Refresh intakes documentation

_shared_content/operations_center/integrations/generated/02a74ceb-a9b0-467c-97d1-588319e39d71.md

@@ -443,6 +443,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
             "ip": [
                 "1.2.3.4",
                 "5.6.7.8"
+            ],
+            "user": [
+                "vpn17590"
             ]
         },
         "rule": {
@@ -451,6 +454,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
         "source": {
             "address": "1.2.3.4",
             "ip": "1.2.3.4"
+        },
+        "user": {
+            "name": "vpn17590"
         }
     }
     	
@@ -518,6 +524,53 @@ Find below few samples of events and how they are normalized by Sekoia.io.
 	```
 
 
+=== "test_sslvpn_log_3.json"
+
+    ```json
+
+    {
+        "message": "\"12/07/2023:10:58:42 GMT CXA-GAT 0-PPE-0 : default SSLVPN Message 1521206 0 :  \"SSO ns_sslvpn_process_sso_conn: user [email protected] clientip 1.2.3.7 request: /Citrix/CITRIXCGDWeb/clients/HTML5Client/resources/images/icon_clipboard.png sso_flags-0 p_flags-0 x_flags-200000 author_hdr_removed-0\"\"",
+        "event": {
+            "category": [
+                "network"
+            ],
+            "code": "Message",
+            "dataset": "audit_sslvpn",
+            "kind": "event",
+            "type": [
+                "connection"
+            ]
+        },
+        "@timestamp": "2023-12-07T10:58:42Z",
+        "citrix": {
+            "adc": {
+                "message": "SSO ns_sslvpn_process_sso_conn: user [email protected] clientip 1.2.3.7 request: /Citrix/CITRIXCGDWeb/clients/HTML5Client/resources/images/icon_clipboard.png sso_flags-0 p_flags-0 x_flags-200000 author_hdr_removed-0"
+            }
+        },
+        "client": {
+            "address": "1.2.3.7",
+            "ip": "1.2.3.7"
+        },
+        "observer": {
+            "name": "CXA-GAT"
+        },
+        "related": {
+            "ip": [
+                "1.2.3.7"
+            ],
+            "user": [
+                "john.doe"
+            ]
+        },
+        "user": {
+            "domain": "example.com",
+            "name": "john.doe"
+        }
+    }
+    	
+	```
+
+
 
 
 
@@ -534,6 +587,7 @@ The following table lists the fields that are extracted, normalized under the EC
 |`citrix.adc.message` | `keyword` |  |
 |`citrix.adc.virtual_server.ip` | `keyword` |  |
 |`citrix.adc.virtual_server.port` | `keyword` |  |
+|`client.ip` | `ip` | IP address of the client. |
 |`destination.ip` | `ip` | IP address of the destination. |
 |`event.action` | `keyword` | The action captured by the event. |
 |`event.category` | `keyword` | Event category. The second categorization field in the hierarchy. |
@@ -554,5 +608,6 @@ The following table lists the fields that are extracted, normalized under the EC
 |`tls.cipher` | `keyword` | String indicating the cipher used during the current connection. |
 |`tls.version` | `keyword` | Numeric part of the version parsed from the original string. |
 |`url.original` | `wildcard` | Unmodified original url as seen in the event source. |
+|`user.domain` | `keyword` | Name of the directory the user is a member of. |
 |`user.name` | `keyword` | Short name or login of the user. |