Console user action audit log (syslog CEF, event_id = UserAction)

Type	Field	Name	Description
Date	_time	Time
String	risk	Risk	LOW, MEDIUM, HIGH
String	hostname	Machine name	e.g. PC-0001
IP address	host_ip	Machine IP	e.g. 10.0.0.10
String	event_name	Event name	e.g. General/Login, General/Logout, Investigation/Query
String	user	User	e.g. /user01@example.com
String	login_method	Login method	e.g. PASSWORD
Boolean	is_success	Success
String	user_roles	User roles	e.g. sys_admin/analyst_l3