Detailed Network Event Schema
Twingate exports network events in CSV format. Each network flow is represented as a single line, regardless of the duration or amount of data transferred during the connection. Only completed flows are reported. Details of the event columns are below:
start_time
: the beginning of the network communicationend_time
: the end of the network communication, will be empty if an error occurreduser
: the email address of the user initiating the communicationuser_id
: a numerical unique ID for the userdevice_id
: a unique identifier for the device used to connectclient_ip
: the public IPv4 IP of the client initiating the connectionconnector
: the name of the Connector the communication went throughconnector_id
: a numerical unique ID for the Connectorresource_ip
: the IP of the Resource that the user connected to, will be empty if a DNS error occurredresource_port
: the port that is being connected to on the Resourceresource_domain
: the FQDN of the Resource, will be empty if connection was direct to IPresource_id
: a numerical unique ID of the Resource, as defined in Twingate (e.g., if*.twingate.com
is the defined Resource, any connections totwingate.com
domains will have the same Resource IDprotocol
: the protocol used for the connection, can betcp
,udp
, oricmp
status
: can beDNS_ERROR
if the domain can’t be resolved orCONNECTION_FAILED
if a connection could not be established, otherwise will beNORMAL
bytes_transferred
: cumulative number of bytes transferred during the connection, will be empty if an error occurredbytes_received
: cumulative number of bytes received during the connection, will be empty if an error occurredremote_network
: the name defined in Twingate of the Remote Network that the Resource belongs toremote_network_id
: a numerical unique ID for the Remote Networkapplied_rule
: the name of the Resource that Twingate used to connect, as defined in Twingate (e.g., if*.twingate.com
is a Resource and the connection is tofoo.twingate.com
, this field will be*.twingate.com
relays
: an identifier for the Relay that the connection flowed throughrelay_ips
: the IP of the Relay that was usedrelay_ports
: the port of the Relay that was used
Last updated 8 hours ago