One of the significant features of NetFoundry and the OpenZiti technology is a rich set of events and metrics. Focused on security, we have invested significant amounts of time and energy into providing information to the user for security purposes. Some of these events are key to protect and investigate network usage.
API Session Creates
The API session is the primary authentication to the network. The session, as a token, is used to authenticate and authorize the various policies controlling service access, Edge Router Access, and other features. The API session create message, available from the OpenZiti Controller and the NetFoundry Metrics API (index ncevents) An OpenZiti example is available here. NetFoundry enriches the logs with the provided text labels, to make the records easier to read and adds the geographic context. An example:
{
"_index": ".ds-ncevents-2025.02.05-000310",
"_type": "_doc",
"_id": "ue9I15QBNzksA-IV3aRT",
"_version": 1,
"_score": 1,
"_source": {
"tags": null,
"geo": {
"country_code3": "US",
"country_name": "United States",
"region_name": "Southeast",
"location": {
"lon": -70.6536,
"lat": 33.4521
},
"longitude": -70.6536,
"city_name": "Anytown",
"continent_code": "NA",
"region_code": "SE",
"latitude": 33.4521,
"country_code2": "US",
"ip": "101.189.227.6",
"timezone": "America/New_York"
},
"organizationId": "048ff15d-7aef-498d-0902-478566818b6b",
"event_type": "created",
"token": "c78ef382-c780-4778-bdef-2b1c68595aa3",
"ip_address": "101.189.227.6",
"network_group_id": "012cc15d-7aef-498d-af02-478566818b6b",
"api_session_id": "cm6s78e1acqcm6ypcq482wn97",
"network_id": "5669f35a-5098-4bc2-8ae2-cc67e6bd1af7",
"@version": "1",
"nf_endpoint_id": "7234e066-3ed8-4da6-9762-ac1fced50bf3",
"identity_id": "ax9MkL3Jgj",
"@timestamp": "2025-02-05T18:04:23.799Z",
"network_name": "NetFoundry Customer",
"target_index": "ncevents",
"timestamp": "2025-02-05T18:04:14.070158103Z",
"nf_endpoint_name": "satisfied.customer",
"namespace": "edge.apiSessions",
"processed": 1
},
As you can see, there is geographic context added via our Elastic system, the IP as seen by the controller, and the identity information for the user or system connecting. This allows the user to be identified as to rough location and can be used to locate odd patterns of movement or the possible use of compromised devices or credentials. The identity ID and api session serve as indices to join other types of records to correlate use of the network by this identity.
API sessions are temporary and may be deleted and created for a number of reasons. In correlation, it is important to search for all the occurrences of the identity in the time period under investigation.
Fabric Circuit Dials
Fabric Circuits are the logical connections of an identity to a service. Detailed field descriptions are available here. Similar to other events, the NetFoundry API provides an enriched set of data with the configured text labels to make the records more easily human-readable (ncfabriccircuits index). The tags of these events include the clientId, which is the accessing (dialing) identity and the hostId, which is the identity id connected to. The key fields are the timestamp of the event, indicating whent he conneciton was made, and the service ID. The service ID can be correlated to utilization reports to understand the overall data volume transmitted and received on a particular circuit. The record also includes additional information about the circuit, however, these are generally not useful in a security context, though may be for network operations use cases.
An example record from the ncfabriccircuits index:
{
"_index": ".ds-ncfabriccircuits-2025.02.05-000949",
"_type": "_doc",
"_id": "84ZZ15QBIaEv9Dvai7HS",
"_version": 1,
"_score": 1,
"_source": {
"service_id": "6p5gN2FhU9UpG5fSMa7VSx",
"circuit_id": "MQgiJruoR",
"target_index": "ncfabriccircuits",
"nf_endpoint_id": "7f99f44f-256e-4cd6-8762-c40be0d1f1d6",
"network_group_id": "e3c426aa-9d83-4b5a-9bc5-f7355e296e1e",
"network_id": "3859cb88-aed6-459f-beeb-9b4f2fdd557e",
"client_id": "cm2p47f4v003g6vpjux2blozm",
"creation_timespan": 128789744,
"attributes": [
"#MY-ER"
],
"nf_service_name": "SSH_Service",
"terminator_id": "7kNw1PyeV1wvKyXoIFLil9",
"namespace": "fabric.circuits",
"key": "fabric.circuits.MQgiJruoR.3859cbc4-aed6-459f-beeb-9b4f2fdd557e",
"nf_service_id": "90782aca-c088-433e-8815-944c119cd7b9",
"path_cost": 263068,
"instance_id": "",
"tags": {
"serviceId": "6p5gN2FnU9UpG5fSMa7VSx",
"hostId": "zU5wk2R1H",
"clientId": "uJ0Z.7yzma"
},
"providerid": "",
"network_name": "My_Network",
"failure_cause": "",
"event_type": "created",
"timestamp": "2025-02-05T18:22:32.507969691Z",
"processed": 1,
"path": {
"initiator_local_addr": "10.101.5.4:53",
"ingress_id": "bAmYjex",
"initiator_remote_addr": "10.6.1.32:63141",
"links": [
"4U5WSQiHU8U2kEhXgRWFtH",
"7atjHGTe7xstcm1VmE3g7q"
],
"nodes": [
"uJ0Z.7yzma",
"w319Gtf.O8",
"zU5wkwc1H"
],
"terminator_remote_addr": "10.101.5.4:53",
"egress_id": "O2pPGXd",
"terminator_local_addr": "10.100.5.4:40947"
},
"link_count": 2,
"@version": "1",
"@timestamp": "2025-02-05T18:22:36.881Z",
"nf_endpoint_name": "MY-ER",
"identity_id": "uJ0Z.7yzma",
"organizationId": "1fc426aa-9d83-3a5a-9bc5-f7355e296e1e"
},
"fields": {
"target_index": [
"ncfabriccircuits"
],
"path.terminator_local_addr.keyword": [
"10.100.5.4:40947"
],
"network_group_id": [
"1fc426aa-9d83-4b5a-9bc5-f73552396e1e"
],
"key.keyword": [
"fabric.circuits.MQgiJruoR.3859cbc4-aed6-459f-beeb-9b4f2fdd557e"
],
"network_group_id.keyword": [
"1fc426aa-9d83-4b5a-9bc5-f7355e296e1e"
],
"client_id": [
"cm2p47f4v003g6vpjux2blozm"
],
"circuit_id.keyword": [
"MQgiJruoR"
],
"organizationId": [
"1fc426aa-9d83-4b5a-48c5-f7355e296e1e"
],
"event_type": [
"created"
],
"nf_endpoint_name": [
"PRT-ER"
],
"tags.hostId": [
"zU5wkwc1H"
],
"terminator_id": [
"7kNw1PyeV1wvKyXoIFLil9"
],
"failure_cause": [
""
],
"tags.clientId.keyword": [
"uJ-Z.7yzma"
],
"path.terminator_remote_addr.keyword": [
"10.101.5.4:53"
],
"path.initiator_remote_addr.keyword": [
"10.6.1.32:63141"
],
"creation_timespan": [
128789744
],
"path.links.keyword": [
"4U5WSQiHU8U2kEhXgRWFtH",
"7atjHGTe7xstcm1VmE3g7q"
],
"client_id.keyword": [
"cm2p47f4v003g6vpjux21lozm"
],
"network_name": [
"KEO-v7"
],
"@version.keyword": [
"1"
],
"path.initiator_local_addr": [
"10.101.5.4:53"
],
"network_name.keyword": [
"My_Network"
],
"network_id": [
"3859cbc4-aed6-459f-beeb-99cf2fdd557e"
],
"path.nodes.keyword": [
"uJ0Z.7yzma",
"w329Gtf.O8",
"zU7wkwc1H"
],
"instance_id": [
""
],
"nf_service_id.keyword": [
"90782aca-3ce6-433e-8815-944c119cd7b9"
],
"path.terminator_remote_addr": [
"10.101.5.4:53"
],
"organizationId.keyword": [
"1fc426aa-9483-4b5a-9bc5-f7355e296e1e"
],
"nf_endpoint_id": [
"7f0bf44f-336e-4cd6-8762-c40be0d1f1d6"
],
"nf_service_name": [
"SSH_Service"
],
"target_index.keyword": [
"ncfabriccircuits"
],
"link_count": [
2
],
"nf_endpoint_name.keyword": [
"MY-ER"
],
"path.nodes": [
"uJ0Z.7yzma",
"w359Gtf.O8",
"zU1wkwc1H"
],
"event_type.keyword": [
"created"
],
"instance_id.keyword": [
""
],
"path.initiator_remote_addr": [
"10.6.1.32:63141"
],
"path.terminator_local_addr": [
"10.100.5.4:40947"
],
"path_cost": [
263068
],
"path.egress_id": [
"O2pPGXd"
],
"service_id": [
"6p5gN2FnU9UpG5fSMa7VSx"
],
"@version": [
"1"
],
"path.ingress_id.keyword": [
"bAmYjex"
],
"identity_id.keyword": [
"uJ-Z.7yzma"
],
"circuit_id": [
"MQgiJruoR"
],
"tags.clientId": [
"uJ0Z.7yzma"
],
"key": [
"fabric.circuits.MQgiJruoR.3859cbc4-aed6-459f-beeb-9b4f2fdd557e"
],
"terminator_id.keyword": [
"7kNw1PyeV1wvKyXoIFLil9"
],
"timestamp": [
"2025-02-05T18:22:32.507Z"
],
"service_id.keyword": [
"6p5gN2FnU9UpG5fSMa7VSx"
],
"tags.serviceId": [
"6p5gN2FnU9UpG5fSMa7VSx"
],
"identity_id": [
"uJ0Z.7yzma"
],
"path.egress_id.keyword": [
"O2pPGXd"
],
"tags.hostId.keyword": [
"zU5wkwcK2"
],
"nf_service_id": [
"90782aca-34e6-433e-8815-944c119cd7b9"
],
"namespace.keyword": [
"fabric.circuits"
],
"nf_endpoint_id.keyword": [
"7f0bf44f-116e-4cd6-8762-c40be0d1f1d6"
],
"tags.serviceId.keyword": [
"6p5gN2FnUPOpG5fSMa7VSx"
],
"processed": [
1
],
"nf_service_name.keyword": [
"SSH_Service"
],
"path.links": [
"4U5WSQiHU8U2kEhXgRWFtH",
"7atjHGTe7xstcm1VmE3g7q"
],
"@timestamp": [
"2025-02-05T18:22:36.881Z"
],
"attributes.keyword": [
"#MY-ER"
],
"providerid.keyword": [
""
],
"network_id.keyword": [
"38523bc4-aed6-459f-beeb-9b4f2fdd557e"
],
"path.initiator_local_addr.keyword": [
"10.10.5.4:53"
],
"providerid": [
""
],
"namespace": [
"fabric.circuits"
],
"attributes": [
"#MY-ER"
],
"path.ingress_id": [
"bAmYjex"
],
"failure_cause.keyword": [
""
]
}
}
Fabric Usage
Fabric usage messages are published every 5 minutes (This is the NetFoundry default, it is configurable but can increase log volume significantly) and indicate the amount of data transmitted in each direction at each edge of the circuit. To understand the volume of data transmitted, one would usually choose either the ingress or egress transmit and receive. Ingress, in this context, is relative to the fabric. So the ingress receive traffic is from the initiating endpoint to the network, bound for the service. Ingress transmit is data flowing from the network service to the initiating endpoint. Egress measurements are relative to the hosting side of the circuit.
The usage is indexed to the fabric circuit, so data can be correlated from the fabric circuit created events, which can be correlated to the identity. The detailed field information can be found here.
As with other records, the NetFoundry metrics API provides preenriched data.
{
"_index": ".ds-ncutilization-2025-2025.02.04-000095",
"_type": "_doc",
"_id": "D6Vn15QB0M2j2yegHmHU",
"_version": 1,
"_score": 1,
"_source": {
"network_id": "5f529675-d864-4a87-aa93-28795796fee8",
"edge_session_id": "",
"nf_service_id": "b4a389db-68ef-444b-a3fe-4ab02e9ebc5c",
"organizationId": "0fcfac32-6082-488d-a3c8-0360bea93a7a",
"host_id": "vRzwTqRPAv",
"version": 3,
"processed": 1,
"nf_host_id": "4ea63bee-fdf6-463a-b4a1-a9a5162e98e2",
"usage": 300,
"fabric_circuit_id": "yDRTWbYex",
"namespace": "fabric.usage",
"nf_edge_router_name": "My_ER",
"target_index": "ncutilization-2025",
"network_group_id": "0fcfe832-6082-488d-a3c8-4760bea3ea7a",
"attributes": [
"#netfoundry"
],
"network_name": "Production",
"nf_endpoint_name": "us-east-1",
"service_id": "45xB1SaqdDsx3ID1HtZUWG",
"nf_edge_router_id": "413e6665-22c6-4d17-87a1-2fcd9527f290",
"identity_id": "rMHAcfDPAv",
"tags": {
"hostId": "vRzwTqRPAv",
"clientId": "rMHAcfDPAv",
"serviceId": "45xB1SaqdDsx3ID1HtZUWG"
},
"@version": "1",
"usage_type": "usage.egress.rx",
"timestamp": "2025-02-05T18:36:00Z",
"@timestamp": "2025-02-05T18:37:26.914Z",
"fabric_session_id": "",
"source_id": "vRzwTqRPAv",
"nf_endpoint_id": "8c86cdfd-3b08-43cf-9d2d-c5df2a37e473",
"nf_host_name": "My_ER",
"nf_service_name": "SSH_Service"
},
"fields": {
"target_index": [
"ncutilization-2025"
],
"network_group_id": [
"0fcfe832-6082-488d-a3c8-0360be3e3a7a"
],
"usage": [
300
],
"fabric_circuit_id.keyword": [
"yDRTWbYex"
],
"nf_host_name": [
"My_ER"
],
"network_group_id.keyword": [
"0fcfe832-6082-488d-a3c8-0360be3e3a7a"
],
"nf_edge_router_id": [
"413e6665-22c6-4d17-87a1-2fcd9527f290"
],
"organizationId": [
"0fcfe832-6082-488d-a3c8-0360be3e3a7a"
],
"nf_endpoint_name": [
"us-east-1"
],
"tags.hostId": [
"vRzwTqRPAv"
],
"usage_type": [
"usage.egress.rx"
],
"tags.clientId.keyword": [
"rMHAcfDPAv"
],
"nf_edge_router_name": [
"My_ER"
],
"network_name": [
"Production"
],
"@version.keyword": [
"1"
],
"fabric_session_id": [
""
],
"version": [
3
],
"network_name.keyword": [
"Production"
],
"network_id": [
"5f552675-d864-4a87-aa93-28795796fee8"
],
"nf_service_id.keyword": [
"b4a539db-68ef-444b-a3fe-4ab02e9ebc5c"
],
"host_id.keyword": [
"vRzwTqRPAv"
],
"organizationId.keyword": [
"0fcfe832-6082-488d-a3c8-0360bea93a7a"
],
"nf_endpoint_id": [
"8c86cdfd-3b08-43cf-9d2d-c5df2a37e473"
],
"nf_service_name": [
"SSH_Service"
],
"target_index.keyword": [
"ncutilization-2025"
],
"source_id.keyword": [
"vRzwTqRPAv"
],
"nf_endpoint_name.keyword": [
"us-east-1"
],
"edge_session_id": [
""
],
"nf_host_id.keyword": [
"4ea80bee-fdf6-463a-b4a1-a9a5162e98e2"
],
"nf_host_id": [
"4ea80bee-fdf6-463a-b4a1-a9a5162e98e2"
],
"service_id": [
"45xB1SaqdDsx3ID1HtZUWG"
],
"@version": [
"1"
],
"usage_type.keyword": [
"usage.egress.rx"
],
"identity_id.keyword": [
"rMHAcfDPAv"
],
"tags.clientId": [
"rMHAcfDPAv"
],
"nf_host_name.keyword": [
"My_ER"
],
"timestamp": [
"2025-02-05T18:36:00.000Z"
],
"service_id.keyword": [
"45xB1SaqdDsx3ID1HtZUWG"
],
"tags.serviceId": [
"45xB1SaqdDsx3ID1HtZUWG"
],
"identity_id": [
"rMHAcfDPAv"
],
"tags.hostId.keyword": [
"vRzwTqRPAv"
],
"fabric_session_id.keyword": [
""
],
"nf_edge_router_name.keyword": [
"My_ER"
],
"nf_service_id": [
"b4a539db-68ef-444b-a3fe-4ab02e9ebc5c"
],
"namespace.keyword": [
"fabric.usage"
],
"nf_endpoint_id.keyword": [
"8c86cdfd-3b08-43cf-9d2d-c5df2a37e473"
],
"host_id": [
"vRzwTqRPAv"
],
"nf_edge_router_id.keyword": [
"413e6665-22c6-4d17-87a1-2fcd9527f290"
],
"tags.serviceId.keyword": [
"45xB1SaqdDsx3ID1HtZUWG"
],
"processed": [
1
],
"nf_service_name.keyword": [
"SSH_service"
],
"@timestamp": [
"2025-02-05T18:37:26.914Z"
],
"attributes.keyword": [
"#netfoundry"
],
"edge_session_id.keyword": [
""
],
"network_id.keyword": [
"5f552675-d864-4a87-aa93-28795796fee8"
],
"namespace": [
"fabric.usage"
],
"attributes": [
"#netfoundry"
],
"fabric_circuit_id": [
"yDRTWbYex"
],
"source_id": [
"vRzwTqRPAv"
]
}
}
Entity Changes
The OpenZiti system produces a log of all changes made to entities within the network, and enriched data is available via the NetFoundry metrics API (index ncentitychanges) Some of these are redundant, such as API sessions. The most important items are those that may affect service and policy configurations. Policies authorize identities to dial or host services, use certain Edge Routers, and other aspects of the network. Endpoints and nodes are the infrastructure of the network.
The events are created, deleted, and updated on each entity, and include the original and final state for comparison, as well as the details of the identity making the change.
An example:
{
"_index": ".ds-ncentitychanges-2025.02.04-000321",
"_type": "_doc",
"_id": "WdN215QB0M2j2yegaXGd",
"_version": 1,
"_score": 1,
"_ignored": [
"event.finalState.keyword"
],
"_source": {
"networkName": "My_Network",
"ecs": {
"version": "1.12.0"
},
"@timestamp": "2025-02-05T18:54:08.383Z",
"log": {
"offset": 867649588,
"file": {
"path": "/var/log/ziti/entity-change-events.log"
}
},
"env": "production",
"target_index": "ncentitychanges",
"network_group_id": "82d70e3f-deda-469f-be1a-9c40561ede5d",
"event": {
"metadata": {
"source": {
"localAddr": "cc7da54f-8086-4ff9-b96d-6137124f6380.production.netfoundry.io:443",
"type": "rest",
"method": "POST",
"remoteAddr": "54.172.87.138:31622",
"auth": "edge"
},
"version": "v1.1.8",
"author": {
"type": "identity",
"id": "mVKFRcgIa",
"name": "Default Admin"
}
},
"isParentEvent": false,
"namespace": "entityChange",
"eventId": "2e27d3bb-9d1d-4933-8f03-d1c8c8c8b54b",
"initialState": "null",
"timestamp": "2025-02-05T18:54:08.330835128Z",
"eventType": "created",
"finalState": "{\"isSystem\":false,\"policyType\":\"Dial\",\"semantic\":\"AllOf\",\"name\":\"ScZYuPuRYi-5W6WHLZ2MN0FchsxwgReX3-dial\",\"serviceRoles\":[\"@5W6WHLZ2MN0FchsxwgReX3\"],\"postureCheckRoles\":null,\"updatedAt\":\"2025-02-05T18:54:07.91098798Z\",\"id\":\"3qKS5p53DzPBmw40gkSmIn\",\"createdAt\":\"2025-02-05T18:54:07.91098798Z\",\"identityRoles\":[\"@4li4CiYDHh\"],\"tags\":{\"zrok\":\"v0.4.47 [030c87aa]\",\"zrokShareToken\":\"6pm54do20433\"}}",
"entityType": "servicePolicies"
},
"network_id": "%{network_id}",
"namespace": "entityChange",
"input": {
"type": "log"
},
"networkGroupId": "82d70e3f-deda-469f-be1a-9c40561ede5d",
"@version": "1",
"networkId": "493b74d5-7498-4699-8a29-04611f07ccb9",
"cloudziti": true
},
"fields": {
"target_index": [
"ncentitychanges"
],
"event.metadata.source.method.keyword": [
"POST"
],
"network_group_id": [
"82d70e3f-deda-469f-be1a-9c40561ede5d"
],
"networkName": [
"My_Network"
],
"network_group_id.keyword": [
"82d70e3f-deda-469f-be1a-9c40561ede5d"
],
"event.metadata.version.keyword": [
"v1.1.8"
],
"ecs.version.keyword": [
"1.12.0"
],
"networkId": [
"493b74d5-7498-4699-8a29-04611f07ccb9"
],
"event.metadata.version": [
"v1.1.8"
],
"networkGroupId": [
"82d70e3f-deda-469f-be1a-9c40561ede5d"
],
"networkGroupId.keyword": [
"82d70e3f-deda-469f-be1a-9c40561ede5d"
],
"event.metadata.author.name.keyword": [
"Default Admin"
],
"event.metadata.source.auth.keyword": [
"edge"
],
"event.eventType": [
"created"
],
"event.initialState": [
"null"
],
"event.metadata.source.localAddr.keyword": [
"cc7da54f-8086-4ff9-b96d-6137124f6380.production.netfoundry.io:443"
],
"@version.keyword": [
"1"
],
"input.type": [
"log"
],
"log.offset": [
867649588
],
"event.timestamp": [
"2025-02-05T18:54:08.330Z"
],
"event.metadata.source.remoteAddr": [
"54.34.87.138:31622"
],
"network_id": [
"%{network_id}"
],
"cloudziti": [
true
],
"event.metadata.source.auth": [
"edge"
],
"ecs.version": [
"1.12.0"
],
"event.metadata.author.name": [
"Default Admin"
],
"event.metadata.author.type.keyword": [
"identity"
],
"event.initialState.keyword": [
"null"
],
"event.entityType": [
"servicePolicies"
],
"event.namespace.keyword": [
"entityChange"
],
"input.type.keyword": [
"log"
],
"target_index.keyword": [
"ncentitychanges"
],
"event.metadata.source.remoteAddr.keyword": [
"54.34.87.138:31622"
],
"event.eventId": [
"2e27d3bb-9d1d-4933-8f03-d1c8c8c8b54b"
],
"event.isParentEvent": [
false
],
"event.metadata.author.type": [
"identity"
],
"networkId.keyword": [
"493b74d5-7498-4699-8a29-04611f07ccb9"
],
"event.metadata.source.type": [
"rest"
],
"event.namespace": [
"entityChange"
],
"env.keyword": [
"production"
],
"@version": [
"1"
],
"log.file.path.keyword": [
"/var/log/ziti/entity-change-events.log"
],
"event.metadata.source.localAddr": [
"cc7da54f-8086-4ff9-b96d-6137124f6380.production.netfoundry.io:443"
],
"event.metadata.author.id.keyword": [
"mVKFRcgIa"
],
"event.entityType.keyword": [
"servicePolicies"
],
"event.metadata.source.type.keyword": [
"rest"
],
"event.metadata.author.id": [
"mVKFRcgIa"
],
"namespace.keyword": [
"entityChange"
],
"env": [
"production"
],
"event.eventId.keyword": [
"2e27d3bb-9d1d-4933-8f03-d1c8c8c8b54b"
],
"@timestamp": [
"2025-02-05T18:54:08.383Z"
],
"event.eventType.keyword": [
"created"
],
"network_id.keyword": [
"%{network_id}"
],
"event.finalState": [
"{\"isSystem\":false,\"policyType\":\"Dial\",\"semantic\":\"AllOf\",\"name\":\"ScZYuPuRYi-5W6WHLZ2MN0FchsxwgReX3-dial\",\"serviceRoles\":[\"@5W6WHLZ2MN0FchsxwgReX3\"],\"postureCheckRoles\":null,\"updatedAt\":\"2025-02-05T18:54:07.91098798Z\",\"id\":\"3qKS5p53DzPBmw40gkSmIn\",\"createdAt\":\"2025-02-05T18:54:07.91098798Z\",\"identityRoles\":[\"@4li4CiYDHh\"],\"tags\":{\"zrok\":\"v0.4.47 [030c87aa]\",\"zrokShareToken\":\"6pm54do4ms33\"}}"
],
"event.metadata.source.method": [
"POST"
],
"log.file.path": [
"/var/log/ziti/entity-change-events.log"
],
"namespace": [
"entityChange"
],
"networkName.keyword": [
"My_Network"
]
},
"ignored_field_values": {
"event.finalState.keyword": [
"{\"isSystem\":false,\"policyType\":\"Dial\",\"semantic\":\"AllOf\",\"name\":\"ScZYuPuRYi-5W6WHLZ2MN0FchsxwgReX3-dial\",\"serviceRoles\":[\"@5W6WHLZ2MN0FchsxwgReX3\"],\"postureCheckRoles\":null,\"updatedAt\":\"2025-02-05T18:54:07.91098798Z\",\"id\":\"3qKS5p53DzPBmw40gkSmIn\",\"createdAt\":\"2025-02-05T18:54:07.91098798Z\",\"identityRoles\":[\"@4li4CiYDHh\"],\"tags\":{\"zrok\":\"v0.4.47 [030c87aa]\",\"zrokShareToken\":\"6pm54do4ms33\"}}"
]
}
}