Original ClearPass event timestamp in 'yyyy-MM-dd HH:mm:ss' format.

Type of authentication event.

Client device IP address assigned during the session.

IP address or hostname of the ClearPass Policy Manager server that processed the event.

Authenticated username associated with the session.

Operating system of the client device as identified by ClearPass.

Comma-separated list of user roles assigned by ClearPass Policy Manager.

Wireless network SSID the device connected to, if applicable.

Authentication protocol used for the session (e.g., EAP-TLS, PEAP, MAB).

Device health/posture status as determined by ClearPass endpoint compliance checks.

MAC address of the client device in colon-separated format.

Network access point or location identifier where the device connected.

Additional event attributes in JSON format that don't map to standard fields.