Audit Events in Cloud Audit

[#1]

Context:

What Audit Events are: 

    Audit Events are records that a user took action in an IdentityNow tenant, or other service like IdentityAI. Audit Events are structurally and conceptually very similar to IdentityIQ's Audit Events, but have evolved in several ways.

Searching them in the UI:

   Go to the search tab -> search field. Please see the attached image.

Below is the list of audit events allowed by default that are currently indexed in Search.

Scroll to the right to see more fields with information ->

1	Technical name in Search	Type in Search	Legacy Action	Description
2	USER_ACTIVATE_PASSED	USER_MANAGEMENT	USER_ACTIVATE	The user activation from user management operation was successfully activated
3	USER_ACTIVITY_EXPORT_PASSED	USER_MANAGEMENT	USER_ACTIVITY_EXPORT	The user activity export from user management operation was successfully exported
4	USER_ROLE_ADMIN_GRANT_PASSED	USER_MANAGEMENT	USER_ADMIN_GRANT	The admin role for a user from user management operation was granted successfully
5	USER_ROLE_ADMIN_REVOKE_PASSED	USER_MANAGEMENT	USER_ADMIN_REVOKE	The admin role for a user form user management operation was revoked successfully
6	USER_DELETE_PASSED	USER_MANAGEMENT	USER_DELETE	The deletion of a user from user management operation was successful
7	USER_EMAIL_UPDATE_PASSED	USER_MANAGEMENT	USER_EMAIL_UPDATE	The updating of a user email from user management operation was successful
8	USER_ROLE_HELPDESK GRANT_PASSED	USER_MANAGEMENT	USER_HELPDESK_GRANT	The helpdesk role for a user from user management operation was granted successfully
9	USER_ROLE_HELPDESK_REVOKE_PASSED	USER_MANAGEMENT	USER_HELPDESK_REVOKE	The helpdesk role for a user from user management operation was revoked successfully
10	USER_INVITE_PASSED	USER_MANAGEMENT	USER_INVITE	The invite for a user from user management operation was successful
11	USER_INVITE_FAILED	USER_MANAGEMENT	USER_INVITE_FAILURE	The invite for a user from user management operation failed
12	USER_KBA_DELETE_PASSED	USER_MANAGEMENT	USER_KBA_ANSWER_DELETE	The KBA deletion for a user from user management operation was successful
13	USER_KBA_UPDATE_PASSED	USER_MANAGEMENT	USER_KBA_ANSWER_UPDATE	The KBA updation for a user from user managements operation was successful
14	USER_KBA_NOTIFY_PASSED	USER_MANAGEMENT	USER_KBA_ANSWER_UPDATE_NOTIFICATION	The KBA notification for a user in user management operation was successful
15	USER_KBA_ANSWERS_PASSED	USER_MANAGEMENT	USER_KBA_ANSWERS	The KBA answerf or a user in user management operation was successful
16	USER_LOCK_PASSED	USER_MANAGEMENT	USER_LOCK	The locking of a user in user management operation was successful
17	USER_PHONE_UPDATE_PASSED	USER_MANAGEMENT	USER_PHONE_UPDATE	The updating of a users phone in user managemenet operation was successful
18	USER_REGISTER_PASSED	USER_MANAGEMENT	USER_REGISTRATION	The registration of a user in user management operation was successful
19	USER_REGISTER_FAILED	USER_MANAGEMENT	USER_REGISTRATION_FAILURE	The registration of a user in user management operation has failed
20	USER_REGISTER_STARTED	USER_MANAGEMENT	USER_REGISTRATION_LINK	The registration of a user in user management operation has started
21	USER_RESET_PASSED	USER_MANAGEMENT	USER_RESET	The reset of a user in user management operation was successful
22	USER_AUTH_STEP_UP _SETUP_PASSED	USER_MANAGEMENT	USER_STEP_UP_AUTH	The setup of step up in a user auth in user management operation was successful
23	USER_AUTH_STEP_UP _SETUP_FAILED	USER_MANAGEMENT	USER_STEP_UP_AUTH_FAILURE	The setup of step up in a user auth in user management operation has failed
24	USER_UNLOCK_PASSED	USER_MANAGEMENT	USER_UNLOCK	The unlocking of a user in user management operation was successful
25	USER_UNLOCK_REJECTED	USER_MANAGEMENT	USER_UNLOCK_REJECTED	The unlocking of a user in user management operation was rejected
26	EMAIL_SENT_PASSED	USER_MANAGEMENT	emailSent	The sending email in user management operation was successful
27	EMAIL_SENT_FAILED	USER_MANAGEMENT	emailFailure	The sending email in user management operation has failed
28	USER_ROLE_DASHBOARD_GRANT_PASSED	USER_MANAGEMENT	USER_DASHBOARD_GRANT	Role dashboard for a user has been granted in user management operation was successful
29	USER_ROLE_DASHBOARD_REVOKE_PASSED	USER_MANAGEMENT	USER_DASHBOARD_REVOKE	Role dashboard for a user has been revoked in user management operation was successful
30	IDENTITY_DELETE_PASSED	USER_MANAGEMENT	USER_REMOVE	The deletion of an identity in user management operation was successful
31	USER_ROLE_CERTIFICATION_ADMIN_GRANT_PASSED	USER_MANAGEMENT	USER_CERT_ADMIN_GRANT	Indicates the role certification admin has been granted to a user in user management operation successfully
32	USER_ROLE_CERTIFICATION_ADMIN_REVOKE_PASSED	USER_MANAGEMENT	USER_CERT_ADMIN_REVOKE	Indicates the role certification admin has been revoked to a user in user management operation successfully
33	USER_ROLE_REPORT_ADMIN_GRANT_PASSED	USER_MANAGEMENT	USER_REPORT_ADMIN_GRANT	Indicates the role report admin has been granted to a user in user management operation successfully
34	USER_ROLE_REPORT_ADMIN_REVOKE_PASSED	USER_MANAGEMENT	USER_REPORT_ADMIN_REVOKE	Indicates the role report admin has been revoked to a user in user management operation successfully
35	USER_ROLE_ROLE_ADMIN_GRANT_PASSED	USER_MANAGEMENT	USER_ROLE_ADMIN_GRANT	Indicates the role role admin has been granted to a user in user management operation successfully
36	USER_ROLE_ROLE_ADMIN_REVOKE_PASSED	USER_MANAGEMENT	USER_ROLE_ADMIN_REVOKE	Indicates the role role admin has been revoked to a user in user management operation successfully
37	USER_ROLE_SOURCE_ADMIN_REVOKE_PASSED	USER_MANAGEMENT	USER_SOURCE_ADMIN_GRANT	Indicates the role source admin has been revoked to a user in user management operation successfully
38	USER_ROLE_SOURCE_ADMIN_REVOKE_PASSED	USER_MANAGEMENT	USER_SOURCE_ADMIN_REVOKE	Indicates the role source admin has been revoked to a user in user management operation successfully
39	PASSWORD_CHANGE_STARTED	PASSWORD_ACTIVITY	PasswordChange	The change of a password process from password activity operation is started
40	PASSWORD_CHANGE_FAILED	PASSWORD_ACTIVITY	PasswordChangeFailure	The change of a password process from password activity operation has failed
41	PASSWORD_ACTION_CHANGE_PASSED	PASSWORD_ACTIVITY	PasswordChangeSuccess	The action of changing a password process from password activity operation was successful
42	PASSWORD_REQUEST_STARTED	PASSWORD_ACTIVITY	PasswordsRequestStart	The request of a password process from password activity operation has started
43	PASSWORD_EXPIRED_CHANGE_STARTED	PASSWORD_ACTIVITY	ExpirePasswordStart	The process of changing a password when it expired from password activity operation has started
44	PASSWORD_EXPIRED_CHANGE_PASSED	PASSWORD_ACTIVITY	ExpiredPasswordChange	The process of changing a password when it expired from password activity operation was successful
45	PASSWORD_FORGOT_CHANGE_PASSED	PASSWORD_ACTIVITY	ForgotPasswordChange	The process of changing a password when it was forgotten from password activity operation was successful
46	PASSWORD_FORGOT_CHANGE_STARTED	PASSWORD_ACTIVITY	ForgotPasswordStart	The process of changing a password when it was forgotten from password activity operation has started
47	ACCOUNT_PASSWORD_RESET_FAILED	PASSWORD_ACTIVITY	ACCOUNT_PASSWORD_RESET_FAILED	The reset an account password from password activity operation failed
48	ACCOUNT_PASSWORD_RESET_PASSED	PASSWORD_ACTIVITY	ACCOUNT_PASSWORD_RESET_PASSED	The reset an account password from password activity operation was successful
49	ACCOUNT_PASSWORD_SYNC_PASSED	PASSWORD_ACTIVITY	ACCOUNT_PASSWORD_SYNC_PASSED	The sync of a password in an account from password activity operation was successful
50	SOURCE_PASSWORD_CHANGE_STARTED	PASSWORD_ACTIVITY	SOURCE_EXTERNAL_PASSWORD_CHANGE	The change of the source password in password activity operation has started
51	SOURCE_PASSWORD_CHANGE_FAILED	PASSWORD_ACTIVITY	SOURCE_EXTERNAL_PASSWORD_CHANGE_FAILED	The change of the source password in password activity operation failed
52	SOURCE_PASSWORD_CHANGE_PASSED	PASSWORD_ACTIVITY	SOURCE_EXTERNAL_PASSWORD_CHANGE_PASSED	The change of the source password in password activity operation was successful
53	USER_PASSWORD_RESET_REJECTED	PASSWORD_ACTIVITY	USER_PASSWORD_RESET_REJECTED	A reset of a user password in password activity operation was rejected
54	USER_PASSWORD_UPDATE_STARTED	PASSWORD_ACTIVITY	USER_PASSWORD_UPDATE	A user password updating in password activity operation event has started
55	USER_PASSWORD_UPDATE_FAILED	PASSWORD_ACTIVITY	USER_PASSWORD_UPDATE_FAILED	A user password updating in password activity operation has failed
56	USER_PASSWORD_UPDATE_PASSED	PASSWORD_ACTIVITY	USER_PASSWORD_UPDATE_PASSED	A user password updating in password activity operation was successful
57	SOURCE_PASSWORD_INTERCEPT_IGNORED	PASSWORD_ACTIVITY	SOURCE_PASSWORD_INTERCEPT_IGNORED	The intercept of the source password in password activity was ignored
58	SOURCE_PASSWORD_INTERCEPT_PROCESSED	PASSWORD_ACTIVITY	SOURCE_PASSWORD_INTERCEPT_PROCESSED	The intercept of the source password in password activity was processed
59	ACCOUNT_VAULT_UPDATE_PASSED	PASSWORD_ACTIVITY	ACCOUNT_VAULT_UPDATED	The vault of an account updating in password activity operation was successful
60	PASSWORD_POLICY_ASSIGN_PASSED	PASSWORD_ACTIVITY	SOURCE_PASSWORD_POLICY_ASSIGNED	A password policy was assigned successfully in password activity operation
61	SAML_REDIRECT_PATTERNS_UPDATE_PASSED	PASSWORD_ACTIVITY	REDIRECT_PATTERNS_UPDATED	The updating of the saml redirect patterns in password activity operation was successful
62	PASSWORD_POLICY_CREATE_PASSED	PASSWORD_ACTIVITY	PASSWORD_POLICY_CREATED	Creation of a password policy in password activity operation was successful
63	PASSWORD_POLICY_DELETE_PASSED	PASSWORD_ACTIVITY	PASSWORD_POLICY_DELETED	Deletion of a password policy in password activity operation was successful
64	PASSWORD_REPLAY_ENABLE_PASSED	PASSWORD_ACTIVITY	PASSWORD_REPLAY_ENABLED	Enable the password replay in password activity operation was successful
65	STRONG_AUTHENTICATION_INTEGRATION_ENABLE_PASSED	PASSWORD_ACTIVITY	INTEGRATION_ENABLED	Enable to strong authentication integration in password activity operation was successful
66	PASSWORD_REPLAY_PASSIVE_LAUNCH_PASSED	PASSWORD_ACTIVITY	PASSWORD_REPLAY_PASSIVE	The passive launch of password replay in password activity operation was successful
67	PASSWORD_POLICY_UPDATE_PASSED	PASSWORD_ACTIVITY	PASSWORD_POLICY_UPDATED	The updating of password policy in password activity operation was successful
68	STRONG_AUTHENTICATION_INTEGRATION_DISABLE_PASSED	PASSWORD_ACTIVITY	INTEGRATION_DISABLED	The strong authentication integration was disabled successfully in password activity operation
69	STRONG_AUTHENTICATION_INTEGRATION_UPDATE_PASSED	PASSWORD_ACTIVITY	INTEGRATION_UPDATED	The updating of a strong authentication integration in password activity operation was successful
70	ACCOUNT_VAULT_RESET_PASSED	PASSWORD_ACTIVITY	ACCOUNT_FULL_RESET	The reset of account vault in password activity operation was successful
71	MFA_VERIFICATION_FAILED_PASSED	PASSWORD_ACTIVITY	MFA_VERIFICATION_FAILED	The failure of the mfa verification in password activity operation was successful
72	BROWSER_EXTENSION_DISABLE_PASSED	PASSWORD_ACTIVITY	PASSWORD_REPLAY_DISABLED	Indicates the browser extension was disabled successfully in password activity operation
73	ACCOUNT_CREATE_PASSED	PROVISIONING	CreateAccount	The create account provisioning operation was successful
74	ACCOUNT_CREATE_FAILED	PROVISIONING	CreateAccountFailure	The create account provisioning operation failed
75	ACCOUNT_DELETE_PASSED	PROVISIONING	DeleteAccount	The delete account provisioning operation was successful
76	ACCOUNT_DELETE_FAILED	PROVISIONING	DeleteAccountFailure	The delete account provisioning operation failed
77	ACCOUNT_DISABLE_PASSED	PROVISIONING	DisableAccount	The disable account provisioning operation was successful
78	ACCOUNT_DISABLE_FAILED	PROVISIONING	DisableAccountFailure	The disable account provisioning operation failed
79	ATTRIBUTE_SYNC_DISABLE_PASSED	PROVISIONING	DisableAttributeSync	The attribute synchronization configuration was successfully disabled
80	ACCOUNT_ENABLE_PASSED	PROVISIONING	EnableAccount	The enable account provisioning operation was successful
81	ACCOUNT_ENABLE_FAILED	PROVISIONING	EnableAccountFailure	The enable account provisioning operation failed
82	ATTRIBUTE_SYNC_ENABLE_PASSED	PROVISIONING	EnableAttributeSync	The attribute synchronization configuration was successfully enabled
83	ACCOUNT_MODIFY_PASSED	PROVISIONING	ModifyAccount	The provisioning operations which updated the account were successful
84	ACCOUNT_MODIFY_FAILED	PROVISIONING	ModifyAccountFailure	The provisioning operations which updated the account failed
85	ACCOUNT_UNLOCK_PASSED	PROVISIONING	UnlockAccount	The unlock account provisioning operation was successful
86	ACCOUNT_UNLOCK_FAILED	PROVISIONING	UnlockAccountFailure	The unlock account provisioning operation failed
87	IDENTITY_STATE_CHANGE_PASSED	PROVISIONING	IdentityStateChange	The change of state of an identity in provisioning operation was successful
88	PROVISION_CHANGE_STARTED	PROVISIONING	Provisioning	The change for provision in provisioning operation has started
89	PROVISION_CHANGE_PASSED	PROVISIONING	ProvisioningComplete	The change for provision in provisioning operation was successful
90	PROVISION_CHANGE_FAILED	PROVISIONING	ProvisioningFailure	The change for provision in provisioning operation has failed
91	APP_REQUEST_APPROVED	PROVISIONING	App Request Approved	The app request provisioning operation was approved
92	APP_REQUEST_REJECTED	PROVISIONING	App Request Rejected	The app request provisioning operation was rejected
93	IDENTITY_CREATE_PASSED	PROVISIONING	IDENTITY_CREATE_PASSED	The identity creation provisioning operation was successful
94	IDENTITY_UPDATE_PASSED	PROVISIONING	IDENTITY_UPDATE_PASSED	The identity updating provisioning operation was successful
95	IDENTITY_DELETE_PASSED	PROVISIONING	IDENTITY_DELETE_PASSED	The identity deletion provisioning operation was successful
96	IDENTITY_LIFECYCLE_CHANGE_PASSED	PROVISIONING	identityLifecycleEvent	The change of lifecycle for an identity in provisioning operation was successful
97	ACCOUNT_MANUAL_CHANGE_COMPLETE_PASSED	PROVISIONING	ManualChange	The completion of a manual change in an account in provisioning operation was successful
98	IDENTITY_ATTRIBUTE_VALUE_UPDATE_PASSED	PROVISIONING	IdentityAttributeUpdate	The updating of an attribute value in identity in provisioning operation was successful
99	WORKITEM_COMPLETE_COMMENTS_ADD_PASSED	PROVISIONING	Comment	The addition of comments for a complete workitem in provisioning operation was successful
100	APPROVAL_ITEM_APPROVE_PASSED	PROVISIONING	ApproveLineItem	The approving item in an approval in provisioning operation was successful
101	ACCOUNT_PROFILE_UPDATED	PROVISIONING	ACCOUNT_PROFILE_UPDATED	The account provisioning policy was successfully updated
102	ACCOUNT_PROFILE_CREATED	PROVISIONING	ACCOUNT_PROFILE_CREATED	The account provisioning policy was successfully created
103	ACCOUNT_PROFILE_DELETED	PROVISIONING	ACCOUNT_PROFILE_DELETED	The account provisioning policy was successfully deleted
104	IDENTITY_ACCOUNT_REMOVE_PASSED	PROVISIONING	USER_REMOVE_ACCOUNT	The account was successfully removed from the identity
105	ACCESS_REQUEST_STARTED	ACCESS_REQUEST	AccessRequestRequested	The request for access in access request operation has started
106	ACCESS_REQUEST_APPROVED	ACCESS_REQUEST	AccessRequestApproved	The request for access in access request operation was approved
107	ACCESS_REQUEST_REJECTED	ACCESS_REQUEST	AccessRequestRejected	The request for access in access request operation was rejected
108	ACCESS_REQUEST_FORWARDED	ACCESS_REQUEST	AccessRequestForwarded	The request for access in access request operation was forwarded
109	ACCESS_REQUEST_ESCALATED	ACCESS_REQUEST	escalate	The request for access in access request operation was escalated
110	APP_REQUEST_PASSED	ACCESS_REQUEST	RequestApp	The request for an app in access request operation has passed
111	CERTIFICATION_CAMPAIGN_CREATE_PASSED	CERTIFICATION	CertificationCampaignCreate	The creation of a certification campaign in certification operation was successful
112	CERTIFICATION_CAMPAIGN_ACTIVATE_PASSED	CERTIFICATION	CertificationCampaignActivate	The activation of a certification campaign in certification operation was successful
113	CERTIFICATION_CAMPAIGN_COMPLETE_PASSED	CERTIFICATION	CERT_CAMPAIGN_COMPLETE	The completion of a certification campaign in certification operation was successful
114	CERTIFICATION_CAMPAIGN_DELETE_PASSED	CERTIFICATION	CertificationCampaignDelete	The deletion of a certification campaign in certification operation was successful
115	CERTIFICATION_CAMPAIGN_FILTER_CREATE_PASSED	CERTIFICATION	CampaignFilterCreate	The filter creation of a certification campaign in certification operation was successful
116	CERTIFICATION_CAMPAIGN_FILTER_DELETE_PASSED	CERTIFICATION	CampaignFilterDelete	The filter deletion of a certification campaign in certification operation was successful
117	CERTIFICATION_CAMPAIGN_FILTER_UPDATE_PASSED	CERTIFICATION	CampaignFilterUpdate	The filter updating of a certification campaign in certification operation was successful
118	CERTIFICATION_CAMPAIGN_STUCK_DETECTED	CERTIFICATION	STUCK_PENDING_CAMPAIGN_DETECTED	The stuck of a certification campaign in certification operation was detected
119	CERTIFICATION_CAMPAIGN_REVIEW_NOTIFY_PASSED	CERTIFICATION	CERT_CAMPAIGN_REVIEW_NOTIFICATION	The notification of a certification campaign review in certification operation was successful
120	CERTIFICATION_CAMPAIGN_FINISH_PASSED	CERTIFICATION	CERTIFICATIONSFINISHED	The completion of certification campaign in certification operation was successful
121	CERTIFICATION_SIGNOFF_PASSED	CERTIFICATION	signoff	The signoff of a certification in certification operation was successful
122	CERTIFICATION_REASSIGN_PASSED	CERTIFICATION	reassign	The reassign of a certification in certification operation was successful
123	CERTIFICATION_ITEM_CREATION_STATS_LOG_PASSED	CERTIFICATION	CERT_ITEM_TIMESTAMP_STATS	The certification item creation stats log event in certification operation was successful
124	CERTIFICATION_PHASE_CHANGE_PASSED	CERTIFICATION	certificationsPhased	The certification phase change in certification operation was successful
125	CERTIFICATION_ITEM_REMEDIATE	CERTIFICATION	remediate	Indicates the remediation of a certification item in certification operation
126	RULE_CREATE_PASSED	CERTIFICATION	RULE_CREATE_PASSED	The creation of a rule in certification operation was successful
127	RULE_UPDATE_PASSED	CERTIFICATION	RULE_UPDATE_PASSED	The updating of a rule in certification operation was successful
128	RULE_DELETE_PASSED	CERTIFICATION	RULE_DELETE_PASSED	The deletion of a rule in certification operation was successful
129	ENTITLEMENT_ADD_PASSED	ACCESS_ITEM	AddEntitlement	The addition of an entitlement in access item operation was successful
130	ENTITLEMENT_ADD_FAILED	ACCESS_ITEM	AddEntitlementFailure	The addition of an entitlement in access item operation has failed
131	ENTITLEMENT_REMOVE_PASSED	ACCESS_ITEM	RemoveEntitlement	The removal of an entitlement in access item operation was successful
132	ENTITLEMENT_REMOVE_FAILED	ACCESS_ITEM	RemoveEntitlementFailure	The removal of an entitlement in access item operation has failed
133	ACCESS_PROFILE_CREATE_PASSED	ACCESS_ITEM	ACCESS_PROFILE_CREATE	The access profile creation in access item operation was successful
134	ACCESS_PROFILE_DELETE_PASSED	ACCESS_ITEM	ACCESS_PROFILE_DELETE	The access profile deletion in access item operation was successful
135	ACCESS_PROFILE_UPDATE_PASSED	ACCESS_ITEM	ACCESS_PROFILE_UPDATE	The access profile updating in access item operation was successful
136	ROLE_DEPROVISION_ENABLE_PASSED	ACCESS_ITEM	ROLE_ENABLE_DEPROVISIONING	The enablement of role deprovision in access item operation
137	ROLE_DEPROVISION_DISABLE_PASSED	ACCESS_ITEM	ROLE_DISABLE_DEPROVISIONING	A role deprovision in access item operation was disabled successfully
138	IDENTITY_PROFILE_UPDATE_PASSED	ACCESS_ITEM	IDENTITY_PROFILE_UPDATE	Updating of identity profile in access item operation was successful
139	ROLE_CREATE_PASSED	ACCESS_ITEM	ROLE_CREATE_PASSED	The creation of a role in access item operation was successful
140	ROLE_UPDATE_PASSED	ACCESS_ITEM	ROLE_UPDATE_PASSED	The updating of a role in access item operation was successful
141	ROLE_DELETE_PASSED	ACCESS_ITEM	ROLE_DELETE_PASSED	The deletion of a role in access item operation was successful
142	LIFECYCLE_STATE_CREATE_PASSED	ACCESS_ITEM	LIFECYCLE_STATE_CREATE_PASSED	The creation of a lifecycle state in access item operation was successful
143	LIFECYCLE_STATE_UPDATE_PASSED	ACCESS_ITEM	LIFECYCLE_STATE_UPDATE_PASSED	The updating of a lifecycle state in access item operation was successful
144	LIFECYCLE_STATE_DELETE_PASSED	ACCESS_ITEM	LIFECYCLE_STATE_DELETE_PASSED	The deletion of a lifecycle state in access item operation was successful
145	ENTITLEMENT_SET_PASSED	ACCESS_ITEM	SetEntitlement	Entitlement was set up successfully in access item operation
146	ROLE_ADD_PASSED	ACCESS_ITEM	RoleAdd	The addition of a role in access item operation was successful
147	IDENTITY_PROFILE_ATTRIBUTE_CREATE_PASSED	ACCESS_ITEM	Identity Profile Attribute Create	The creation of a profile attribute in an identity in access item operation was successful
148	IDENTITY_PROFILE_ATTRIBUTE_DELETE_PASSED	ACCESS_ITEM	Identity Profile Attribute Delete	The deletion of a profile attribute in an identity in access item operation was successful
149	IDENTITY_PROFILE_ATTRIBUTE_UPDATE_PASSED	ACCESS_ITEM	Identity Profile Attribute Update	The updating of a profile attribute in an identity in access item operation was successful
150	APP_UPDATE_PASSED	ACCESS_ITEM	APP_UPDATE	The app updating in access item operation was successful
151	APP_CREATE_PASSED	ACCESS_ITEM	APP_CREATE	The creation of an app in access item operation was successful
152	APP_DELETE_PASSED	ACCESS_ITEM	APP_DELETE	The deletion of an app in access item operation was successful
153	APP_IMPORT_PASSED	ACCESS_ITEM	APP_IMPORT	The import of an app in access item operation was successful
154	APP_ACCESS_PROFILE_SET_PASSED	ACCESS_ITEM	APP_SET_ACCESS_PROFILES	The app access profile set up in access item operation was successful
155	APP_ADD_PASSED	ACCESS_ITEM	APP_ADD	The addition of an app in access item operation was successful
156	APP_XML_UPDATE_PASSED	ACCESS_ITEM	APP_UPDATE_XML	The updating of an app xml in access item operation was successful
157	APP_REMOVE_PASSED	ACCESS_ITEM	APP_REMOVE	The removal of an app in access item operation was successful
158	APP_PURGE_PASSED	ACCESS_ITEM	APP_PURGED	The app purge in access item operation was successful
159	IDENTITY_PROFILE_AUTHENTICATION_CONFIGURE_PASSED	ACCESS_ITEM	IDENTITY_PROFILE_CONFIGURE_AUTHN	The authentication configuration of an identity profile in access item operation was successful
160	ACCESS_REQUEST_APPROVAL_FORWARD_PASSED	ACCESS_ITEM	Forward	The forward of an access request approval in access item operation was successful
161	ACCESS_REQUEST_CONFIG_UPDATE_PASSED	ACCESS_ITEM	AccessRequestConfigUpdated	The config update of an access request in access item operation was successful
162	IDENTITY_PROFILE_DELETE_PASSED	ACCESS_ITEM	IDENTITY_PROFILE_DELETE	The deletion of an identity profile in access item operation was successful
163	IDENTITY_PROFILE_ATTRIBUTES_UPDATE_PASSED	ACCESS_ITEM	IDENTITY_PROFILE_ATTRIBUTES_UPDATED	The attribute updating for an identity profile in access item operation was successful
164	IDENTITY_PROFILE_CREATE_PASSED	ACCESS_ITEM	IDENTITY_PROFILE_CREATE	The creation of an identity profile in access item operation was successful
165	CONNECTOR_FILE_DELETE_PASSED	SOURCE_MANAGMENT	CONNECTOR_FILE_DELETE	The deletion of a connector file in source management operation was successful
166	CONNECTOR_FILE_UPLOAD_PASSED	SOURCE_MANAGMENT	CONNECTOR_FILE_UPLOAD	The uploading of a connector file in source management operation was successful
167	SOURCE_ACCOUNT_AGGREGATE_PASSED	SOURCE_MANAGMENT	SOURCE_ACCOUNT_AGGREGATION	Aggregation of a source account in source management operation was successful
168	SOURCE_ACCOUNT_AGGREGATE_TERMINATED	SOURCE_MANAGMENT	SOURCE_AGGREGATION_TERMINATED	Termination of source account aggregate in source management operation
169	SOURCE_ACCOUNT_EXPORT_PASSED	SOURCE_MANAGMENT	SOURCE_ACCOUNTS_EXPORT	The export of a source account in source management operation was successful
170	SOURCE_ACCOUNT_FEED_DOWNLOAD_PASSED	SOURCE_MANAGMENT	SOURCE_ACCOUNT_FEED_DOWNLOAD	The download of the source account feed in source management operation was successful
171	SOURCE_ACTIVITY_EXPORT_PASSED	SOURCE_MANAGMENT	SOURCE_ACTIVITY_EXPORT	The export of source activity in source management operation was successful
172	SOURCE_CREATE_PASSED	SOURCE_MANAGMENT	SOURCE_CREATE	The creation of source in source management operation was successful
173	SOURCE_DELETE_PASSED	SOURCE_MANAGMENT	SOURCE_DELETE	The deletion of source in source management operation was successful
174	SOURCE_FEATURES_STRING_UPDATE_PASSED	SOURCE_MANAGMENT	SOURCE_FEATURES_STRING_UPDATE	The update of source features string in source management operation was successful
175	SOURCE_RESET_PASSED	SOURCE_MANAGMENT	SOURCE_RESET	The source reset in source management operation was successful
176	SOURCE_UPDATE_PASSED	SOURCE_MANAGMENT	SOURCE_UPDATE	The source updating in source management operation was successful
177	SOURCE_ENTITLEMENT_AGGREGATE_PASSED	SOURCE_MANAGMENT	SOURCE_ENTITLEMENT_AGGREGATION	The aggregation of source entitlement in source management operation was successful
178	SOURCE_ENTITLEMENT_IMPORT_PASSED	SOURCE_MANAGMENT	SOURCE_ENTITLEMENT_IMPORT	The import of source entitlement in source management operation was successful
179	SOURCE_ENTITLEMENT_EXPORT_PASSED	SOURCE_MANAGMENT	SOURCE_ENTITLEMENT_EXPORT	The export of source entitlement in source management operation was successful
180	SOURCE_EXTERNAL_PASSWORD_CHANGE_ACTIVITY_EXPORT_PASSED	SOURCE_MANAGMENT	SOURCE_EXTERNAL_PASSWORD_CHANGE_ACTIVITY_EXPORT	The export of source external password change activity in source management operation was successful
181	SOURCE_SCHEMA_ATTRIBUTE_ADD_PASSED	SOURCE_MANAGMENT	SOURCE_SCHEMA_ATTRIBUTE_ADDED	The addition of a source schema attribute in source management operation was successful
182	SOURCE_SCHEMA_ATTRIBUTE_DELETE_PASSED	SOURCE_MANAGMENT	SOURCE_SCHEMA_ATTRIBUTES_DELETED	The deletion of a source schema attribute in source management operation was successful
183	SOURCE_SCHEMA_ATTRIBUTE_UPDATE_PASSED	SOURCE_MANAGMENT	SOURCE_SCHEMA_ATTRIBUTES_UPDATED	The updating of a source schema attribute in source management operation was successful
184	SOURCE_DELETE_THRESHOLD_UPDATE_PASSED	SOURCE_MANAGMENT	SOURCE_UPDATE_DELETE_THRESHOLD	The updating of a source delete threshold in source management operation was successful
185	SOURCE_AGGREGATION_SCHEDULE_UPDATE_PASSED	SOURCE_MANAGMENT	SOURCE_AGGREGATION_SCHEDULE_UPDATED	The schedule updating of a source aggregation in source management operation was successful
186	CUSTOM_CONNECTOR_CREATE_PASSED	SOURCE_MANAGMENT	CONNECTOR_CREATE	The creation of a custom connector in source management operation was successful
187	CUSTOM_CONNECTOR_DELETE_PASSED	SOURCE_MANAGMENT	CONNECTOR_DELETE	The deletion of a custom connector in source management operation was successful
188	CUSTOM_CONNECTOR_EXPORT_PASSED	SOURCE_MANAGMENT	CONNECTOR_EXPORT	The export of a custom connector in source management operation was successful
189	CUSTOM_CONNECTOR_UPDATE_PASSED	SOURCE_MANAGMENT	CONNECTOR_UPDATE	The updating of a custom connector in source management operation was successful
190	SOURCE_RENAME_FAILED	SOURCE_MANAGMENT	SOURCE_RENAME_FAILURE_DETECTED	The source rename in source management operation has failed
191	SERVICE_DESK_INTEGRATION_CREATED	SOURCE_MANAGMENT	SERVICE_DESK_INTEGRATION_CREATED	An integration for service desk in source management operation was created
192	SERVICE_DESK_INTEGRATION_CREATE_FAILED	SOURCE_MANAGMENT	SERVICE_DESK_INTEGRATION_CREATE_FAILED	The creation of a service desk integration in source management operation has failed
193	SERVICE_DESK_INTEGRATION_UPDATED	SOURCE_MANAGMENT	SERVICE_DESK_INTEGRATION_UPDATED	The updating of a service desk integration in source management operation was successful
194	SERVICE_DESK_INTEGRATION_UPDATE_FAILED	SOURCE_MANAGMENT	SERVICE_DESK_INTEGRATION_UPDATE_FAILED	The updating of service desk integration in source management operation has failed
195	SERVICE_DESK_INTEGRATION_DELETED	SOURCE_MANAGMENT	SERVICE_DESK_INTEGRATION_DELETED	The service desk integration in source management operation was deleted
196	SERVICE_DESK_INTEGRATION_DELETE_FAILED	SOURCE_MANAGMENT	SERVICE_DESK_INTEGRATION_DELETE_FAILED	The service desk integration deletion in source management operation has failed
197	SESSION_CREATED_PASSED	AUTH	SESSION-1	The creation of a session in auth operation was successful
198	SESSION_MAXIMUM_TIMEOUT_PASSED	AUTH	SESSION-3	The maximum timeout for a session in auth operation was successful
199	SESSION_IDLE_TIMEOUT_PASSED	AUTH	SESSION-2	The timeout session idle in auth operation was successful
200	USER_LOGOUT_PASSED	AUTH	SESSION-4	The user logout in auth operation was successful
201	SESSION_DESTROY_PASSED	AUTH	SESSION-6	The session in auth operation was destroyed successfully
202	AUTHENTICATION_REQUEST_PASSED	AUTH	AUTHENTICATION-103	The authentication request in auth operation was successful
203	AUTHENTICATION_REQUEST_PASSED	AUTH	AUTHENTICATION-105	The authentication request in auth operation was successful
204	AUTHENTICATION_REQUEST_FAILED	AUTH	AUTHENTICATION-240	The authentication request in auth operation has failed
205	AUTHENTICATION_REQUEST_FAILED	AUTH	AUTHENTICATION-241	The authentication request in auth operation has failed
206	USER_LOGOUT_PASSED	AUTH	AUTHENTICATION-300	The logout for a user in auth operation was successful
207	USER_LOGOUT_PASSED	AUTH	AUTHENTICATION-303	The logout for a user in auth operation was successful
208	AUTHENTICATION_REQUEST_PASSED	AUTH	AUTHENTICATION-100	The authentication request for auth operation was successful
209	IDENTITY_PROVIDER_ENABLE_PASSED	AUTH	IDENTITY_PROVIDER_ENABLED	The enablement of identity provider in auth operation was successful
210	IDENTITY_PROVIDER_EXTERNAL_ENABLE_PASSED	AUTH	IDENTITY_PROVIDER_EXTERNAL_ENABLED	Enablement of an external identity provider in auth operation was successful
211	IDENTITY_PROVIDER_EXTERNAL_DISABLE_PASSED	AUTH	IDENTITY_PROVIDER_EXTERNAL_DISABLED	External identity provider in auth operation was successfully disabled
212	CLIENT_TOKEN_CREATE_PASSED	AUTH	CLIENT_TOKEN_ISSUE	The creation of a client token in auth operation was successful
213	FORCE_SAML_AUTHENTICATION_PASSED	AUTH	SAML_FORCE_AUTHN	Forcing the saml authentication in auth operation was successful
214	APP_SAML_LAUNCH_PASSED	SSO	APP_LAUNCH_SAML	The launch of App SAML in sso operation was successful
215	APP_WSFED_LAUNCH_PASSED	SSO	APP_LAUNCH_WSFED	The launch of App wsfed in sso operation was successful
216	APP_USAGE_AGREEMENT_PASSED	SSO	APP_USAGE_AGREEMENT	The launch of App Usage agreement in sso operation was successful
217	APP_PASSWORD_LAUNCH_PASSED	SSO	APP_LAUNCH_PASSWORD	The launch of the app password in sso operation was successful
218	APP_ACCESS_DENY_PASSED	SSO	APP_ACCESS_DENIED	The denial of an app access in sso operation was successful
219	APP_BOOKMARK_LAUNCH_PASSED	SSO	APP_LAUNCH_NONE	The launch of an app bookmark in sso operation was successful
220	APP_DIRECTORY_PASSWORD_LAUNCH_PASSED	SSO	APP_LAUNCH_DIR_PSWD	The launch of an app directory password in sso operation was successful
221	SERVICE_BROWSER_PASSWORD_REPLAY_PASSED	SSO	SERVICE_PASSWORD_REPLAY	The replay of a service browser password in sso operation was successful
222	SERVICE_BROWSER_PASSWORD_REPLAY_CREDENTIALS_RETRIEVE_PASSED	SSO	SERVICE_PASSWORD_REPLAY_CREDENTIALS_RETRIEVED	The retrieval of service browser password replay credentials in sso operation was successful
223	SYSTEM_KBA_ADD_PASSED	SYSTEM_CONFIG	ORG_KBA_ADD	Addition of system kba in system config operation was successful
224	SYSTEM_KBA_DELETE_PASSED	SYSTEM_CONFIG	ORG_KBA_DELETE	Deletion of a system kba in system config operation was successful
225	API_CLIENT_CREATE_PASSED	SYSTEM_CONFIG	API_CLIENT_CREATE	The creation of an api client in system config operation was successful
226	API_CLIENT_DELETE_PASSED	SYSTEM_CONFIG	API_CLIENT_DELETE	The deletion of an api client in system config operation was successful
227	BRANDING_CREATE_PASSED	SYSTEM_CONFIG	BRANDING_CREATE	The branding creation in system config operation was successful
228	BRANDING_UPDATE_PASSED	SYSTEM_CONFIG	BRANDING_UPDATE	The branding updating in system config operation was successful
229	BRANDING_DELETE_PASSED	SYSTEM_CONFIG	BRANDING_DELETE	The branding deletion in system config operation was successful
230	EMAIL_REDIRECTION_ENABLE_PASSED	SYSTEM_CONFIG	EMAIL_REDIRECTION_ENABLED	The enablement of email redirection in system config operation was successful
231	EMAIL_TEMPLATE_UPDATE_PASSED	SYSTEM_CONFIG	EMAIL_TEMPLATE_UPDATE	The updating of an email template in system config operation was successful
232	TASK_RESULT_DELETE_PASSED	SYSTEM_CONFIG	ActionTaskResultsPruned	The deletion of a task result in system config operation was successful
233	TASK_SCHEDULE_CREATE_PASSED	SYSTEM_CONFIG	TASK_SCHEDULE_CREATE_PASSED	The creation of a task schedule in system config operation was successful
234	TASK_SCHEDULE_UPDATE_PASSED	SYSTEM_CONFIG	TASK_SCHEDULE_UPDATE_PASSED	The updating of a task schedule in system config operation was successful
235	TASK_SCHEDULE_DELETE_PASSED	SYSTEM_CONFIG	TASK_SCHEDULE_DELETE_PASSED	The deletion of a task schedule in system config operation was successful
236	SAVED_SEARCH_CREATE_PASSED	SYSTEM_CONFIG		The creation of a saved search in system config operation was successful
237	SAVED_SEARCH_UPDATE_PASSED	SYSTEM_CONFIG		The updating of a saved search in system config operation was successful
238	SAVED_SEARCH_DELETE_PASSED	SYSTEM_CONFIG		The deletion of a saved search in system config operation was successful
239	SUBSCRIPTION_CREATE_PASSED	SYSTEM_CONFIG		The creation of a subscription in system config operation was successful
240	SUBSCRIPTION_UPDATE_PASSED	SYSTEM_CONFIG		The updating of a subscription in system config operation was successful
241	SUBSCRIPTION_EXECUTE_STARTED	SYSTEM_CONFIG		The execution of a subscription in system config operation has started
242	SUBSCRIPTION_DELETE_PASSED	SYSTEM_CONFIG		The deletion of a subscription in system config operation was successful
243	API_IDENTITY_CREATE_PASSED	IDENTITY_MANAGMENT	IdentityDirectCreate	The creation of an api identity in identity management operation was successful
244	API_IDENTITY_CREATE_FAILED	IDENTITY_MANAGMENT	IdentityDirectCreateFailure	The creation of an api identity in identity management operation has failed
245	NON_EMPLOYEE_CREATE_PASSED	NON_EMPLOYEE		The creation of a non-employee in non-employe operation was successful
246	NON_EMPLOYEE_UPDATE_PASSED	NON_EMPLOYEE		The updating of a non-employee in non-employe operation was successful
247	NON_EMPLOYEE_DELETE_PASSED	NON_EMPLOYEE		The deletion of a non-employee in non-employe operation was successful
248	NON_EMPLOYEE_REQUEST_CREATE_PASSED	NON_EMPLOYEE		The request for a creation of a non-employee in non-employee operation was successful
249	NON_EMPLOYEE_REQUEST_UPDATE_PASSED	NON_EMPLOYEE		The request for an update for a non-employee in non-employee operation was successful
250	NON_EMPLOYEE_REQUEST_APPROVAL_PASSED	NON_EMPLOYEE		The approval request of a non employee in non-employee operation was successful
251	AUTHENTICATION_LOCK_PASSED	AUTH	AUTHENTICATION-245	The locking of authentication in auth operation was successful
252	AUTHENTICATION_REQUEST_FAILED	AUTH	AUTHENTICATION-246	The request for authentication in auth operation has failed
253	AUTHENTICATION_TIMEOUT_PASSED	AUTH	AUTHENTICATION-247	The timeout for authentication in auth operation was successful
254	AUTHENTICATION_REQUEST_BLOCKED	AUTH	AUTHENTICATION-281	The request for authentication in auth operation was blocked
255	SAML_ASSERTION_RECEIVE_PASSED	AUTH	SAML2-142	The saml assertion in auth operation was received successfully
256	SAML_ASSERTION_RECEIVE_FAILED	AUTH	SAML2-166	The saml assertion in auth operation reception failed
257	SAML_ASSERTION_SEND_PASSED	AUTH	SAML2-31	The sending of a saml assertion in auth operation was successful
258	ACCESS_REQUEST_PROCESSED	ACCESS_REQUEST	AccessRequestProcessed	The request for access in access request operation was processed
259	AUTH_SUPPORT_LOGIN_CREATED	AUTH		The support login authorization in auth operation was created
260	AUTH_SUPPORT_LOGIN_UPDATED	AUTH		The support login authorization in auth operation was updated
261	AUTH_SUPPORT_LOGIN_DELETED	AUTH		The support login authorization in auth operation was deleted
262	IAI_ADMIN_CONFIG_UPDATE_EVENT	IAI_ADMIN_AUDIT		AI updates to customer configs
263	IAI_ADMIN_CUSTOMER_UPDATE_EVENT	IAI_ADMIN_AUDIT		AI updates to customer details
264	IAI_ADMIN_DATASOURCE_UPDAATE_EVENT	IAI_ADMIN_AUDIT		AI updates to data-sources
265	IAI_PIPELINE_STREAMING	IAI_PIPELINE_STREAMING		Events from the AI pipeline when streaming has been started
266	IAI_PIPELINE_BATCH	IAI_PIPELINE_BATCH		Events from the AI pipeline related to batch operations
267	SLPT_TOKEN_EXCHANGE	AUTH		Events from the support login flow in Oathkeeper that are emitted when a support user exchanges a token in his or her auth domain for a token in a target tenant’s auth domain.
268	SUPPORT_LOGIN_AUTHENTICATE	AUTH		Events from the support login flow in Oathkeeper that are emitted when a support user’s token in the target tenant are posted to the target tenant’s /auth endpoint for login.
269	ONBOARDING_TOKEN_GENERATION_PASSED	PASSWORD_ACTIVITY		Generate onboarding password reset email token successfully
270	ONBOARDING_TOKEN_GENERATION_FAILED	PASSWORD_ACTIVITY		Fail to generate onboarding password reset email token
271	DIGIT_TOKEN_GENERATION_PASSED	PASSWORD_ACTIVITY		Generate digit token successfully
272	DIGIT_TOKEN_GENERATION_FAILED	PASSWORD_ACTIVITY		Fail to generate digit token
273	ONBOARDING_TOKEN_VERIFICATION_PASSED	PASSWORD_ACTIVITY		Verify the given email token
274	ONBOARDING_TOKEN_VERIFICATION_FAILED	PASSWORD_ACTIVITY		Fail to verify the give email token
275	DIGIT_TOKEN_VERIFICATION_PASSED	PASSWORD_ACTIVITY		Verify the given digit token
276	DIGIT_TOKEN_VERIFICATION_FAILED	PASSWORD_ACTIVITY		Fail to verify the give digit token
277	PASSWORD_ORG_CONFIG_CREATE	PASSWORD_ACTIVITY		Create the password org config
278	PASSWORD_ORG_CONFIG_UPDATE	PASSWORD_ACTIVITY		Update the password org config
279	ONBOARDING_TOKEN_GENERATION_LIMIT_BYPASS	PASSWORD_ACTIVITY		Bypass default limit on onboarding password reset email token
280	WORKFLOW_CREATED	WORKFLOW		The creation of a workflow in workflow operation succeeded
281	WORKFLOW_DELETED	WORKFLOW		The deletion of a workflow in workflow operation was successful
282	WORKFLOW_DEFINITION_UPDATED	WORKFLOW		The updating of a workflow definition in workflow operation succeeded
283	WORKFLOW_OWNER_UPDATED	WORKFLOW		The updating of an owner of a workflow in workflow operation succeeded
284	WORKFLOW_TRIGGER_UPDATED	WORKFLOW		The updating of a trigger of a workflow in workflow operation succeeded
285	WORKFLOW_ENABLED	WORKFLOW		A workflow in workflow operation was enabled
286	WORKFLOW_DISABLED	WORKFLOW		A workflow in workflow operation was disabled
287	WORKFLOW_EXECUTION_CANCELLED	WORKFLOW		The execution of a workflow in workflow operation was cancelled
288	WORKFLOW_SECRET_CREATED	WORKFLOW		A workflow secret in workflow operation was created successfully
289	WORKFLOW_SECRET_ACCESSED	WORKFLOW		A workflow secret in workflow operation was accessed
290	WORKFLOW_TENANT_SECRETS_ACCESSED	WORKFLOW		A workflow secret for a tenant in workflow operation was accessed
291	WORKFLOW_SECRET_UPDATED	WORKFLOW		A workflow secret in workflow operation was updated
292	WORKFLOW_SECRET_DELETED	WORKFLOW		A workflow secret in workflow operation was deleted
293	MFA_CONFIGURATION_ENABLE_PASSED	PASSWORD_ACTIVITY	INTEGRATION_ENABLED	Enable mfa integration configuration
294	MFA_CONFIGURATION_DISABLE_PASSED	PASSWORD_ACTIVITY	INTEGRATION_DISABLED	Disable mfa integration configuration
295	MFA_LOGIN_AUTHENTICATE_PASSED	AUTH		Indicates that a user successfully authenticated using multi-factor authentication.
296	MFA_LOGIN_AUTHENTICATE_FAILED	AUTH		Indicates that a user failed second-factor in multi-factor authentication.
297	SEGMENT_UPDATE_ADD_EVENT	SEGMENT		An event was added
298	SEGMENT_UPDATE_REMOVE_EVENT	SEGMENT		Indicates the event when a segment is to be updated as removed in segment operation
299	CAPABILITY_UPDATE_EVENT	USER_MANAGEMENT		Indicates an identity has had a capability (role) either granted or revoked.
300	AUTH_USER_PASSWORD_UPDATE	AUTH		Indicates that an identity’s associated AuthUser has had its password set or updated.

[asolodunov]

In the end you mention "are currently indexed in Search and AWS S3." 

Does this imply customers have access to the s3 buckets where these audit logs are stored and can be accessed/exported to process further in say a SIEM or a third party automation tool? 

[Andrea-carrillo]

Hello @asolodunov , this was my bad, I already corrected it, customers are not able to reach them directly on AWS S3, this can only be accessed through Search.

[NGMUNOZ001]

Great information, thank you for posting this.

[ScottTanselle]

Really would like to see more details as to what each of these really mean.

Example:  USER_ROLE_ADMIN_GRANT_PASSED - What does this really mean?

ACCOUNT_VAULT_UPDATE_PASSED - What is a Vault account?

Unfortunately, most of the descriptions was very lacking in details.

[adamian]

37	USER_ROLE_SOURCE_ADMIN_REVOKE_PASSED	USER_MANAGEMENT	USER_SOURCE_ADMIN_GRANT	Indicates the role source admin has been revoked to a user in user management operation successfully

Mixing GRANT and REVOKE here.