Audit Events in Cloud Audit

[#1]

Context:

What Audit Events are: 

    Audit Events are records that a user took action in an IdentityNow tenant, or other service like IdentityAI. Audit Events are structurally and conceptually very similar to IdentityIQ's Audit Events, but have evolved in several ways.

Searching them in the UI:

   Go to the search tab -> search field. Please see the attached image.

Below is the list of audit events allowed by default that are currently indexed in Search.

Scroll to the right to see more fields with information ->

1	Technical name in Search	Type in Search	Legacy Action	Description
2	USER_ACTIVATE_PASSED	USER_MANAGEMENT	USER_ACTIVATE	The user activation from user management operation was successfully activated
3	USER_ACTIVITY_EXPORT_PASSED	USER_MANAGEMENT	USER_ACTIVITY_EXPORT	The user activity export from user management operation was successfully exported
4	USER_ROLE_ADMIN_GRANT_PASSED	USER_MANAGEMENT	USER_ADMIN_GRANT	The admin role for a user from user management operation was granted successfully
5	USER_ROLE_ADMIN_REVOKE_PASSED	USER_MANAGEMENT	USER_ADMIN_REVOKE	The admin role for a user form user management operation was revoked successfully
6	USER_DELETE_PASSED	USER_MANAGEMENT	USER_DELETE	The deletion of a user from user management operation was successful
7	USER_EMAIL_UPDATE_PASSED	USER_MANAGEMENT	USER_EMAIL_UPDATE	The updating of a user email from user management operation was successful
8	USER_ROLE_HELPDESK GRANT_PASSED	USER_MANAGEMENT	USER_HELPDESK_GRANT	The helpdesk role for a user from user management operation was granted successfully
9	USER_ROLE_HELPDESK_REVOKE_PASSED	USER_MANAGEMENT	USER_HELPDESK_REVOKE	The helpdesk role for a user from user management operation was revoked successfully
10	USER_INVITE_PASSED	USER_MANAGEMENT	USER_INVITE	The invite for a user from user management operation was successful
11	USER_INVITE_FAILED	USER_MANAGEMENT	USER_INVITE_FAILURE	The invite for a user from user management operation failed
12	USER_KBA_DELETE_PASSED	USER_MANAGEMENT	USER_KBA_ANSWER_DELETE	The KBA deletion for a user from user management operation was successful
13	USER_KBA_UPDATE_PASSED	USER_MANAGEMENT	USER_KBA_ANSWER_UPDATE	The KBA updation for a user from user managements operation was successful
14	USER_KBA_NOTIFY_PASSED	USER_MANAGEMENT	USER_KBA_ANSWER_UPDATE_NOTIFICATION	The KBA notification for a user in user management operation was successful
15	USER_KBA_ANSWERS_PASSED	USER_MANAGEMENT	USER_KBA_ANSWERS	The KBA answerf or a user in user management operation was successful
16	USER_LOCK_PASSED	USER_MANAGEMENT	USER_LOCK	The locking of a user in user management operation was successful
17	USER_PHONE_UPDATE_PASSED	USER_MANAGEMENT	USER_PHONE_UPDATE	The updating of a users phone in user managemenet operation was successful
18	USER_REGISTER_PASSED	USER_MANAGEMENT	USER_REGISTRATION	The registration of a user in user management operation was successful
19	USER_REGISTER_FAILED	USER_MANAGEMENT	USER_REGISTRATION_FAILURE	The registration of a user in user management operation has failed
20	USER_REGISTER_STARTED	USER_MANAGEMENT	USER_REGISTRATION_LINK	The registration of a user in user management operation has started
21	USER_RESET_PASSED	USER_MANAGEMENT	USER_RESET	The reset of a user in user management operation was successful
22	USER_AUTH_STEP_UP _SETUP_PASSED	USER_MANAGEMENT	USER_STEP_UP_AUTH	The setup of step up in a user auth in user management operation was successful
23	USER_AUTH_STEP_UP _SETUP_FAILED	USER_MANAGEMENT	USER_STEP_UP_AUTH_FAILURE	The setup of step up in a user auth in user management operation has failed
24	USER_UNLOCK_PASSED	USER_MANAGEMENT	USER_UNLOCK	The unlocking of a user in user management operation was successful
25	USER_UNLOCK_REJECTED	USER_MANAGEMENT	USER_UNLOCK_REJECTED	The unlocking of a user in user management operation was rejected
26	EMAIL_SENT_PASSED	USER_MANAGEMENT	emailSent	The sending email in user management operation was successful
27	EMAIL_SENT_FAILED	USER_MANAGEMENT	emailFailure	The sending email in user management operation has failed
28	USER_ROLE_DASHBOARD_GRANT_PASSED	USER_MANAGEMENT	USER_DASHBOARD_GRANT	Role dashboard for a user has been granted in user management operation was successful
29	USER_ROLE_DASHBOARD_REVOKE_PASSED	USER_MANAGEMENT	USER_DASHBOARD_REVOKE	Role dashboard for a user has been revoked in user management operation was successful
30	IDENTITY_DELETE_PASSED	USER_MANAGEMENT	USER_REMOVE	The deletion of an identity in user management operation was successful
31	USER_ROLE_CERTIFICATION_ADMIN_GRANT_PASSED	USER_MANAGEMENT	USER_CERT_ADMIN_GRANT	Indicates the role certification admin has been granted to a user in user management operation successfully
32	USER_ROLE_CERTIFICATION_ADMIN_REVOKE_PASSED	USER_MANAGEMENT	USER_CERT_ADMIN_REVOKE	Indicates the role certification admin has been revoked to a user in user management operation successfully
33	USER_ROLE_REPORT_ADMIN_GRANT_PASSED	USER_MANAGEMENT	USER_REPORT_ADMIN_GRANT	Indicates the role report admin has been granted to a user in user management operation successfully
34	USER_ROLE_REPORT_ADMIN_REVOKE_PASSED	USER_MANAGEMENT	USER_REPORT_ADMIN_REVOKE	Indicates the role report admin has been revoked to a user in user management operation successfully
35	USER_ROLE_ROLE_ADMIN_GRANT_PASSED	USER_MANAGEMENT	USER_ROLE_ADMIN_GRANT	Indicates the role role admin has been granted to a user in user management operation successfully
36	USER_ROLE_ROLE_ADMIN_REVOKE_PASSED	USER_MANAGEMENT	USER_ROLE_ADMIN_REVOKE	Indicates the role role admin has been revoked to a user in user management operation successfully
37	USER_ROLE_SOURCE_ADMIN_REVOKE_PASSED	USER_MANAGEMENT	USER_SOURCE_ADMIN_GRANT	Indicates the role source admin has been revoked to a user in user management operation successfully
38	USER_ROLE_SOURCE_ADMIN_REVOKE_PASSED	USER_MANAGEMENT	USER_SOURCE_ADMIN_REVOKE	Indicates the role source admin has been revoked to a user in user management operation successfully
39	PASSWORD_CHANGE_STARTED	PASSWORD_ACTIVITY	PasswordChange	The change of a password process from password activity operation is started
40	PASSWORD_CHANGE_FAILED	PASSWORD_ACTIVITY	PasswordChangeFailure	The change of a password process from password activity operation has failed
41	PASSWORD_ACTION_CHANGE_PASSED	PASSWORD_ACTIVITY	PasswordChangeSuccess	The action of changing a password process from password activity operation was successful
42	PASSWORD_REQUEST_STARTED	PASSWORD_ACTIVITY	PasswordsRequestStart	The request of a password process from password activity operation has started
43	PASSWORD_EXPIRED_CHANGE_STARTED	PASSWORD_ACTIVITY	ExpirePasswordStart	The process of changing a password when it expired from password activity operation has started
44	PASSWORD_EXPIRED_CHANGE_PASSED	PASSWORD_ACTIVITY	ExpiredPasswordChange	The process of changing a password when it expired from password activity operation was successful
45	PASSWORD_FORGOT_CHANGE_PASSED	PASSWORD_ACTIVITY	ForgotPasswordChange	The process of changing a password when it was forgotten from password activity operation was successful
46	PASSWORD_FORGOT_CHANGE_STARTED	PASSWORD_ACTIVITY	ForgotPasswordStart	The process of changing a password when it was forgotten from password activity operation has started
47	ACCOUNT_PASSWORD_RESET_FAILED	PASSWORD_ACTIVITY	ACCOUNT_PASSWORD_RESET_FAILED	The reset an account password from password activity operation failed
48	ACCOUNT_PASSWORD_RESET_PASSED	PASSWORD_ACTIVITY	ACCOUNT_PASSWORD_RESET_PASSED	The reset an account password from password activity operation was successful
49	ACCOUNT_PASSWORD_SYNC_PASSED	PASSWORD_ACTIVITY	ACCOUNT_PASSWORD_SYNC_PASSED	The sync of a password in an account from password activity operation was successful
50	SOURCE_PASSWORD_CHANGE_STARTED	PASSWORD_ACTIVITY	SOURCE_EXTERNAL_PASSWORD_CHANGE	The change of the source password in password activity operation has started
51	SOURCE_PASSWORD_CHANGE_FAILED	PASSWORD_ACTIVITY	SOURCE_EXTERNAL_PASSWORD_CHANGE_FAILED	The change of the source password in password activity operation failed
52	SOURCE_PASSWORD_CHANGE_PASSED	PASSWORD_ACTIVITY	SOURCE_EXTERNAL_PASSWORD_CHANGE_PASSED	The change of the source password in password activity operation was successful
53	USER_PASSWORD_RESET_REJECTED	PASSWORD_ACTIVITY	USER_PASSWORD_RESET_REJECTED	A reset of a user password in password activity operation was rejected
54	USER_PASSWORD_UPDATE_STARTED	PASSWORD_ACTIVITY	USER_PASSWORD_UPDATE	A user password updating in password activity operation event has started
55	USER_PASSWORD_UPDATE_FAILED	PASSWORD_ACTIVITY	USER_PASSWORD_UPDATE_FAILED	A user password updating in password activity operation has failed
56	USER_PASSWORD_UPDATE_PASSED	PASSWORD_ACTIVITY	USER_PASSWORD_UPDATE_PASSED	A user password updating in password activity operation was successful
57	SOURCE_PASSWORD_INTERCEPT_IGNORED	PASSWORD_ACTIVITY	SOURCE_PASSWORD_INTERCEPT_IGNORED	The intercept of the source password in password activity was ignored
58	SOURCE_PASSWORD_INTERCEPT_PROCESSED	PASSWORD_ACTIVITY	SOURCE_PASSWORD_INTERCEPT_PROCESSED	The intercept of the source password in password activity was processed
59	ACCOUNT_VAULT_UPDATE_PASSED	PASSWORD_ACTIVITY	ACCOUNT_VAULT_UPDATED	The vault of an account updating in password activity operation was successful
60	PASSWORD_POLICY_ASSIGN_PASSED	PASSWORD_ACTIVITY	SOURCE_PASSWORD_POLICY_ASSIGNED	A password policy was assigned successfully in password activity operation
61	SAML_REDIRECT_PATTERNS_UPDATE_PASSED	PASSWORD_ACTIVITY	REDIRECT_PATTERNS_UPDATED	The updating of the saml redirect patterns in password activity operation was successful
62	PASSWORD_POLICY_CREATE_PASSED	PASSWORD_ACTIVITY	PASSWORD_POLICY_CREATED	Creation of a password policy in password activity operation was successful
63	PASSWORD_POLICY_DELETE_PASSED	PASSWORD_ACTIVITY	PASSWORD_POLICY_DELETED	Deletion of a password policy in password activity operation was successful
64	PASSWORD_REPLAY_ENABLE_PASSED	PASSWORD_ACTIVITY	PASSWORD_REPLAY_ENABLED	Enable the password replay in password activity operation was successful
65	STRONG_AUTHENTICATION_INTEGRATION_ENABLE_PASSED	PASSWORD_ACTIVITY	INTEGRATION_ENABLED	Enable to strong authentication integration in password activity operation was successful
66	PASSWORD_REPLAY_PASSIVE_LAUNCH_PASSED	PASSWORD_ACTIVITY	PASSWORD_REPLAY_PASSIVE	The passive launch of password replay in password activity operation was successful
67	PASSWORD_POLICY_UPDATE_PASSED	PASSWORD_ACTIVITY	PASSWORD_POLICY_UPDATED	The updating of password policy in password activity operation was successful
68	STRONG_AUTHENTICATION_INTEGRATION_DISABLE_PASSED	PASSWORD_ACTIVITY	INTEGRATION_DISABLED	The strong authentication integration was disabled successfully in password activity operation
69	STRONG_AUTHENTICATION_INTEGRATION_UPDATE_PASSED	PASSWORD_ACTIVITY	INTEGRATION_UPDATED	The updating of a strong authentication integration in password activity operation was successful
70	ACCOUNT_VAULT_RESET_PASSED	PASSWORD_ACTIVITY	ACCOUNT_FULL_RESET	The reset of account vault in password activity operation was successful
71	MFA_VERIFICATION_FAILED_PASSED	PASSWORD_ACTIVITY	MFA_VERIFICATION_FAILED	The failure of the mfa verification in password activity operation was successful
72	BROWSER_EXTENSION_DISABLE_PASSED	PASSWORD_ACTIVITY	PASSWORD_REPLAY_DISABLED	Indicates the browser extension was disabled successfully in password activity operation
73	ACCOUNT_CREATE_PASSED	PROVISIONING	CreateAccount	The create account provisioning operation was successful
74	ACCOUNT_CREATE_FAILED	PROVISIONING	CreateAccountFailure	The create account provisioning operation failed
75	ACCOUNT_DELETE_PASSED	PROVISIONING	DeleteAccount	The delete account provisioning operation was successful
76	ACCOUNT_DELETE_FAILED	PROVISIONING	DeleteAccountFailure	The delete account provisioning operation failed
77	ACCOUNT_DISABLE_PASSED	PROVISIONING	DisableAccount	The disable account provisioning operation was successful
78	ACCOUNT_DISABLE_FAILED	PROVISIONING	DisableAccountFailure	The disable account provisioning operation failed
79	ATTRIBUTE_SYNC_DISABLE_PASSED	PROVISIONING	DisableAttributeSync	The attribute synchronization configuration was successfully disabled
80	ACCOUNT_ENABLE_PASSED	PROVISIONING	EnableAccount	The enable account provisioning operation was successful
81	ACCOUNT_ENABLE_FAILED	PROVISIONING	EnableAccountFailure	The enable account provisioning operation failed
82	ATTRIBUTE_SYNC_ENABLE_PASSED	PROVISIONING	EnableAttributeSync	The attribute synchronization configuration was successfully enabled
83	ACCOUNT_MODIFY_PASSED	PROVISIONING	ModifyAccount	The provisioning operations which updated the account were successful
84	ACCOUNT_MODIFY_FAILED	PROVISIONING	ModifyAccountFailure	The provisioning operations which updated the account failed
85	ACCOUNT_UNLOCK_PASSED	PROVISIONING	UnlockAccount	The unlock account provisioning operation was successful
86	ACCOUNT_UNLOCK_FAILED	PROVISIONING	UnlockAccountFailure	The unlock account provisioning operation failed
87	IDENTITY_STATE_CHANGE_PASSED	PROVISIONING	IdentityStateChange	The change of state of an identity in provisioning operation was successful
88	PROVISION_CHANGE_STARTED	PROVISIONING	Provisioning	The change for provision in provisioning operation has started
89	PROVISION_CHANGE_PASSED	PROVISIONING	ProvisioningComplete	The change for provision in provisioning operation was successful
90	PROVISION_CHANGE_FAILED	PROVISIONING	ProvisioningFailure	The change for provision in provisioning operation has failed
91	APP_REQUEST_APPROVED	PROVISIONING	App Request Approved	The app request provisioning operation was approved
92	APP_REQUEST_REJECTED	PROVISIONING	App Request Rejected	The app request provisioning operation was rejected
93	IDENTITY_CREATE_PASSED	PROVISIONING	IDENTITY_CREATE_PASSED	The identity creation provisioning operation was successful
94	IDENTITY_UPDATE_PASSED	PROVISIONING	IDENTITY_UPDATE_PASSED	The identity updating provisioning operation was successful
95	IDENTITY_DELETE_PASSED	PROVISIONING	IDENTITY_DELETE_PASSED	The identity deletion provisioning operation was successful
96	IDENTITY_LIFECYCLE_CHANGE_PASSED	PROVISIONING	identityLifecycleEvent	The change of lifecycle for an identity in provisioning operation was successful
97	ACCOUNT_MANUAL_CHANGE_COMPLETE_PASSED	PROVISIONING	ManualChange	The completion of a manual change in an account in provisioning operation was successful
98	IDENTITY_ATTRIBUTE_VALUE_UPDATE_PASSED	PROVISIONING	IdentityAttributeUpdate	The updating of an attribute value in identity in provisioning operation was successful
99	WORKITEM_COMPLETE_COMMENTS_ADD_PASSED	PROVISIONING	Comment	The addition of comments for a complete workitem in provisioning operation was successful
100	APPROVAL_ITEM_APPROVE_PASSED	PROVISIONING	ApproveLineItem	The approving item in an approval in provisioning operation was successful
101	ACCOUNT_PROFILE_UPDATED	PROVISIONING	ACCOUNT_PROFILE_UPDATED	The account provisioning policy was successfully updated
102	ACCOUNT_PROFILE_CREATED	PROVISIONING	ACCOUNT_PROFILE_CREATED	The account provisioning policy was successfully created
103	ACCOUNT_PROFILE_DELETED	PROVISIONING	ACCOUNT_PROFILE_DELETED	The account provisioning policy was successfully deleted
104	IDENTITY_ACCOUNT_REMOVE_PASSED	PROVISIONING	USER_REMOVE_ACCOUNT	The account was successfully removed from the identity
105	ACCESS_REQUEST_STARTED	ACCESS_REQUEST	AccessRequestRequested	The request for access in access request operation has started
106	ACCESS_REQUEST_APPROVED	ACCESS_REQUEST	AccessRequestApproved	The request for access in access request operation was approved
107	ACCESS_REQUEST_REJECTED	ACCESS_REQUEST	AccessRequestRejected	The request for access in access request operation was rejected
108	ACCESS_REQUEST_FORWARDED	ACCESS_REQUEST	AccessRequestForwarded	The request for access in access request operation was forwarded
109	ACCESS_REQUEST_ESCALATED	ACCESS_REQUEST	escalate	The request for access in access request operation was escalated
110	APP_REQUEST_PASSED	ACCESS_REQUEST	RequestApp	The request for an app in access request operation has passed
111	CERTIFICATION_CAMPAIGN_CREATE_PASSED	CERTIFICATION	CertificationCampaignCreate	The creation of a certification campaign in certification operation was successful
112	CERTIFICATION_CAMPAIGN_ACTIVATE_PASSED	CERTIFICATION	CertificationCampaignActivate	The activation of a certification campaign in certification operation was successful
113	CERTIFICATION_CAMPAIGN_COMPLETE_PASSED	CERTIFICATION	CERT_CAMPAIGN_COMPLETE	The completion of a certification campaign in certification operation was successful
114	CERTIFICATION_CAMPAIGN_DELETE_PASSED	CERTIFICATION	CertificationCampaignDelete	The deletion of a certification campaign in certification operation was successful
115	CERTIFICATION_CAMPAIGN_FILTER_CREATE_PASSED	CERTIFICATION	CampaignFilterCreate	The filter creation of a certification campaign in certification operation was successful
116	CERTIFICATION_CAMPAIGN_FILTER_DELETE_PASSED	CERTIFICATION	CampaignFilterDelete	The filter deletion of a certification campaign in certification operation was successful
117	CERTIFICATION_CAMPAIGN_FILTER_UPDATE_PASSED	CERTIFICATION	CampaignFilterUpdate	The filter updating of a certification campaign in certification operation was successful
118	CERTIFICATION_CAMPAIGN_STUCK_DETECTED	CERTIFICATION	STUCK_PENDING_CAMPAIGN_DETECTED	The stuck of a certification campaign in certification operation was detected
119	CERTIFICATION_CAMPAIGN_REVIEW_NOTIFY_PASSED	CERTIFICATION	CERT_CAMPAIGN_REVIEW_NOTIFICATION	The notification of a certification campaign review in certification operation was successful
120	CERTIFICATION_CAMPAIGN_FINISH_PASSED	CERTIFICATION	CERTIFICATIONSFINISHED	The completion of certification campaign in certification operation was successful
121	CERTIFICATION_SIGNOFF_PASSED	CERTIFICATION	signoff	The signoff of a certification in certification operation was successful
122	CERTIFICATION_REASSIGN_PASSED	CERTIFICATION	reassign	The reassign of a certification in certification operation was successful
123	CERTIFICATION_ITEM_CREATION_STATS_LOG_PASSED	CERTIFICATION	CERT_ITEM_TIMESTAMP_STATS	The certification item creation stats log event in certification operation was successful
124	CERTIFICATION_PHASE_CHANGE_PASSED	CERTIFICATION	certificationsPhased	The certification phase change in certification operation was successful
125	CERTIFICATION_ITEM_REMEDIATE	CERTIFICATION	remediate	Indicates the remediation of a certification item in certification operation
126	RULE_CREATE_PASSED	CERTIFICATION	RULE_CREATE_PASSED	The creation of a rule in certification operation was successful
127	RULE_UPDATE_PASSED	CERTIFICATION	RULE_UPDATE_PASSED	The updating of a rule in certification operation was successful
128	RULE_DELETE_PASSED	CERTIFICATION	RULE_DELETE_PASSED	The deletion of a rule in certification operation was successful
129	ENTITLEMENT_ADD_PASSED	ACCESS_ITEM	AddEntitlement	The addition of an entitlement in access item operation was successful
130	ENTITLEMENT_ADD_FAILED	ACCESS_ITEM	AddEntitlementFailure	The addition of an entitlement in access item operation has failed
131	ENTITLEMENT_REMOVE_PASSED	ACCESS_ITEM	RemoveEntitlement	The removal of an entitlement in access item operation was successful
132	ENTITLEMENT_REMOVE_FAILED	ACCESS_ITEM	RemoveEntitlementFailure	The removal of an entitlement in access item operation has failed
133	ACCESS_PROFILE_CREATE_PASSED	ACCESS_ITEM	ACCESS_PROFILE_CREATE	The access profile creation in access item operation was successful
134	ACCESS_PROFILE_DELETE_PASSED	ACCESS_ITEM	ACCESS_PROFILE_DELETE	The access profile deletion in access item operation was successful
135	ACCESS_PROFILE_UPDATE_PASSED	ACCESS_ITEM	ACCESS_PROFILE_UPDATE	The access profile updating in access item operation was successful
136	ROLE_DEPROVISION_ENABLE_PASSED	ACCESS_ITEM	ROLE_ENABLE_DEPROVISIONING	The enablement of role deprovision in access item operation
137	ROLE_DEPROVISION_DISABLE_PASSED	ACCESS_ITEM	ROLE_DISABLE_DEPROVISIONING	A role deprovision in access item operation was disabled successfully
138	IDENTITY_PROFILE_UPDATE_PASSED	ACCESS_ITEM	IDENTITY_PROFILE_UPDATE	Updating of identity profile in access item operation was successful
139	ROLE_CREATE_PASSED	ACCESS_ITEM	ROLE_CREATE_PASSED	The creation of a role in access item operation was successful
140	ROLE_UPDATE_PASSED	ACCESS_ITEM	ROLE_UPDATE_PASSED	The updating of a role in access item operation was successful
141	ROLE_DELETE_PASSED	ACCESS_ITEM	ROLE_DELETE_PASSED	The deletion of a role in access item operation was successful
142	LIFECYCLE_STATE_CREATE_PASSED	ACCESS_ITEM	LIFECYCLE_STATE_CREATE_PASSED	The creation of a lifecycle state in access item operation was successful
143	LIFECYCLE_STATE_UPDATE_PASSED	ACCESS_ITEM	LIFECYCLE_STATE_UPDATE_PASSED	The updating of a lifecycle state in access item operation was successful
144	LIFECYCLE_STATE_DELETE_PASSED	ACCESS_ITEM	LIFECYCLE_STATE_DELETE_PASSED	The deletion of a lifecycle state in access item operation was successful
145	ENTITLEMENT_SET_PASSED	ACCESS_ITEM	SetEntitlement	Entitlement was set up successfully in access item operation
146	ROLE_ADD_PASSED	ACCESS_ITEM	RoleAdd	The addition of a role in access item operation was successful
147	IDENTITY_PROFILE_ATTRIBUTE_CREATE_PASSED	ACCESS_ITEM	Identity Profile Attribute Create	The creation of a profile attribute in an identity in access item operation was successful
148	IDENTITY_PROFILE_ATTRIBUTE_DELETE_PASSED	ACCESS_ITEM	Identity Profile Attribute Delete	The deletion of a profile attribute in an identity in access item operation was successful
149	IDENTITY_PROFILE_ATTRIBUTE_UPDATE_PASSED	ACCESS_ITEM	Identity Profile Attribute Update	The updating of a profile attribute in an identity in access item operation was successful
150	APP_UPDATE_PASSED	ACCESS_ITEM	APP_UPDATE	The app updating in access item operation was successful
151	APP_CREATE_PASSED	ACCESS_ITEM	APP_CREATE	The creation of an app in access item operation was successful
152	APP_DELETE_PASSED	ACCESS_ITEM	APP_DELETE	The deletion of an app in access item operation was successful
153	APP_IMPORT_PASSED	ACCESS_ITEM	APP_IMPORT	The import of an app in access item operation was successful
154	APP_ACCESS_PROFILE_SET_PASSED	ACCESS_ITEM	APP_SET_ACCESS_PROFILES	The app access profile set up in access item operation was successful
155	APP_ADD_PASSED	ACCESS_ITEM	APP_ADD	The addition of an app in access item operation was successful
156	APP_XML_UPDATE_PASSED	ACCESS_ITEM	APP_UPDATE_XML	The updating of an app xml in access item operation was successful
157	APP_REMOVE_PASSED	ACCESS_ITEM	APP_REMOVE	The removal of an app in access item operation was successful
158	APP_PURGE_PASSED	ACCESS_ITEM	APP_PURGED	The app purge in access item operation was successful
159	IDENTITY_PROFILE_AUTHENTICATION_CONFIGURE_PASSED	ACCESS_ITEM	IDENTITY_PROFILE_CONFIGURE_AUTHN	The authentication configuration of an identity profile in access item operation was successful
160	ACCESS_REQUEST_APPROVAL_FORWARD_PASSED	ACCESS_ITEM	Forward	The forward of an access request approval in access item operation was successful
161	ACCESS_REQUEST_CONFIG_UPDATE_PASSED	ACCESS_ITEM	AccessRequestConfigUpdated	The config update of an access request in access item operation was successful
162	IDENTITY_PROFILE_DELETE_PASSED	ACCESS_ITEM	IDENTITY_PROFILE_DELETE	The deletion of an identity profile in access item operation was successful
163	IDENTITY_PROFILE_ATTRIBUTES_UPDATE_PASSED	ACCESS_ITEM	IDENTITY_PROFILE_ATTRIBUTES_UPDATED	The attribute updating for an identity profile in access item operation was successful
164	IDENTITY_PROFILE_CREATE_PASSED	ACCESS_ITEM	IDENTITY_PROFILE_CREATE	The creation of an identity profile in access item operation was successful
165	CONNECTOR_FILE_DELETE_PASSED	SOURCE_MANAGMENT	CONNECTOR_FILE_DELETE	The deletion of a connector file in source management operation was successful
166	CONNECTOR_FILE_UPLOAD_PASSED	SOURCE_MANAGMENT	CONNECTOR_FILE_UPLOAD	The uploading of a connector file in source management operation was successful
167	SOURCE_ACCOUNT_AGGREGATE_PASSED	SOURCE_MANAGMENT	SOURCE_ACCOUNT_AGGREGATION	Aggregation of a source account in source management operation was successful
168	SOURCE_ACCOUNT_AGGREGATE_TERMINATED	SOURCE_MANAGMENT	SOURCE_AGGREGATION_TERMINATED	Termination of source account aggregate in source management operation
169	SOURCE_ACCOUNT_EXPORT_PASSED	SOURCE_MANAGMENT	SOURCE_ACCOUNTS_EXPORT	The export of a source account in source management operation was successful
170	SOURCE_ACCOUNT_FEED_DOWNLOAD_PASSED	SOURCE_MANAGMENT	SOURCE_ACCOUNT_FEED_DOWNLOAD	The download of the source account feed in source management operation was successful
171	SOURCE_ACTIVITY_EXPORT_PASSED	SOURCE_MANAGMENT	SOURCE_ACTIVITY_EXPORT	The export of source activity in source management operation was successful
172	SOURCE_CREATE_PASSED	SOURCE_MANAGMENT	SOURCE_CREATE	The creation of source in source management operation was successful
173	SOURCE_DELETE_PASSED	SOURCE_MANAGMENT	SOURCE_DELETE	The deletion of source in source management operation was successful
174	SOURCE_FEATURES_STRING_UPDATE_PASSED	SOURCE_MANAGMENT	SOURCE_FEATURES_STRING_UPDATE	The update of source features string in source management operation was successful
175	SOURCE_RESET_PASSED	SOURCE_MANAGMENT	SOURCE_RESET	The source reset in source management operation was successful
176	SOURCE_UPDATE_PASSED	SOURCE_MANAGMENT	SOURCE_UPDATE	The source updating in source management operation was successful
177	SOURCE_ENTITLEMENT_AGGREGATE_PASSED	SOURCE_MANAGMENT	SOURCE_ENTITLEMENT_AGGREGATION	The aggregation of source entitlement in source management operation was successful
178	SOURCE_ENTITLEMENT_IMPORT_PASSED	SOURCE_MANAGMENT	SOURCE_ENTITLEMENT_IMPORT	The import of source entitlement in source management operation was successful
179	SOURCE_ENTITLEMENT_EXPORT_PASSED	SOURCE_MANAGMENT	SOURCE_ENTITLEMENT_EXPORT	The export of source entitlement in source management operation was successful
180	SOURCE_EXTERNAL_PASSWORD_CHANGE_ACTIVITY_EXPORT_PASSED	SOURCE_MANAGMENT	SOURCE_EXTERNAL_PASSWORD_CHANGE_ACTIVITY_EXPORT	The export of source external password change activity in source management operation was successful
181	SOURCE_SCHEMA_ATTRIBUTE_ADD_PASSED	SOURCE_MANAGMENT	SOURCE_SCHEMA_ATTRIBUTE_ADDED	The addition of a source schema attribute in source management operation was successful
182	SOURCE_SCHEMA_ATTRIBUTE_DELETE_PASSED	SOURCE_MANAGMENT	SOURCE_SCHEMA_ATTRIBUTES_DELETED	The deletion of a source schema attribute in source management operation was successful
183	SOURCE_SCHEMA_ATTRIBUTE_UPDATE_PASSED	SOURCE_MANAGMENT	SOURCE_SCHEMA_ATTRIBUTES_UPDATED	The updating of a source schema attribute in source management operation was successful
184	SOURCE_DELETE_THRESHOLD_UPDATE_PASSED	SOURCE_MANAGMENT	SOURCE_UPDATE_DELETE_THRESHOLD	The updating of a source delete threshold in source management operation was successful
185	SOURCE_AGGREGATION_SCHEDULE_UPDATE_PASSED	SOURCE_MANAGMENT	SOURCE_AGGREGATION_SCHEDULE_UPDATED	The schedule updating of a source aggregation in source management operation was successful
186	CUSTOM_CONNECTOR_CREATE_PASSED	SOURCE_MANAGMENT	CONNECTOR_CREATE	The creation of a custom connector in source management operation was successful
187	CUSTOM_CONNECTOR_DELETE_PASSED	SOURCE_MANAGMENT	CONNECTOR_DELETE	The deletion of a custom connector in source management operation was successful
188	CUSTOM_CONNECTOR_EXPORT_PASSED	SOURCE_MANAGMENT	CONNECTOR_EXPORT	The export of a custom connector in source management operation was successful
189	CUSTOM_CONNECTOR_UPDATE_PASSED	SOURCE_MANAGMENT	CONNECTOR_UPDATE	The updating of a custom connector in source management operation was successful
190	SOURCE_RENAME_FAILED	SOURCE_MANAGMENT	SOURCE_RENAME_FAILURE_DETECTED	The source rename in source management operation has failed
191	SERVICE_DESK_INTEGRATION_CREATED	SOURCE_MANAGMENT	SERVICE_DESK_INTEGRATION_CREATED	An integration for service desk in source management operation was created
192	SERVICE_DESK_INTEGRATION_CREATE_FAILED	SOURCE_MANAGMENT	SERVICE_DESK_INTEGRATION_CREATE_FAILED	The creation of a service desk integration in source management operation has failed
193	SERVICE_DESK_INTEGRATION_UPDATED	SOURCE_MANAGMENT	SERVICE_DESK_INTEGRATION_UPDATED	The updating of a service desk integration in source management operation was successful
194	SERVICE_DESK_INTEGRATION_UPDATE_FAILED	SOURCE_MANAGMENT	SERVICE_DESK_INTEGRATION_UPDATE_FAILED	The updating of service desk integration in source management operation has failed
195	SERVICE_DESK_INTEGRATION_DELETED	SOURCE_MANAGMENT	SERVICE_DESK_INTEGRATION_DELETED	The service desk integration in source management operation was deleted
196	SERVICE_DESK_INTEGRATION_DELETE_FAILED	SOURCE_MANAGMENT	SERVICE_DESK_INTEGRATION_DELETE_FAILED	The service desk integration deletion in source management operation has failed
197	SESSION_CREATED_PASSED	AUTH	SESSION-1	The creation of a session in auth operation was successful
198	SESSION_MAXIMUM_TIMEOUT_PASSED	AUTH	SESSION-3	The maximum timeout for a session in auth operation was successful
199	SESSION_IDLE_TIMEOUT_PASSED	AUTH	SESSION-2	The timeout session idle in auth operation was successful
200	USER_LOGOUT_PASSED	AUTH	SESSION-4	The user logout in auth operation was successful
201	SESSION_DESTROY_PASSED	AUTH	SESSION-6	The session in auth operation was destroyed successfully
202	AUTHENTICATION_REQUEST_PASSED	AUTH	AUTHENTICATION-103	The authentication request in auth operation was successful
203	AUTHENTICATION_REQUEST_PASSED	AUTH	AUTHENTICATION-105	The authentication request in auth operation was successful
204	AUTHENTICATION_REQUEST_FAILED	AUTH	AUTHENTICATION-240	The authentication request in auth operation has failed
205	AUTHENTICATION_REQUEST_FAILED	AUTH	AUTHENTICATION-241	The authentication request in auth operation has failed
206	USER_LOGOUT_PASSED	AUTH	AUTHENTICATION-300	The logout for a user in auth operation was successful
207	USER_LOGOUT_PASSED	AUTH	AUTHENTICATION-303	The logout for a user in auth operation was successful
208	AUTHENTICATION_REQUEST_PASSED	AUTH	AUTHENTICATION-100	The authentication request for auth operation was successful
209	IDENTITY_PROVIDER_ENABLE_PASSED	AUTH	IDENTITY_PROVIDER_ENABLED	The enablement of identity provider in auth operation was successful
210	IDENTITY_PROVIDER_EXTERNAL_ENABLE_PASSED	AUTH	IDENTITY_PROVIDER_EXTERNAL_ENABLED	Enablement of an external identity provider in auth operation was successful
211	IDENTITY_PROVIDER_EXTERNAL_DISABLE_PASSED	AUTH	IDENTITY_PROVIDER_EXTERNAL_DISABLED	External identity provider in auth operation was successfully disabled
212	CLIENT_TOKEN_CREATE_PASSED	AUTH	CLIENT_TOKEN_ISSUE	The creation of a client token in auth operation was successful
213	FORCE_SAML_AUTHENTICATION_PASSED	AUTH	SAML_FORCE_AUTHN	Forcing the saml authentication in auth operation was successful
214	APP_SAML_LAUNCH_PASSED	SSO	APP_LAUNCH_SAML	The launch of App SAML in sso operation was successful
215	APP_WSFED_LAUNCH_PASSED	SSO	APP_LAUNCH_WSFED	The launch of App wsfed in sso operation was successful
216	APP_USAGE_AGREEMENT_PASSED	SSO	APP_USAGE_AGREEMENT	The launch of App Usage agreement in sso operation was successful
217	APP_PASSWORD_LAUNCH_PASSED	SSO	APP_LAUNCH_PASSWORD	The launch of the app password in sso operation was successful
218	APP_ACCESS_DENY_PASSED	SSO	APP_ACCESS_DENIED	The denial of an app access in sso operation was successful
219	APP_BOOKMARK_LAUNCH_PASSED	SSO	APP_LAUNCH_NONE	The launch of an app bookmark in sso operation was successful
220	APP_DIRECTORY_PASSWORD_LAUNCH_PASSED	SSO	APP_LAUNCH_DIR_PSWD	The launch of an app directory password in sso operation was successful
221	SERVICE_BROWSER_PASSWORD_REPLAY_PASSED	SSO	SERVICE_PASSWORD_REPLAY	The replay of a service browser password in sso operation was successful
222	SERVICE_BROWSER_PASSWORD_REPLAY_CREDENTIALS_RETRIEVE_PASSED	SSO	SERVICE_PASSWORD_REPLAY_CREDENTIALS_RETRIEVED	The retrieval of service browser password replay credentials in sso operation was successful
223	SYSTEM_KBA_ADD_PASSED	SYSTEM_CONFIG	ORG_KBA_ADD	Addition of system kba in system config operation was successful
224	SYSTEM_KBA_DELETE_PASSED	SYSTEM_CONFIG	ORG_KBA_DELETE	Deletion of a system kba in system config operation was successful
225	API_CLIENT_CREATE_PASSED	SYSTEM_CONFIG	API_CLIENT_CREATE	The creation of an api client in system config operation was successful
226	API_CLIENT_DELETE_PASSED	SYSTEM_CONFIG	API_CLIENT_DELETE	The deletion of an api client in system config operation was successful
227	BRANDING_CREATE_PASSED	SYSTEM_CONFIG	BRANDING_CREATE	The branding creation in system config operation was successful
228	BRANDING_UPDATE_PASSED	SYSTEM_CONFIG	BRANDING_UPDATE	The branding updating in system config operation was successful
229	BRANDING_DELETE_PASSED	SYSTEM_CONFIG	BRANDING_DELETE	The branding deletion in system config operation was successful
230	EMAIL_REDIRECTION_ENABLE_PASSED	SYSTEM_CONFIG	EMAIL_REDIRECTION_ENABLED	The enablement of email redirection in system config operation was successful
231	EMAIL_TEMPLATE_UPDATE_PASSED	SYSTEM_CONFIG	EMAIL_TEMPLATE_UPDATE	The updating of an email template in system config operation was successful
232	TASK_RESULT_DELETE_PASSED	SYSTEM_CONFIG	ActionTaskResultsPruned	The deletion of a task result in system config operation was successful
233	TASK_SCHEDULE_CREATE_PASSED	SYSTEM_CONFIG	TASK_SCHEDULE_CREATE_PASSED	The creation of a task schedule in system config operation was successful
234	TASK_SCHEDULE_UPDATE_PASSED	SYSTEM_CONFIG	TASK_SCHEDULE_UPDATE_PASSED	The updating of a task schedule in system config operation was successful
235	TASK_SCHEDULE_DELETE_PASSED	SYSTEM_CONFIG	TASK_SCHEDULE_DELETE_PASSED	The deletion of a task schedule in system config operation was successful
236	SAVED_SEARCH_CREATE_PASSED	SYSTEM_CONFIG		The creation of a saved search in system config operation was successful
237	SAVED_SEARCH_UPDATE_PASSED	SYSTEM_CONFIG		The updating of a saved search in system config operation was successful
238	SAVED_SEARCH_DELETE_PASSED	SYSTEM_CONFIG		The deletion of a saved search in system config operation was successful
239	SUBSCRIPTION_CREATE_PASSED	SYSTEM_CONFIG		The creation of a subscription in system config operation was successful
240	SUBSCRIPTION_UPDATE_PASSED	SYSTEM_CONFIG		The updating of a subscription in system config operation was successful
241	SUBSCRIPTION_EXECUTE_STARTED	SYSTEM_CONFIG		The execution of a subscription in system config operation has started
242	SUBSCRIPTION_DELETE_PASSED	SYSTEM_CONFIG		The deletion of a subscription in system config operation was successful
243	API_IDENTITY_CREATE_PASSED	IDENTITY_MANAGMENT	IdentityDirectCreate	The creation of an api identity in identity management operation was successful
244	API_IDENTITY_CREATE_FAILED	IDENTITY_MANAGMENT	IdentityDirectCreateFailure	The creation of an api identity in identity management operation has failed
245	NON_EMPLOYEE_CREATE_PASSED	NON_EMPLOYEE		The creation of a non-employee in non-employe operation was successful
246	NON_EMPLOYEE_UPDATE_PASSED	NON_EMPLOYEE		The updating of a non-employee in non-employe operation was successful
247	NON_EMPLOYEE_DELETE_PASSED	NON_EMPLOYEE		The deletion of a non-employee in non-employe operation was successful
248	NON_EMPLOYEE_REQUEST_CREATE_PASSED	NON_EMPLOYEE		The request for a creation of a non-employee in non-employee operation was successful
249	NON_EMPLOYEE_REQUEST_UPDATE_PASSED	NON_EMPLOYEE		The request for an update for a non-employee in non-employee operation was successful
250	NON_EMPLOYEE_REQUEST_APPROVAL_PASSED	NON_EMPLOYEE		The approval request of a non employee in non-employee operation was successful
251	AUTHENTICATION_LOCK_PASSED	AUTH	AUTHENTICATION-245	The locking of authentication in auth operation was successful
252	AUTHENTICATION_REQUEST_FAILED	AUTH	AUTHENTICATION-246	The request for authentication in auth operation has failed
253	AUTHENTICATION_TIMEOUT_PASSED	AUTH	AUTHENTICATION-247	The timeout for authentication in auth operation was successful
254	AUTHENTICATION_REQUEST_BLOCKED	AUTH	AUTHENTICATION-281	The request for authentication in auth operation was blocked
255	SAML_ASSERTION_RECEIVE_PASSED	AUTH	SAML2-142	The saml assertion in auth operation was received successfully
256	SAML_ASSERTION_RECEIVE_FAILED	AUTH	SAML2-166	The saml assertion in auth operation reception failed
257	SAML_ASSERTION_SEND_PASSED	AUTH	SAML2-31	The sending of a saml assertion in auth operation was successful
258	ACCESS_REQUEST_PROCESSED	ACCESS_REQUEST	AccessRequestProcessed	The request for access in access request operation was processed
259	AUTH_SUPPORT_LOGIN_CREATED	AUTH		The support login authorization in auth operation was created
260	AUTH_SUPPORT_LOGIN_UPDATED	AUTH		The support login authorization in auth operation was updated
261	AUTH_SUPPORT_LOGIN_DELETED	AUTH		The support login authorization in auth operation was deleted
262	IAI_ADMIN_CONFIG_UPDATE_EVENT	IAI_ADMIN_AUDIT		AI updates to customer configs
263	IAI_ADMIN_CUSTOMER_UPDATE_EVENT	IAI_ADMIN_AUDIT		AI updates to customer details
264	IAI_ADMIN_DATASOURCE_UPDAATE_EVENT	IAI_ADMIN_AUDIT		AI updates to data-sources
265	IAI_PIPELINE_STREAMING	IAI_PIPELINE_STREAMING		Events from the AI pipeline when streaming has been started
266	IAI_PIPELINE_BATCH	IAI_PIPELINE_BATCH		Events from the AI pipeline related to batch operations
267	SLPT_TOKEN_EXCHANGE	AUTH		Events from the support login flow in Oathkeeper that are emitted when a support user exchanges a token in his or her auth domain for a token in a target tenant’s auth domain.
268	SUPPORT_LOGIN_AUTHENTICATE	AUTH		Events from the support login flow in Oathkeeper that are emitted when a support user’s token in the target tenant are posted to the target tenant’s /auth endpoint for login.
269	ONBOARDING_TOKEN_GENERATION_PASSED	PASSWORD_ACTIVITY		Generate onboarding password reset email token successfully
270	ONBOARDING_TOKEN_GENERATION_FAILED	PASSWORD_ACTIVITY		Fail to generate onboarding password reset email token
271	DIGIT_TOKEN_GENERATION_PASSED	PASSWORD_ACTIVITY		Generate digit token successfully
272	DIGIT_TOKEN_GENERATION_FAILED	PASSWORD_ACTIVITY		Fail to generate digit token
273	ONBOARDING_TOKEN_VERIFICATION_PASSED	PASSWORD_ACTIVITY		Verify the given email token
274	ONBOARDING_TOKEN_VERIFICATION_FAILED	PASSWORD_ACTIVITY		Fail to verify the give email token
275	DIGIT_TOKEN_VERIFICATION_PASSED	PASSWORD_ACTIVITY		Verify the given digit token
276	DIGIT_TOKEN_VERIFICATION_FAILED	PASSWORD_ACTIVITY		Fail to verify the give digit token
277	PASSWORD_ORG_CONFIG_CREATE	PASSWORD_ACTIVITY		Create the password org config
278	PASSWORD_ORG_CONFIG_UPDATE	PASSWORD_ACTIVITY		Update the password org config
279	ONBOARDING_TOKEN_GENERATION_LIMIT_BYPASS	PASSWORD_ACTIVITY		Bypass default limit on onboarding password reset email token
280	WORKFLOW_CREATED	WORKFLOW		The creation of a workflow in workflow operation succeeded
281	WORKFLOW_DELETED	WORKFLOW		The deletion of a workflow in workflow operation was successful
282	WORKFLOW_DEFINITION_UPDATED	WORKFLOW		The updating of a workflow definition in workflow operation succeeded
283	WORKFLOW_OWNER_UPDATED	WORKFLOW		The updating of an owner of a workflow in workflow operation succeeded
284	WORKFLOW_TRIGGER_UPDATED	WORKFLOW		The updating of a trigger of a workflow in workflow operation succeeded
285	WORKFLOW_ENABLED	WORKFLOW		A workflow in workflow operation was enabled
286	WORKFLOW_DISABLED	WORKFLOW		A workflow in workflow operation was disabled
287	WORKFLOW_EXECUTION_CANCELLED	WORKFLOW		The execution of a workflow in workflow operation was cancelled
288	WORKFLOW_SECRET_CREATED	WORKFLOW		A workflow secret in workflow operation was created successfully
289	WORKFLOW_SECRET_ACCESSED	WORKFLOW		A workflow secret in workflow operation was accessed
290	WORKFLOW_TENANT_SECRETS_ACCESSED	WORKFLOW		A workflow secret for a tenant in workflow operation was accessed
291	WORKFLOW_SECRET_UPDATED	WORKFLOW		A workflow secret in workflow operation was updated
292	WORKFLOW_SECRET_DELETED	WORKFLOW		A workflow secret in workflow operation was deleted
293	MFA_CONFIGURATION_ENABLE_PASSED	PASSWORD_ACTIVITY	INTEGRATION_ENABLED	Enable mfa integration configuration
294	MFA_CONFIGURATION_DISABLE_PASSED	PASSWORD_ACTIVITY	INTEGRATION_DISABLED	Disable mfa integration configuration
295	MFA_LOGIN_AUTHENTICATE_PASSED	AUTH		Indicates that a user successfully authenticated using multi-factor authentication.
296	MFA_LOGIN_AUTHENTICATE_FAILED	AUTH		Indicates that a user failed second-factor in multi-factor authentication.
297	SEGMENT_UPDATE_ADD_EVENT	SEGMENT		An event was added
298	SEGMENT_UPDATE_REMOVE_EVENT	SEGMENT		Indicates the event when a segment is to be updated as removed in segment operation
299	CAPABILITY_UPDATE_EVENT	USER_MANAGEMENT		Indicates an identity has had a capability (role) either granted or revoked.
300	AUTH_USER_PASSWORD_UPDATE	AUTH		Indicates that an identity’s associated AuthUser has had its password set or updated.

[asolodunov]

In the end you mention "are currently indexed in Search and AWS S3." 

Does this imply customers have access to the s3 buckets where these audit logs are stored and can be accessed/exported to process further in say a SIEM or a third party automation tool? 

[Andrea-carrillo]

Hello @asolodunov , this was my bad, I already corrected it, customers are not able to reach them directly on AWS S3, this can only be accessed through Search.

[NGMUNOZ001]

Great information, thank you for posting this.

[ScottTanselle]

Really would like to see more details as to what each of these really mean.

Example:  USER_ROLE_ADMIN_GRANT_PASSED - What does this really mean?

ACCOUNT_VAULT_UPDATE_PASSED - What is a Vault account?

Unfortunately, most of the descriptions was very lacking in details.

[adamian]

37	USER_ROLE_SOURCE_ADMIN_REVOKE_PASSED	USER_MANAGEMENT	USER_SOURCE_ADMIN_GRANT	Indicates the role source admin has been revoked to a user in user management operation successfully

Mixing GRANT and REVOKE here.

[Shubhams_009]

technicalName:"EMAIL_SEND_PASSED" worked for me instead of technicalName:"EMAIL_SENT_PASSED" mentioned above at no. 26

[sup3rmark]

there's a few blind spots here. for example, general source or system configuration events don't seem to be logged (or at least, searchable), nor do transform updates/creations/deletions. is this an oversight, or is there a reason there's no events listed for these?

[sup3rmark]

Can this list be updated to include the friendly names of these events as well? This includes the "technicalName" but not the "name" that is returned in Search.

For example:

84

ACCOUNT_MODIFY_FAILED

PROVISIONING

ModifyAccountFailure

The provisioning operations which updated the account failed

This returns in an API call with the following attributes:

type           : PROVISIONING
technicalName  : ACCOUNT_MODIFY_FAILED
name           : Modify Account Failed
action         : ModifyAccountFailure

Search shows this just as "Modify Account Failed" rather than any of the other attributes currently listed in this table.

[sup3rmark]

I'll just keep yelling into the void here...

This list is incomplete. I count at least 60 event types in my tenant's audit history that are not listed in this article. Please update the article to include all current event types with descriptions.

Missing technicalNames include, but are probably not limited to:

1. SOURCE_ACCOUNT_REMOVE_PASSED
2. ALL_SOURCE_ACCOUNTS_REMOVE_PASSED
3. PERSONAL_ACCESS_TOKEN_USE_PASSED
4. SAML_REQUEST_SEND_PASSED
5. SUPPORT_LOGIN_TOKEN_AUTHENTICATE_PASSED
6. SAML_JIT_CONFIGURATION_UPDATE_PASSED
7. AUTH_SUPPORT_LOGIN_DELETE_PASSED
8. MFA_AUTHENTICATION_VERIFY_PASSED
9. AUTH_SUPPORT_LOGIN_CREATE_PASSED
10. MFA_REGISTRATION_REGISTER_PASSED
11. PERSONAL_ACCESS_TOKEN_CREATE_PASSED
12. MFA_AUTHENTICATION_VERIFY_FAILED
13. CONFIG_UPDATE_PASSED
14. CONFIG_CONNECTION_CREATE_PASSED
15. SOURCE CORRELATION CONFIG_UPDATE_PASSED
16. EMAIL_SEND_PASSED
17. EMAIL_TEST_MODE_UPDATE_PASSED
18. PROVISIONING_POLICY_UPDATE_PASSED
19. PROVISIONING_POLICY_CREATE_PASSED
20. USER_ROLE_SP:AIC-DASHBOARD-WRITE_GRANT_PASSED
21. USER_ROLE_SP:AIC-DASHBOARD-READ_GRANT_PASSED
22. IAI_ADMIN_CONFIG_UPDATE_PASSED
23. IDENTITY_PROCESSING_MANUAL_PASSED
24. IDENTITY_PROCESSING_SCHEDULED_STARTED
25. IDENTITY_PROCESSING_SCHEDULED_PASSED
26. IDENTITY_PROCESSING_MANUAL_STARTED
27. ATTRIBUTE_SYNC_MANUAL_STARTED
28. ATTRIBUTE_SYNC_MANUAL_PASSED
29. IDENTITY_LIFECYCLE_STATE_CHANGE_STARTED
30. IDENTITY_LIFECYCLE_STATE_CHANGE_SUCCESS
31. IDENTITY_UNCORRELATE_PASSED
32. MANAGED_CLIENT_UPDATE_SUCCESS
33. MANAGED_CLIENT_CREATE_SUCCESS
34. ORG_CONFIG_CHANGE_REPLACE_PASSED
35. NATIVE_CHANGE_UPDATE_DETECTED
36. SOURCE_ACCOUNT_AGGREGATE_STARTED
37. SOURCE_ENTITLEMENT_AGGREGATE_STARTED
38. SOURCE_ACCOUNT_AGGREGATE_FAILED
39. NATIVE_CHANGE_CREATE_DETECTED
40. NATIVE_CHANGE_DELETE_DETECTED
41. SOURCE_SCHEMA_UPDATE_PASSED
42. NATIVE_CHANGE_CONFIGURATION_UPDATE_PASSED
43. SOURCE SCHEDULE_CREATE_PASSED
44. SOURCE SCHEDULE_DELETE_PASSED
45. SOURCE SCHEDULE_UPDATE_PASSED
46. EMAIL_SEND_PASSED
47. USER_ROLE_HELPDESK_GRANT_PASSED
48. WORKFLOW_CREATE_PASSED
49. WORKFLOW_ENABLE_PASSED
50. WORKFLOW_DISABLE_PASSED
51. WORKFLOW_TRIGGER_UPDATE_PASSED
52. SOURCE_ENTITLEMENT_AGGREGATE_FAILED
53. MANAGED_CLUSTER_CREATE_SUCCESS
54. ALL_SOURCE_ACCOUNTS_REMOVE_STARTED
55. WORKFLOW_DEFINITION_UPDATE_PASSED
56. WORKFLOW_DELETE_PASSED
57. AUTH_SUPPORT_LOGIN_EXPIRE_PASSED
58. MANAGED_CLUSTER_UPDATE_SUCCESS
59. SOURCE_SCHEMA_DELETE_PASSED
60. AUTH_SUPPORT_LOGIN_UPDATE_PASSED

[spadaro]

+1 to @sup3rmark's comments. I've reached out to my CSM for help getting visibility to this page.

[sup3rmark]

I submitted a Support case about this (CS0416615) and was told that it's out of scope of Support and that "this is managed by our product/documentation team, who are already aware of the matter. They have informed us that it is on the future roadmap to be addressed." They confirmed that "the existing documentation is outdated" but "there is no updated list of event resources available at this time" and there is no timeline for when this will be updated. "The new document is currently in the information-gathering phase and will be published once it's ready in the near future." Support refused to provide any information on any of the unlisted audit event types I listed above.

(cc @spadaro)

[spadaro]

I received this from SailPoint (converted from PDF):

List of audit events in IdentityNow

Below is the list of audit events currently indexed in Search and AWS S3

Sl No	Name in Search	Type in Search	Legacy Action	Description
1	USER_ACTIVATE_PASSED	USER_MANAGE MENT	USER_ACTIVATE
2	USER_ACTIVITY_EXPORT_P ASSED	USER_MANAGE MENT	USER_ACTIVITY _EXPORT
3	USER_ROLE_ADMIN_GRANT _PASSED	USER_MANAGE MENT	USER_ADMIN_G RANT
4	USER_ROLE_ADMIN_REVOK E_PASSED	USER_MANAGE MENT	USER_ADMIN_R EVOKE
5	USER_DELETE_PASSED	USER_MANAGE MENT	USER_DELETE
6	USER_EMAIL_UPDATE_PASS ED	USER_MANAGE MENT	USER_EMAIL_UP DATE
7	USER_ROLE_HELPDESK GRANT_PASSED	USER_MANAGE MENT	USER_HELPDES K_GRANT
8	USER_ROLE_HELPDESK_REV OKE_PASSED	USER_MANAGE MENT	USER_HELPDES K_REVOKE
9	USER_INVITE_PASSED	USER_MANAGE MENT	USER_INVITE
10	USER_INVITE_FAILED	USER_MANAGE MENT	USER_INVITE_F AILURE
11	USER_KBA_DELETE_PASSED	USER_MANAGE MENT	USER_KBA_ANS WER_DELETE

12	USER_KBA_UPDATE_PASSED	USER_MANAGE MENT	USER_KBA_ANS WER_UPDATE
13	USER_KBA_NOTIFY_PASSED	USER_MANAGE MENT	USER_KBA_ANS WER_UPDATE_N OTIFICATION
14	USER_KBA_ANSWERS_PASS ED	USER_MANAGE MENT	USER_KBA_ANS WERS
15	USER_LOCK_PASSED	USER_MANAGE MENT	USER_LOCK
16	USER_PHONE_UPDATE_PAS SED	USER_MANAGE MENT	USER_PHONE_U PDATE
17	USER_REGISTER_PASSED	USER_MANAGE MENT	USER_REGISTRA TION
18	USER_REGISTER_FAILED	USER_MANAGE MENT	USER_REGISTRA TION_FAILURE
19	USER_REGISTER_STARTED	USER_MANAGE MENT	USER_REGISTRA TION_LINK
20	USER_RESET_PASSED	USER_MANAGE MENT	USER_RESET
21	USER_AUTH_STEP_UP _SETUP_PASSED	USER_MANAGE MENT	USER_STEP_UP_ AUTH
22	USER_AUTH_STEP_UP _SETUP_FAILED	USER_MANAGE MENT	USER_STEP_UP_ AUTH_FAILURE
23	USER_UNLOCK_PASSED	USER_MANAGE MENT	USER_UNLOCK
24	USER_UNLOCK_REJECTED	USER_MANAGE MENT	USER_UNLOCK_ REJECTED
25	EMAIL_SENT_PASSED	USER_MANAGE MENT	emailSent

26	EMAIL_SENT_FAILED	USER_MANAGE MENT	emailFailure
27	USER_ROLE_DASHBOARD_G RANT_PASSED	USER_MANAGE MENT	USER_DASHBOA RD_GRANT
28	USER_ROLE_DASHBOARD_R EVOKE_PASSED	USER_MANAGE MENT	USER_DASHBOA RD_REVOKE
29	IDENTITY_DELETE_PASSED	USER_MANAGE MENT	USER_REMOVE
30	USER_ROLE_CERTIFICATIO N_ADMIN_GRANT_PASSED	USER_MANAGE MENT	USER_CERT_AD MIN_GRANT
31	USER_ROLE_CERTIFICATIO N_ADMIN_REVOKE_PASSED	USER_MANAGE MENT	USER_CERT_AD MIN_REVOKE
32	USER_ROLE_REPORT_ADMI N_GRANT_PASSED	USER_MANAGE MENT	USER_REPORT_A DMIN_GRANT
33	USER_ROLE_REPORT_ADMI N_REVOKE_PASSED	USER_MANAGE MENT	USER_REPORT_A DMIN_REVOKE
34	USER_ROLE_ROLE_ADMIN_G RANT_PASSED	USER_MANAGE MENT	USER_ROLE_AD MIN_GRANT
35	USER_ROLE_ROLE_ADMIN_R EVOKE_PASSED	USER_MANAGE MENT	USER_ROLE_AD MIN_REVOKE
36	USER_ROLE_SOURCE_ADMI N_REVOKE_PASSED	USER_MANAGE MENT	USER_SOURCE_ ADMIN_GRANT
37	USER_ROLE_SOURCE_ADMI N_REVOKE_PASSED	USER_MANAGE MENT	USER_SOURCE_ ADMIN_REVOKE
38	PASSWORD_CHANGE_STAR TED	PASSWORD_ACT IVITY	PasswordChange
39	PASSWORD_CHANGE_FAILE D	PASSWORD_ACT IVITY	PasswordChange Failure
40	PASSWORD_ACTION_CHAN GE_PASSED	PASSWORD_ACT IVITY	PasswordChange Success

41	PASSWORD_REQUEST_STAR TED	PASSWORD_ACT IVITY	PasswordsReque stStart
42	PASSWORD_EXPIRED_CHAN GE_STARTED	PASSWORD_ACT IVITY	ExpirePasswordS tart
43	PASSWORD_EXPIRED_CHAN GE_PASSED	PASSWORD_ACT IVITY	ExpiredPassword Change
44	PASSWORD_FORGOT_CHAN GE_PASSED	PASSWORD_ACT IVITY	ForgotPassword Change
45	PASSWORD_FORGOT_CHAN GE_STARTED	PASSWORD_ACT IVITY	ForgotPasswordS tart
46	ACCOUNT_PASSWORD_RES ET_FAILED	PASSWORD_ACT IVITY	ACCOUNT_PASS WORD_RESET_F AILED
47	ACCOUNT_PASSWORD_RES ET_PASSED	PASSWORD_ACT IVITY	ACCOUNT_PASS WORD_RESET_P ASSED
48	ACCOUNT_PASSWORD_SYN C_PASSED	PASSWORD_ACT IVITY	ACCOUNT_PASS WORD_SYNC_PA SSED
49	SOURCE_PASSWORD_CHAN GE_STARTED	PASSWORD_ACT IVITY	SOURCE_EXTER NAL_PASSWORD _CHANGE
50	SOURCE_PASSWORD_CHAN GE_FAILED	PASSWORD_ACT IVITY	SOURCE_EXTER NAL_PASSWORD _CHANGE_FAILE D
51	SOURCE_PASSWORD_CHAN GE_PASSED	PASSWORD_ACT IVITY	SOURCE_EXTER NAL_PASSWORD _CHANGE_PASS ED
52	USER_PASSWORD_RESET_R EJECTED	PASSWORD_ACT IVITY	USER_PASSWOR D_RESET_REJEC

			TED
53	USER_PASSWORD_UPDATE_ STARTED	PASSWORD_ACT IVITY	USER_PASSWOR D_UPDATE
54	USER_PASSWORD_UPDATE_ FAILED	PASSWORD_ACT IVITY	USER_PASSWOR D_UPDATE_FAIL ED
55	USER_PASSWORD_UPDATE_ PASSED	PASSWORD_ACT IVITY	USER_PASSWOR D_UPDATE_PASS ED
56	SOURCE_PASSWORD_INTER CEPT_IGNORED	PASSWORD_ACT IVITY	SOURCE_PASSW ORD_INTERCEP T_IGNORED
57	SOURCE_PASSWORD_INTER CEPT_PROCESSED	PASSWORD_ACT IVITY	SOURCE_PASSW ORD_INTERCEP T_PROCESSED
58	ACCOUNT_VAULT_UPDATE_P ASSED	PASSWORD_ACT IVITY	ACCOUNT_VAUL T_UPDATED
59	PASSWORD_POLICY_ASSIG N_PASSED	PASSWORD_ACT IVITY	SOURCE_PASSW ORD_POLICY_AS SIGNED
60	SAML_REDIRECT_PATTERNS _UPDATE_PASSED	PASSWORD_ACT IVITY	REDIRECT_PATT ERNS_UPDATED
61	PASSWORD_POLICY_CREAT E_PASSED	PASSWORD_ACT IVITY	PASSWORD_POL ICY_CREATED
62	PASSWORD_POLICY_DELET E_PASSED	PASSWORD_ACT IVITY	PASSWORD_POL ICY_DELETED
63	PASSWORD_REPLAY_ENABL E_PASSED	PASSWORD_ACT IVITY	PASSWORD_REP LAY_ENABLED
64	STRONG_AUTHENTICATION _INTEGRATION_ENABLE_PA SSED	PASSWORD_ACT IVITY	INTEGRATION_E NABLED

65	PASSWORD_REPLAY_PASSI VE_LAUNCH_PASSED	PASSWORD_ACT IVITY	PASSWORD_REP LAY_PASSIVE
66	PASSWORD_POLICY_UPDAT E_PASSED	PASSWORD_ACT IVITY	PASSWORD_POL ICY_UPDATED
67	STRONG_AUTHENTICATION _INTEGRATION_DISABLE_P ASSED	PASSWORD_ACT IVITY	INTEGRATION_D ISABLED
68	STRONG_AUTHENTICATION _INTEGRATION_UPDATE_PA SSED	PASSWORD_ACT IVITY	INTEGRATION_U PDATED
69	ACCOUNT_VAULT_RESET_PA SSED	PASSWORD_ACT IVITY	ACCOUNT_FULL _RESET
70	MFA_VERIFICATION_FAILED _PASSED	PASSWORD_ACT IVITY	MFA_VERIFICATI ON_FAILED
71	BROWSER_EXTENSION_DIS ABLE_PASSED	PASSWORD_ACT IVITY	PASSWORD_REP LAY_DISABLED
72	ACCOUNT_CREATE_PASSED	PROVISIONING	CreateAccount
73	ACCOUNT_CREATE_FAILED	PROVISIONING	CreateAccountFa ilure
74	ACCOUNT_DELETE_PASSED	PROVISIONING	DeleteAccount
75	ACCOUNT_DELETE_FAILED	PROVISIONING	DeleteAccountFai lure
76	ACCOUNT_DISABLE_PASSE D	PROVISIONING	DisableAccount
77	ACCOUNT_DISABLE_FAILED	PROVISIONING	DisableAccountF ailure
78	ATTRIBUTE_SYNC_DISABLE _PASSED	PROVISIONING	DisableAttributeS ync
79	ACCOUNT_ENABLE_PASSED	PROVISIONING	EnableAccount

80	ACCOUNT_ENABLE_FAILED	PROVISIONING	EnableAccountFa ilure
81	ATTRIBUTE_SYNC_ENABLE_ PASSED	PROVISIONING	EnableAttributeS ync
82	ACCOUNT_MODIFY_PASSED	PROVISIONING	ModifyAccount
83	ACCOUNT_MODIFY_FAILED	PROVISIONING	ModifyAccountFa ilure
84	ACCOUNT_UNLOCK_PASSE D	PROVISIONING	UnlockAccount
85	ACCOUNT_UNLOCK_FAILED	PROVISIONING	UnlockAccountFa ilure
86	IDENTITY_STATE_CHANGE_ PASSED	PROVISIONING	IdentityStateCha nge
87	PROVISION_CHANGE_STAR TED	PROVISIONING	Provisioning
88	PROVISION_CHANGE_PASS ED	PROVISIONING	ProvisioningCom plete
89	PROVISION_CHANGE_FAILE D	PROVISIONING	ProvisioningFailur e
90	APP_REQUEST_APPROVED	PROVISIONING	App Request Approved
91	APP_REQUEST_REJECTED	PROVISIONING	App Request Rejected
92	IDENTITY_CREATE_PASSED	PROVISIONING	IDENTITY_CREA TE_PASSED
93	IDENTITY_UPDATE_PASSED	PROVISIONING	IDENTITY_UPDA TE_PASSED
94	IDENTITY_DELETE_PASSED	PROVISIONING	IDENTITY_DELE TE_PASSED

95	IDENTITY_LIFECYCLE_CHA NGE_PASSED	PROVISIONING	identityLifecycleE vent
96	ACCOUNT_MANUAL_CHANG E_COMPLETE_PASSED	PROVISIONING	ManualChange
97	IDENTITY_ATTRIBUTE_VALU E_UPDATE_PASSED	PROVISIONING	IdentityAttribute Update
98	WORKITEM_COMPLETE_CO MMENTS_ADD_PASSED	PROVISIONING	Comment
99	APPROVAL_ITEM_APPROVE_ PASSED	PROVISIONING	ApproveLineItem
100	ACCOUNT_PROFILE_UPDAT ED	PROVISIONING	ACCOUNT_PROF ILE_UPDATED
101	ACCOUNT_PROFILE_CREAT ED	PROVISIONING	ACCOUNT_PROF ILE_CREATED
102	ACCOUNT_PROFILE_DELETE D	PROVISIONING	ACCOUNT_PROF ILE_DELETED
103	IDENTITY_ACCOUNT_REMO VE_PASSED	PROVISIONING	USER_REMOVE_ ACCOUNT
104	ACCESS_REQUEST_STARTE D	ACCESS_REQUE ST	AccessRequestR equested
105	ACCESS_REQUEST_APPROV ED	ACCESS_REQUE ST	AccessRequestA pproved
106	ACCESS_REQUEST_REJECT ED	ACCESS_REQUE ST	AccessRequestR ejected
107	ACCESS_REQUEST_FORWAR DED	ACCESS_REQUE ST	AccessRequestF orwarded
108	ACCESS_REQUEST_ESCALA TED	ACCESS_REQUE ST	escalate
109	APP_REQUEST_PASSED	ACCESS_REQUE ST	RequestApp

110	CERTIFICATION_CAMPAIGN _CREATE_PASSED	CERTIFICATION	CertificationCam paignCreate
111	CERTIFICATION_CAMPAIGN _ACTIVATE_PASSED	CERTIFICATION	CertificationCam paignActivate
112	CERTIFICATION_CAMPAIGN _COMPLETE_PASSED	CERTIFICATION	CERT_CAMPAIG N_COMPLETE
113	CERTIFICATION_CAMPAIGN _DELETE_PASSED	CERTIFICATION	CertificationCam paignDelete
114	CERTIFICATION_CAMPAIGN _FILTER_CREATE_PASSED	CERTIFICATION	CampaignFilterCr eate
115	CERTIFICATION_CAMPAIGN _FILTER_DELETE_PASSED	CERTIFICATION	CampaignFilterD elete
116	CERTIFICATION_CAMPAIGN _FILTER_UPDATE_PASSED	CERTIFICATION	CampaignFilterU pdate
117	CERTIFICATION_CAMPAIGN _STUCK_DETECTED	CERTIFICATION	STUCK_PENDIN G_CAMPAIGN_D ETECTED
118	CERTIFICATION_CAMPAIGN _REVIEW_NOTIFY_PASSED	CERTIFICATION	CERT_CAMPAIG N_REVIEW_NOTI FICATION
119	CERTIFICATION_CAMPAIGN _FINISH_PASSED	CERTIFICATION	CERTIFICATION SFINISHED
120	CERTIFICATION_SIGNOFF_ PASSED	CERTIFICATION	signoff
121	CERTIFICATION_REASSIGN _PASSED	CERTIFICATION	reassign
122	CERTIFICATION_ITEM_CRE ATION_STATS_LOG_PASSED	CERTIFICATION	CERT_ITEM_TIM ESTAMP_STATS
123	CERTIFICATION_PHASE_CH ANGE_PASSED	CERTIFICATION	certificationsPha sed

124	CERTIFICATION_ITEM_REM EDIATE	CERTIFICATION	remediate
125	RULE_CREATE_PASSED	CERTIFICATION	RULE_CREATE_P ASSED
126	RULE_UPDATE_PASSED	CERTIFICATION	RULE_UPDATE_P ASSED
127	RULE_DELETE_PASSED	CERTIFICATION	RULE_DELETE_P ASSED
128	ENTITLEMENT_ADD_PASSE D	ACCESS_ITEM	AddEntitlement
129	ENTITLEMENT_ADD_FAILED	ACCESS_ITEM	AddEntitlementFa ilure
130	ENTITLEMENT_REMOVE_PA SSED	ACCESS_ITEM	RemoveEntitleme nt
131	ENTITLEMENT_REMOVE_FAI LED	ACCESS_ITEM	RemoveEntitleme ntFailure
132	ACCESS_PROFILE_CREATE_ PASSED	ACCESS_ITEM	ACCESS_PROFIL E_CREATE
133	ACCESS_PROFILE_DELETE_ PASSED	ACCESS_ITEM	ACCESS_PROFIL E_DELETE
134	ACCESS_PROFILE_UPDATE_ PASSED	ACCESS_ITEM	ACCESS_PROFIL E_UPDATE
135	ROLE_DEPROVISION_ENABL E_PASSED	ACCESS_ITEM	ROLE_ENABLE_D EPROVISIONING
136	ROLE_DEPROVISION_DISAB LE_PASSED	ACCESS_ITEM	ROLE_DISABLE_ DEPROVISIONIN G
137	IDENTITY_PROFILE_UPDATE _PASSED	ACCESS_ITEM	IDENTITY_PROF ILE_UPDATE

138	ROLE_CREATE_PASSED	ACCESS_ITEM	ROLE_CREATE_P ASSED
139	ROLE_UPDATE_PASSED	ACCESS_ITEM	ROLE_UPDATE_P ASSED
140	ROLE_DELETE_PASSED	ACCESS_ITEM	ROLE_DELETE_P ASSED
141	LIFECYCLE_STATE_CREATE_ PASSED	ACCESS_ITEM	LIFECYCLE_STA TE_CREATE_PAS SED
142	LIFECYCLE_STATE_UPDATE_ PASSED	ACCESS_ITEM	LIFECYCLE_STA TE_UPDATE_PAS SED
143	LIFECYCLE_STATE_DELETE_ PASSED	ACCESS_ITEM	LIFECYCLE_STA TE_DELETE_PAS SED
144	ENTITLEMENT_SET_PASSED	ACCESS_ITEM	SetEntitlement
145	ROLE_ADD_PASSED	ACCESS_ITEM	RoleAdd
146	IDENTITY_PROFILE_ATTRIB UTE_CREATE_PASSED	ACCESS_ITEM	Identity Profile Attribute Create
147	IDENTITY_PROFILE_ATTRIB UTE_DELETE_PASSED	ACCESS_ITEM	Identity Profile Attribute Delete
148	IDENTITY_PROFILE_ATTRIB UTE_UPDATE_PASSED	ACCESS_ITEM	Identity Profile Attribute Update
149	APP_UPDATE_PASSED	ACCESS_ITEM	APP_UPDATE
150	APP_CREATE_PASSED	ACCESS_ITEM	APP_CREATE
151	APP_DELETE_PASSED	ACCESS_ITEM	APP_DELETE
152	APP_IMPORT_PASSED	ACCESS_ITEM	APP_IMPORT
153	APP_ACCESS_PROFILE_SET _PASSED	ACCESS_ITEM	APP_SET_ACCES S_PROFILES

154	APP_ADD_PASSED	ACCESS_ITEM	APP_ADD
155	APP_XML_UPDATE_PASSED	ACCESS_ITEM	APP_UPDATE_X ML
156	APP_REMOVE_PASSED	ACCESS_ITEM	APP_REMOVE
157	APP_PURGE_PASSED	ACCESS_ITEM	APP_PURGED
158	IDENTITY_PROFILE_AUTHE NTICATION_CONFIGURE_PA SSED	ACCESS_ITEM	IDENTITY_PROF ILE_CONFIGURE _AUTHN
159	ACCESS_REQUEST_APPROV AL_FORWARD_PASSED	ACCESS_ITEM	Forward
160	ACCESS_REQUEST_CONFIG _UPDATE_PASSED	ACCESS_ITEM	AccessRequestC onfigUpdated
161	IDENTITY_PROFILE_DELETE _PASSED	ACCESS_ITEM	IDENTITY_PROF ILE_DELETE
162	IDENTITY_PROFILE_ATTRIB UTES_UPDATE_PASSED	ACCESS_ITEM	IDENTITY_PROF ILE_ATTRIBUTE S_UPDATED
163	IDENTITY_PROFILE_CREATE _PASSED	ACCESS_ITEM	IDENTITY_PROF ILE_CREATE
164	CONNECTOR_FILE_DELETE_ PASSED	SOURCE_MANA GMENT	CONNECTOR_FI LE_DELETE
165	CONNECTOR_FILE_UPLOAD _PASSED	SOURCE_MANA GMENT	CONNECTOR_FI LE_UPLOAD
166	SOURCE_ACCOUNT_AGGRE GATE_PASSED	SOURCE_MANA GMENT	SOURCE_ACCO UNT_AGGREGAT ION
167	SOURCE_ACCOUNT_AGGRE GATE_TERMINATED	SOURCE_MANA GMENT	SOURCE_AGGRE GATION_TERMI NATED

168	SOURCE_ACCOUNT_EXPOR T_PASSED	SOURCE_MANA GMENT	SOURCE_ACCO UNTS_EXPORT
169	SOURCE_ACCOUNT_FEED_D OWNLOAD_PASSED	SOURCE_MANA GMENT	SOURCE_ACCO UNT_FEED_DOW NLOAD
170	SOURCE_ACTIVITY_EXPOR T_PASSED	SOURCE_MANA GMENT	SOURCE_ACTIVI TY_EXPORT
171	SOURCE_CREATE_PASSED	SOURCE_MANA GMENT	SOURCE_CREAT E
172	SOURCE_DELETE_PASSED	SOURCE_MANA GMENT	SOURCE_DELET E
173	SOURCE_FEATURES_STRIN G_UPDATE_PASSED	SOURCE_MANA GMENT	SOURCE_FEATU RES_STRING_UP DATE
174	SOURCE_RESET_PASSED	SOURCE_MANA GMENT	SOURCE_RESET
175	SOURCE_UPDATE_PASSED	SOURCE_MANA GMENT	SOURCE_UPDAT E
176	SOURCE_ENTITLEMENT_AG GREGATE_PASSED	SOURCE_MANA GMENT	SOURCE_ENTITL EMENT_AGGREG ATION	Indicates success completion of Entitlement Aggregation workflow
177	SOURCE_ENTITLEMENT_IM PORT_PASSED	SOURCE_MANA GMENT	SOURCE_ENTITL EMENT_IMPORT
178	SOURCE_ENTITLEMENT_EX PORT_PASSED	SOURCE_MANA GMENT	SOURCE_ENTITL EMENT_EXPORT
179	SOURCE_EXTERNAL_PASSW ORD_CHANGE_ACTIVITY_EX PORT_PASSED	SOURCE_MANA GMENT	SOURCE_EXTER NAL_PASSWORD _CHANGE_ACTI VITY_EXPORT

180	SOURCE_SCHEMA_ATTRIBU TE_ADD_PASSED	SOURCE_MANA GMENT	SOURCE_SCHE MA_ATTRIBUTE_ ADDED
181	SOURCE_SCHEMA_ATTRIBU TE_DELETE_PASSED	SOURCE_MANA GMENT	SOURCE_SCHE MA_ATTRIBUTE S_DELETED
182	SOURCE_SCHEMA_ATTRIBU TE_UPDATE_PASSED	SOURCE_MANA GMENT	SOURCE_SCHE MA_ATTRIBUTE S_UPDATED
183	SOURCE_DELETE_THRESHO LD_UPDATE_PASSED	SOURCE_MANA GMENT	SOURCE_UPDAT E_DELETE_THRE SHOLD
184	SOURCE_AGGREGATION_SC HEDULE_UPDATE_PASSED	SOURCE_MANA GMENT	SOURCE_AGGRE GATION_SCHED ULE_UPDATED
185	CUSTOM_CONNECTOR_CRE ATE_PASSED	SOURCE_MANA GMENT	CONNECTOR_CR EATE
186	CUSTOM_CONNECTOR_DEL ETE_PASSED	SOURCE_MANA GMENT	CONNECTOR_DE LETE
187	CUSTOM_CONNECTOR_EXP ORT_PASSED	SOURCE_MANA GMENT	CONNECTOR_EX PORT
188	CUSTOM_CONNECTOR_UPD ATE_PASSED	SOURCE_MANA GMENT	CONNECTOR_UP DATE
189	SOURCE_RENAME_FAILED	SOURCE_MANA GMENT	SOURCE_RENAM E_FAILURE_DET ECTED
190	SESSION_CREATED_PASSED	AUTH	SESSION-1
191	SESSION_MAXIMUM_TIMEO UT_PASSED	AUTH	SESSION-3
192	SESSION_IDLE_TIMEOUT_P ASSED	AUTH	SESSION-2

193	USER_LOGOUT_PASSED	AUTH	SESSION-4
194	SESSION_DESTROY_PASSE D	AUTH	SESSION-6
195	AUTHENTICATION_REQUES T_PASSED	AUTH	AUTHENTICATI ON-103
196	AUTHENTICATION_REQUES T_PASSED	AUTH	AUTHENTICATI ON-105
197	AUTHENTICATION_REQUES T_FAILED	AUTH	AUTHENTICATI ON-240
198	AUTHENTICATION_REQUES T_FAILED	AUTH	AUTHENTICATI ON-241
199	USER_LOGOUT_PASSED	AUTH	AUTHENTICATI ON-300
200	USER_LOGOUT_PASSED	AUTH	AUTHENTICATI ON-303
201	AUTHENTICATION_REQUES T_PASSED	AUTH	AUTHENTICATI ON-100
202	IDEENTITY_PROVIDER_ENA BLE_PASSED	AUTH	IDENTITY_PROV IDER_ENABLED
203	IDENTITY_PROVIDER_EXTE RNAL_ENABLE_PASSED	AUTH	IDENTITY_PROV IDER_EXTERNAL _ENABLED
204	IDENTITY_PROVIDER_EXTE RNAL_DISABLE_PASSED	AUTH	IDENTITY_PROV IDER_EXTERNAL _DISABLED
205	CLIENT_TOKEN_CREATE_PA SSED	AUTH	CLIENT_TOKEN_ ISSUE
206	FORCE_SAML_AUTHENTICA TION_PASSED	AUTH	SAML_FORCE_A UTHN

207	APP_SAML_LAUNCH_PASSE D	SSO	APP_LAUNCH_S AML
208	APP_WSFED_LAUNCH_PASS ED	SSO	APP_LAUNCH_W SFED
209	APP_USAGE_AGREEMENT_P ASSED	SSO	APP_USAGE_AG REEMENT
210	APP_PASSWORD_LAUNCH_P ASSED	SSO	APP_LAUNCH_P ASSWORD
211	APP_ACCESS_DENY_PASSE D	SSO	APP_ACCESS_D ENIED
212	APP_BOOKMARK_LAUNCH_ PASSED	SSO	APP_LAUNCH_N ONE
213	APP_DIRECTORY_PASSWOR D_LAUNCH_PASSED	SSO	APP_LAUNCH_D IR_PSWD
214	SERVICE_BROWSER_PASSW ORD_REPLAY_PASSED	SSO	SERVICE_PASS WORD_REPLAY
215	SERVICE_BROWSER_PASSW ORD_REPLAY_CREDENTIALS _RETRIEVE_PASSED	SSO	SERVICE_PASS WORD_REPLAY_ CREDENTIALS_R ETRIEVED
216	SYSTEM_KBA_ADD_PASSED	SYSTEM_CONFI G	ORG_KBA_ADD
217	SYSTEM_KBA_DELETE_PASS ED	SYSTEM_CONFI G	ORG_KBA_DELE TE
218	API_CLIENT_CREATE_PASSE D	SYSTEM_CONFI G	API_CLIENT_CRE ATE
219	API_CLIENT_DELETE_PASSE D	SYSTEM_CONFI G	API_CLIENT_DEL ETE
220	BRANDING_CREATE_PASSE D	SYSTEM_CONFI G	BRANDING_CRE ATE

221	BRANDING_UPDATE_PASSE D	SYSTEM_CONFI G	BRANDING_UPD ATE
222	BRANDING_DELETE_PASSE D	SYSTEM_CONFI G	BRANDING_DEL ETE
223	EMAIL_REDIRECTION_ENAB LE_PASSED	SYSTEM_CONFI G	EMAIL_REDIREC TION_ENABLED
224	EMAIL_TEMPLATE_UPDATE_ PASSED	SYSTEM_CONFI G	EMAIL_TEMPLAT E_UPDATE
225	TASK_RESULT_DELETE_PAS SED	SYSTEM_CONFI G	ActionTaskResult sPruned
226	TASK_SCHEDULE_CREATE_P ASSED	SYSTEM_CONFI G	TASK_SCHEDUL E_CREATE_PASS ED
227	TASK_SCHEDULE_UPDATE_P ASSED	SYSTEM_CONFI G	TASK_SCHEDUL E_UPDATE_PASS ED
228	TASK_SCHEDULE_DELETE_P ASSED	SYSTEM_CONFI G	TASK_SCHEDUL E_DELETE_PASS ED
229	SAVED_SEARCH_CREATE_PA SSED	SYSTEM_CONFI G
230	SAVED_SEARCH_UPDATE_PA SSED	SYSTEM_CONFI G
231	SAVED_SEARCH_DELETE_PA SSED	SYSTEM_CONFI G
232	SUBSCRIPTION_CREATE_PA SSED	SYSTEM_CONFI G
233	SUBSCRIPTION_UPDATE_PA SSED	SYSTEM_CONFI G
234	SUBSCRIPTION_EXECUTE_S TARTED	SYSTEM_CONFI G

235	SUBSCRIPTION_DELETE_PA SSED	SYSTEM_CONFI G
236	API_IDENTITY_CREATE_PAS SED	IDENTITY_MAN AGMENT
237	API_IDENTITY_CREATE_FAI LED	IDENTITY_MAN AGMENT
238	NON_EMPLOYEE_CREATE_P ASSED	NON_EMPLOYEE
239	NON_EMPLOYEE_UPDATE_P ASSED	NON_EMPLOYEE
240	NON_EMPLOYEE_DELETE_P ASSED	NON_EMPLOYEE
241	NON_EMPLOYEE_REQUEST_ CREATE_PASSED	NON_EMPLOYEE
242	NON_EMPLOYEE_REQUEST_ UPDATE_PASSED	NON_EMPLOYEE
243	NON_EMPLOYEE_REQUEST_ APPROVAL_PASSED	NON_EMPLOYEE
244	AUTHENTICATION_LOCK_P ASSED	AUTH	AUTHENTICATI ON-245
245	AUTHENTICATION_REQUES T_FAILED	AUTH	AUTHENTICATI ON-246
246	AUTHENTICATION_TIMEOU T_PASSED	AUTH	AUTHENTICATI ON-247
247	AUTHENTICATION_REQUES T_BLOCKED	AUTH	AUTHENTICATI ON-281
248	SAML_ASSERTION_RECEIVE _PASSED	AUTH	SAML2-142
249	SAML_ASSERTION_RECEIVE _FAILED	AUTH	SAML2-166
250	SAML_ASSERTION_SEND_P ASSED	AUTH	SAML2-31
251	ACCESS_REQUEST_PROCES SED	ACCESS_REQUE ST	AccessRequestPr ocessed
252	SOURCE_ENTITLEMENT_AG GREGATE_STARTED	SOURCE_MANA GMENT	SOURCE_ENTITL EMENT_AGGREG ATION_STARTED	Published on beginning of Entitlement Aggregation workflow
253	SOURCE_ENTITLEMENT_AG GREGATE_FAILED	SOURCE_MANA GMENT	SOURCE_ENTITL EMENT_AGGREG ATION_FAILED	Indicates failure in Entitlement Aggregation workflow
254	SOURCE_ENTITLEMENT_AG GREGATE_TERMINATED	SOURCE_MANA GMENT	SOURCE_ENTITL EMENT_AGGREG ATION_TERMINA TED	Indicates termination of Entitlement Aggregation workflow

Below are the audit events not going into Search and S3

Sl No	message_json.action: Descending	Count
1	SAML2-37	26,552,922
2	SAML2-36	5,586,623
3	CLIENT_REQUEST_CREDENTI ALS	4,732,776

A Kibana query was run on production for the last 90 days on 2020-03-12. Based on the query results, below are the audit events that are not being sent to Search.

Kibana query: message_json.sentToSearch: false

4	SAML2-156	2,039,032
5	SAML2-149	721,849
7	SERVICE_PASSWORD_REPLA Y_SCRIPT_FAILURE	152,359
8	WSFederation-52	120,260
9	SAML2-30	42,072
10	AUTHENTICATION-305	24,451
11	CLIENT_MANUAL_VA_JOB	13,675
12	SetEntitlementFailure	13,039
13	APP_LAUNCH_USR_MGD	8,993
14	ACCOUNT_PASSWORD_RESE T	4,491
15	update	4,159
16	SERVICE_PASSWORD_REPLA Y_FAILURE	3,548
17	SOD_POLICY_SCHEDULED_R EPORT_EXECUTED	2,204
18	expire	1,810
19	create	1,398
20	import	829
21	SOD_POLICY_CREATED	529
22	AUTHENTICATION-243	499
23	SOD_POLICY_DELETED	459
24	Identity Profile Attribute Update	371
25	delete	294
26	AUTHENTICATION-270	230

27	SOD_POLICY_UPDATED	197
28	AUTHENTICATION-201	157
29	EMAIL_REDIRECTION_DISAB LED	141
30	AUTHENTICATION-207	124
31	SOD_POLICY_MANUAL_REPO RT_EXECUTED	110
32	ORPHAN_SOURCE_DETECTE D	98
33	PublicIdentityAttributesConfig	70
34	AUTHENTICATION-268	68
35	SOD_POLICY_SCHEDULE_CR EATED	24
36	AUTOMATION_GENERATION_ START	20
37	SAML2-167	20
38	AUTHENTICATION-200	17
39	AUTOMATION_ADD	16
40	AUTOMATION_GENERATION_ FINISH	16
41	SOD_POLICY_SCHEDULE_UP DATED	16
42	linkMoved	13
43	SOD_POLICY_SCHEDULE_DE LETED	11
44	AUTOMATION_DELETE	10
45	AUTHENTICATION-272	9
46	SAML2-2	8

47	EMAIL_TEMPLATE_RESET	6
48	AUTOMATION_GENERATION_ CANCEL	5
49	IDENTITY_PROVIDER_DISAB LED	4
50	AUTHENTICATION-203	2
51	SOD_POLICY_ENFORCEMEN T_DISABLED	2
52	SOD_POLICY_ENFORCEMEN T_ENABLED	2

[naomi_wilkin]

Hello everyone! Thank you for your input. 

To confirm: the above list is outdated, but there are SailPoint experts currently researching and compiling a new list. The new list will be hosted and maintained on the documentation website. Once it is published, we will provide an update to its new location!