Client Intermediate Events Metadata

[
    {
        "categoryType": 5,
        "description": "Quarantine",
        "eventTypeMetaData": [
            {
                "eventType": 103,
                "description": "Prevention",
                "eventSubTypeMetaData": [
                    {
                        "eventSubType": 0,
                        "description": "The access point allowed the client to connect because intrusion prevention was turned off."
                    },
                    {
                        "eventSubType": 1,
                        "description": "The access point blocked the client because intrusion prevention was turned on."
                    }
                ]
            }
        ]
    },
    {
        "categoryType": 4,
        "description": "Client Steering",
        "eventTypeMetaData": [
            {
                "eventType": 20,
                "description": "Steering",
                "eventSubTypeMetaData": [
                    {
                        "eventSubType": 30,
                        "description": "The access point skipped client steering because a voice or video call was in progress. Client RSSI [$rssi] dBm. Threshold RSSI [$thresholdRssi] dBm. Best neighboring access point [$bstNbrMac] has RSSI [$bstNbrRssi] dBm and [$bstNbrClCnt] associated clients."
                    },
                    {
                        "eventSubType": 32,
                        "description": "The access point allowed the client to associate having tried to steer it previously. Client RSSI: [$rssi] dBm, Threshold RSSI: [$thresholdRssi] dBm."
                    },
                    {
                        "eventSubType": 31,
                        "description": "The access point skipped deauthentication because forceful disconnection was disabled for 802.11v supporting clients. Client RSSI [$rssi] dBm. Threshold RSSI [$thresholdRssi] dBm. Best neighboring access point [$bstNbrMac] has RSSI [$bstNbrRssi] dBm and [$bstNbrClCnt] associated clients."
                    },
                    {
                        "eventSubType": 34,
                        "description": "The access point skipped smart load balancing steering because the client was in a steering blackout period. Client RSSI [$rssi] dBm. Threshold RSSI [$thresholdRssi] dBm."
                    },
                    {
                        "eventSubType": 35,
                        "description": "The access point skipped smart load balancing steering because the client was in a steering blackout period. Client RSSI [$rssi] dBm. Threshold RSSI [$thresholdRssi] dBm. Best neighboring access point [$bstNbrMac] has RSSI [$bstNbrRssi] dBm and [$bstNbrClCnt] associated clients."
                    },
                    {
                        "eventSubType": 9,
                        "description": "Association failed because of high client load on AP. Client RSSI: [$rssi] dBm. Threshold RSSI [$thresholdRssi] dBm. Number of associated clients on 2.4 GHz radio: [$clCount2Ghz]. Number of associated clients on 5 GHz radio: [$clCount5Ghz]."
                    },
                    {
                        "eventSubType": 8,
                        "description": "The access point deauthenticated the client because of band steering. Client RSSI: [$rssi] dBm. Number of associated clients on 2.4 GHz radio: [$clCount2Ghz]. Number of associated clients on 5 GHz radio: [$clCount5Ghz]."
                    },
                    {
                        "eventSubType": 4,
                        "description": "Association failed because client’s RSSI [$rssi] dBm was below the minimum association RSSI [$thresholdRssi] dBm."
                    },
                    {
                        "eventSubType": 7,
                        "description": "The access point rejected the client’s association request on 2.4 GHz to steer it to 5 GHz. Client RSSI: [$rssi] dBm. Number of associated clients on 2.4 GHz radio: [$clCount2Ghz]. Number of associated clients on 5 GHz radio: [$clCount5Ghz]."
                    },
                    {
                        "eventSubType": 6,
                        "description": "The access point ignored the client’s association request on 2.4 GHz to steer it to 5 GHz. Client RSSI: [$rssi] dBm. Number of associated clients on 2.4 GHz radio: [$clCount2Ghz]. Number of associated clients on 5 GHz radio: [$clCount5Ghz]."
                    },
                    {
                        "eventSubType": 3,
                        "description": "The access point allowed the client to associate having tried to steer it previously. Client RSSI: [$rssi] dBm, Threshold RSSI: [$thresholdRssi] dBm."
                    },
                    {
                        "eventSubType": 2,
                        "description": "The access point deauthenticated the client because its RSSI [$rssi] dBm was below the minimum association RSSI [$thresholdRssi] dBm."
                    },
                    {
                        "eventSubType": 19,
                        "description": "The access point allowed the client to connect to 2.4 GHz radio because the client load on 5 GHz exceeded the configured threshold. Number of associated clients on 2.4 GHz radio: [$clCount2Ghz]. Number of associated clients on 5 GHz radio: [$clCount5Ghz]."
                    },
                    {
                        "eventSubType": 16,
                        "description": "The access point allowed the client to connect to 2.4 GHz radio because of higher client load on 5 GHz radio. Number of associated clients on 2.4 GHz radio: [$clCount2Ghz]. Number of associated clients on 5 GHz radio: [$clCount5Ghz]."
                    },
                    {
                        "eventSubType": 15,
                        "description": "The access point skipped band steering because the client was roaming. Client RSSI [$rssi] dBm. Number of associated clients on 2.4 GHz radio: [$clCount2Ghz]. Number of associated clients on 5 GHz radio: [$clCount5Ghz]."
                    },
                    {
                        "eventSubType": 18,
                        "description": "The access point skipped band steering because the client was in a steering blackout period. Number of associated clients on 2.4 GHz radio: [$clCount2Ghz]. Number of associated clients on 5 GHz radio: [$clCount5Ghz]."
                    },
                    {
                        "eventSubType": 17,
                        "description": "The access point skipped band steering because the client was in a steering blackout period. Number of associated clients on 2.4 GHz radio: [$clCount2Ghz]. Number of associated clients on 5 GHz radio: [$clCount5Ghz]."
                    },
                    {
                        "eventSubType": 11,
                        "description": "The access point skipped minimum RSSI based steering because the client was in a steering blackout period. Client RSSI [$rssi] dBm. Threshold RSSI [$thresholdRssi] dBm."
                    },
                    {
                        "eventSubType": 13,
                        "description": "The access point skipped client steering because a voice or video call was in progress. Client RSSI: [$rssi] dBm. Threshold RSSI [$thresholdRssi] dBm."
                    },
                    {
                        "eventSubType": 14,
                        "description": "The access point skipped deauthentication because forceful disconnection was disabled for 802.11v supporting clients. Client RSSI [$rssi] dBm. Threshold RSSI [$thresholdRssi] dBm."
                    },
                    {
                        "eventSubType": 10,
                        "description": "The access point skipped smart steering because the client was in a steering blackout period. Client RSSI: [$rssi] dBm.  Threshold RSSI [$thresholdRssi] dBm."
                    },
                    {
                        "eventSubType": 29,
                        "description": "The access point skipped minimum RSSI based steering because the client was in a steering blackout period. Client RSSI [$rssi] dBm. Threshold RSSI [$thresholdRssi] dBm. Best neighboring access point [$bstNbrMac] has RSSI [$bstNbrRssi] dBm and [$bstNbrClCnt] associated clients."
                    },
                    {
                        "eventSubType": 28,
                        "description": "The access point skipped smart steering because the client was in a steering blackout period. Client RSSI [$rssi] dBm. Threshold RSSI [$thresholdRssi] dBm. Best neighboring access point [$bstNbrMac] has RSSI [$bstNbrRssi] dBm and [$bstNbrClCnt] associated clients."
                    },
                    {
                        "eventSubType": 27,
                        "description": "Association failed because of high client load on AP. Client RSSI [$rssi] dBm. Threshold RSSI [$thresholdRssi] dBm. Best neighboring access point [$bstNbrMac] has RSSI [$bstNbrRssi] dBm and [$bstNbrClCnt] associated clients."
                    },
                    {
                        "eventSubType": 26,
                        "description": "Association failed because client’s RSSI [$rssi] dBm was below the minimum association RSSI of [$thresholdRssi] dBm. Best neighboring access point [$bstNbrMac] has RSSI [$bstNbrRssi] dBm and [$bstNbrClCnt] associated clients."
                    },
                    {
                        "eventSubType": 24,
                        "description": "The access point sent a 802.11v BSS Transition Request to the client, which will be disconnected in [$disTime] milliseconds. The count of neighboring APs that the client could connect: [$nbrCnt]."
                    },
                    {
                        "eventSubType": 25,
                        "description": "The access point deauthenticated the client because its RSSI [$rssi] dBm was below the minimum association RSSI of [$thresholdRssi] dBm. Best neighboring access point [$bstNbrMac] has RSSI [$bstNbrRssi] dBm and  [$bstNbrClCnt] associated clients."
                    },
                    {
                        "eventSubType": 22,
                        "description": "The access point allowed the client to connect to 2.4 GHz radio because the client RSSI in 5 GHz was low. Number of associated clients on 2.4 GHz radio: [$clCount2Ghz]. Number of associated clients on 5 GHz radio: [$clCount5Ghz]."
                    },
                    {
                        "eventSubType": 23,
                        "description": "The access point skipped band steering because a voice or video call was in progress. Client RSSI: [$rssi] dBm. Number of associated clients on 2.4 GHz radio: [$clCount2Ghz]. Number of associated clients on 5 GHz radio: [$clCount5Ghz]."
                    },
                    {
                        "eventSubType": 20,
                        "description": "The access point skipped band steering because the client load on 5 GHz exceeded the configured threshold. Number of associated clients on 2.4 GHz radio: [$clCount2Ghz]. Number of associated clients on 5 GHz radio: [$clCount5Ghz]."
                    },
                    {
                        "eventSubType": 21,
                        "description": "The access point skipped band steering because the client RSSI in 5 GHz was lower than the configured threshold. Number of associated clients on 2.4 GHz radio: [$clCount2Ghz]. Number of associated clients on 5 GHz radio: [$clCount5Ghz]."
                    }
                ]
            }
        ]
    },
    {
        "categoryType": 1,
        "description": "Association",
        "eventTypeMetaData": [
            {
                "eventType": 13,
                "description": "Disassociation received from client",
                "eventSubTypeMetaData": [
                    {
                        "eventSubType": 11,
                        "description": "The access point received disassociation from the client because RSN information was inconsistent."
                    },
                    {
                        "eventSubType": 10,
                        "description": "The access point received disassociation from the client because RSN information was absent."
                    },
                    {
                        "eventSubType": 13,
                        "description": "The access point disassociated the client because of Message Integrity Code (MIC) failure."
                    },
                    {
                        "eventSubType": 12,
                        "description": "The access point received disassociation from the client because it received an invalid information element from the client."
                    },
                    {
                        "eventSubType": 1,
                        "description": "The access point received disassociation from the client."
                    },
                    {
                        "eventSubType": 2,
                        "description": "The access point received disassociation from the client because the previous association was no longer valid."
                    },
                    {
                        "eventSubType": 3,
                        "description": "The access point received disassociation from the client because it was leaving or has left."
                    },
                    {
                        "eventSubType": 4,
                        "description": "The access point received disassociation from the client because its association has expired."
                    },
                    {
                        "eventSubType": 0,
                        "description": "The access point successfully received disassociation from  the client."
                    },
                    {
                        "eventSubType": 9,
                        "description": "The access point received disassociation from the client because it was not layer 2 authenticated."
                    },
                    {
                        "eventSubType": 6,
                        "description": "The access point received disassociation from the client because it was not authenticated."
                    },
                    {
                        "eventSubType": 5,
                        "description": "The access point received disassociation from the client because the access point has reached the limit on maximum number of simultaneous associations."
                    },
                    {
                        "eventSubType": 8,
                        "description": "The access point received disassociation from the client because it was leaving or has left."
                    },
                    {
                        "eventSubType": 7,
                        "description": "The access point received disassociation from the client because it sent a data frame when it was not authenticated."
                    }
                ]
            },
            {
                "eventType": 18,
                "description": "Inactive Client removed from AP",
                "eventSubTypeMetaData": [
                    {
                        "eventSubType": 0,
                        "description": "The access point deauthenticated the client because of client inactivity."
                    }
                ]
            },
            {
                "eventType": 17,
                "description": "Client disconnected from AP",
                "eventSubTypeMetaData": []
            },
            {
                "eventType": 102,
                "description": "Client Disconnection",
                "eventSubTypeMetaData": [
                    {
                        "eventSubType": 1,
                        "description": "The client was disconnected from its access point by a user via the management console."
                    }
                ]
            },
            {
                "eventType": 5,
                "description": "Association Response",
                "eventSubTypeMetaData": [
                    {
                        "eventSubType": 0,
                        "description": "Client successfully (re)associated."
                    }
                ]
            },
            {
                "eventType": 11,
                "description": "Deauthentication received from client",
                "eventSubTypeMetaData": [
                    {
                        "eventSubType": 2,
                        "description": "The access point received deauthentication from client because previous authentication is no longer valid."
                    },
                    {
                        "eventSubType": 1,
                        "description": "The access point received deauthentication from client."
                    },
                    {
                        "eventSubType": 0,
                        "description": "The access point successfully received deauthentication from client."
                    },
                    {
                        "eventSubType": 6,
                        "description": "The access point received deauthentication from client because a Class 2 frame was unexpectedly received by the access point when it was unassociated."
                    },
                    {
                        "eventSubType": 5,
                        "description": "The access point received deauthentication from client because access point is unable to handle all currently associated clients."
                    },
                    {
                        "eventSubType": 4,
                        "description": "The access point received deauthentication from client because authentication expired."
                    },
                    {
                        "eventSubType": 3,
                        "description": "The access point received deauthentication from client because client is leaving (or has left) IBSS or ESS."
                    },
                    {
                        "eventSubType": 9,
                        "description": "The access point received deauthentication from client because layer 2 authentication was not completed."
                    },
                    {
                        "eventSubType": 7,
                        "description": "The access point received deauthentication from client because Class 3 frame was unexpectedly received from nonauthenticated client"
                    },
                    {
                        "eventSubType": 8,
                        "description": "The access point received deauthentication from client because client was leaving or has left IBSS or ESS."
                    },
                    {
                        "eventSubType": 11,
                        "description": "The access point received deauthentication from the client because the 802.11i Robust Security Network (RSN) was inconsistent."
                    },
                    {
                        "eventSubType": 10,
                        "description": "The access point received deauthentication from client because the 802.11i Robust Security Network (RSN) was not present. "
                    },
                    {
                        "eventSubType": 13,
                        "description": "The access point received deauthentiucation from client because Message integrity code (MIC) failed."
                    },
                    {
                        "eventSubType": 12,
                        "description": "The access point received deauthentication from the client because access point received invalid information element from client"
                    }
                ]
            },
            {
                "eventType": 12,
                "description": "Disassociation sent from AP",
                "eventSubTypeMetaData": [
                    {
                        "eventSubType": 7,
                        "description": "The access point disassociated the client because it sent a data frame when it was not authenticated."
                    },
                    {
                        "eventSubType": 6,
                        "description": "The access point disassociated the client because it was not authenticated."
                    },
                    {
                        "eventSubType": 9,
                        "description": "The client (re)association failed because it was not layer 2 authenticated."
                    },
                    {
                        "eventSubType": 8,
                        "description": "The access point disassociated the client because it was leaving or has left."
                    },
                    {
                        "eventSubType": 0,
                        "description": "The access point successfully disassociated the client."
                    },
                    {
                        "eventSubType": 1,
                        "description": "The access point disassociated the client."
                    },
                    {
                        "eventSubType": 2,
                        "description": "The access point disassociated the client because the previous association was no longer valid."
                    },
                    {
                        "eventSubType": 3,
                        "description": "The access point disassociated the client because it was leaving (or has left) IBSS or ESS."
                    },
                    {
                        "eventSubType": 4,
                        "description": "The access point disassociated the client because its association has expired."
                    },
                    {
                        "eventSubType": 5,
                        "description": "The access point disassociated the client because the access point has reached the limit on maximum number of simultaneous associations."
                    },
                    {
                        "eventSubType": 23,
                        "description": "The access point disassociated the client because RADIUS authentication was failed."
                    },
                    {
                        "eventSubType": 13,
                        "description": "The access point disassociated the client because of Message Integrity Code (MIC) failure."
                    },
                    {
                        "eventSubType": 12,
                        "description": "The access point disassociated the client because the access point received an invalid information element from the client."
                    },
                    {
                        "eventSubType": 11,
                        "description": "The access point disassociated the client because RSN information was inconsistent."
                    },
                    {
                        "eventSubType": 10,
                        "description": "The access point disassociated the client because RSN information was absent."
                    }
                ]
            },
            {
                "eventType": 10,
                "description": "Deauthentication sent from AP",
                "eventSubTypeMetaData": [
                    {
                        "eventSubType": 6,
                        "description": "The access point disassociated the client because a Class 2 frame was unexpectedly received from the client when it was unassociated."
                    },
                    {
                        "eventSubType": 9,
                        "description": "Client (re)association failed because layer 2 authentication was not completed."
                    },
                    {
                        "eventSubType": 111,
                        "description": "The access point deauthenticated the client because of client inactivity."
                    },
                    {
                        "eventSubType": 112,
                        "description": "The access point deauthenticated the client because BSS was down."
                    },
                    {
                        "eventSubType": 113,
                        "description": "The access point deauthenticated the client because of a configuration change on the access point."
                    },
                    {
                        "eventSubType": 114,
                        "description": "The access point deauthenticated the client because the access point changed the channel."
                    },
                    {
                        "eventSubType": 11,
                        "description": "The access point deauthenticated the client because the 802.11i Robust Security Network (RSN) was inconsistent."
                    },
                    {
                        "eventSubType": 15,
                        "description": "The access point deauthenticated the client because of MAC filtering."
                    }
                ]
            }
        ]
    },
    {
        "categoryType": 3,
        "description": "Network",
        "eventTypeMetaData": [
            {
                "eventType": 21,
                "description": "DNS",
                "eventSubTypeMetaData": [
                    {
                        "eventSubType": 1,
                        "description": "The client successfully received a response for its DNS query."
                    }
                ]
            },
            {
                "eventType": 104,
                "description": "Hostapd Network",
                "eventSubTypeMetaData": [
                    {
                        "eventSubType": 39,
                        "description": "VLAN ID [$vlan] was received from the RADIUS server."
                    },
                    {
                        "eventSubType": 43,
                        "description": "Clearing client Role [$detailedRole]."
                    },
                    {
                        "eventSubType": 42,
                        "description": "Client Role [$detailedRole] received."
                    },
                    {
                        "eventSubType": 47,
                        "description": "Clearing Google OU [$detailedGoogleOU] received."
                    },
                    {
                        "eventSubType": 46,
                        "description": "Google OU [$detailedGoogleOU] received."
                    },
                    {
                        "eventSubType": 48,
                        "description": "[$detailedRole] role applied to the client."
                    }
                ]
            },
            {
                "eventType": 9,
                "description": "IP Address",
                "eventSubTypeMetaData": [
                    {
                        "eventSubType": 0,
                        "description": "Client has received IP address [$ip]."
                    }
                ]
            },
            {
                "eventType": 19,
                "description": "Bandwidth",
                "eventSubTypeMetaData": [
                    {
                        "eventSubType": 3,
                        "description": "The bandwidth limit for this client, set from [$bwSource], was removed."
                    },
                    {
                        "eventSubType": 1,
                        "description": "Upload bandwidth limit of [$bwUpload] and download bandwidth limit of [$bwDownload] was set for this client from [$bwSource]."
                    }
                ]
            }
        ]
    },
    {
        "categoryType": 2,
        "description": "Authentication",
        "eventTypeMetaData": [
            {
                "eventType": 8,
                "description": "Splashd",
                "eventSubTypeMetaData": [
                    {
                        "eventSubType": 5,
                        "description": "Client successfully connected to the captive portal."
                    },
                    {
                        "eventSubType": 0,
                        "description": "Client successfully authenticated on the captive portal."
                    }
                ]
            },
            {
                "eventType": 3,
                "description": "Authentication Response",
                "eventSubTypeMetaData": []
            },
            {
                "eventType": 1,
                "description": "Hostapd",
                "eventSubTypeMetaData": [
                    {
                        "eventSubType": 41,
                        "description": "The access point reached the maximum retry limit for 3/4 msg of WPA 4-way handshake."
                    },
                    {
                        "eventSubType": 40,
                        "description": "The access point reached the maximum retry limit for 1/4 msg of WPA 4-way handshake."
                    },
                    {
                        "eventSubType": 44,
                        "description": "Google authentication successful."
                    },
                    {
                        "eventSubType": 20,
                        "description": "The access point received an EAPOL-Key request with an invalid Message Integrity Code (MIC) from the client."
                    },
                    {
                        "eventSubType": 21,
                        "description": "The Key Message Integrity Code (MIC) was not set in the EAPOL-Key frame received from the client."
                    },
                    {
                        "eventSubType": 22,
                        "description": "The access point received an invalid EAPOL-Key from the client."
                    },
                    {
                        "eventSubType": 16,
                        "description": "The EAPOL-Key msg 2/4 of WPA 4-way handshake from the client was invalid and hence dropped."
                    },
                    {
                        "eventSubType": 17,
                        "description": "The EAPOL-Key msg 4/4 of WPA 4-way handshake from the client was invalid and hence dropped."
                    },
                    {
                        "eventSubType": 15,
                        "description": "An invalid EAPOL-Key frame received from the client."
                    },
                    {
                        "eventSubType": 18,
                        "description": "The client detected a Michael Message Integrity Code (MIC) failure."
                    },
                    {
                        "eventSubType": 19,
                        "description": "The access point received an EAPOL-Key with an invalid Message Integrity Code (MIC) from the client."
                    },
                    {
                        "eventSubType": 11,
                        "description": "PMKID not found in PMK Cache."
                    },
                    {
                        "eventSubType": 8,
                        "description": "The EAPOL-Key frame received from the access point contains invalid Pairwise Transit Key (PTK)."
                    }
                ]
            },
            {
                "eventType": 15,
                "description": "RADIUS Authentication",
                "eventSubTypeMetaData": [
                    {
                        "eventSubType": 15,
                        "description": "Switching to Primary RADIUS server [$radiusPrimaryIP] from Secondary RADIUS server [$radiusSecondaryIP] for authentication."
                    },
                    {
                        "eventSubType": 18,
                        "description": "The client received RADIUS Change of Authorization (CoA)."
                    },
                    {
                        "eventSubType": 1,
                        "description": "RADIUS authentication was successful."
                    },
                    {
                        "eventSubType": 6,
                        "description": "Switching to Secondary RADIUS server [$radiusSecondaryIP] from Primary RADIUS server [$radiusPrimaryIP] for authentication."
                    }
                ]
            },
            {
                "eventType": 22,
                "description": "Roaming",
                "eventSubTypeMetaData": [
                    {
                        "eventSubType": 1,
                        "description": "The PMKID requested by the client did not match the stored PMKIDs for the client."
                    }
                ]
            }
        ]
    }
]