Context:
What Audit Events are:
Audit Events are records that a user took action in an IdentityNow tenant, or other service like IdentityAI. Audit Events are structurally and conceptually very similar to IdentityIQ's Audit Events, but have evolved in several ways.
Searching them in the UI:
Go to the search tab -> search field. Please see the attached image.
Below is the list of audit events allowed by default that are currently indexed in Search.
Scroll to the right to see more fields with information ->
1 | Technical name in Search | Type in Search | Legacy Action | Description |
2 | USER_ACTIVATE_PASSED | USER_MANAGEMENT | USER_ACTIVATE | The user activation from user management operation was successfully activated |
3 | USER_ACTIVITY_EXPORT_PASSED | USER_MANAGEMENT | USER_ACTIVITY_EXPORT | The user activity export from user management operation was successfully exported |
4 | USER_ROLE_ADMIN_GRANT_PASSED | USER_MANAGEMENT | USER_ADMIN_GRANT | The admin role for a user from user management operation was granted successfully |
5 | USER_ROLE_ADMIN_REVOKE_PASSED | USER_MANAGEMENT | USER_ADMIN_REVOKE | The admin role for a user form user management operation was revoked successfully |
6 | USER_DELETE_PASSED | USER_MANAGEMENT | USER_DELETE | The deletion of a user from user management operation was successful |
7 | USER_EMAIL_UPDATE_PASSED | USER_MANAGEMENT | USER_EMAIL_UPDATE | The updating of a user email from user management operation was successful |
8 | USER_ROLE_HELPDESK GRANT_PASSED | USER_MANAGEMENT | USER_HELPDESK_GRANT | The helpdesk role for a user from user management operation was granted successfully |
9 | USER_ROLE_HELPDESK_REVOKE_PASSED | USER_MANAGEMENT | USER_HELPDESK_REVOKE | The helpdesk role for a user from user management operation was revoked successfully |
10 | USER_INVITE_PASSED | USER_MANAGEMENT | USER_INVITE | The invite for a user from user management operation was successful |
11 | USER_INVITE_FAILED | USER_MANAGEMENT | USER_INVITE_FAILURE | The invite for a user from user management operation failed |
12 | USER_KBA_DELETE_PASSED | USER_MANAGEMENT | USER_KBA_ANSWER_DELETE | The KBA deletion for a user from user management operation was successful |
13 | USER_KBA_UPDATE_PASSED | USER_MANAGEMENT | USER_KBA_ANSWER_UPDATE | The KBA updation for a user from user managements operation was successful |
14 | USER_KBA_NOTIFY_PASSED | USER_MANAGEMENT | USER_KBA_ANSWER_UPDATE_NOTIFICATION | The KBA notification for a user in user management operation was successful |
15 | USER_KBA_ANSWERS_PASSED | USER_MANAGEMENT | USER_KBA_ANSWERS | The KBA answerf or a user in user management operation was successful |
16 | USER_LOCK_PASSED | USER_MANAGEMENT | USER_LOCK | The locking of a user in user management operation was successful |
17 | USER_PHONE_UPDATE_PASSED | USER_MANAGEMENT | USER_PHONE_UPDATE | The updating of a users phone in user managemenet operation was successful |
18 | USER_REGISTER_PASSED | USER_MANAGEMENT | USER_REGISTRATION | The registration of a user in user management operation was successful |
19 | USER_REGISTER_FAILED | USER_MANAGEMENT | USER_REGISTRATION_FAILURE | The registration of a user in user management operation has failed |
20 | USER_REGISTER_STARTED | USER_MANAGEMENT | USER_REGISTRATION_LINK | The registration of a user in user management operation has started |
21 | USER_RESET_PASSED | USER_MANAGEMENT | USER_RESET | The reset of a user in user management operation was successful |
22 | USER_AUTH_STEP_UP _SETUP_PASSED | USER_MANAGEMENT | USER_STEP_UP_AUTH | The setup of step up in a user auth in user management operation was successful |
23 | USER_AUTH_STEP_UP _SETUP_FAILED | USER_MANAGEMENT | USER_STEP_UP_AUTH_FAILURE | The setup of step up in a user auth in user management operation has failed |
24 | USER_UNLOCK_PASSED | USER_MANAGEMENT | USER_UNLOCK | The unlocking of a user in user management operation was successful |
25 | USER_UNLOCK_REJECTED | USER_MANAGEMENT | USER_UNLOCK_REJECTED | The unlocking of a user in user management operation was rejected |
26 | EMAIL_SENT_PASSED | USER_MANAGEMENT | emailSent | The sending email in user management operation was successful |
27 | EMAIL_SENT_FAILED | USER_MANAGEMENT | emailFailure | The sending email in user management operation has failed |
28 | USER_ROLE_DASHBOARD_GRANT_PASSED | USER_MANAGEMENT | USER_DASHBOARD_GRANT | Role dashboard for a user has been granted in user management operation was successful |
29 | USER_ROLE_DASHBOARD_REVOKE_PASSED | USER_MANAGEMENT | USER_DASHBOARD_REVOKE | Role dashboard for a user has been revoked in user management operation was successful |
30 | IDENTITY_DELETE_PASSED | USER_MANAGEMENT | USER_REMOVE | The deletion of an identity in user management operation was successful |
31 | USER_ROLE_CERTIFICATION_ADMIN_GRANT_PASSED | USER_MANAGEMENT | USER_CERT_ADMIN_GRANT | Indicates the role certification admin has been granted to a user in user management operation successfully |
32 | USER_ROLE_CERTIFICATION_ADMIN_REVOKE_PASSED | USER_MANAGEMENT | USER_CERT_ADMIN_REVOKE | Indicates the role certification admin has been revoked to a user in user management operation successfully |
33 | USER_ROLE_REPORT_ADMIN_GRANT_PASSED | USER_MANAGEMENT | USER_REPORT_ADMIN_GRANT | Indicates the role report admin has been granted to a user in user management operation successfully |
34 | USER_ROLE_REPORT_ADMIN_REVOKE_PASSED | USER_MANAGEMENT | USER_REPORT_ADMIN_REVOKE | Indicates the role report admin has been revoked to a user in user management operation successfully |
35 | USER_ROLE_ROLE_ADMIN_GRANT_PASSED | USER_MANAGEMENT | USER_ROLE_ADMIN_GRANT | Indicates the role role admin has been granted to a user in user management operation successfully |
36 | USER_ROLE_ROLE_ADMIN_REVOKE_PASSED | USER_MANAGEMENT | USER_ROLE_ADMIN_REVOKE | Indicates the role role admin has been revoked to a user in user management operation successfully |
37 | USER_ROLE_SOURCE_ADMIN_REVOKE_PASSED | USER_MANAGEMENT | USER_SOURCE_ADMIN_GRANT | Indicates the role source admin has been revoked to a user in user management operation successfully |
38 | USER_ROLE_SOURCE_ADMIN_REVOKE_PASSED | USER_MANAGEMENT | USER_SOURCE_ADMIN_REVOKE | Indicates the role source admin has been revoked to a user in user management operation successfully |
39 | PASSWORD_CHANGE_STARTED | PASSWORD_ACTIVITY | PasswordChange | The change of a password process from password activity operation is started |
40 | PASSWORD_CHANGE_FAILED | PASSWORD_ACTIVITY | PasswordChangeFailure | The change of a password process from password activity operation has failed |
41 | PASSWORD_ACTION_CHANGE_PASSED | PASSWORD_ACTIVITY | PasswordChangeSuccess | The action of changing a password process from password activity operation was successful |
42 | PASSWORD_REQUEST_STARTED | PASSWORD_ACTIVITY | PasswordsRequestStart | The request of a password process from password activity operation has started |
43 | PASSWORD_EXPIRED_CHANGE_STARTED | PASSWORD_ACTIVITY | ExpirePasswordStart | The process of changing a password when it expired from password activity operation has started |
44 | PASSWORD_EXPIRED_CHANGE_PASSED | PASSWORD_ACTIVITY | ExpiredPasswordChange | The process of changing a password when it expired from password activity operation was successful |
45 | PASSWORD_FORGOT_CHANGE_PASSED | PASSWORD_ACTIVITY | ForgotPasswordChange | The process of changing a password when it was forgotten from password activity operation was successful |
46 | PASSWORD_FORGOT_CHANGE_STARTED | PASSWORD_ACTIVITY | ForgotPasswordStart | The process of changing a password when it was forgotten from password activity operation has started |
47 | ACCOUNT_PASSWORD_RESET_FAILED | PASSWORD_ACTIVITY | ACCOUNT_PASSWORD_RESET_FAILED | The reset an account password from password activity operation failed |
48 | ACCOUNT_PASSWORD_RESET_PASSED | PASSWORD_ACTIVITY | ACCOUNT_PASSWORD_RESET_PASSED | The reset an account password from password activity operation was successful |
49 | ACCOUNT_PASSWORD_SYNC_PASSED | PASSWORD_ACTIVITY | ACCOUNT_PASSWORD_SYNC_PASSED | The sync of a password in an account from password activity operation was successful |
50 | SOURCE_PASSWORD_CHANGE_STARTED | PASSWORD_ACTIVITY | SOURCE_EXTERNAL_PASSWORD_CHANGE | The change of the source password in password activity operation has started |
51 | SOURCE_PASSWORD_CHANGE_FAILED | PASSWORD_ACTIVITY | SOURCE_EXTERNAL_PASSWORD_CHANGE_FAILED | The change of the source password in password activity operation failed |
52 | SOURCE_PASSWORD_CHANGE_PASSED | PASSWORD_ACTIVITY | SOURCE_EXTERNAL_PASSWORD_CHANGE_PASSED | The change of the source password in password activity operation was successful |
53 | USER_PASSWORD_RESET_REJECTED | PASSWORD_ACTIVITY | USER_PASSWORD_RESET_REJECTED | A reset of a user password in password activity operation was rejected |
54 | USER_PASSWORD_UPDATE_STARTED | PASSWORD_ACTIVITY | USER_PASSWORD_UPDATE | A user password updating in password activity operation event has started |
55 | USER_PASSWORD_UPDATE_FAILED | PASSWORD_ACTIVITY | USER_PASSWORD_UPDATE_FAILED | A user password updating in password activity operation has failed |
56 | USER_PASSWORD_UPDATE_PASSED | PASSWORD_ACTIVITY | USER_PASSWORD_UPDATE_PASSED | A user password updating in password activity operation was successful |
57 | SOURCE_PASSWORD_INTERCEPT_IGNORED | PASSWORD_ACTIVITY | SOURCE_PASSWORD_INTERCEPT_IGNORED | The intercept of the source password in password activity was ignored |
58 | SOURCE_PASSWORD_INTERCEPT_PROCESSED | PASSWORD_ACTIVITY | SOURCE_PASSWORD_INTERCEPT_PROCESSED | The intercept of the source password in password activity was processed |
59 | ACCOUNT_VAULT_UPDATE_PASSED | PASSWORD_ACTIVITY | ACCOUNT_VAULT_UPDATED | The vault of an account updating in password activity operation was successful |
60 | PASSWORD_POLICY_ASSIGN_PASSED | PASSWORD_ACTIVITY | SOURCE_PASSWORD_POLICY_ASSIGNED | A password policy was assigned successfully in password activity operation |
61 | SAML_REDIRECT_PATTERNS_UPDATE_PASSED | PASSWORD_ACTIVITY | REDIRECT_PATTERNS_UPDATED | The updating of the saml redirect patterns in password activity operation was successful |
62 | PASSWORD_POLICY_CREATE_PASSED | PASSWORD_ACTIVITY | PASSWORD_POLICY_CREATED | Creation of a password policy in password activity operation was successful |
63 | PASSWORD_POLICY_DELETE_PASSED | PASSWORD_ACTIVITY | PASSWORD_POLICY_DELETED | Deletion of a password policy in password activity operation was successful |
64 | PASSWORD_REPLAY_ENABLE_PASSED | PASSWORD_ACTIVITY | PASSWORD_REPLAY_ENABLED | Enable the password replay in password activity operation was successful |
65 | STRONG_AUTHENTICATION_INTEGRATION_ENABLE_PASSED | PASSWORD_ACTIVITY | INTEGRATION_ENABLED | Enable to strong authentication integration in password activity operation was successful |
66 | PASSWORD_REPLAY_PASSIVE_LAUNCH_PASSED | PASSWORD_ACTIVITY | PASSWORD_REPLAY_PASSIVE | The passive launch of password replay in password activity operation was successful |
67 | PASSWORD_POLICY_UPDATE_PASSED | PASSWORD_ACTIVITY | PASSWORD_POLICY_UPDATED | The updating of password policy in password activity operation was successful |
68 | STRONG_AUTHENTICATION_INTEGRATION_DISABLE_PASSED | PASSWORD_ACTIVITY | INTEGRATION_DISABLED | The strong authentication integration was disabled successfully in password activity operation |
69 | STRONG_AUTHENTICATION_INTEGRATION_UPDATE_PASSED | PASSWORD_ACTIVITY | INTEGRATION_UPDATED | The updating of a strong authentication integration in password activity operation was successful |
70 | ACCOUNT_VAULT_RESET_PASSED | PASSWORD_ACTIVITY | ACCOUNT_FULL_RESET | The reset of account vault in password activity operation was successful |
71 | MFA_VERIFICATION_FAILED_PASSED | PASSWORD_ACTIVITY | MFA_VERIFICATION_FAILED | The failure of the mfa verification in password activity operation was successful |
72 | BROWSER_EXTENSION_DISABLE_PASSED | PASSWORD_ACTIVITY | PASSWORD_REPLAY_DISABLED | Indicates the browser extension was disabled successfully in password activity operation |
73 | ACCOUNT_CREATE_PASSED | PROVISIONING | CreateAccount | The create account provisioning operation was successful |
74 | ACCOUNT_CREATE_FAILED | PROVISIONING | CreateAccountFailure | The create account provisioning operation failed |
75 | ACCOUNT_DELETE_PASSED | PROVISIONING | DeleteAccount | The delete account provisioning operation was successful |
76 | ACCOUNT_DELETE_FAILED | PROVISIONING | DeleteAccountFailure | The delete account provisioning operation failed |
77 | ACCOUNT_DISABLE_PASSED | PROVISIONING | DisableAccount | The disable account provisioning operation was successful |
78 | ACCOUNT_DISABLE_FAILED | PROVISIONING | DisableAccountFailure | The disable account provisioning operation failed |
79 | ATTRIBUTE_SYNC_DISABLE_PASSED | PROVISIONING | DisableAttributeSync | The attribute synchronization configuration was successfully disabled |
80 | ACCOUNT_ENABLE_PASSED | PROVISIONING | EnableAccount | The enable account provisioning operation was successful |
81 | ACCOUNT_ENABLE_FAILED | PROVISIONING | EnableAccountFailure | The enable account provisioning operation failed |
82 | ATTRIBUTE_SYNC_ENABLE_PASSED | PROVISIONING | EnableAttributeSync | The attribute synchronization configuration was successfully enabled |
83 | ACCOUNT_MODIFY_PASSED | PROVISIONING | ModifyAccount | The provisioning operations which updated the account were successful |
84 | ACCOUNT_MODIFY_FAILED | PROVISIONING | ModifyAccountFailure | The provisioning operations which updated the account failed |
85 | ACCOUNT_UNLOCK_PASSED | PROVISIONING | UnlockAccount | The unlock account provisioning operation was successful |
86 | ACCOUNT_UNLOCK_FAILED | PROVISIONING | UnlockAccountFailure | The unlock account provisioning operation failed |
87 | IDENTITY_STATE_CHANGE_PASSED | PROVISIONING | IdentityStateChange | The change of state of an identity in provisioning operation was successful |
88 | PROVISION_CHANGE_STARTED | PROVISIONING | Provisioning | The change for provision in provisioning operation has started |
89 | PROVISION_CHANGE_PASSED | PROVISIONING | ProvisioningComplete | The change for provision in provisioning operation was successful |
90 | PROVISION_CHANGE_FAILED | PROVISIONING | ProvisioningFailure | The change for provision in provisioning operation has failed |
91 | APP_REQUEST_APPROVED | PROVISIONING | App Request Approved | The app request provisioning operation was approved |
92 | APP_REQUEST_REJECTED | PROVISIONING | App Request Rejected | The app request provisioning operation was rejected |
93 | IDENTITY_CREATE_PASSED | PROVISIONING | IDENTITY_CREATE_PASSED | The identity creation provisioning operation was successful |
94 | IDENTITY_UPDATE_PASSED | PROVISIONING | IDENTITY_UPDATE_PASSED | The identity updating provisioning operation was successful |
95 | IDENTITY_DELETE_PASSED | PROVISIONING | IDENTITY_DELETE_PASSED | The identity deletion provisioning operation was successful |
96 | IDENTITY_LIFECYCLE_CHANGE_PASSED | PROVISIONING | identityLifecycleEvent | The change of lifecycle for an identity in provisioning operation was successful |
97 | ACCOUNT_MANUAL_CHANGE_COMPLETE_PASSED | PROVISIONING | ManualChange | The completion of a manual change in an account in provisioning operation was successful |
98 | IDENTITY_ATTRIBUTE_VALUE_UPDATE_PASSED | PROVISIONING | IdentityAttributeUpdate | The updating of an attribute value in identity in provisioning operation was successful |
99 | WORKITEM_COMPLETE_COMMENTS_ADD_PASSED | PROVISIONING | Comment | The addition of comments for a complete workitem in provisioning operation was successful |
100 | APPROVAL_ITEM_APPROVE_PASSED | PROVISIONING | ApproveLineItem | The approving item in an approval in provisioning operation was successful |
101 | ACCOUNT_PROFILE_UPDATED | PROVISIONING | ACCOUNT_PROFILE_UPDATED | The account provisioning policy was successfully updated |
102 | ACCOUNT_PROFILE_CREATED | PROVISIONING | ACCOUNT_PROFILE_CREATED | The account provisioning policy was successfully created |
103 | ACCOUNT_PROFILE_DELETED | PROVISIONING | ACCOUNT_PROFILE_DELETED | The account provisioning policy was successfully deleted |
104 | IDENTITY_ACCOUNT_REMOVE_PASSED | PROVISIONING | USER_REMOVE_ACCOUNT | The account was successfully removed from the identity |
105 | ACCESS_REQUEST_STARTED | ACCESS_REQUEST | AccessRequestRequested | The request for access in access request operation has started |
106 | ACCESS_REQUEST_APPROVED | ACCESS_REQUEST | AccessRequestApproved | The request for access in access request operation was approved |
107 | ACCESS_REQUEST_REJECTED | ACCESS_REQUEST | AccessRequestRejected | The request for access in access request operation was rejected |
108 | ACCESS_REQUEST_FORWARDED | ACCESS_REQUEST | AccessRequestForwarded | The request for access in access request operation was forwarded |
109 | ACCESS_REQUEST_ESCALATED | ACCESS_REQUEST | escalate | The request for access in access request operation was escalated |
110 | APP_REQUEST_PASSED | ACCESS_REQUEST | RequestApp | The request for an app in access request operation has passed |
111 | CERTIFICATION_CAMPAIGN_CREATE_PASSED | CERTIFICATION | CertificationCampaignCreate | The creation of a certification campaign in certification operation was successful |
112 | CERTIFICATION_CAMPAIGN_ACTIVATE_PASSED | CERTIFICATION | CertificationCampaignActivate | The activation of a certification campaign in certification operation was successful |
113 | CERTIFICATION_CAMPAIGN_COMPLETE_PASSED | CERTIFICATION | CERT_CAMPAIGN_COMPLETE | The completion of a certification campaign in certification operation was successful |
114 | CERTIFICATION_CAMPAIGN_DELETE_PASSED | CERTIFICATION | CertificationCampaignDelete | The deletion of a certification campaign in certification operation was successful |
115 | CERTIFICATION_CAMPAIGN_FILTER_CREATE_PASSED | CERTIFICATION | CampaignFilterCreate | The filter creation of a certification campaign in certification operation was successful |
116 | CERTIFICATION_CAMPAIGN_FILTER_DELETE_PASSED | CERTIFICATION | CampaignFilterDelete | The filter deletion of a certification campaign in certification operation was successful |
117 | CERTIFICATION_CAMPAIGN_FILTER_UPDATE_PASSED | CERTIFICATION | CampaignFilterUpdate | The filter updating of a certification campaign in certification operation was successful |
118 | CERTIFICATION_CAMPAIGN_STUCK_DETECTED | CERTIFICATION | STUCK_PENDING_CAMPAIGN_DETECTED | The stuck of a certification campaign in certification operation was detected |
119 | CERTIFICATION_CAMPAIGN_REVIEW_NOTIFY_PASSED | CERTIFICATION | CERT_CAMPAIGN_REVIEW_NOTIFICATION | The notification of a certification campaign review in certification operation was successful |
120 | CERTIFICATION_CAMPAIGN_FINISH_PASSED | CERTIFICATION | CERTIFICATIONSFINISHED | The completion of certification campaign in certification operation was successful |
121 | CERTIFICATION_SIGNOFF_PASSED | CERTIFICATION | signoff | The signoff of a certification in certification operation was successful |
122 | CERTIFICATION_REASSIGN_PASSED | CERTIFICATION | reassign | The reassign of a certification in certification operation was successful |
123 | CERTIFICATION_ITEM_CREATION_STATS_LOG_PASSED | CERTIFICATION | CERT_ITEM_TIMESTAMP_STATS | The certification item creation stats log event in certification operation was successful |
124 | CERTIFICATION_PHASE_CHANGE_PASSED | CERTIFICATION | certificationsPhased | The certification phase change in certification operation was successful |
125 | CERTIFICATION_ITEM_REMEDIATE | CERTIFICATION | remediate | Indicates the remediation of a certification item in certification operation |
126 | RULE_CREATE_PASSED | CERTIFICATION | RULE_CREATE_PASSED | The creation of a rule in certification operation was successful |
127 | RULE_UPDATE_PASSED | CERTIFICATION | RULE_UPDATE_PASSED | The updating of a rule in certification operation was successful |
128 | RULE_DELETE_PASSED | CERTIFICATION | RULE_DELETE_PASSED | The deletion of a rule in certification operation was successful |
129 | ENTITLEMENT_ADD_PASSED | ACCESS_ITEM | AddEntitlement | The addition of an entitlement in access item operation was successful |
130 | ENTITLEMENT_ADD_FAILED | ACCESS_ITEM | AddEntitlementFailure | The addition of an entitlement in access item operation has failed |
131 | ENTITLEMENT_REMOVE_PASSED | ACCESS_ITEM | RemoveEntitlement | The removal of an entitlement in access item operation was successful |
132 | ENTITLEMENT_REMOVE_FAILED | ACCESS_ITEM | RemoveEntitlementFailure | The removal of an entitlement in access item operation has failed |
133 | ACCESS_PROFILE_CREATE_PASSED | ACCESS_ITEM | ACCESS_PROFILE_CREATE | The access profile creation in access item operation was successful |
134 | ACCESS_PROFILE_DELETE_PASSED | ACCESS_ITEM | ACCESS_PROFILE_DELETE | The access profile deletion in access item operation was successful |
135 | ACCESS_PROFILE_UPDATE_PASSED | ACCESS_ITEM | ACCESS_PROFILE_UPDATE | The access profile updating in access item operation was successful |
136 | ROLE_DEPROVISION_ENABLE_PASSED | ACCESS_ITEM | ROLE_ENABLE_DEPROVISIONING | The enablement of role deprovision in access item operation |
137 | ROLE_DEPROVISION_DISABLE_PASSED | ACCESS_ITEM | ROLE_DISABLE_DEPROVISIONING | A role deprovision in access item operation was disabled successfully |
138 | IDENTITY_PROFILE_UPDATE_PASSED | ACCESS_ITEM | IDENTITY_PROFILE_UPDATE | Updating of identity profile in access item operation was successful |
139 | ROLE_CREATE_PASSED | ACCESS_ITEM | ROLE_CREATE_PASSED | The creation of a role in access item operation was successful |
140 | ROLE_UPDATE_PASSED | ACCESS_ITEM | ROLE_UPDATE_PASSED | The updating of a role in access item operation was successful |
141 | ROLE_DELETE_PASSED | ACCESS_ITEM | ROLE_DELETE_PASSED | The deletion of a role in access item operation was successful |
142 | LIFECYCLE_STATE_CREATE_PASSED | ACCESS_ITEM | LIFECYCLE_STATE_CREATE_PASSED | The creation of a lifecycle state in access item operation was successful |
143 | LIFECYCLE_STATE_UPDATE_PASSED | ACCESS_ITEM | LIFECYCLE_STATE_UPDATE_PASSED | The updating of a lifecycle state in access item operation was successful |
144 | LIFECYCLE_STATE_DELETE_PASSED | ACCESS_ITEM | LIFECYCLE_STATE_DELETE_PASSED | The deletion of a lifecycle state in access item operation was successful |
145 | ENTITLEMENT_SET_PASSED | ACCESS_ITEM | SetEntitlement | Entitlement was set up successfully in access item operation |
146 | ROLE_ADD_PASSED | ACCESS_ITEM | RoleAdd | The addition of a role in access item operation was successful |
147 | IDENTITY_PROFILE_ATTRIBUTE_CREATE_PASSED | ACCESS_ITEM | Identity Profile Attribute Create | The creation of a profile attribute in an identity in access item operation was successful |
148 | IDENTITY_PROFILE_ATTRIBUTE_DELETE_PASSED | ACCESS_ITEM | Identity Profile Attribute Delete | The deletion of a profile attribute in an identity in access item operation was successful |
149 | IDENTITY_PROFILE_ATTRIBUTE_UPDATE_PASSED | ACCESS_ITEM | Identity Profile Attribute Update | The updating of a profile attribute in an identity in access item operation was successful |
150 | APP_UPDATE_PASSED | ACCESS_ITEM | APP_UPDATE | The app updating in access item operation was successful |
151 | APP_CREATE_PASSED | ACCESS_ITEM | APP_CREATE | The creation of an app in access item operation was successful |
152 | APP_DELETE_PASSED | ACCESS_ITEM | APP_DELETE | The deletion of an app in access item operation was successful |
153 | APP_IMPORT_PASSED | ACCESS_ITEM | APP_IMPORT | The import of an app in access item operation was successful |
154 | APP_ACCESS_PROFILE_SET_PASSED | ACCESS_ITEM | APP_SET_ACCESS_PROFILES | The app access profile set up in access item operation was successful |
155 | APP_ADD_PASSED | ACCESS_ITEM | APP_ADD | The addition of an app in access item operation was successful |
156 | APP_XML_UPDATE_PASSED | ACCESS_ITEM | APP_UPDATE_XML | The updating of an app xml in access item operation was successful |
157 | APP_REMOVE_PASSED | ACCESS_ITEM | APP_REMOVE | The removal of an app in access item operation was successful |
158 | APP_PURGE_PASSED | ACCESS_ITEM | APP_PURGED | The app purge in access item operation was successful |
159 | IDENTITY_PROFILE_AUTHENTICATION_CONFIGURE_PASSED | ACCESS_ITEM | IDENTITY_PROFILE_CONFIGURE_AUTHN | The authentication configuration of an identity profile in access item operation was successful |
160 | ACCESS_REQUEST_APPROVAL_FORWARD_PASSED | ACCESS_ITEM | Forward | The forward of an access request approval in access item operation was successful |
161 | ACCESS_REQUEST_CONFIG_UPDATE_PASSED | ACCESS_ITEM | AccessRequestConfigUpdated | The config update of an access request in access item operation was successful |
162 | IDENTITY_PROFILE_DELETE_PASSED | ACCESS_ITEM | IDENTITY_PROFILE_DELETE | The deletion of an identity profile in access item operation was successful |
163 | IDENTITY_PROFILE_ATTRIBUTES_UPDATE_PASSED | ACCESS_ITEM | IDENTITY_PROFILE_ATTRIBUTES_UPDATED | The attribute updating for an identity profile in access item operation was successful |
164 | IDENTITY_PROFILE_CREATE_PASSED | ACCESS_ITEM | IDENTITY_PROFILE_CREATE | The creation of an identity profile in access item operation was successful |
165 | CONNECTOR_FILE_DELETE_PASSED | SOURCE_MANAGMENT | CONNECTOR_FILE_DELETE | The deletion of a connector file in source management operation was successful |
166 | CONNECTOR_FILE_UPLOAD_PASSED | SOURCE_MANAGMENT | CONNECTOR_FILE_UPLOAD | The uploading of a connector file in source management operation was successful |
167 | SOURCE_ACCOUNT_AGGREGATE_PASSED | SOURCE_MANAGMENT | SOURCE_ACCOUNT_AGGREGATION | Aggregation of a source account in source management operation was successful |
168 | SOURCE_ACCOUNT_AGGREGATE_TERMINATED | SOURCE_MANAGMENT | SOURCE_AGGREGATION_TERMINATED | Termination of source account aggregate in source management operation |
169 | SOURCE_ACCOUNT_EXPORT_PASSED | SOURCE_MANAGMENT | SOURCE_ACCOUNTS_EXPORT | The export of a source account in source management operation was successful |
170 | SOURCE_ACCOUNT_FEED_DOWNLOAD_PASSED | SOURCE_MANAGMENT | SOURCE_ACCOUNT_FEED_DOWNLOAD | The download of the source account feed in source management operation was successful |
171 | SOURCE_ACTIVITY_EXPORT_PASSED | SOURCE_MANAGMENT | SOURCE_ACTIVITY_EXPORT | The export of source activity in source management operation was successful |
172 | SOURCE_CREATE_PASSED | SOURCE_MANAGMENT | SOURCE_CREATE | The creation of source in source management operation was successful |
173 | SOURCE_DELETE_PASSED | SOURCE_MANAGMENT | SOURCE_DELETE | The deletion of source in source management operation was successful |
174 | SOURCE_FEATURES_STRING_UPDATE_PASSED | SOURCE_MANAGMENT | SOURCE_FEATURES_STRING_UPDATE | The update of source features string in source management operation was successful |
175 | SOURCE_RESET_PASSED | SOURCE_MANAGMENT | SOURCE_RESET | The source reset in source management operation was successful |
176 | SOURCE_UPDATE_PASSED | SOURCE_MANAGMENT | SOURCE_UPDATE | The source updating in source management operation was successful |
177 | SOURCE_ENTITLEMENT_AGGREGATE_PASSED | SOURCE_MANAGMENT | SOURCE_ENTITLEMENT_AGGREGATION | The aggregation of source entitlement in source management operation was successful |
178 | SOURCE_ENTITLEMENT_IMPORT_PASSED | SOURCE_MANAGMENT | SOURCE_ENTITLEMENT_IMPORT | The import of source entitlement in source management operation was successful |
179 | SOURCE_ENTITLEMENT_EXPORT_PASSED | SOURCE_MANAGMENT | SOURCE_ENTITLEMENT_EXPORT | The export of source entitlement in source management operation was successful |
180 | SOURCE_EXTERNAL_PASSWORD_CHANGE_ACTIVITY_EXPORT_PASSED | SOURCE_MANAGMENT | SOURCE_EXTERNAL_PASSWORD_CHANGE_ACTIVITY_EXPORT | The export of source external password change activity in source management operation was successful |
181 | SOURCE_SCHEMA_ATTRIBUTE_ADD_PASSED | SOURCE_MANAGMENT | SOURCE_SCHEMA_ATTRIBUTE_ADDED | The addition of a source schema attribute in source management operation was successful |
182 | SOURCE_SCHEMA_ATTRIBUTE_DELETE_PASSED | SOURCE_MANAGMENT | SOURCE_SCHEMA_ATTRIBUTES_DELETED | The deletion of a source schema attribute in source management operation was successful |
183 | SOURCE_SCHEMA_ATTRIBUTE_UPDATE_PASSED | SOURCE_MANAGMENT | SOURCE_SCHEMA_ATTRIBUTES_UPDATED | The updating of a source schema attribute in source management operation was successful |
184 | SOURCE_DELETE_THRESHOLD_UPDATE_PASSED | SOURCE_MANAGMENT | SOURCE_UPDATE_DELETE_THRESHOLD | The updating of a source delete threshold in source management operation was successful |
185 | SOURCE_AGGREGATION_SCHEDULE_UPDATE_PASSED | SOURCE_MANAGMENT | SOURCE_AGGREGATION_SCHEDULE_UPDATED | The schedule updating of a source aggregation in source management operation was successful |
186 | CUSTOM_CONNECTOR_CREATE_PASSED | SOURCE_MANAGMENT | CONNECTOR_CREATE | The creation of a custom connector in source management operation was successful |
187 | CUSTOM_CONNECTOR_DELETE_PASSED | SOURCE_MANAGMENT | CONNECTOR_DELETE | The deletion of a custom connector in source management operation was successful |
188 | CUSTOM_CONNECTOR_EXPORT_PASSED | SOURCE_MANAGMENT | CONNECTOR_EXPORT | The export of a custom connector in source management operation was successful |
189 | CUSTOM_CONNECTOR_UPDATE_PASSED | SOURCE_MANAGMENT | CONNECTOR_UPDATE | The updating of a custom connector in source management operation was successful |
190 | SOURCE_RENAME_FAILED | SOURCE_MANAGMENT | SOURCE_RENAME_FAILURE_DETECTED | The source rename in source management operation has failed |
191 | SERVICE_DESK_INTEGRATION_CREATED | SOURCE_MANAGMENT | SERVICE_DESK_INTEGRATION_CREATED | An integration for service desk in source management operation was created |
192 | SERVICE_DESK_INTEGRATION_CREATE_FAILED | SOURCE_MANAGMENT | SERVICE_DESK_INTEGRATION_CREATE_FAILED | The creation of a service desk integration in source management operation has failed |
193 | SERVICE_DESK_INTEGRATION_UPDATED | SOURCE_MANAGMENT | SERVICE_DESK_INTEGRATION_UPDATED | The updating of a service desk integration in source management operation was successful |
194 | SERVICE_DESK_INTEGRATION_UPDATE_FAILED | SOURCE_MANAGMENT | SERVICE_DESK_INTEGRATION_UPDATE_FAILED | The updating of service desk integration in source management operation has failed |
195 | SERVICE_DESK_INTEGRATION_DELETED | SOURCE_MANAGMENT | SERVICE_DESK_INTEGRATION_DELETED | The service desk integration in source management operation was deleted |
196 | SERVICE_DESK_INTEGRATION_DELETE_FAILED | SOURCE_MANAGMENT | SERVICE_DESK_INTEGRATION_DELETE_FAILED | The service desk integration deletion in source management operation has failed |
197 | SESSION_CREATED_PASSED | AUTH | SESSION-1 | The creation of a session in auth operation was successful |
198 | SESSION_MAXIMUM_TIMEOUT_PASSED | AUTH | SESSION-3 | The maximum timeout for a session in auth operation was successful |
199 | SESSION_IDLE_TIMEOUT_PASSED | AUTH | SESSION-2 | The timeout session idle in auth operation was successful |
200 | USER_LOGOUT_PASSED | AUTH | SESSION-4 | The user logout in auth operation was successful |
201 | SESSION_DESTROY_PASSED | AUTH | SESSION-6 | The session in auth operation was destroyed successfully |
202 | AUTHENTICATION_REQUEST_PASSED | AUTH | AUTHENTICATION-103 | The authentication request in auth operation was successful |
203 | AUTHENTICATION_REQUEST_PASSED | AUTH | AUTHENTICATION-105 | The authentication request in auth operation was successful |
204 | AUTHENTICATION_REQUEST_FAILED | AUTH | AUTHENTICATION-240 | The authentication request in auth operation has failed |
205 | AUTHENTICATION_REQUEST_FAILED | AUTH | AUTHENTICATION-241 | The authentication request in auth operation has failed |
206 | USER_LOGOUT_PASSED | AUTH | AUTHENTICATION-300 | The logout for a user in auth operation was successful |
207 | USER_LOGOUT_PASSED | AUTH | AUTHENTICATION-303 | The logout for a user in auth operation was successful |
208 | AUTHENTICATION_REQUEST_PASSED | AUTH | AUTHENTICATION-100 | The authentication request for auth operation was successful |
209 | IDENTITY_PROVIDER_ENABLE_PASSED | AUTH | IDENTITY_PROVIDER_ENABLED | The enablement of identity provider in auth operation was successful |
210 | IDENTITY_PROVIDER_EXTERNAL_ENABLE_PASSED | AUTH | IDENTITY_PROVIDER_EXTERNAL_ENABLED | Enablement of an external identity provider in auth operation was successful |
211 | IDENTITY_PROVIDER_EXTERNAL_DISABLE_PASSED | AUTH | IDENTITY_PROVIDER_EXTERNAL_DISABLED | External identity provider in auth operation was successfully disabled |
212 | CLIENT_TOKEN_CREATE_PASSED | AUTH | CLIENT_TOKEN_ISSUE | The creation of a client token in auth operation was successful |
213 | FORCE_SAML_AUTHENTICATION_PASSED | AUTH | SAML_FORCE_AUTHN | Forcing the saml authentication in auth operation was successful |
214 | APP_SAML_LAUNCH_PASSED | SSO | APP_LAUNCH_SAML | The launch of App SAML in sso operation was successful |
215 | APP_WSFED_LAUNCH_PASSED | SSO | APP_LAUNCH_WSFED | The launch of App wsfed in sso operation was successful |
216 | APP_USAGE_AGREEMENT_PASSED | SSO | APP_USAGE_AGREEMENT | The launch of App Usage agreement in sso operation was successful |
217 | APP_PASSWORD_LAUNCH_PASSED | SSO | APP_LAUNCH_PASSWORD | The launch of the app password in sso operation was successful |
218 | APP_ACCESS_DENY_PASSED | SSO | APP_ACCESS_DENIED | The denial of an app access in sso operation was successful |
219 | APP_BOOKMARK_LAUNCH_PASSED | SSO | APP_LAUNCH_NONE | The launch of an app bookmark in sso operation was successful |
220 | APP_DIRECTORY_PASSWORD_LAUNCH_PASSED | SSO | APP_LAUNCH_DIR_PSWD | The launch of an app directory password in sso operation was successful |
221 | SERVICE_BROWSER_PASSWORD_REPLAY_PASSED | SSO | SERVICE_PASSWORD_REPLAY | The replay of a service browser password in sso operation was successful |
222 | SERVICE_BROWSER_PASSWORD_REPLAY_CREDENTIALS_RETRIEVE_PASSED | SSO | SERVICE_PASSWORD_REPLAY_CREDENTIALS_RETRIEVED | The retrieval of service browser password replay credentials in sso operation was successful |
223 | SYSTEM_KBA_ADD_PASSED | SYSTEM_CONFIG | ORG_KBA_ADD | Addition of system kba in system config operation was successful |
224 | SYSTEM_KBA_DELETE_PASSED | SYSTEM_CONFIG | ORG_KBA_DELETE | Deletion of a system kba in system config operation was successful |
225 | API_CLIENT_CREATE_PASSED | SYSTEM_CONFIG | API_CLIENT_CREATE | The creation of an api client in system config operation was successful |
226 | API_CLIENT_DELETE_PASSED | SYSTEM_CONFIG | API_CLIENT_DELETE | The deletion of an api client in system config operation was successful |
227 | BRANDING_CREATE_PASSED | SYSTEM_CONFIG | BRANDING_CREATE | The branding creation in system config operation was successful |
228 | BRANDING_UPDATE_PASSED | SYSTEM_CONFIG | BRANDING_UPDATE | The branding updating in system config operation was successful |
229 | BRANDING_DELETE_PASSED | SYSTEM_CONFIG | BRANDING_DELETE | The branding deletion in system config operation was successful |
230 | EMAIL_REDIRECTION_ENABLE_PASSED | SYSTEM_CONFIG | EMAIL_REDIRECTION_ENABLED | The enablement of email redirection in system config operation was successful |
231 | EMAIL_TEMPLATE_UPDATE_PASSED | SYSTEM_CONFIG | EMAIL_TEMPLATE_UPDATE | The updating of an email template in system config operation was successful |
232 | TASK_RESULT_DELETE_PASSED | SYSTEM_CONFIG | ActionTaskResultsPruned | The deletion of a task result in system config operation was successful |
233 | TASK_SCHEDULE_CREATE_PASSED | SYSTEM_CONFIG | TASK_SCHEDULE_CREATE_PASSED | The creation of a task schedule in system config operation was successful |
234 | TASK_SCHEDULE_UPDATE_PASSED | SYSTEM_CONFIG | TASK_SCHEDULE_UPDATE_PASSED | The updating of a task schedule in system config operation was successful |
235 | TASK_SCHEDULE_DELETE_PASSED | SYSTEM_CONFIG | TASK_SCHEDULE_DELETE_PASSED | The deletion of a task schedule in system config operation was successful |
236 | SAVED_SEARCH_CREATE_PASSED | SYSTEM_CONFIG | The creation of a saved search in system config operation was successful | |
237 | SAVED_SEARCH_UPDATE_PASSED | SYSTEM_CONFIG | The updating of a saved search in system config operation was successful | |
238 | SAVED_SEARCH_DELETE_PASSED | SYSTEM_CONFIG | The deletion of a saved search in system config operation was successful | |
239 | SUBSCRIPTION_CREATE_PASSED | SYSTEM_CONFIG | The creation of a subscription in system config operation was successful | |
240 | SUBSCRIPTION_UPDATE_PASSED | SYSTEM_CONFIG | The updating of a subscription in system config operation was successful | |
241 | SUBSCRIPTION_EXECUTE_STARTED | SYSTEM_CONFIG | The execution of a subscription in system config operation has started | |
242 | SUBSCRIPTION_DELETE_PASSED | SYSTEM_CONFIG | The deletion of a subscription in system config operation was successful | |
243 | API_IDENTITY_CREATE_PASSED | IDENTITY_MANAGMENT | IdentityDirectCreate | The creation of an api identity in identity management operation was successful |
244 | API_IDENTITY_CREATE_FAILED | IDENTITY_MANAGMENT | IdentityDirectCreateFailure | The creation of an api identity in identity management operation has failed |
245 | NON_EMPLOYEE_CREATE_PASSED | NON_EMPLOYEE | The creation of a non-employee in non-employe operation was successful | |
246 | NON_EMPLOYEE_UPDATE_PASSED | NON_EMPLOYEE | The updating of a non-employee in non-employe operation was successful | |
247 | NON_EMPLOYEE_DELETE_PASSED | NON_EMPLOYEE | The deletion of a non-employee in non-employe operation was successful | |
248 | NON_EMPLOYEE_REQUEST_CREATE_PASSED | NON_EMPLOYEE | The request for a creation of a non-employee in non-employee operation was successful | |
249 | NON_EMPLOYEE_REQUEST_UPDATE_PASSED | NON_EMPLOYEE | The request for an update for a non-employee in non-employee operation was successful | |
250 | NON_EMPLOYEE_REQUEST_APPROVAL_PASSED | NON_EMPLOYEE | The approval request of a non employee in non-employee operation was successful | |
251 | AUTHENTICATION_LOCK_PASSED | AUTH | AUTHENTICATION-245 | The locking of authentication in auth operation was successful |
252 | AUTHENTICATION_REQUEST_FAILED | AUTH | AUTHENTICATION-246 | The request for authentication in auth operation has failed |
253 | AUTHENTICATION_TIMEOUT_PASSED | AUTH | AUTHENTICATION-247 | The timeout for authentication in auth operation was successful |
254 | AUTHENTICATION_REQUEST_BLOCKED | AUTH | AUTHENTICATION-281 | The request for authentication in auth operation was blocked |
255 | SAML_ASSERTION_RECEIVE_PASSED | AUTH | SAML2-142 | The saml assertion in auth operation was received successfully |
256 | SAML_ASSERTION_RECEIVE_FAILED | AUTH | SAML2-166 | The saml assertion in auth operation reception failed |
257 | SAML_ASSERTION_SEND_PASSED | AUTH | SAML2-31 | The sending of a saml assertion in auth operation was successful |
258 | ACCESS_REQUEST_PROCESSED | ACCESS_REQUEST | AccessRequestProcessed | The request for access in access request operation was processed |
259 | AUTH_SUPPORT_LOGIN_CREATED | AUTH | The support login authorization in auth operation was created | |
260 | AUTH_SUPPORT_LOGIN_UPDATED | AUTH | The support login authorization in auth operation was updated | |
261 | AUTH_SUPPORT_LOGIN_DELETED | AUTH | The support login authorization in auth operation was deleted | |
262 | IAI_ADMIN_CONFIG_UPDATE_EVENT | IAI_ADMIN_AUDIT | AI updates to customer configs | |
263 | IAI_ADMIN_CUSTOMER_UPDATE_EVENT | IAI_ADMIN_AUDIT | AI updates to customer details | |
264 | IAI_ADMIN_DATASOURCE_UPDAATE_EVENT | IAI_ADMIN_AUDIT | AI updates to data-sources | |
265 | IAI_PIPELINE_STREAMING | IAI_PIPELINE_STREAMING | Events from the AI pipeline when streaming has been started | |
266 | IAI_PIPELINE_BATCH | IAI_PIPELINE_BATCH | Events from the AI pipeline related to batch operations | |
267 | SLPT_TOKEN_EXCHANGE | AUTH | Events from the support login flow in Oathkeeper that are emitted when a support user exchanges a token in his or her auth domain for a token in a target tenant’s auth domain. | |
268 | SUPPORT_LOGIN_AUTHENTICATE | AUTH | Events from the support login flow in Oathkeeper that are emitted when a support user’s token in the target tenant are posted to the target tenant’s /auth endpoint for login. | |
269 | ONBOARDING_TOKEN_GENERATION_PASSED | PASSWORD_ACTIVITY | Generate onboarding password reset email token successfully | |
270 | ONBOARDING_TOKEN_GENERATION_FAILED | PASSWORD_ACTIVITY | Fail to generate onboarding password reset email token | |
271 | DIGIT_TOKEN_GENERATION_PASSED | PASSWORD_ACTIVITY | Generate digit token successfully | |
272 | DIGIT_TOKEN_GENERATION_FAILED | PASSWORD_ACTIVITY | Fail to generate digit token | |
273 | ONBOARDING_TOKEN_VERIFICATION_PASSED | PASSWORD_ACTIVITY | Verify the given email token | |
274 | ONBOARDING_TOKEN_VERIFICATION_FAILED | PASSWORD_ACTIVITY | Fail to verify the give email token | |
275 | DIGIT_TOKEN_VERIFICATION_PASSED | PASSWORD_ACTIVITY | Verify the given digit token | |
276 | DIGIT_TOKEN_VERIFICATION_FAILED | PASSWORD_ACTIVITY | Fail to verify the give digit token | |
277 | PASSWORD_ORG_CONFIG_CREATE | PASSWORD_ACTIVITY | Create the password org config | |
278 | PASSWORD_ORG_CONFIG_UPDATE | PASSWORD_ACTIVITY | Update the password org config | |
279 | ONBOARDING_TOKEN_GENERATION_LIMIT_BYPASS | PASSWORD_ACTIVITY | Bypass default limit on onboarding password reset email token | |
280 | WORKFLOW_CREATED | WORKFLOW | The creation of a workflow in workflow operation succeeded | |
281 | WORKFLOW_DELETED | WORKFLOW | The deletion of a workflow in workflow operation was successful | |
282 | WORKFLOW_DEFINITION_UPDATED | WORKFLOW | The updating of a workflow definition in workflow operation succeeded | |
283 | WORKFLOW_OWNER_UPDATED | WORKFLOW | The updating of an owner of a workflow in workflow operation succeeded | |
284 | WORKFLOW_TRIGGER_UPDATED | WORKFLOW | The updating of a trigger of a workflow in workflow operation succeeded | |
285 | WORKFLOW_ENABLED | WORKFLOW | A workflow in workflow operation was enabled | |
286 | WORKFLOW_DISABLED | WORKFLOW | A workflow in workflow operation was disabled | |
287 | WORKFLOW_EXECUTION_CANCELLED | WORKFLOW | The execution of a workflow in workflow operation was cancelled | |
288 | WORKFLOW_SECRET_CREATED | WORKFLOW | A workflow secret in workflow operation was created successfully | |
289 | WORKFLOW_SECRET_ACCESSED | WORKFLOW | A workflow secret in workflow operation was accessed | |
290 | WORKFLOW_TENANT_SECRETS_ACCESSED | WORKFLOW | A workflow secret for a tenant in workflow operation was accessed | |
291 | WORKFLOW_SECRET_UPDATED | WORKFLOW | A workflow secret in workflow operation was updated | |
292 | WORKFLOW_SECRET_DELETED | WORKFLOW | A workflow secret in workflow operation was deleted | |
293 | MFA_CONFIGURATION_ENABLE_PASSED | PASSWORD_ACTIVITY | INTEGRATION_ENABLED | Enable mfa integration configuration |
294 | MFA_CONFIGURATION_DISABLE_PASSED | PASSWORD_ACTIVITY | INTEGRATION_DISABLED | Disable mfa integration configuration |
295 | MFA_LOGIN_AUTHENTICATE_PASSED | AUTH | Indicates that a user successfully authenticated using multi-factor authentication. | |
296 | MFA_LOGIN_AUTHENTICATE_FAILED | AUTH | Indicates that a user failed second-factor in multi-factor authentication. | |
297 | SEGMENT_UPDATE_ADD_EVENT | SEGMENT | An event was added | |
298 | SEGMENT_UPDATE_REMOVE_EVENT | SEGMENT | Indicates the event when a segment is to be updated as removed in segment operation | |
299 | CAPABILITY_UPDATE_EVENT | USER_MANAGEMENT | Indicates an identity has had a capability (role) either granted or revoked. | |
300 | AUTH_USER_PASSWORD_UPDATE | AUTH | Indicates that an identity’s associated AuthUser has had its password set or updated. |
In the end you mention "are currently indexed in Search and AWS S3."
Does this imply customers have access to the s3 buckets where these audit logs are stored and can be accessed/exported to process further in say a SIEM or a third party automation tool?
Hello @asolodunov , this was my bad, I already corrected it, customers are not able to reach them directly on AWS S3, this can only be accessed through Search.
Great information, thank you for posting this.
Really would like to see more details as to what each of these really mean.
Example: USER_ROLE_ADMIN_GRANT_PASSED - What does this really mean?
ACCOUNT_VAULT_UPDATE_PASSED - What is a Vault account?
Unfortunately, most of the descriptions was very lacking in details.
37 | USER_ROLE_SOURCE_ADMIN_REVOKE_PASSED | USER_MANAGEMENT | USER_SOURCE_ADMIN_GRANT | Indicates the role source admin has been revoked to a user in user management operation successfully |
Mixing GRANT and REVOKE here.