni) and the FQDN (cs-host) of the decrypted HTTP request. | string |
| x-s-custom-signing-ca-error | (Client SSL) Signing CA Error | Indicates that the SSL Engine failed to load the Interception CA to perform SSL interception. | string |
| x-client-ssl-err | (Client SSL) SSL Error | Description of SSL error between Client and POP. | string |
| x-cs-ssl-version | (Client SSL) Version | TLS Version negotiation between the Client and the POP. | string |
| x-cs-ssl-cipher | (Client SSL) Cipher | Cipher suite negotiation between the Client and the POP. | string |
| x-cs-domain-fronted-sni | N/A | This field is deprecated. Please use x-cs-ssl-fronting-error instead. | empty |
Client Geolocation
| Field Name | Name in Management Console | Description | Type |
|---|
| x-c-timezone | (Client) Timezone | Local timezone of the Client computed from geolocation of the device IP. | string |
| x-c-local-time | (Client) Local Time | Local time of the Client computed from geolocation of the device IP. This field provides the text format. | string |
| x-c-local-timestamp | N/A | Local time of the Client computed from geolocation of the device IP. This field provides the epoch format in seconds. | uint64 |
| x-c-location | (Client) Location | Location (e.g. city) of the Client. | string |
| x-c-zipcode | (Client) Zipcode | Zip code of the Client. | string |
| x-c-region | (Client) Region | Region (e.g. state) of the Client. | string |
| x-c-country | (Client) Country | Country of the Client. | string |
| x-c-latitude | (Client) Latitude | Latitude of the Client. | float64 |
| x-c-longitude | (Client) Longitude | Longitude of the Client. | float64 |
URL
| Field Name | Name in Management Console | Description | Type |
|---|
| x-cs-url | (URL) URL | Full URL of the Client to POP request, includes scheme, host, port if not standard, path and query. | string |
| x-cs-site | (URL) Site | Destination site computed from FQDN. | string |
| cs-method | (URL) Method | Method of the request (e.g. “GET”, “POST”). | string |
| cs-uri-scheme | (URL) Scheme | Scheme of the request (eg “https”). | string |
| cs-host | (URL) FQDN | FQDN (Fully Qualified Domain Name) of the request. | string |
| cs-dns | N/A | Alias to cs-host. | string |
| cs-uri-port | (URL) Port | Port of the FQDN requested by the client. | uint16 |
| x-cs-uri-path | (URL) Path | Path of the Client to POP request. | string |
| cs-uri-query | (URL) Query | Query string portion of the HTTP request. | string |
| cs-uri | N/A | Equivalent to x-cs-uri-path + ? + cs-uri-query. | string |
| cs-referer | (URL) Referer | Referer header in the HTTP request. | string |
General
| Field Name | Name in Management Console | Description | Type |
|---|
| date | Date | Date of beginning of the request, YYYY-MM-DD format, GMT Timezone. Human readable format for the x-cs-timestamp field. | string |
| time | Time | Time of beginning of the request in HH:MM-SEC format in GMT. Human readable format for the x-cs-timestamp field. | string |
| x-cs-timestamp | N/A | Date and Time of beginning of the request, epoch format in seconds, GMT Timezone. Epoch format of date and time. | uint64 |
| time-taken | Total time | Duration of the request processing: time between the first byte received and the last byte sent (integer value in ms). | uint64 |
| bytes | Total Processed Bytes | Sum of processed bytes (equivalent to cs-bytes + rs-bytes).
Note: in Format 1 to Format 3, definition remain the same, equivalent to cs-bytes + sc-bytes. | uint64 |
| x-action | Action | Final action applied at the POP (allow, block or redirect):
- block: the Client didn’t have access to the content of the Remote Server. Either the user is not allowed or there was an exception during the processing.
- allow: the Client received the data from the Remote Server.
- redirect: the Client received a redirect instead of the Remote Server content. Check x-action-reason for more details.
| string |
| x-action-reason | Action Reason | Provides insights on the cause of the x-action value. | string |
| x-error | Error Type | Provide details when the request is blocked. This field provide details on the reason of the block. | string |
| x-policy-justification-type | Justification Type | Justification type selected by the end user. | string |
| x-policy-justification-reason | Justification Reason | Justification provided by the end user. | string |
| x-cs-traffic-type | Traffic Type | Type of traffic. Values are: CloudApp for requests matching a Cloud application from App Catalog, Web for other HTTP requests, Unavailable for non decrypted traffic. | string |
| x-type | Transaction Type | The type of log message, which can be http_transaction or WebSocket. | string |
| x-transaction-id | Transaction ID | Transaction ID is a unique ID per individual request.Please use this ID to correlate with other events and alerts. | uint64 |
| x-request-id | Request ID | Request ID. Note: we recommend using x-transaction-id for event correlation. | uint64 |
| x-cs-session-id | Session ID | SessionID of the event. | uint64 |
| x-cs-page-id | Page ID | PageID identifier used for page event feature. | uint64 |
| x-tenant-id | N/A | ID of the Netskope Tenant. This field is useful when exporting events of multiple tenants in the same SIEM. | uint32 |
Identity
| Field Name | Name in Management Console | Description | Type |
|---|
| x-c-authn-user | User | Username after authentication.
Special values are:
- Unauthenticated: a configured authentication bypass matched the Client request.
- Pending: this request require authentication and is being redirected to the IDP. This request is not yet authenticated.
- Exception: the POP could not authenticate this request.
| string |
| cs-username | N/A | Alias to x-c-authn-user. | string |
| x-c-authz-groups | Groups | List of groups of the User after authentication. This field will include all groups referenced in the policies, even if the policies are not matching this request. | list of string |
| x-c-authz-ou | OU | Organization Unit of the User after authentication. | string |
| x-c-user-confidence-index | User Confidence Index | User Confidence Index. This field requires at least one policy based on user score. | uint16 |
| x-c-authn-source | Authentication Source | Source of the authentication. | string |
| x-c-authn-surrogate | Authentication Surrogate | Type of surrogate used to track the authentication. | string |
| x-c-authn-surrogate-status | Authentication Surrogate Status | Status of the surrogate. This field is mostly used to troubleshoot authentication issues. | string |
| x-c-authz-source | Authorization Source | Source of the User identity. | string |
Real-time Protection Policy
| Field Name | Name in Management Console | Description | Type |
|---|
| x-policy-action | (RTP Policy) Action | Action to execute after RTP policy evaluation. (allow, block, bypass, alert, useralert,…). | string |
| x-policy-name | (RTP Policy) Name | RTP policy name that matched and triggered the x-policy-action. | string |
| x-sc-notification-name | Notification Template | Name of the user notification displayed to the end user. | string |
| x-policy-categories | (RTP Policy) Categories | All custom and predefined categories applicable for the url in this transaction. | list of string |
| x-other-category | N/A | Alias to x-policy-categories. | list of string |
| x-other-category-id | N/A | Deprecated. Please use x-policy-categories instead. | empty |
| x-category | N/A | First value of x-policy-categories field. | string |
| x-category-id | N/A | Deprecated. Please use x-category instead. | empty |
| x-policy-src-ip | (RTP Policy) Source IP | Source IP computed by the RTP policy engine to evaluate the policy. This field will be updated with X-Forward-For when configured. | string |
| c-ip | N/A | Alias to x-policy-src-ip. | string |
| x-cs-userip | N/A | Alias to x-policy-src-ip. | string |
| x-policy-dst-ip | (RTP Policy) Destination IP | Destination IP computed by the RTP policy engine to evaluate the policy. | string |
| s-ip | N/A | Alias to x-policy-dst-ip. | string |
| x-policy-dst-host | (RTP Policy) FQDN | FQDN computed by the RTP policy engine to evaluate the policy.. Source for the FQDN is provided in x-policy-dst-host-source. | string |
| x-policy-dst-host-source | (RTP Policy) FQDN Source | Source for the x-policy-dst-host value computed by RTP policy engine (OriginalDestDomain Sni, Uri, HttpHostHeader, …). | string |
SSL Policy
| Field Name | Name in Management Console | Description | Type |
|---|
| x-ssl-bypass | SSL Bypass | Indicates if the request was SSL bypassed (not decrypted). | string |
| x-ssl-bypass-reason | SSL Bypass Reason | If the request was SSL bypassed, this field will provide the reason. | string |
| x-ssl-policy-action | (SSL Policy) Action | Action of the SSL Decryption Policy that matched the request. | string |
| x-ssl-policy-name | (SSL Policy) Name | Name of the SSL Decryption Policy that matched the request. | string |
| x-ssl-policy-issuer | (SSL Policy) Issuer | Certificate Authority name used to perform SSL Interception. | string |
| x-ssl-policy-categories | (SSL Policy) Categories | Categories of Destination FQDN computed by SSL Policy Engine to evaluate SSL Decryption Policies. | list of string |
| x-ssl-policy-src-ip | (SSL Policy) Source IP | Source IP computed by SSL Policy Engine to evaluate SSL Decryption Policies. | string |
| x-ssl-policy-dst-ip | (SSL Policy) Destination IP | Destination IP computed by SSL Policy Engine to evaluate SSL Decryption Policies. | string |
| x-ssl-policy-dst-host | (SSL Policy) FQDN | Destination FQDN computed by SSL Policy Engine to evaluate SSL Decryption Policies. | string |
| x-ssl-policy-dst-host-source | (SSL Policy) FQDN Source | Provide insight on how Destination FQDN was computed by SSL Policy Engine. Can be from SNI or original host. | string |
Threat Protection
| Field Name | Name in Management Console | Description | Type |
|---|
| x-tp-result | (Threat Protection) Result | Threat Protection evaluation result. | list of string |
| x-tp-engine | (Threat Protection) Engine | Threat Protection engine name in case of malware detection. | list of string |
| x-tp-malware-name | Malware Name | Malware name in case of malware detection. | list of string |
| x-tp-severity | (Threat Protection) Severity | Malware severity in case of malware detection. | list of string |
Egress IP Policy
| Field Name | Name in Management Console | Description | Type |
|---|
| x-eip-policy-footprint | (Egress IP Policy) Name | Egress Footprint name matching the POP to Remote Server request. | string |
| x-eip-policy-name | (Egress IP Policy) Footprint | Egress IP policy name matching the POP to Remote Server request. | string |
Remote Connection
| Field Name | Name in Management Console | Description | Type |
|---|
| x-sr-forward-dest | (Remote Connection) Forward Destination | Destination Proxy name when forward to proxy is applied on the POP to Remote Server request. | string |
| x-sr-src-ip | (Remote Connection) Source IP | Source IP of the POP to Remote Server request. This field is empty if dedicated IPs are used. | string |
| x-sr-src-port | (Remote Connection) Source Port | Source port of the POP to Remote Server request. This field is empty if dedicated IPs are used. | uint16 |
| x-sr-dst-ip | (Remote Connection) Destination IP | Destination IP of the POP to Remote Server request. | string |
| x-sr-dst-port | (Remote Connection) Destination Port | Destination port of the POP to Remote Server request. | uint16 |
| sr-bytes | (Remote Connection) Bytes Uploaded | Bytes sent from the POP to Remote Server. | uint64 |
| rs-bytes | (Remote Connection) Bytes Downloaded | Bytes received from the Remote Serve to the POP. | uint64 |
| rs-status | Remote Status Code | HTTP status code of the Remote Server to POP response. | uint16 |
| x-sr-headers-name | N/A | List of custom HTTP headers inserted. | string |
| x-sr-headers-value | N/A | List of custom HTTP header values inserted. | string |
Application
| Field Name | Name in Management Console | Description | Type |
|---|
| x-cs-app-activity | Activity | Activity identified by the proxy. | string |
| x-cs-app-from-user | (Application) From User | User identity in the Remote Application or Website. | string |
| x-cs-app-to-user | (Application) To User | Recipients of a share/send activity detected in the Cloud Application. | string |
| x-cs-app-instance-name | (Application) Instance Name | Cloud Application Instance name configured for the instance ID. | string |
| x-cs-app-instance-id | (Application) Instance ID | Cloud Application instance ID identified by the Proxy. | string |
| x-cs-app-instance-tags | (Application) Instance Tags | List of Cloud Application Instance tags. | list of string |
| x-cs-app-instance-tag | N/A | Alias to x-cs-app-instance-tags. | list of string |
| x-cs-app | (Application) Name | Cloud Application name. | string |
| x-cs-app-cci | (Application) CCI | Cloud Confidence Index of the Cloud Application. | uint16 |
| x-cs-app-ccl | (Application) CCL | Cloud Confidence Level of the Cloud Application. | string |
| x-cs-app-tags | (Application) Tags | Tags of the Cloud Application. | list of string |
| x-cs-app-category | (Application) Category | Category of the Cloud Application. | string |
| x-cs-app-suite | (Application) Suite | Cloud Application Suite name. | string |
Content
| Field Name | Name in Management Console | Description | Type |
|---|
| x-cs-app-object-name | Object Name | Name of the object transferred to/from the Cloud Application. | string |
| x-cs-app-object-id | Object ID | ID of the object transferred to/from the Cloud Application. | string |
| x-cs-app-object-type | Object Type | Type of the object transferred to/from the Cloud Application. | string |
| x-rs-file-type | File Type | Type of the object transferred to/from the Remote Server. | string |
| x-rs-file-category | File Category | Category of the object transferred to/from the Remote Server. | string |
| x-rs-file-language | File Language | Language of the object transferred to/from the Remote Server. | string |
| x-rs-file-size | File Size | Size of the object transferred to/from the Remote Server. Please note this is the size of the full object which can combine multiple requests. For accurate bytes consumption reports, please use bytes fields. | uint64 |
| x-rs-file-md5 | MD5 | MD5 Hash of the objects transferred to/from the remote server. This fields can have multiple values when multiple objects are transferred in the same request. | list of string |
| x-rs-file-sha256 | SHA256 | SHA256 Hash of the objects transferred to/from the remote server. This fields can have multiple values when multiple objects are transferred in the same request. | list of string |
Remote SSL Certificate
| Field Name | Name in Management Console | Description | Type |
|---|
| x-r-cert-subject-cn | (Remote SSL Certificate) CN | CN attribute of the Remote Server certificate Subject. | string |
| x-r-cert-issuer-cn | (Remote SSL Certificate) Issuer | Issuer CN attribute of the Remote Server certificate. | string |
| x-r-cert-valid | (Remote SSL Certificate) Valid | Overall result of the evaluation of the Remote Server certificate. This field doesn’t reflect the action of the SSL Engine. | string |
| x-r-cert-expired | (Remote SSL Certificate) Expired | Indicates if the Remote Server certificate is expired. | string |
| x-r-cert-untrusted-root | (Remote SSL Certificate) Untrusted Root | Indicates if the Remote Server certificate is signed by a trusted CA. | string |
| x-r-cert-incomplete-chain | (Remote SSL Certificate) Incomplete Chain | Indicates if the Remote Server certificate has an incomplete Issuer chain. | string |
| x-r-cert-self-signed | (Remote SSL Certificate) Self-Signed | Indicates if the Remote Server certificate is self-signed. | string |
| x-r-cert-revoked | (Remote SSL Certificate) Revoked | Indicates if the Remote Server certificate is revoked. | string |
| x-r-cert-revocation-check | (Remote SSL Certificate) Revocation Check (SSL Certificate) | Reserved for future use. | string |
| x-r-cert-mismatch | (Remote SSL Certificate) CN Mismatch | Indicates if the Remote Server certificate CN/SAN (x-r-cert-subject-cn, SAN is not logged) is not trusted for the requested SNI (x-cs-sni). | string |
| x-r-cert-startdate | (Remote SSL Certificate) Start Date | Start date/time of the Remote Server certificate. This field provides the text format. | string |
| x-r-cert-start | N/A | Start date/time of the Remote Server certificate. This field provides the epoch format in seconds. | uint64 |
| x-r-cert-enddate | (Remote SSL Certificate) End Date | End date/time of the Remote Server certificate. This field provides the text format. | string |
| x-r-cert-end | N/A | End date/time of the Remote Server certificate. This field provides the epoch format in seconds. | uint64 |
Remote SSL
| Field Name | Name in Management Console | Description | Type |
|---|
| x-sr-ssl-ja3s | (Remote SSL) JAS3s | JA3S Fingerprints the way the server responds to the TLS. | string |
| x-sr-ssl-engine-action | (Remote SSL) Engine Action | Indicates the result of SSL Engine processing between the POP and the Remote Server. | string |
| x-sr-ssl-engine-action-reason | (Remote SSL) Engine Action Reason | Provides details of the SSL Engine processing between the POP and the Remote Server. | string |
| x-sr-ssl-malformed-ssl | (Remote SSL) Malformed SSL | Indicates if the SSL Engine encounters malformed SSL packet during SSL/TLS negotiation between the POP and the Remote Server. | boolean |
| x-sr-ssl-handshake-error | (Remote SSL) Handshake Error | Indicates a problem to establish SSL/TLS negotiation between the POP and the Remote Server. Please check x-server-ssl-err for more details. | boolean |
| x-sr-ssl-client-certificate-error | (Remote SSL) Client Certificate Error | Indicates that the Remote Server requested a Client certificate during SSL/TLS negotiation. | boolean |
| x-server-ssl-err | (Remote SSL) Error | Description of SSL error between POP and Remote server. | string |
| x-sr-ssl-version | (Remote SSL) Version | TLS Version negotiated between the POP and the Remote Server. | string |
| x-sr-ssl-cipher | (Remote SSL) Cipher | Cipher suite negotiated between the Client and the POP. | string |
Remote Geolocation
| Field Name | Name in Management Console | Description | Type |
|---|
| x-r-location | (Remote) Location | Location (e.g. city) of the Remote Server. | string |
| x-s-location | N/A | Alias to x-r-location. | string |
| x-r-zipcode | (Remote) Zipcode | Zip code of the Remote Server. | string |
| x-s-zipcode | N/A | Alias to x-r-zipcode. | string |
| x-r-region | (Remote) Region | Region (e.g. state) of the Remote Server. | string |
| x-s-region | N/A | Alias to x-r-region. | string |
| x-r-country | (Remote) Country | Country of the Remote Server. | string |
| x-s-country | N/A | Alias to x-r-country. | string |
| x-r-latitude | (Remote) Latitude | Latitude of the Remote Server. | float64 |
| x-s-latitude | N/A | Alias to x-r-latitude. | float64 |
| x-r-longitude | (Remote) Longitude | Longitude of the Remote Server. | float64 |
| x-s-longitude | N/A | Alias to x-r-longitude. | float64 |
