This is a string combining the netlogin session type (NETLOGIN or DOT1X) with the authenticated username, in the form "[NETLOGIN | DOT1X]:<username>". An admin reads this to identify both which authentication method was used and which user account was involved in a login, logout, or failure event. For example, this field might read "DOT1X:jsmith" to show that user jsmith authenticated via 802.1X.