A.5.3.9 Network Entry

This message describes the event of a system, such as a mobile device, intentionally entering or leaving the network.

Note: The machine should attempt to send this message prior to detaching. If this is not possible, it should retain the message in a local buffer so that it can be sent later. The mobile machine can then capture audit messages in a local buffer while it is outside the secure domain. When it is reconnected to the secure domain, it can send the detach message (if buffered), followed by the buffered messages, followed by a mobile machine message for rejoining the secure domain. The timestamps on these messages is the time that the event was noticed to have occurred, not the time that the message is sent.

Table A.5.3.9-1 Audit Message for Network Entry

Real World Entities Field Name Opt. Value
Event EventID M EV (110108, DCM, ”Network Entry”)
EventActionCode M Shall be: E = Execute
EventDateTime M not specialized
EventOutcomeIndicator M not specialized
EventTypeCode M EV (110124, DCM, “Attach”) EV (110125, DCM, “Detach”)

Active Participant: Node or System entering or leaving the network (1) UserID M not specialized
AlternativeUserID U not specialized
UserName U not specialized
UserIsRequestor M Shall be FALSE
RoleIDCode U not specialized
NetworkAccessPointTypeCode U not specialized
NetworkAccessPointID U not specialized

No Participant Objects are needed for this message.