Event Reference

How to read an entry

Each event below includes:

Event code — the identifier that appears in the logs (for example, E_LOGIN_SUCCEEDED).
Name — a plain-language description of what the event represents.
Notes — any conditions that affect when the event is recorded, where applicable.
Fields captured — the data fields included in the event's payload.

Some events include a short summary of what they capture instead of (or in addition to) a full field list.

User Activity

Fields captured: type, event_ts, version, journey_id, session_id, client_ip_address, caller_user_agent, login_state, user_id, user_status, user_email, user_firstname, user_lastname, source_user_directory, tenant_dns, tenant_tag, service_name, server_ip, auth_method, auth_device_os, auth_device_name, auth_device_app_name, auth_device_app_version, auth_device_latitude, auth_device_longitude, moduleId, otp_type, factsSubmitted, applicationId, machine_id, machine_name, machine_domain, machine_os, machine_os_version, machine_mac_addr, machine_ip, agent_version, groups, userTrustedLocations, mobileLocation, authModuleId, authenticationMethods, username, machine_user, IP, authFactor, sessionUrl, authJourneysMatched, name, Id, user_role, distanceUserTrustedMobileMeters, event_id, timestamp, epoch_time, tenant_id, community_id, eventName, event_name, note

Note: When authentication is performed via an auth proxy with client IP tracking enabled, the payload instead includes: eventName, event_name, type, tenant_id, community_id, loginMethod, ipAddress, client_ip, radiusId, radiusAuthenticator, userName, user_id, referrer_name, referrer_protocol, event_id, timestamp, epoch_time, event_ts.

Fields captured: type, event_ts, version, journey_id, client_ip_address, caller_user_agent, login_state, user_id, user_status, user_email, user_firstname, user_lastname, source_user_directory, tenant_dns, tenant_tag, service_name, server_ip, auth_method, auth_device_os, auth_device_name, auth_device_app_name, auth_device_app_version, auth_device_latitude, auth_device_longitude, moduleId, otp_type, factsSubmitted, applicationId, machine_id, machine_name, machine_domain, machine_os, machine_os_version, machine_mac_addr, machine_ip, agent_version, eventData, reason, event_id, timestamp, epoch_time, tenant_id, community_id, eventName, event_name

Onboarding Activity

E_USER_INVITED — User invited to tenant

Captures which email address the invitation was sent to and which user account created the invitation.

E_USER_ONBOARDED — User onboarded and device linked

Captures information about the user onboarded to the tenant and details about the device linked to their account.

Authentication Activity

E_ACCOUNT_LOCKED — Account locked

Note: Only records lockouts caused by exceeding the maximum number of incorrect OTP attempts.

Fields captured: tenant_id, community_id, username, initiatedby, lockedAt, reason, reasonCode, message

E_ACCOUNT_UNLOCKED — Account restored after lockout

Note: Only records restorations when the lockout was due to exceeding the maximum number of incorrect OTP attempts.

Fields captured: tenant_id, community_id, username, initiatedby, lockedAt, reason, reasonCode, message

E_OTP_RATE_LIMIT_HIT — OTP request limit exceeded

Fields captured: user_id, retry_after_seconds, eventName, tenant_dns, tenant_id, community_id, community_name, license_hash, request_id, requested_at, type, event_id, timestamp, epoch_time, event_name, event_ts

E_PUSH_RATE_LIMIT_HIT — Push request limit exceeded

E_DEVICE_DELINKED — Mobile device removed

Fields captured: tenant_id, community_id, username, actor, auth_device_application_id, auth_device_did, auth_device_id, auth_device_longitude, auth_device_latitude, auth_device_name, initiatedby, user_id

E_PWDRESET_SUCCEEDED — Password reset successful

Fields captured: data, type, event_ts, user_id, directory_id, directory_type, directory_name, tenant_id, community_id, event_id, timestamp, epoch_time, eventName, event_name

E_PWDRESET_FAILED — Password reset failed

Fields captured: data, type, event_ts, user_id, directory_id, directory_type, directory_name, tenant_id, community_id, failure_reason, event_id, timestamp, epoch_time, eventName, event_name

Records user account details and the time the push notification was requested.

E_OTP_GENERATED — OTP generated and sent

Captures the time an OTP was generated, user details, and which email or phone it was sent to.

E_OTP_LOCKED — Account locked due to incorrect OTP attempts

Triggered when a user has entered an incorrect OTP the maximum number of times allowed.

E_OTP_REQUESTED — OTP requested by user

Captures which user requested an OTP, the time of request, and which email or phone it was sent to.

E_OTP_VERIFIED — OTP verification outcome

Captures the outcome of an OTP verification, including the time.

Fields captured: event_id, event_ts, version, journey_id, session_id, client_ip_address, caller_user_agent, user_id, user_status, user_email, user_firstname, user_lastname, source_user_directory, source_user_directory_name, caller_ip, tenant_dns, auth_method, auth_device_os, auth_device_name, auth_device_app_name, auth_device_app_version, auth_device_ip_address, auth_device_latitude, auth_device_longitude, sp_type, sp_name, sp_id, tenant_id, community_id, type, eventName, timestamp, epoch_time, reports_producer_time

Fields captured: authenticator_id, authenticator_name, authenticator_os, authenticator_version, device_id, event_name, license_hash, network_info, person_id, person_publickey, sender, sender_version, status, type, user_agent, user_id, origin, api, authPage, community, communityId

E_ORPHAN_ACCOUNT_REMOVED — Orphaned account removed

Fields captured: data, authenticator_id, authenticator_name, authenticator_os, authenticator_version, device_id, event_name, license_hash, network_info, origin, api, community_name, tag, person_id, person_publickey, reason, sender, sender_version, status, type, user_agent, user_id, event_id, timestamp, epoch_time, tenant_id, community_id, eventName, event_ts

E_ADAPTIVE_AUTH_MODIFIED — Adaptive authentication journey modified

Fields captured: event_name, journey_id, journey_name, event_ts, tenant_id, community_id, eventCategory, type, old_groups.operator, new_groups.operator, user_id, user_name, connection_ip_address, connection_useragent, event_id, timestamp, epoch_time, eventName

E_ADAPTIVEAUTH_CREATED — Adaptive authentication journey created

Fields captured: event_name, journey_id, journey_type, journey_name, event_ts, tenant_id, community_id, eventCategory, type, decision.action, user_id, user_name, connection_ip_address, connection_useragent, decision.authenticationMethods, groups.value, requestingAppId.value, event_id, timestamp, epoch_time, eventName

E_ADAPTIVEAUTH_DELETED — Adaptive authentication journey deleted

Fields captured: event_name, journey_id, journey_type, journey_name, event_ts, tenant_id, community_id, eventCategory, type, user_id, user_name, connection_ip_address, connection_useragent, event_id, timestamp, epoch_time, eventName

E_SESSIONS_TERMINATED — User session revoked

Fields captured: data, type, tenant_dns, tenant_tag, caller_user_agent, eventCategory, revoked_by, user_role, client_ip_address, server_ip, user_ip, user_details, user_id, uid, user_status, user_email, user_firstname, user_lastname, module_id, source_user_directory, active_sessions, event_id, timestamp, epoch_time, tenant_id, community_id, eventName, event_name, event_ts

E_ACCESSCODE_GENERATED — Onboarding invite generated by admin

Fields captured: tenant_id, initiated_by, caller_ip, purpose, expiry_date, sent_to, type, tenant_tag, community_id, user_id, caller_user_agent, event_ts, eventName, event_name, tenant_dns, accesscode_type, event_id, timestamp, epoch_time

E_USER_PROFILE_UPDATED — User enrolled a new phone number

Fields captured: type, tenant_id, community_id, eventName, event_id, ip_address, user_agent, request_id, username, action, event_ts, updated_by, phone_number, timestamp, epoch_time, event_name, user_id

E_AFFIDAVIT_ISSUED — Affidavit issued to user

Fields captured: type, tenant_name, community_name, issued_by, issued_to, date, doc_type, doc_id, expiry, user_id, event_id, timestamp, epoch_time, tenant_id, community_id, eventName, event_name, event_ts

E_BEHAVIOR_AUTH_SUCCESS — Behavior authentication succeeded

Fields captured: type, tenant_id, community_id, event_ts, version, eventName, event_name, request_id, client_ip_address, license_hash, login_state, user_id, user_email, user_firstname, user_lastname, user_status, source_user_directory, urn, urn_b64, moduleId, tenant_dns, auth_method, auth_device_app_name, authFactor, behaviorAuth, success, result, score, confidence_interval, confidence, net_score, device_similarity, compared_samples, action, previous_samples, status, event_id, timestamp, epoch_time

E_BEHAVIOR_AUTH_FAILED — Behavior authentication failed

Fields captured: event_name, event_ts, tenant_id, community_id, eventCategory, type, consent_doc_id, actions, user_id, user_name, client_ip_address, caller_user_agent, event_id, timestamp, epoch_time, eventName

Fields captured: event_name, event_ts, user_id, user_name, client_ip_address, caller_useragent, tenant_id, community_id, consent_status, type, consent_record_id, consent_doc_id, event_id, timestamp, epoch_time, eventName

Authentication Policy

E_AUTHPOLICY_CHECKED — Authentication policy evaluated

Records whether access was granted, denied, or if additional step-up authentication was required.

Fields captured: type, event_id, ip, person_publickey, requestid, rule_id, decision, caller_user_agent, url, country, region, eventName, timestamp, epoch_time, tenant_id, community_id, reports_producer_time

Identity Verification

E_DOCUMENT_ENROLLED — Identity document enrolled

Tracks enrollment of passports, driver's licenses, state IDs, social security numbers, and LiveID. No personally identifiable information is captured.

Fields captured: type, tenant_name, community_name, username, email, timestamp, document_type, live_id, ip_address, user_agent, document_id, transaction_id, event_id, eventName, epoch_time, tenant_id, community_id

E_DOCUMENT_UNENROLLED — Identity document removed

Records the document type and the user's IAL level resulting from the removal.

Fields captured: tenantid, communityid, username, did, document_id, document_type, ial

Records that consent has been granted and details about the items consent was granted for.

Fields captured: tenantid, communityid, username, relying_party, wallet_did, wallet_publickey, document_ids, scopes

Administrator Activity

Note: Administrator activity events contain the AUDIT_LOG event category, distinguishing them from user events.

E_BROKER_DISCONNECTED — Broker disconnected

Fields captured: type, tenantid, communityid, client_id, auth_module_id, license_hash, software_version, ts, eventName, broker_id, broker_name, broker_version, broker_last_seen, reason, connected, event_id, timestamp, epoch_time, event_name, event_ts, user_id

E_ROLE_CHANGED — User role changed

Fields captured: type, version, server_ip, service_name, authorization, tenant_id, community_id, username, initiatedby, caller_user_agent, caller_ip, role_changed_from, role_changed_to, event_id, timestamp, epoch_time, eventName, event_name, event_ts, user_id

E_DIRECTORY_ADDED — Directory added

Covers: new AD directory (via AD Broker), LDAP directory (via LDAP Broker), Direct LDAP directory, and Azure AD directory.

Fields captured: timestamp, tenantid, communityid, username, connection_ip_address, connection_useragent, directory_id, directory_name, directory_type

E_DIRECTORY_MODIFIED — Directory settings modified

E_DIRECTORY_REMOVED — Directory deleted

Fields captured: timestamp, tenantid, communityid, username, connection_ip_address, connection_useragent, directory_id, directory_name

E_DIRECTORY_BROKER_ENABLED — Directory broker enabled

Fields captured: timestamp, tenantid, communityid, username, connection_ip_address, connection_useragent, directory_id, directory_name, broker_name, broker_client_id, last_seen_at

E_DIRECTORY_BROKER_DISABLED — Directory broker disabled

E_DIRECTORY_BROKER_DELETED — Directory broker deleted

E_DIRECTORY_BROKER_MODIFIED — Directory broker renamed

E_DIRECTORY_ATTRIBUTE_ADDED — Directory attribute added

Fields captured: timestamp, tenantid, communityid, username, connection_ip_address, connection_useragent, directory_id, directory_name, attribute_name, directory_attribute_name

E_DIRECTORY_ATTRIBUTE_MODIFIED — Directory attribute modified

E_DIRECTORY_ATTRIBUTE_DELETED — Directory attribute deleted

E_DIRECTORY_ADVANCED_CONFIGURATION_MODIFIED — Advanced directory configuration modified

Fields captured: timestamp, tenantid, communityid, username, connection_ip_address, connection_useragent, directory_id, directory_name, old_login_using_smartcard, new_login_using_smartcard, old_scep_service_url, new_scep_service_url, old_enrollment_challenge_url, new_enrollment_challenge_url, old_allow_password_reset, new_allow_password_reset, old_password_policy, new_password_policy, old_kerberos_sso, new_kerberos_sso

E_IDP_CONFIGURATION_MODIFIED — IdP configuration modified

Fields captured: tenantid, communityid, username, connection_ip_address, connection_useragent, old_idp_name, new_idp_name, old_authentication_request, new_authentication_request, old_key_size, new_key_size, old_algorithm, new_algorithm, old_service_url_signon_endpoint, new_service_url_signon_endpoint, old_service_url_logout_endpoint, new_service_url_logout_endpoint

Reporting Activity

E_REPORT_REQUESTED — Report requested by administrator

Fields captured: tenant_id, community_id, type, event_name, event_ts, user_id, eventData, number_of_records, event_id, filters_used, tenant_dns, timestamp, epoch_time, eventName

E_REPORT_GENERATED — Report generated and ready to download

Fields captured: tenant_id, community_id, type, event_name, event_ts, user_id, eventData, number_of_records, event_id, filter_used, tenant_DNS, timestamp, epoch_time, eventName

PreviousMonitoring & Reporting

NextSettings

Last updated 3 months ago

Was this helpful?