cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Audit Events in Cloud Audit

Audit Events in Cloud Audit

Context:

What Audit Events are: 

    Audit Events are records that a user took action in an IdentityNow tenant, or other service like IdentityAI. Audit Events are structurally and conceptually very similar to IdentityIQ's Audit Events, but have evolved in several ways.

Searching them in the UI:

   Go to the search tab -> search field. Please see the attached image.

 

Below is the list of audit events allowed by default that are currently indexed in Search.

Scroll to the right to see more fields with information ->

 
1 Technical name in Search Type in Search Legacy Action Description
2 USER_ACTIVATE_PASSED USER_MANAGEMENT USER_ACTIVATE The user activation from user management operation was successfully activated
3 USER_ACTIVITY_EXPORT_PASSED USER_MANAGEMENT USER_ACTIVITY_EXPORT The user activity export from user management operation was successfully exported
4 USER_ROLE_ADMIN_GRANT_PASSED USER_MANAGEMENT USER_ADMIN_GRANT The admin role for a user from user management operation was granted successfully
5 USER_ROLE_ADMIN_REVOKE_PASSED USER_MANAGEMENT USER_ADMIN_REVOKE The admin role for a user form user management operation was revoked successfully
6 USER_DELETE_PASSED USER_MANAGEMENT USER_DELETE The deletion of a user from user management operation was successful
7 USER_EMAIL_UPDATE_PASSED USER_MANAGEMENT USER_EMAIL_UPDATE The updating of a user email from user management operation was successful
8 USER_ROLE_HELPDESK GRANT_PASSED USER_MANAGEMENT USER_HELPDESK_GRANT The helpdesk role for a user from user management operation was granted successfully
9 USER_ROLE_HELPDESK_REVOKE_PASSED USER_MANAGEMENT USER_HELPDESK_REVOKE The helpdesk role for a user from user management operation was revoked successfully
10 USER_INVITE_PASSED USER_MANAGEMENT USER_INVITE The invite for a user from user management operation was successful
11 USER_INVITE_FAILED USER_MANAGEMENT USER_INVITE_FAILURE The invite for a user from user management operation failed
12 USER_KBA_DELETE_PASSED USER_MANAGEMENT USER_KBA_ANSWER_DELETE The KBA deletion for a user from user management operation was successful
13 USER_KBA_UPDATE_PASSED USER_MANAGEMENT USER_KBA_ANSWER_UPDATE The KBA updation for a user from user managements operation was successful
14 USER_KBA_NOTIFY_PASSED USER_MANAGEMENT USER_KBA_ANSWER_UPDATE_NOTIFICATION The KBA notification for a user in user management operation was successful
15 USER_KBA_ANSWERS_PASSED USER_MANAGEMENT USER_KBA_ANSWERS The KBA answerf or a user in user management operation was successful
16 USER_LOCK_PASSED USER_MANAGEMENT USER_LOCK The locking of a user in user management operation was successful
17 USER_PHONE_UPDATE_PASSED USER_MANAGEMENT USER_PHONE_UPDATE The updating of a users phone in user managemenet operation was successful
18 USER_REGISTER_PASSED USER_MANAGEMENT USER_REGISTRATION The registration of a user in user management operation was successful
19 USER_REGISTER_FAILED USER_MANAGEMENT USER_REGISTRATION_FAILURE The registration of a user in user management operation has failed
20 USER_REGISTER_STARTED USER_MANAGEMENT USER_REGISTRATION_LINK The registration of a user in user management operation has started
21 USER_RESET_PASSED USER_MANAGEMENT USER_RESET The reset of a user in user management operation was successful
22 USER_AUTH_STEP_UP _SETUP_PASSED USER_MANAGEMENT USER_STEP_UP_AUTH The setup of step up in a user auth in user management operation was successful
23 USER_AUTH_STEP_UP _SETUP_FAILED USER_MANAGEMENT USER_STEP_UP_AUTH_FAILURE The setup of step up in a user auth in user management operation has failed
24 USER_UNLOCK_PASSED USER_MANAGEMENT USER_UNLOCK The unlocking of a user in user management operation was successful
25 USER_UNLOCK_REJECTED USER_MANAGEMENT USER_UNLOCK_REJECTED The unlocking of a user in user management operation was rejected
26 EMAIL_SENT_PASSED USER_MANAGEMENT emailSent The sending email in user management operation was successful
27 EMAIL_SENT_FAILED USER_MANAGEMENT emailFailure The sending email in user management operation has failed
28 USER_ROLE_DASHBOARD_GRANT_PASSED USER_MANAGEMENT USER_DASHBOARD_GRANT Role dashboard for a user has been granted in user management operation was successful
29 USER_ROLE_DASHBOARD_REVOKE_PASSED USER_MANAGEMENT USER_DASHBOARD_REVOKE Role dashboard for a user has been revoked in user management operation was successful
30 IDENTITY_DELETE_PASSED USER_MANAGEMENT USER_REMOVE The deletion of an identity in user management operation was successful
31 USER_ROLE_CERTIFICATION_ADMIN_GRANT_PASSED USER_MANAGEMENT USER_CERT_ADMIN_GRANT Indicates the role certification admin has been granted to a user in user management operation successfully
32 USER_ROLE_CERTIFICATION_ADMIN_REVOKE_PASSED USER_MANAGEMENT USER_CERT_ADMIN_REVOKE Indicates the role certification admin has been revoked to a user in user management operation successfully
33 USER_ROLE_REPORT_ADMIN_GRANT_PASSED USER_MANAGEMENT USER_REPORT_ADMIN_GRANT Indicates the role report admin has been granted to a user in user management operation successfully
34 USER_ROLE_REPORT_ADMIN_REVOKE_PASSED USER_MANAGEMENT USER_REPORT_ADMIN_REVOKE Indicates the role report admin has been revoked to a user in user management operation successfully
35 USER_ROLE_ROLE_ADMIN_GRANT_PASSED USER_MANAGEMENT USER_ROLE_ADMIN_GRANT Indicates the role role admin has been granted to a user in user management operation successfully
36 USER_ROLE_ROLE_ADMIN_REVOKE_PASSED USER_MANAGEMENT USER_ROLE_ADMIN_REVOKE Indicates the role role admin has been revoked to a user in user management operation successfully
37 USER_ROLE_SOURCE_ADMIN_REVOKE_PASSED USER_MANAGEMENT USER_SOURCE_ADMIN_GRANT Indicates the role source admin has been revoked to a user in user management operation successfully
38 USER_ROLE_SOURCE_ADMIN_REVOKE_PASSED USER_MANAGEMENT USER_SOURCE_ADMIN_REVOKE Indicates the role source admin has been revoked to a user in user management operation successfully
39 PASSWORD_CHANGE_STARTED PASSWORD_ACTIVITY PasswordChange The change of a password process from password activity operation is started
40 PASSWORD_CHANGE_FAILED PASSWORD_ACTIVITY PasswordChangeFailure The change of a password process from password activity operation has failed
41 PASSWORD_ACTION_CHANGE_PASSED PASSWORD_ACTIVITY PasswordChangeSuccess The action of changing a password process from password activity operation was successful
42 PASSWORD_REQUEST_STARTED PASSWORD_ACTIVITY PasswordsRequestStart The request of a password process from password activity operation has started
43 PASSWORD_EXPIRED_CHANGE_STARTED PASSWORD_ACTIVITY ExpirePasswordStart The process of changing a password when it expired from password activity operation has started
44 PASSWORD_EXPIRED_CHANGE_PASSED PASSWORD_ACTIVITY ExpiredPasswordChange The process of changing a password when it expired from password activity operation was successful
45 PASSWORD_FORGOT_CHANGE_PASSED PASSWORD_ACTIVITY ForgotPasswordChange The process of changing a password when it was forgotten from password activity operation was successful
46 PASSWORD_FORGOT_CHANGE_STARTED PASSWORD_ACTIVITY ForgotPasswordStart The process of changing a password when it was forgotten from password activity operation has started
47 ACCOUNT_PASSWORD_RESET_FAILED PASSWORD_ACTIVITY ACCOUNT_PASSWORD_RESET_FAILED The reset an account password from password activity operation failed
48 ACCOUNT_PASSWORD_RESET_PASSED PASSWORD_ACTIVITY ACCOUNT_PASSWORD_RESET_PASSED The reset an account password from password activity operation was successful
49 ACCOUNT_PASSWORD_SYNC_PASSED PASSWORD_ACTIVITY ACCOUNT_PASSWORD_SYNC_PASSED The sync of a password in an account from password activity operation was successful
50 SOURCE_PASSWORD_CHANGE_STARTED PASSWORD_ACTIVITY SOURCE_EXTERNAL_PASSWORD_CHANGE The change of the source password in password activity operation has started
51 SOURCE_PASSWORD_CHANGE_FAILED PASSWORD_ACTIVITY SOURCE_EXTERNAL_PASSWORD_CHANGE_FAILED The change of the source password in password activity operation failed
52 SOURCE_PASSWORD_CHANGE_PASSED PASSWORD_ACTIVITY SOURCE_EXTERNAL_PASSWORD_CHANGE_PASSED The change of the source password in password activity operation was successful
53 USER_PASSWORD_RESET_REJECTED PASSWORD_ACTIVITY USER_PASSWORD_RESET_REJECTED A reset of a user password in password activity operation was rejected
54 USER_PASSWORD_UPDATE_STARTED PASSWORD_ACTIVITY USER_PASSWORD_UPDATE A user password updating in password activity operation event has started
55 USER_PASSWORD_UPDATE_FAILED PASSWORD_ACTIVITY USER_PASSWORD_UPDATE_FAILED A user password updating in password activity operation has failed
56 USER_PASSWORD_UPDATE_PASSED PASSWORD_ACTIVITY USER_PASSWORD_UPDATE_PASSED A user password updating in password activity operation was successful
57 SOURCE_PASSWORD_INTERCEPT_IGNORED PASSWORD_ACTIVITY SOURCE_PASSWORD_INTERCEPT_IGNORED The intercept of the source password in password activity was ignored
58 SOURCE_PASSWORD_INTERCEPT_PROCESSED PASSWORD_ACTIVITY SOURCE_PASSWORD_INTERCEPT_PROCESSED The intercept of the source password in password activity was processed
59 ACCOUNT_VAULT_UPDATE_PASSED PASSWORD_ACTIVITY ACCOUNT_VAULT_UPDATED The vault of an account updating in password activity operation was successful
60 PASSWORD_POLICY_ASSIGN_PASSED PASSWORD_ACTIVITY SOURCE_PASSWORD_POLICY_ASSIGNED A password policy was assigned successfully in password activity operation
61 SAML_REDIRECT_PATTERNS_UPDATE_PASSED PASSWORD_ACTIVITY REDIRECT_PATTERNS_UPDATED The updating of the saml redirect patterns in password activity operation was successful
62 PASSWORD_POLICY_CREATE_PASSED PASSWORD_ACTIVITY PASSWORD_POLICY_CREATED Creation of a password policy in password activity operation was successful
63 PASSWORD_POLICY_DELETE_PASSED PASSWORD_ACTIVITY PASSWORD_POLICY_DELETED Deletion of a password policy in password activity operation was successful
64 PASSWORD_REPLAY_ENABLE_PASSED PASSWORD_ACTIVITY PASSWORD_REPLAY_ENABLED Enable the password replay in password activity operation was successful
65 STRONG_AUTHENTICATION_INTEGRATION_ENABLE_PASSED PASSWORD_ACTIVITY INTEGRATION_ENABLED Enable to strong authentication integration in password activity operation was successful
66 PASSWORD_REPLAY_PASSIVE_LAUNCH_PASSED PASSWORD_ACTIVITY PASSWORD_REPLAY_PASSIVE The passive launch of password replay in password activity operation was successful
67 PASSWORD_POLICY_UPDATE_PASSED PASSWORD_ACTIVITY PASSWORD_POLICY_UPDATED The updating of password policy in password activity operation was successful
68 STRONG_AUTHENTICATION_INTEGRATION_DISABLE_PASSED PASSWORD_ACTIVITY INTEGRATION_DISABLED The strong authentication integration was disabled successfully in password activity operation
69 STRONG_AUTHENTICATION_INTEGRATION_UPDATE_PASSED PASSWORD_ACTIVITY INTEGRATION_UPDATED The updating of a strong authentication integration in password activity operation was successful
70 ACCOUNT_VAULT_RESET_PASSED PASSWORD_ACTIVITY ACCOUNT_FULL_RESET The reset of account vault in password activity operation was successful
71 MFA_VERIFICATION_FAILED_PASSED PASSWORD_ACTIVITY MFA_VERIFICATION_FAILED The failure of the mfa verification in password activity operation was successful
72 BROWSER_EXTENSION_DISABLE_PASSED PASSWORD_ACTIVITY PASSWORD_REPLAY_DISABLED Indicates the browser extension was disabled successfully in password activity operation
73 ACCOUNT_CREATE_PASSED PROVISIONING CreateAccount The create account provisioning operation was successful
74 ACCOUNT_CREATE_FAILED PROVISIONING CreateAccountFailure The create account provisioning operation failed
75 ACCOUNT_DELETE_PASSED PROVISIONING DeleteAccount The delete account provisioning operation was successful
76 ACCOUNT_DELETE_FAILED PROVISIONING DeleteAccountFailure The delete account provisioning operation failed
77 ACCOUNT_DISABLE_PASSED PROVISIONING DisableAccount The disable account provisioning operation was successful
78 ACCOUNT_DISABLE_FAILED PROVISIONING DisableAccountFailure The disable account provisioning operation failed
79 ATTRIBUTE_SYNC_DISABLE_PASSED PROVISIONING DisableAttributeSync The attribute synchronization configuration was successfully disabled
80 ACCOUNT_ENABLE_PASSED PROVISIONING EnableAccount The enable account provisioning operation was successful
81 ACCOUNT_ENABLE_FAILED PROVISIONING EnableAccountFailure The enable account provisioning operation failed
82 ATTRIBUTE_SYNC_ENABLE_PASSED PROVISIONING EnableAttributeSync The attribute synchronization configuration was successfully enabled
83 ACCOUNT_MODIFY_PASSED PROVISIONING ModifyAccount The provisioning operations which updated the account were successful
84 ACCOUNT_MODIFY_FAILED PROVISIONING ModifyAccountFailure The provisioning operations which updated the account failed
85 ACCOUNT_UNLOCK_PASSED PROVISIONING UnlockAccount The unlock account provisioning operation was successful
86 ACCOUNT_UNLOCK_FAILED PROVISIONING UnlockAccountFailure The unlock account provisioning operation failed
87 IDENTITY_STATE_CHANGE_PASSED PROVISIONING IdentityStateChange The change of state of an identity in provisioning operation was successful
88 PROVISION_CHANGE_STARTED PROVISIONING Provisioning The change for provision in provisioning operation has started
89 PROVISION_CHANGE_PASSED PROVISIONING ProvisioningComplete The change for provision in provisioning operation was successful
90 PROVISION_CHANGE_FAILED PROVISIONING ProvisioningFailure The change for provision in provisioning operation has failed
91 APP_REQUEST_APPROVED PROVISIONING App Request Approved The app request provisioning operation was approved
92 APP_REQUEST_REJECTED PROVISIONING App Request Rejected The app request provisioning operation was rejected
93 IDENTITY_CREATE_PASSED PROVISIONING IDENTITY_CREATE_PASSED The identity creation provisioning operation was successful
94 IDENTITY_UPDATE_PASSED PROVISIONING IDENTITY_UPDATE_PASSED The identity updating provisioning operation was successful
95 IDENTITY_DELETE_PASSED PROVISIONING IDENTITY_DELETE_PASSED The identity deletion provisioning operation was successful
96 IDENTITY_LIFECYCLE_CHANGE_PASSED PROVISIONING identityLifecycleEvent The change of lifecycle for an identity in provisioning operation was successful
97 ACCOUNT_MANUAL_CHANGE_COMPLETE_PASSED PROVISIONING ManualChange The completion of a manual change in an account in provisioning operation was successful
98 IDENTITY_ATTRIBUTE_VALUE_UPDATE_PASSED PROVISIONING IdentityAttributeUpdate The updating of an attribute value in identity in provisioning operation was successful
99 WORKITEM_COMPLETE_COMMENTS_ADD_PASSED PROVISIONING Comment The addition of comments for a complete workitem in provisioning operation was successful
100 APPROVAL_ITEM_APPROVE_PASSED PROVISIONING ApproveLineItem The approving item in an approval in provisioning operation was successful
101 ACCOUNT_PROFILE_UPDATED PROVISIONING ACCOUNT_PROFILE_UPDATED The account provisioning policy was successfully updated
102 ACCOUNT_PROFILE_CREATED PROVISIONING ACCOUNT_PROFILE_CREATED The account provisioning policy was successfully created
103 ACCOUNT_PROFILE_DELETED PROVISIONING ACCOUNT_PROFILE_DELETED The account provisioning policy was successfully deleted
104 IDENTITY_ACCOUNT_REMOVE_PASSED PROVISIONING USER_REMOVE_ACCOUNT The account was successfully removed from the identity
105 ACCESS_REQUEST_STARTED ACCESS_REQUEST AccessRequestRequested The request for access in access request operation has started
106 ACCESS_REQUEST_APPROVED ACCESS_REQUEST AccessRequestApproved The request for access in access request operation was approved
107 ACCESS_REQUEST_REJECTED ACCESS_REQUEST AccessRequestRejected The request for access in access request operation was rejected
108 ACCESS_REQUEST_FORWARDED ACCESS_REQUEST AccessRequestForwarded The request for access in access request operation was forwarded
109 ACCESS_REQUEST_ESCALATED ACCESS_REQUEST escalate The request for access in access request operation was escalated
110 APP_REQUEST_PASSED ACCESS_REQUEST RequestApp The request for an app in access request operation has passed
111 CERTIFICATION_CAMPAIGN_CREATE_PASSED CERTIFICATION CertificationCampaignCreate The creation of a certification campaign in certification operation was successful
112 CERTIFICATION_CAMPAIGN_ACTIVATE_PASSED CERTIFICATION CertificationCampaignActivate The activation of a certification campaign in certification operation was successful
113 CERTIFICATION_CAMPAIGN_COMPLETE_PASSED CERTIFICATION CERT_CAMPAIGN_COMPLETE The completion of a certification campaign in certification operation was successful
114 CERTIFICATION_CAMPAIGN_DELETE_PASSED CERTIFICATION CertificationCampaignDelete The deletion of a certification campaign in certification operation was successful
115 CERTIFICATION_CAMPAIGN_FILTER_CREATE_PASSED CERTIFICATION CampaignFilterCreate The filter creation of a certification campaign in certification operation was successful
116 CERTIFICATION_CAMPAIGN_FILTER_DELETE_PASSED CERTIFICATION CampaignFilterDelete The filter deletion of a certification campaign in certification operation was successful
117 CERTIFICATION_CAMPAIGN_FILTER_UPDATE_PASSED CERTIFICATION CampaignFilterUpdate The filter updating of a certification campaign in certification operation was successful
118 CERTIFICATION_CAMPAIGN_STUCK_DETECTED CERTIFICATION STUCK_PENDING_CAMPAIGN_DETECTED The stuck of a certification campaign in certification operation was detected
119 CERTIFICATION_CAMPAIGN_REVIEW_NOTIFY_PASSED CERTIFICATION CERT_CAMPAIGN_REVIEW_NOTIFICATION The notification of a certification campaign review in certification operation was successful
120 CERTIFICATION_CAMPAIGN_FINISH_PASSED CERTIFICATION CERTIFICATIONSFINISHED The completion of certification campaign in certification operation was successful
121 CERTIFICATION_SIGNOFF_PASSED CERTIFICATION signoff The signoff of a certification in certification operation was successful
122 CERTIFICATION_REASSIGN_PASSED CERTIFICATION reassign The reassign of a certification in certification operation was successful
123 CERTIFICATION_ITEM_CREATION_STATS_LOG_PASSED CERTIFICATION CERT_ITEM_TIMESTAMP_STATS The certification item creation stats log event in certification operation was successful
124 CERTIFICATION_PHASE_CHANGE_PASSED CERTIFICATION certificationsPhased The certification phase change in certification operation was successful
125 CERTIFICATION_ITEM_REMEDIATE CERTIFICATION remediate Indicates the remediation of a certification item in certification operation
126 RULE_CREATE_PASSED CERTIFICATION RULE_CREATE_PASSED The creation of a rule in certification operation was successful
127 RULE_UPDATE_PASSED CERTIFICATION RULE_UPDATE_PASSED The updating of a rule in certification operation was successful
128 RULE_DELETE_PASSED CERTIFICATION RULE_DELETE_PASSED The deletion of a rule in certification operation was successful
129 ENTITLEMENT_ADD_PASSED ACCESS_ITEM AddEntitlement The addition of an entitlement in access item operation was successful
130 ENTITLEMENT_ADD_FAILED ACCESS_ITEM AddEntitlementFailure The addition of an entitlement in access item operation has failed
131 ENTITLEMENT_REMOVE_PASSED ACCESS_ITEM RemoveEntitlement The removal of an entitlement in access item operation was successful
132 ENTITLEMENT_REMOVE_FAILED ACCESS_ITEM RemoveEntitlementFailure The removal of an entitlement in access item operation has failed
133 ACCESS_PROFILE_CREATE_PASSED ACCESS_ITEM ACCESS_PROFILE_CREATE The access profile creation in access item operation was successful
134 ACCESS_PROFILE_DELETE_PASSED ACCESS_ITEM ACCESS_PROFILE_DELETE The access profile deletion in access item operation was successful
135 ACCESS_PROFILE_UPDATE_PASSED ACCESS_ITEM ACCESS_PROFILE_UPDATE The access profile updating in access item operation was successful
136 ROLE_DEPROVISION_ENABLE_PASSED ACCESS_ITEM ROLE_ENABLE_DEPROVISIONING The enablement of role deprovision in access item operation
137 ROLE_DEPROVISION_DISABLE_PASSED ACCESS_ITEM ROLE_DISABLE_DEPROVISIONING A role deprovision in access item operation was disabled successfully
138 IDENTITY_PROFILE_UPDATE_PASSED ACCESS_ITEM IDENTITY_PROFILE_UPDATE Updating of identity profile in access item operation was successful
139 ROLE_CREATE_PASSED ACCESS_ITEM ROLE_CREATE_PASSED The creation of a role in access item operation was successful
140 ROLE_UPDATE_PASSED ACCESS_ITEM ROLE_UPDATE_PASSED The updating of a role in access item operation was successful
141 ROLE_DELETE_PASSED ACCESS_ITEM ROLE_DELETE_PASSED The deletion of a role in access item operation was successful
142 LIFECYCLE_STATE_CREATE_PASSED ACCESS_ITEM LIFECYCLE_STATE_CREATE_PASSED The creation of a lifecycle state in access item operation was successful
143 LIFECYCLE_STATE_UPDATE_PASSED ACCESS_ITEM LIFECYCLE_STATE_UPDATE_PASSED The updating of a lifecycle state in access item operation was successful
144 LIFECYCLE_STATE_DELETE_PASSED ACCESS_ITEM LIFECYCLE_STATE_DELETE_PASSED The deletion of a lifecycle state in access item operation was successful
145 ENTITLEMENT_SET_PASSED ACCESS_ITEM SetEntitlement Entitlement was set up successfully in access item operation
146 ROLE_ADD_PASSED ACCESS_ITEM RoleAdd The addition of a role in access item operation was successful
147 IDENTITY_PROFILE_ATTRIBUTE_CREATE_PASSED ACCESS_ITEM Identity Profile Attribute Create The creation of a profile attribute in an identity in access item operation was successful
148 IDENTITY_PROFILE_ATTRIBUTE_DELETE_PASSED ACCESS_ITEM Identity Profile Attribute Delete The deletion of a profile attribute in an identity in access item operation was successful
149 IDENTITY_PROFILE_ATTRIBUTE_UPDATE_PASSED ACCESS_ITEM Identity Profile Attribute Update The updating of a profile attribute in an identity in access item operation was successful
150 APP_UPDATE_PASSED ACCESS_ITEM APP_UPDATE The app updating in access item operation was successful
151 APP_CREATE_PASSED ACCESS_ITEM APP_CREATE The creation of an app in access item operation was successful
152 APP_DELETE_PASSED ACCESS_ITEM APP_DELETE The deletion of an app in access item operation was successful
153 APP_IMPORT_PASSED ACCESS_ITEM APP_IMPORT The import of an app in access item operation was successful
154 APP_ACCESS_PROFILE_SET_PASSED ACCESS_ITEM APP_SET_ACCESS_PROFILES The app access profile set up in access item operation was successful
155 APP_ADD_PASSED ACCESS_ITEM APP_ADD The addition of an app in access item operation was successful
156 APP_XML_UPDATE_PASSED ACCESS_ITEM APP_UPDATE_XML The updating of an app xml in access item operation was successful
157 APP_REMOVE_PASSED ACCESS_ITEM APP_REMOVE The removal of an app in access item operation was successful
158 APP_PURGE_PASSED ACCESS_ITEM APP_PURGED The app purge in access item operation was successful
159 IDENTITY_PROFILE_AUTHENTICATION_CONFIGURE_PASSED ACCESS_ITEM IDENTITY_PROFILE_CONFIGURE_AUTHN The authentication configuration of an identity profile in access item operation was successful
160 ACCESS_REQUEST_APPROVAL_FORWARD_PASSED ACCESS_ITEM Forward The forward of an access request approval in access item operation was successful
161 ACCESS_REQUEST_CONFIG_UPDATE_PASSED ACCESS_ITEM AccessRequestConfigUpdated The config update of an access request in access item operation was successful
162 IDENTITY_PROFILE_DELETE_PASSED ACCESS_ITEM IDENTITY_PROFILE_DELETE The deletion of an identity profile in access item operation was successful
163 IDENTITY_PROFILE_ATTRIBUTES_UPDATE_PASSED ACCESS_ITEM IDENTITY_PROFILE_ATTRIBUTES_UPDATED The attribute updating for an identity profile in access item operation was successful
164 IDENTITY_PROFILE_CREATE_PASSED ACCESS_ITEM IDENTITY_PROFILE_CREATE The creation of an identity profile in access item operation was successful
165 CONNECTOR_FILE_DELETE_PASSED SOURCE_MANAGMENT CONNECTOR_FILE_DELETE The deletion of a connector file in source management operation was successful
166 CONNECTOR_FILE_UPLOAD_PASSED SOURCE_MANAGMENT CONNECTOR_FILE_UPLOAD The uploading of a connector file in source management operation was successful
167 SOURCE_ACCOUNT_AGGREGATE_PASSED SOURCE_MANAGMENT SOURCE_ACCOUNT_AGGREGATION Aggregation of a source account in source management operation was successful
168 SOURCE_ACCOUNT_AGGREGATE_TERMINATED SOURCE_MANAGMENT SOURCE_AGGREGATION_TERMINATED Termination of source account aggregate in source management operation
169 SOURCE_ACCOUNT_EXPORT_PASSED SOURCE_MANAGMENT SOURCE_ACCOUNTS_EXPORT The export of a source account in source management operation was successful
170 SOURCE_ACCOUNT_FEED_DOWNLOAD_PASSED SOURCE_MANAGMENT SOURCE_ACCOUNT_FEED_DOWNLOAD The download of the source account feed in source management operation was successful
171 SOURCE_ACTIVITY_EXPORT_PASSED SOURCE_MANAGMENT SOURCE_ACTIVITY_EXPORT The export of source activity in source management operation was successful
172 SOURCE_CREATE_PASSED SOURCE_MANAGMENT SOURCE_CREATE The creation of source in source management operation was successful
173 SOURCE_DELETE_PASSED SOURCE_MANAGMENT SOURCE_DELETE The deletion of source in source management operation was successful
174 SOURCE_FEATURES_STRING_UPDATE_PASSED SOURCE_MANAGMENT SOURCE_FEATURES_STRING_UPDATE The update of source features string in source management operation was successful
175 SOURCE_RESET_PASSED SOURCE_MANAGMENT SOURCE_RESET The source reset in source management operation was successful
176 SOURCE_UPDATE_PASSED SOURCE_MANAGMENT SOURCE_UPDATE The source updating in source management operation was successful
177 SOURCE_ENTITLEMENT_AGGREGATE_PASSED SOURCE_MANAGMENT SOURCE_ENTITLEMENT_AGGREGATION The aggregation of source entitlement in source management operation was successful
178 SOURCE_ENTITLEMENT_IMPORT_PASSED SOURCE_MANAGMENT SOURCE_ENTITLEMENT_IMPORT The import of source entitlement in source management operation was successful
179 SOURCE_ENTITLEMENT_EXPORT_PASSED SOURCE_MANAGMENT SOURCE_ENTITLEMENT_EXPORT The export of source entitlement in source management operation was successful
180 SOURCE_EXTERNAL_PASSWORD_CHANGE_ACTIVITY_EXPORT_PASSED SOURCE_MANAGMENT SOURCE_EXTERNAL_PASSWORD_CHANGE_ACTIVITY_EXPORT The export of source external password change activity in source management operation was successful
181 SOURCE_SCHEMA_ATTRIBUTE_ADD_PASSED SOURCE_MANAGMENT SOURCE_SCHEMA_ATTRIBUTE_ADDED The addition of a source schema attribute in source management operation was successful
182 SOURCE_SCHEMA_ATTRIBUTE_DELETE_PASSED SOURCE_MANAGMENT SOURCE_SCHEMA_ATTRIBUTES_DELETED The deletion of a source schema attribute in source management operation was successful
183 SOURCE_SCHEMA_ATTRIBUTE_UPDATE_PASSED SOURCE_MANAGMENT SOURCE_SCHEMA_ATTRIBUTES_UPDATED The updating of a source schema attribute in source management operation was successful
184 SOURCE_DELETE_THRESHOLD_UPDATE_PASSED SOURCE_MANAGMENT SOURCE_UPDATE_DELETE_THRESHOLD The updating of a source delete threshold in source management operation was successful
185 SOURCE_AGGREGATION_SCHEDULE_UPDATE_PASSED SOURCE_MANAGMENT SOURCE_AGGREGATION_SCHEDULE_UPDATED The schedule updating of a source aggregation in source management operation was successful
186 CUSTOM_CONNECTOR_CREATE_PASSED SOURCE_MANAGMENT CONNECTOR_CREATE The creation of a custom connector in source management operation was successful
187 CUSTOM_CONNECTOR_DELETE_PASSED SOURCE_MANAGMENT CONNECTOR_DELETE The deletion of a custom connector in source management operation was successful
188 CUSTOM_CONNECTOR_EXPORT_PASSED SOURCE_MANAGMENT CONNECTOR_EXPORT The export of a custom connector in source management operation was successful
189 CUSTOM_CONNECTOR_UPDATE_PASSED SOURCE_MANAGMENT CONNECTOR_UPDATE The updating of a custom connector in source management operation was successful
190 SOURCE_RENAME_FAILED SOURCE_MANAGMENT SOURCE_RENAME_FAILURE_DETECTED The source rename in source management operation has failed
191 SERVICE_DESK_INTEGRATION_CREATED SOURCE_MANAGMENT SERVICE_DESK_INTEGRATION_CREATED An integration for service desk in source management operation was created
192 SERVICE_DESK_INTEGRATION_CREATE_FAILED SOURCE_MANAGMENT SERVICE_DESK_INTEGRATION_CREATE_FAILED The creation of a service desk integration in source management operation has failed
193 SERVICE_DESK_INTEGRATION_UPDATED SOURCE_MANAGMENT SERVICE_DESK_INTEGRATION_UPDATED The updating of a service desk integration in source management operation was successful
194 SERVICE_DESK_INTEGRATION_UPDATE_FAILED SOURCE_MANAGMENT SERVICE_DESK_INTEGRATION_UPDATE_FAILED The updating of service desk integration in source management operation has failed
195 SERVICE_DESK_INTEGRATION_DELETED SOURCE_MANAGMENT SERVICE_DESK_INTEGRATION_DELETED The service desk integration in source management operation was deleted
196 SERVICE_DESK_INTEGRATION_DELETE_FAILED SOURCE_MANAGMENT SERVICE_DESK_INTEGRATION_DELETE_FAILED The service desk integration deletion in source management operation has failed
197 SESSION_CREATED_PASSED AUTH SESSION-1 The creation of a session in auth operation was successful
198 SESSION_MAXIMUM_TIMEOUT_PASSED AUTH SESSION-3 The maximum timeout for a session in auth operation was successful
199 SESSION_IDLE_TIMEOUT_PASSED AUTH SESSION-2 The timeout session idle in auth operation was successful
200 USER_LOGOUT_PASSED AUTH SESSION-4 The user logout in auth operation was successful
201 SESSION_DESTROY_PASSED AUTH SESSION-6 The session in auth operation was destroyed successfully
202 AUTHENTICATION_REQUEST_PASSED AUTH AUTHENTICATION-103 The authentication request in auth operation was successful
203 AUTHENTICATION_REQUEST_PASSED AUTH AUTHENTICATION-105 The authentication request in auth operation was successful
204 AUTHENTICATION_REQUEST_FAILED AUTH AUTHENTICATION-240 The authentication request in auth operation has failed
205 AUTHENTICATION_REQUEST_FAILED AUTH AUTHENTICATION-241 The authentication request in auth operation has failed
206 USER_LOGOUT_PASSED AUTH AUTHENTICATION-300 The logout for a user in auth operation was successful
207 USER_LOGOUT_PASSED AUTH AUTHENTICATION-303 The logout for a user in auth operation was successful
208 AUTHENTICATION_REQUEST_PASSED AUTH AUTHENTICATION-100 The authentication request for auth operation was successful
209 IDENTITY_PROVIDER_ENABLE_PASSED AUTH IDENTITY_PROVIDER_ENABLED The enablement of identity provider in auth operation was successful
210 IDENTITY_PROVIDER_EXTERNAL_ENABLE_PASSED AUTH IDENTITY_PROVIDER_EXTERNAL_ENABLED Enablement of an external identity provider in auth operation was successful
211 IDENTITY_PROVIDER_EXTERNAL_DISABLE_PASSED AUTH IDENTITY_PROVIDER_EXTERNAL_DISABLED External identity provider in auth operation was successfully disabled
212 CLIENT_TOKEN_CREATE_PASSED AUTH CLIENT_TOKEN_ISSUE The creation of a client token in auth operation was successful
213 FORCE_SAML_AUTHENTICATION_PASSED AUTH SAML_FORCE_AUTHN Forcing the saml authentication in auth operation was successful
214 APP_SAML_LAUNCH_PASSED SSO APP_LAUNCH_SAML The launch of App SAML in sso operation was successful
215 APP_WSFED_LAUNCH_PASSED SSO APP_LAUNCH_WSFED The launch of App wsfed in sso operation was successful
216 APP_USAGE_AGREEMENT_PASSED SSO APP_USAGE_AGREEMENT The launch of App Usage agreement in sso operation was successful
217 APP_PASSWORD_LAUNCH_PASSED SSO APP_LAUNCH_PASSWORD The launch of the app password in sso operation was successful
218 APP_ACCESS_DENY_PASSED SSO APP_ACCESS_DENIED The denial of an app access in sso operation was successful
219 APP_BOOKMARK_LAUNCH_PASSED SSO APP_LAUNCH_NONE The launch of an app bookmark in sso operation was successful
220 APP_DIRECTORY_PASSWORD_LAUNCH_PASSED SSO APP_LAUNCH_DIR_PSWD The launch of an app directory password in sso operation was successful
221 SERVICE_BROWSER_PASSWORD_REPLAY_PASSED SSO SERVICE_PASSWORD_REPLAY The replay of a service browser password in sso operation was successful
222 SERVICE_BROWSER_PASSWORD_REPLAY_CREDENTIALS_RETRIEVE_PASSED SSO SERVICE_PASSWORD_REPLAY_CREDENTIALS_RETRIEVED The retrieval of service browser password replay credentials in sso operation was successful
223 SYSTEM_KBA_ADD_PASSED SYSTEM_CONFIG ORG_KBA_ADD Addition of system kba in system config operation was successful
224 SYSTEM_KBA_DELETE_PASSED SYSTEM_CONFIG ORG_KBA_DELETE Deletion of a system kba in system config operation was successful
225 API_CLIENT_CREATE_PASSED SYSTEM_CONFIG API_CLIENT_CREATE The creation of an api client in system config operation was successful
226 API_CLIENT_DELETE_PASSED SYSTEM_CONFIG API_CLIENT_DELETE The deletion of an api client in system config operation was successful
227 BRANDING_CREATE_PASSED SYSTEM_CONFIG BRANDING_CREATE The branding creation in system config operation was successful
228 BRANDING_UPDATE_PASSED SYSTEM_CONFIG BRANDING_UPDATE The branding updating in system config operation was successful
229 BRANDING_DELETE_PASSED SYSTEM_CONFIG BRANDING_DELETE The branding deletion in system config operation was successful
230 EMAIL_REDIRECTION_ENABLE_PASSED SYSTEM_CONFIG EMAIL_REDIRECTION_ENABLED The enablement of email redirection in system config operation was successful
231 EMAIL_TEMPLATE_UPDATE_PASSED SYSTEM_CONFIG EMAIL_TEMPLATE_UPDATE The updating of an email template in system config operation was successful
232 TASK_RESULT_DELETE_PASSED SYSTEM_CONFIG ActionTaskResultsPruned The deletion of a task result in system config operation was successful
233 TASK_SCHEDULE_CREATE_PASSED SYSTEM_CONFIG TASK_SCHEDULE_CREATE_PASSED The creation of a task schedule in system config operation was successful
234 TASK_SCHEDULE_UPDATE_PASSED SYSTEM_CONFIG TASK_SCHEDULE_UPDATE_PASSED The updating of a task schedule in system config operation was successful
235 TASK_SCHEDULE_DELETE_PASSED SYSTEM_CONFIG TASK_SCHEDULE_DELETE_PASSED The deletion of a task schedule in system config operation was successful
236 SAVED_SEARCH_CREATE_PASSED SYSTEM_CONFIG   The creation of a saved search in system config operation was successful
237 SAVED_SEARCH_UPDATE_PASSED SYSTEM_CONFIG   The updating of a saved search in system config operation was successful
238 SAVED_SEARCH_DELETE_PASSED SYSTEM_CONFIG   The deletion of a saved search in system config operation was successful
239 SUBSCRIPTION_CREATE_PASSED SYSTEM_CONFIG   The creation of a subscription in system config operation was successful
240 SUBSCRIPTION_UPDATE_PASSED SYSTEM_CONFIG   The updating of a subscription in system config operation was successful
241 SUBSCRIPTION_EXECUTE_STARTED SYSTEM_CONFIG   The execution of a subscription in system config operation has started
242 SUBSCRIPTION_DELETE_PASSED SYSTEM_CONFIG   The deletion of a subscription in system config operation was successful
243 API_IDENTITY_CREATE_PASSED IDENTITY_MANAGMENT IdentityDirectCreate The creation of an api identity in identity management operation was successful
244 API_IDENTITY_CREATE_FAILED IDENTITY_MANAGMENT IdentityDirectCreateFailure The creation of an api identity in identity management operation has failed
245 NON_EMPLOYEE_CREATE_PASSED NON_EMPLOYEE   The creation of a non-employee in non-employe operation was successful
246 NON_EMPLOYEE_UPDATE_PASSED NON_EMPLOYEE   The updating of a non-employee in non-employe operation was successful
247 NON_EMPLOYEE_DELETE_PASSED NON_EMPLOYEE   The deletion of a non-employee in non-employe operation was successful
248 NON_EMPLOYEE_REQUEST_CREATE_PASSED NON_EMPLOYEE   The request for a creation of a non-employee in non-employee operation was successful
249 NON_EMPLOYEE_REQUEST_UPDATE_PASSED NON_EMPLOYEE   The request for an update for a non-employee in non-employee operation was successful
250 NON_EMPLOYEE_REQUEST_APPROVAL_PASSED NON_EMPLOYEE   The approval request of a non employee in non-employee operation was successful
251 AUTHENTICATION_LOCK_PASSED AUTH AUTHENTICATION-245 The locking of authentication in auth operation was successful
252 AUTHENTICATION_REQUEST_FAILED AUTH AUTHENTICATION-246 The request for authentication in auth operation has failed
253 AUTHENTICATION_TIMEOUT_PASSED AUTH AUTHENTICATION-247 The timeout for authentication in auth operation was successful
254 AUTHENTICATION_REQUEST_BLOCKED AUTH AUTHENTICATION-281 The request for authentication in auth operation was blocked
255 SAML_ASSERTION_RECEIVE_PASSED AUTH SAML2-142 The saml assertion in auth operation was received successfully
256 SAML_ASSERTION_RECEIVE_FAILED AUTH SAML2-166 The saml assertion in auth operation reception failed
257 SAML_ASSERTION_SEND_PASSED AUTH SAML2-31 The sending of a saml assertion in auth operation was successful
258 ACCESS_REQUEST_PROCESSED ACCESS_REQUEST AccessRequestProcessed The request for access in access request operation was processed
259 AUTH_SUPPORT_LOGIN_CREATED AUTH   The support login authorization in auth operation was created
260 AUTH_SUPPORT_LOGIN_UPDATED AUTH   The support login authorization in auth operation was updated
261 AUTH_SUPPORT_LOGIN_DELETED AUTH   The support login authorization in auth operation was deleted
262 IAI_ADMIN_CONFIG_UPDATE_EVENT IAI_ADMIN_AUDIT   AI updates to customer configs
263 IAI_ADMIN_CUSTOMER_UPDATE_EVENT IAI_ADMIN_AUDIT   AI updates to customer details
264 IAI_ADMIN_DATASOURCE_UPDAATE_EVENT IAI_ADMIN_AUDIT   AI updates to data-sources
265 IAI_PIPELINE_STREAMING IAI_PIPELINE_STREAMING   Events from the AI pipeline when streaming has been started
266 IAI_PIPELINE_BATCH IAI_PIPELINE_BATCH   Events from the AI pipeline related to batch operations
267 SLPT_TOKEN_EXCHANGE AUTH   Events from the support login flow in Oathkeeper that are emitted when a support user exchanges a token in his or her auth domain for a token in a target tenant’s auth domain.
268 SUPPORT_LOGIN_AUTHENTICATE AUTH   Events from the support login flow in Oathkeeper that are emitted when a support user’s token in the target tenant are posted to the target tenant’s /auth endpoint for login.
269 ONBOARDING_TOKEN_GENERATION_PASSED PASSWORD_ACTIVITY   Generate onboarding password reset email token successfully
270 ONBOARDING_TOKEN_GENERATION_FAILED PASSWORD_ACTIVITY   Fail to generate onboarding password reset email token
271 DIGIT_TOKEN_GENERATION_PASSED PASSWORD_ACTIVITY   Generate digit token successfully
272 DIGIT_TOKEN_GENERATION_FAILED PASSWORD_ACTIVITY   Fail to generate digit token
273 ONBOARDING_TOKEN_VERIFICATION_PASSED PASSWORD_ACTIVITY   Verify the given email token
274 ONBOARDING_TOKEN_VERIFICATION_FAILED PASSWORD_ACTIVITY   Fail to verify the give email token
275 DIGIT_TOKEN_VERIFICATION_PASSED PASSWORD_ACTIVITY   Verify the given digit token
276 DIGIT_TOKEN_VERIFICATION_FAILED PASSWORD_ACTIVITY   Fail to verify the give digit token
277 PASSWORD_ORG_CONFIG_CREATE PASSWORD_ACTIVITY   Create the password org config
278 PASSWORD_ORG_CONFIG_UPDATE PASSWORD_ACTIVITY   Update the password org config
279 ONBOARDING_TOKEN_GENERATION_LIMIT_BYPASS PASSWORD_ACTIVITY   Bypass default limit on onboarding password reset email token
280 WORKFLOW_CREATED WORKFLOW   The creation of a workflow in workflow operation succeeded
281 WORKFLOW_DELETED WORKFLOW   The deletion of a workflow in workflow operation was successful
282 WORKFLOW_DEFINITION_UPDATED WORKFLOW   The updating of a workflow definition in workflow operation succeeded
283 WORKFLOW_OWNER_UPDATED WORKFLOW   The updating of an owner of a workflow in workflow operation succeeded
284 WORKFLOW_TRIGGER_UPDATED WORKFLOW   The updating of a trigger of a workflow in workflow operation succeeded
285 WORKFLOW_ENABLED WORKFLOW   A workflow in workflow operation was enabled
286 WORKFLOW_DISABLED WORKFLOW   A workflow in workflow operation was disabled
287 WORKFLOW_EXECUTION_CANCELLED WORKFLOW   The execution of a workflow in workflow operation was cancelled
288 WORKFLOW_SECRET_CREATED WORKFLOW   A workflow secret in workflow operation was created successfully
289 WORKFLOW_SECRET_ACCESSED WORKFLOW   A workflow secret in workflow operation was accessed
290 WORKFLOW_TENANT_SECRETS_ACCESSED WORKFLOW   A workflow secret for a tenant in workflow operation was accessed
291 WORKFLOW_SECRET_UPDATED WORKFLOW   A workflow secret in workflow operation was updated
292 WORKFLOW_SECRET_DELETED WORKFLOW   A workflow secret in workflow operation was deleted
293 MFA_CONFIGURATION_ENABLE_PASSED PASSWORD_ACTIVITY INTEGRATION_ENABLED Enable mfa integration configuration
294 MFA_CONFIGURATION_DISABLE_PASSED PASSWORD_ACTIVITY INTEGRATION_DISABLED Disable mfa integration configuration
295 MFA_LOGIN_AUTHENTICATE_PASSED AUTH   Indicates that a user successfully authenticated using multi-factor authentication.
296 MFA_LOGIN_AUTHENTICATE_FAILED AUTH   Indicates that a user failed second-factor in multi-factor authentication.
297 SEGMENT_UPDATE_ADD_EVENT SEGMENT   An event was added
298 SEGMENT_UPDATE_REMOVE_EVENT SEGMENT   Indicates the event when a segment is to be updated as removed in segment operation
299 CAPABILITY_UPDATE_EVENT USER_MANAGEMENT   Indicates an identity has had a capability (role) either granted or revoked.
300 AUTH_USER_PASSWORD_UPDATE AUTH   Indicates that an identity’s associated AuthUser has had its password set or updated.
Labels (2)
Attachments
Comments

In the end you mention "are currently indexed in Search and AWS S3.

Does this imply customers have access to the s3 buckets where these audit logs are stored and can be accessed/exported to process further in say a SIEM or a third party automation tool? 

 

Hello @asolodunov , this was my bad, I already corrected it, customers are not able to reach them directly on AWS S3, this can only be accessed through Search.

Great information, thank you for posting this.

Really would like to see more details as to what each of these really mean.

Example:  USER_ROLE_ADMIN_GRANT_PASSED - What does this really mean?

ACCOUNT_VAULT_UPDATE_PASSED - What is a Vault account?

Unfortunately, most of the descriptions was very lacking in details.

37USER_ROLE_SOURCE_ADMIN_REVOKE_PASSEDUSER_MANAGEMENTUSER_SOURCE_ADMIN_GRANTIndicates the role source admin has been revoked to a user in user management operation successfully
 

Mixing GRANT and REVOKE here.

Version history
Revision #:
12 of 12
Last update:
‎Aug 26, 2022 01:06 PM
Updated by:
 
Contributors