Event log filter values¶
The Event Type and Event filters in the Event Log accept a fixed set of values. This page lists every value each filter accepts, and what each event records.
Event names are scoped to an event type. The same event name can appear under more than one event type, and the two filters are evaluated together, so an event is identified by the combination of its event type and its event name. To look up an event when you only know its name, see Event index.
These are the same values that appear as eventType and eventName in the webhook event payload. For the payload structure, see Notifications overview.
Use the topic menu on the right side of this page to navigate to a specific event type.
Note
Criticality 0 marks an informational event and 1 marks an important event. Use the Criticality filter to narrow the log to one or the other.
ACME Account Creation ¶
| Event | Criticality | Description |
|---|---|---|
| ACME Account Created | 0 | Recorded when an ACME client registers an account against one of your ACME servers using its external account binding credentials. |
ACME Order Creation ¶
| Event | Criticality | Description |
|---|---|---|
| ACME Order Created | 0 | Recorded when an ACME client requests a certificate by submitting an order to one of your ACME servers. |
ACME Server Creation ¶
| Event | Criticality | Description |
|---|---|---|
| ACME Server Created | 0 | Recorded when an administrator creates an ACME server. The directory URL and external account binding credentials are issued at this point. |
ACME Server Deactivation ¶
| Event | Criticality | Description |
|---|---|---|
| ACME Server Deactivated | 0 | Recorded when an administrator deactivates an ACME server. Deactivation cannot be undone, and ACME clients using that server can no longer issue certificates. |
ACME Server Deletion ¶
| Event | Criticality | Description |
|---|---|---|
| ACME Server Deleted | 0 | Recorded when an administrator deletes an ACME server. A server must be deactivated before it can be deleted. |
ACME Server HMAC Key Regeneration ¶
| Event | Criticality | Description |
|---|---|---|
| ACME Server HMAC Key Regenerated | 0 | Recorded when an administrator regenerates the external account binding key for an ACME server. Clients still configured with the previous key cannot register new accounts, but accounts registered earlier continue to work. |
ACME Server Update ¶
| Event | Criticality | Description |
|---|---|---|
| ACME Server Updated | 0 | Recorded when an administrator changes an ACME server's name, application, issuing template, or certificate tags. External account binding credentials are unchanged. |
Applications ¶
| Event | Criticality | Description |
|---|---|---|
| Application Created | 0 | Recorded when an application is created, either from the console or through the API. |
| Application Deleted | 0 | Recorded when an application is deleted. Certificates assigned to it lose that grouping, and any filter or notification scope keyed on it stops matching. |
| Application Owners Changed | 0 | Recorded when a user accepts an invitation to an application and is added to its owners. The new owner is in scope for that application's certificate expiration notifications. |
| Application Updated | 0 | Recorded when an application's name, IP ranges, FQDNs, or owner list are changed. |
Authentication ¶
| Event | Criticality | Description |
|---|---|---|
| Login Failed | 0 | Recorded when a sign-in attempt is refused. Covers an incorrect password, a disabled account, an account with no role assigned, and an API key that is inactive or whose owner is disabled. The record includes the source IP address. |
| Login Succeeded | 0 | Recorded when a user signs in to the console, either with a local password or through your identity provider. |
| Logout | 0 | Recorded when a user signs out of the console. Sessions that expire on their own are not logged. |
| Service Account Access Token Denied | 1 | Recorded when Certificate Manager - SaaS refuses to issue an access token to a service account. Common causes are an expired or incorrectly signed assertion, a disabled or expired service account, and a requested scope the account does not hold. |
| Service Account Access Token Granted | 0 | Recorded when a service account obtains an access token. The record lists the scopes granted. |
Auto-Renewal ¶
| Event | Criticality | Description |
|---|---|---|
| Application Auto-Renewal Options Update Denied | 1 | Recorded when a user without permission tries to change an application's auto-renewal options. The options are left unchanged. |
| Auto-Renewal Completed | 0 | Recorded when an auto-renewal run finishes. The record includes how many applications were scanned and how many certificate renewals were triggered. |
| Auto-Renewal Status Read Denied | 1 | Recorded when a user without permission tries to view auto-renewal status. |
| Certificate Renewal Failed | 1 | Recorded when auto-renewal cannot submit a renewal request for a certificate. The record includes the certificate fingerprint, the issuing template used, and the error returned. The certificate is tried again on the next run. |
| Certificate Renewal Triggered | 0 | Recorded when auto-renewal submits a renewal request for a certificate that has entered its renewal window. |
| Certificate skipped | 1 | Recorded when auto-renewal excludes a certificate from a run. The reason is included, such as an existing pending request, an issuing template that does not support key generation, or an application with no eligible owner. |
| Configuration Update Denied | 1 | Recorded when a user without permission tries to change your tenant's auto-renewal configuration. The configuration is left unchanged. |
| Daily Scan | 0 | Recorded when the scheduled daily auto-renewal run starts for your tenant. |
| Manual Trigger Denied | 1 | Recorded when a user without permission tries to start an auto-renewal run. No run is started. |
| On-demand Scan | 0 | Recorded when a user starts an auto-renewal run manually instead of waiting for the daily run. |
Certificate Approval Rules ¶
| Event | Criticality | Description |
|---|---|---|
| Certificate Approval Rule Created | 0 | Recorded when an administrator creates an approval rule for certificate issuance or revocation. Requests that match the rule are held for sign-off. |
| Certificate Approval Rule Deleted | 0 | Recorded when an administrator deletes an approval rule. Requests already waiting for approval keep the approvers they were assigned. |
| Certificate Approval Rule Reordered | 0 | Recorded when an administrator changes an approval rule's priority. Rules are evaluated in priority order and the first rule that matches applies. |
| Certificate Approval Rule Triggered | 0 | Recorded when a request matches an approval rule and is held pending approval. The record names the rule that matched. |
| Certificate Approval Rule Updated | 0 | Recorded when an administrator changes an approval rule's approvers, conditions, or thresholds. Requests already waiting for approval are unaffected. |
Certificate Authorities ¶
| Event | Criticality | Description |
|---|---|---|
| Certificate Authority Created | 0 | Recorded when an administrator connects a certificate authority. The connection is tested and the authority's product options are imported. |
| Certificate Authority Deleted | 0 | Recorded when an administrator deletes a certificate authority connection. Issuing templates bound to it can no longer be used, and certificates issued through it stay in your inventory without a renewal path. |
| Certificate Authority Issuer Changed | 0 | Recorded when the built-in certificate authority's issuing key and certificate change, either by generating a new one or by uploading an externally signed certificate. Certificates issued afterwards chain to the new issuer. |
| Certificate Authority Updated | 0 | Recorded when an administrator changes a certificate authority connection, such as its credentials, its endpoint, or the VSatellite worker it uses. |
Certificate Deletion ¶
| Event | Criticality | Description |
|---|---|---|
| Machine Identity Deleted | 0 | Recorded when a certificate is deleted and a machine identity that used it is removed. One record is written for each machine identity removed. |
Certificate Issuance ¶
| Event | Criticality | Description |
|---|---|---|
| Certificate Issued | 0 | Recorded when the certificate authority returns a signed certificate. The certificate can now be downloaded and appears in your inventory. |
Certificate Issuance Approval Rules ¶
| Event | Criticality | Description |
|---|---|---|
| Certificate Approval Rule Created | 0 | Recorded when an administrator creates an approval rule for certificate issuance. Matching requests are held for sign-off before they reach the certificate authority. |
| Certificate Approval Rule Deleted | 0 | Recorded when an administrator deletes an issuance approval rule. Requests that would have matched it are no longer held for approval. |
| Certificate Approval Rule Reordered | 0 | Recorded when an administrator changes the priority of an issuance approval rule. |
| Certificate Approval Rule Updated | 0 | Recorded when an administrator changes an issuance approval rule's approvers, conditions, or thresholds. |
Certificate Renewal ¶
| Event | Criticality | Description |
|---|---|---|
| Machine Identity Updated | 0 | Recorded when a certificate is renewed and a machine identity is repointed to the new certificate. Installation follows unless the machine is on a batch provisioning schedule. |
Certificate Request Creation ¶
| Event | Criticality | Description |
|---|---|---|
| Certificate Request Created | 0 | Recorded when a certificate is requested, from the console, the API, or an ACME or SCEP client. The remaining issuance events for that certificate follow from this request. |
Certificate Retirement ¶
| Event | Criticality | Description |
|---|---|---|
| Machine Identity Deleted | 0 | Recorded when a certificate is retired and a machine identity that used it is removed. The certificate stays in your inventory marked as retired. |
Certificate Revocation Approval Rules ¶
| Event | Criticality | Description |
|---|---|---|
| Certificate Approval Rule Created | 0 | Recorded when an administrator creates an approval rule for certificate revocation. Matching revocation requests are held for sign-off. |
| Certificate Approval Rule Deleted | 0 | Recorded when an administrator deletes a revocation approval rule. Requests that would have matched it go to the certificate authority without approval. |
| Certificate Approval Rule Reordered | 0 | Recorded when an administrator changes the priority of a revocation approval rule. |
| Certificate Approval Rule Updated | 0 | Recorded when an administrator changes a revocation approval rule's approvers, conditions, or thresholds. |
Certificate Workflow Approvals ¶
| Event | Criticality | Description |
|---|---|---|
| Certificate Request Approved | 0 | Recorded when an approver approves a certificate request. Issuance continues once the rule's required number of approvers and its final approver have approved. |
| Certificate Request Automatically Approved | 0 | Recorded when a renewal is approved without human sign-off because the matching approval rule allows automatic approval on renewal. |
| Certificate Request Automatically Rejected | 0 | Recorded when a certificate request is rejected because no approver acted within the rule's time limit. The record includes how many hours elapsed. |
| Certificate Request Rejected | 0 | Recorded when an approver rejects a certificate request. The request is never sent to the certificate authority. |
| Certificate Request Resubmitted | 0 | Recorded when a previously approved certificate request that failed at the certificate authority is submitted again. It does not go back through approval. |
Certificates ¶
| Event | Criticality | Description |
|---|---|---|
| Assigned Certificates Changed | 0 | Recorded when the set of certificates assigned to an application is changed. Expiration notifications, outage risk, and reporting for that application immediately reflect the new set. |
| CSR Generated | 0 | Recorded when a certificate signing request is generated for a request whose key material the platform was asked to create. The record includes the key type and size. |
| Certificate Approval Bulk Operation | 0 | Recorded when an approver approves or rejects a batch of certificate requests or pending revocations in one action. A separate record follows for each item in the batch. |
| Certificate Approval Rule Triggered | 0 | Recorded when a certificate request or a revocation request matches an approval rule and is held pending approval. The record names the rule that matched. |
| Certificate Assignment Cleared | 0 | Recorded when certificates are released from a tenant service group. One record is written for each certificate released, and any group in the organization can claim them again. |
| Certificate Assignment Updated | 0 | Recorded when certificates are assigned to a tenant service group. One record is written for each certificate assigned, and those certificates are then visible only within that group's scope. |
| Certificate Blocklisted | 0 | Recorded when an administrator adds a certificate fingerprint to the blocklist. Imports and discovery results carrying that fingerprint are refused unless the caller explicitly overrides the blocklist. |
| Certificate Created | 0 | Recorded when a certificate the platform did not issue is added to your inventory, by upload, by import, or through discovery. The certificate is indexed and starts being monitored for expiration. |
| Certificate Deleted | 0 | Recorded when a certificate is permanently deleted rather than retired. It is removed from your inventory, dashboards, and search results, along with its TLS endpoints. |
| Certificate Downloaded | 0 | Recorded when a certificate or its chain is downloaded, from the console or through the API. The record includes the fingerprint and the caller's IP address. |
| Certificate Issued | 0 | Recorded when the certificate authority returns a signed certificate for a submitted request. The certificate enters your inventory and can be downloaded. |
| Certificate Keystore Downloaded | 0 | Recorded when a certificate is downloaded packaged with its private key, such as in PKCS#12 or JKS format. The record includes the fingerprint and the caller's IP address. |
| Certificate Not Issued | 1 | Recorded when a certificate request ends without a certificate, either because the certificate authority rejected it or because it was not fulfilled before the issuance timeout. The error returned is included. |
| Certificate Not Reissued | 1 | Recorded when a reissue request to the certificate authority fails. The record includes the certificate, the issuing template, and the error returned. The existing certificate stays in place. |
| Certificate Not Renewed | 1 | Recorded when a renewal request to the certificate authority fails. A request for a new certificate is attempted instead, so a Certificate Issued record can still follow. |
| Certificate Recovered | 0 | Recorded when a retired certificate is returned to the active inventory. It resumes expiration monitoring and outage risk scoring. |
| Certificate Request Created | 0 | Recorded when a certificate request is created and validated against its issuing template. The record includes the request identifier and the template used. |
| Certificate Request Submitted to CA | 0 | Recorded when a certificate signing request is handed to the certificate authority. The request then waits until Certificate Issued or Certificate Not Issued is recorded. |
| Certificate Requested | 0 | Recorded when the certificate authority acknowledges a request. The record names the certificate, the issuing template, and whether the request was an issuance, a renewal, a reissue, or a resubmission. |
| Certificate Retired | 0 | Recorded when a certificate is retired. It drops out of the active inventory and stops raising expiration notifications and outage risk, but it can be recovered. |
| Certificate Revocation Approved | 0 | Recorded when an approver approves a pending revocation. The revocation is then sent to the certificate authority on the requester's behalf. |
| Certificate Revocation Automatically Rejected | 0 | Recorded when a pending revocation is rejected because no approver acted within the rule's time limit. The certificate stays valid and a new revocation request is needed. |
| Certificate Revocation Rejected | 0 | Recorded when an approver rejects a pending revocation. A reason is required and is included in the record. The certificate is not revoked. |
| Certificate Revocation Request Failed | 0 | Recorded when the certificate authority does not accept a revocation. Common causes are expired credentials, a certificate authority that cannot revoke that certificate, and a connector error. The certificate is still valid and still trusted. |
| Certificate Revocation Request Submitted | 0 | Recorded when the certificate authority accepts a revocation. The record includes the fingerprint, the reason chosen, and the certificate authority account used. The certificate is marked revoked in your inventory. |
| Certificate Unblocklisted | 0 | Recorded when an administrator removes a fingerprint from the blocklist. That certificate can enter your inventory again on the next import or discovery run. |
| Certificate Validation Finished | 0 | Recorded when validating a TLS endpoint finds a problem, such as a hostname that does not resolve, an unreachable target, or an unexpected or outdated certificate being served. Successful validations are not logged. |
| Certificate Validation Started | 0 | Recorded when validation is requested for one or more certificates. Every TLS endpoint associated with them is checked, and the results arrive separately. |
| Certificates Imports | 0 | Recorded when a bulk import of certificates, and optionally their private keys, starts. Certificates that cannot be imported are logged separately as Failed Import Certificates. |
| Failed Import Certificates | 1 | Recorded when one certificate in an import cannot be accepted, such as unreadable content, a private key that does not match, an incorrect passphrase, a blocklisted fingerprint, or a duplicate. That entry is skipped and the rest of the import continues. |
| KeyPair Generated | 0 | Recorded when the platform generates a private key for a certificate request instead of the requester supplying a signing request. The record includes the key type and size and where the key is stored. |
Cloud Authentication Configurations ¶
| Event | Criticality | Description |
|---|---|---|
| Cloud Authentication Configuration Created | 0 | Recorded when a key pair is created for authenticating to a cloud provider with workload identity federation. This happens while a Google Cloud provider is being added or switched to that authorization method. |
| Cloud Authentication Configuration Rotated | 0 | Recorded when a cloud authentication configuration's key pair is replaced on its scheduled rotation cycle. The published URL does not change, so the trust you configured in your cloud provider keeps working and no action is needed. |
| Cloud Authentication Configuration Updated | 0 | Recorded when a new key pair is stored for a cloud authentication configuration. This is a step in a rotation, and Cloud Authentication Configuration Rotated follows. |
Cloud Keystores ¶
| Event | Criticality | Description |
|---|---|---|
| Cloud Discovery Aborted | 0 | Recorded when a user stops a discovery run that is in progress. The run winds down and finishes with an aborted status. |
| Cloud Discovery Completed | 0 | Recorded when a discovery run finishes. The record includes the final status and a summary of how many certificates were found, added, updated, and no longer present. |
| Cloud Discovery Did Not Abort | 1 | Recorded when a request to stop a discovery run cannot be carried out, such as when the keystore fails validation or no discovery is configured on it. The run continues. |
| Cloud Discovery Did Not Start | 1 | Recorded when a discovery run cannot be started. The record includes the reason, such as a keystore or cloud provider that fails validation. No run takes place. |
| Cloud Discovery Did Not Update | 1 | Recorded when a discovery run cannot write its own progress back. The reported counts may lag, and the run can end with a failed status. |
| Cloud Discovery Started | 0 | Recorded when a discovery run is under way, after the keystore has been validated and the run has been accepted. Progress appears in the console from this point. |
| Cloud Discovery Starting | 0 | Recorded when a request to run discovery on a keystore is received, before any validation. Either Cloud Discovery Did Not Start or Cloud Discovery Started follows. |
| Cloud Keystore Auto-Provisioning | 0 | Recorded when a certificate that was renewed or replaced automatically is installed in a cloud keystore without anyone requesting it. The keystore now serves the new certificate. |
| Cloud Keystore Auto-Provisioning Failed | 0 | Recorded when an automatic installation of a renewed or replaced certificate into a cloud keystore fails. The machine identity is marked as failed, and the keystore keeps serving the old certificate until the next attempt. |
| Cloud Keystore Certificate Import | 0 | Recorded when a batch of certificates found in a cloud keystore is imported. The record includes how many were added and how many existing ones were updated. |
| Cloud Keystore Certificate Import Failed | 1 | Recorded when a batch of certificates cannot be imported from a cloud keystore. The reason is included, and the discovery run ends with a failed status, so the keystore's inventory is incomplete. |
| Cloud Keystore Certificate Listing Denied | 1 | Recorded when a request to list a cloud keystore's certificates is refused because the caller is not in the keystore's owning team, authorized teams, or authorized service accounts. Nothing is read from the cloud provider. |
| Cloud Keystore Certificates Downloaded | 0 | Recorded when the certificates that discovery identified as new are retrieved from the cloud provider. The record includes how many were retrieved. |
| Cloud Keystore Certificates Listed | 0 | Recorded when a page of certificates is listed from a cloud keystore during discovery. Expired and disabled certificates are skipped unless the discovery configuration includes them. |
| Cloud Keystore Certificates Partially Downloaded | 0 | Recorded when only some of the certificates requested from the cloud provider are retrieved. The run continues with what it has, and the rest are tried again on the next run. |
| Cloud Keystore Created | 0 | Recorded when a cloud keystore is created under a cloud provider. The keystore can then be used as a target for provisioning and discovery. |
| Cloud Keystore Delete Denied | 1 | Recorded when a request to delete a cloud keystore is refused because the caller does not have permission on the keystore's owning team. Nothing is deleted, including from the rest of the selection. |
| Cloud Keystore Deleted | 0 | Recorded when a cloud keystore is deleted. Its discovery schedule is removed with it. Certificates already installed in the cloud provider are left in place. |
| Cloud Keystore Discovery Denied | 1 | Recorded when a request to start or stop discovery is refused because the caller is not in the keystore's owning team, authorized teams, or authorized service accounts. |
| Cloud Keystore Discovery Schedule Created | 0 | Recorded when a recurring discovery schedule is added to a cloud keystore. Discovery then runs unattended at each occurrence. |
| Cloud Keystore Discovery Schedule Creation Failed | 0 | Recorded when a discovery schedule cannot be created, such as when the schedule specification is not valid. The whole keystore create or update is rolled back. |
| Cloud Keystore Discovery Schedule Deleted | 0 | Recorded when a cloud keystore's discovery schedule is removed, either because recurring discovery was turned off or because the keystore was deleted. Unattended runs stop. |
| Cloud Keystore Discovery Schedule Update Failed | 0 | Recorded when a change to a cloud keystore's discovery schedule cannot be applied. The keystore keeps its previous schedule and settings. |
| Cloud Keystore Discovery Schedule Updated | 0 | Recorded when a cloud keystore's discovery schedule is changed. Later unattended runs use the new cadence. |
| Cloud Keystore Duplicated | 1 | Recorded when a cloud keystore cannot be created because one with the same name or the same configuration already exists. Nothing is saved. |
| Cloud Keystore Provisioning | 0 | Recorded when a certificate and its private key are installed in a cloud keystore in response to a request. The record includes the certificate and the target keystore. |
| Cloud Keystore Provisioning Denied | 1 | Recorded when a request to install a certificate in a cloud keystore is refused because the caller is not in the keystore's owning team, authorized teams, or authorized service accounts. Nothing is sent to the cloud provider. |
| Cloud Keystore Provisioning Failed | 0 | Recorded when installing a certificate in a cloud keystore fails. Common causes are credentials the cloud provider rejects, certificate or key material it will not accept, and no VSatellite being available for a keystore on a private network. |
| Cloud Keystore Update Denied | 1 | Recorded when a change to a cloud keystore is refused because the caller is not in a team authorized on the keystore's cloud provider. The keystore keeps its previous configuration. |
| Cloud Keystore Updated | 0 | Recorded when a cloud keystore's settings are changed, such as its name, authorized teams, service account access, or discovery schedule. The new settings apply to the next provisioning or discovery. |
| User Permissions | 1 | Recorded when a cloud keystore operation is refused because the caller does not hold the required cloud keystore permission. The operation stops before anything else happens, so none of its other events appear. |
Cloud Providers ¶
| Event | Criticality | Description |
|---|---|---|
| Cloud Provider Create Denied | 1 | Recorded when a request to create a cloud provider is refused because the caller does not hold the required role, team membership, or scope. Nothing is stored. |
| Cloud Provider Created | 0 | Recorded when a cloud provider connection is created. It starts out unvalidated, so test the connection before creating cloud keystores against it. |
| Cloud Provider Delete Denied | 1 | Recorded when a request to delete a cloud provider is refused because the caller does not have permission on its owning team. Nothing is deleted, including from the rest of the selection. |
| Cloud Provider Delete Failed | 1 | Recorded when a cloud provider cannot be deleted because at least one cloud keystore still points at it. Delete or repoint those keystores first. |
| Cloud Provider Deleted | 0 | Recorded when a cloud provider connection is deleted. No further discovery, provisioning, or machine identity updates happen for that cloud account. |
| Cloud Provider Details Denied | 1 | Recorded when a request to view a cloud provider's details is refused because the caller is outside its owning team and authorized teams. Nothing is read from the cloud provider. |
| Cloud Provider Duplicated | 1 | Recorded when a cloud provider cannot be created because an existing one already points at the same cloud account, subscription, or project. The record names the existing provider. |
| Cloud Provider Secrets Rotated | 0 | Recorded when a cloud provider's credentials are rotated. Keystores and provisioning under that provider continue with the new credentials. |
| Cloud Provider Update Denied | 1 | Recorded when a change to a cloud provider is refused because the caller lacks permission on the provider, on its current owning team, or on the team they are moving it to. No fields are changed. |
| Cloud Provider Updated | 0 | Recorded when a cloud provider is changed, such as its credentials, name, owning team, or authorized teams. Keystores under it use the new settings immediately, so test the connection afterwards. |
| Cloud Provider Validation | 1 | Recorded when a cloud provider connection is tested. The provider's status is set to validated or not validated, and the failure detail is included when the test does not succeed. |
| Cloud Provider Validation Denied | 1 | Recorded when a request to test a cloud provider connection is refused because the caller is not in its owning team. Nothing is sent to the cloud provider and its status is unchanged. |
| Team Permissions | 1 | Recorded when a cloud provider operation is refused because the caller is not a member of the team that owns it. The record names the owning team, and the matching Denied record for the operation is written as well. |
| User Permissions | 1 | Recorded when a cloud provider operation is refused because the caller does not hold the required role, permission, or scope. The request stops before it reaches a provider record. |
CodeSign ¶
| Event | Criticality | Description |
|---|---|---|
| Certificate Assigned | 0 | Recorded when a code signing certificate is issued and bound to a signing key. Authorized signers and build pipelines using that key sign with this certificate. |
| Certificate Request Failure | 1 | Recorded when a code signing certificate cannot be obtained for a signing key. The error is included, no certificate is bound, and the key cannot produce trusted signatures until the certificate authority settings are corrected. |
| Configuration Update | 0 | Recorded when a tenant-wide code signing setting is changed. The record includes the previous and new values, and the change applies to every project and signing key in the tenant. |
| Environment Created | 0 | Recorded when a signing key is created. Environment is the earlier name for a signing key, and this is the earlier name for Signing Key Created. |
| Environment Updated | 0 | Recorded when a signing key is changed. Environment is the earlier name for a signing key, and this is the earlier name for Signing Key Updated. |
| Environment(s) Deleted | 1 | Recorded when signing keys are deleted. Environment is the earlier name for a signing key, and this is the earlier name for Signing Key(s) Deleted. |
| Environment(s) Status Change | 1 | Recorded when signing keys are enabled or disabled. Environment is the earlier name for a signing key, and this is the earlier name for Signing Key(s) Status Change. |
| Key Pair Deleted | 1 | Recorded when private key material is destroyed, either because a signing key was deleted or because a superseded key pair was removed after a rotation. Signatures made with that key can still be verified but cannot be reproduced. |
| Key Pair Generation Failure | 1 | Recorded when a key pair cannot be generated for a signing key. The error is included, and signers and pipelines using that key are refused until the key store settings are corrected. |
| New Key Pair Created | 0 | Recorded when a signing key gets usable private key material, either for the first time or on a rotation. The new pair becomes the active one, and the previous pair is kept as historic until it is removed. |
| Project Created | 0 | Recorded when a code signing project is created. The project holds signing keys and carries the owner, auditor, and key user assignments they inherit. |
| Project Updated | 0 | Recorded when a code signing project is changed, including its owners, auditors, and key users. Those role lists are inherited by every signing key in the project. |
| Project(s) Deleted | 0 | Recorded when code signing projects are deleted. Their role assignments go with them, and pipelines configured against signing keys in those projects lose access. |
| Signing Failed | 0 | Recorded when a signing operation does not produce a signature. The record includes the client version, the application and command line reported by the client, the source IP address, and the error. |
| Signing Key Created | 0 | Recorded when a signing key is created in a project. If the cryptographic objects were requested at the same time, New Key Pair Created and Certificate Assigned follow. |
| Signing Key Updated | 0 | Recorded when a signing key is changed, including its name, IP restrictions, renewal values, and its owners, auditors, and authorized signers. This is the trail for changes to who can sign with the key. |
| Signing Key(s) Deleted | 1 | Recorded when signing keys are deleted. Every key pair they hold, active and historic, is destroyed first, and the delete is refused if any private key cannot be removed. Signers and pipelines using the key are cut off immediately. |
| Signing Key(s) Status Change | 1 | Recorded when signing keys are enabled or disabled. A disabled key stops serving signing requests immediately, so builds that depend on it start failing at this point. |
| Signing Succeeded | 0 | Recorded when a signing key produces a signature. The record includes the client version, the application and command line reported by the client, and the source IP address. |
Credential management ¶
| Event | Criticality | Description |
|---|---|---|
| Configuration Created | 0 | Recorded when a connection to an external credential provider is created. Test the connection before creating credentials under it. |
| Configuration Deleted | 0 | Recorded when a connection to an external credential provider is deleted. Credentials created under it lose their route to the provider, so retrieving them fails. |
| Configuration Read Denied | 1 | Recorded when a request to view credential provider configurations is refused because the caller does not hold the required administrator role. No connection details are returned. |
| Configuration Updated | 0 | Recorded when a connection to an external credential provider is changed, such as its authentication details, the VSatellites that reach it, or who it is shared with. The next retrieval uses the new settings. |
| Credential Assigned | 0 | Recorded when a stored credential is attached to a machine or connector. The credential counts as in use, so it cannot be deleted until it is detached. |
| Credential Assignment Failed | 1 | Recorded when a stored credential cannot be attached to a machine or connector. The machine exists but has no credential, so select the credential again. |
| Credential Create Denied | 1 | Recorded when a request to create a credential is refused because the caller does not hold the required administrator role. No credential is created. |
| Credential Created | 0 | Recorded when a credential is created under a credential provider configuration. It then appears in the credential list when a machine or connector connection is configured. |
| Credential Delete Denied | 1 | Recorded when a credential cannot be deleted, either because the caller does not have permission or because the credential is still attached to at least one machine or connector. Detach it everywhere before deleting it. |
| Credential Deleted | 0 | Recorded when a credential is deleted. Anything that reached the stored secret through it must be pointed at another credential. |
| Credential Read Denied | 1 | Recorded when a request to view credentials is refused because the caller does not hold the required administrator role. Nothing about the credential or where it is stored is returned. |
| Credential Unassigned | 0 | Recorded when a stored credential is detached from a machine or connector, either by replacing it or by deleting the machine. The credential can be deleted once nothing else uses it. |
| Credential Unassignment Failed | 1 | Recorded when a stored credential cannot be detached from a machine or connector. The credential can stay marked as in use, which blocks a later attempt to delete it. |
| Credential Updated | 0 | Recorded when a credential is changed, such as its name, its secret, the entry it points at, or the teams that own it. Machines assigned the credential pick up the new value the next time it is retrieved. |
| RetrieveCredential failed | 1 | Recorded when a stored secret cannot be fetched from the external credential provider. Common causes are a missing provider configuration, a configuration with no VSatellites, and every VSatellite attempt failing. The operation that needed the credential does not complete. |
Custom Notification ¶
| Event | Criticality | Description |
|---|---|---|
| Custom Notification Created | 0 | Recorded when a custom notification is created. Events matching its conditions are sent to the provider and recipients it names. |
| Custom Notification Deleted | 0 | Recorded when custom notifications are deleted. Events that matched them no longer produce a notification. |
| Custom Notification Template Created | 0 | Recorded when a notification template is created. The template can be attached to one or more custom notifications and is rendered against the event when a notification is sent. |
| Custom Notification Template Deleted | 0 | Recorded when a notification template is deleted. Custom notifications that used it fall back to the default message for later deliveries. |
| Custom Notification Updated | 0 | Recorded when a custom notification's conditions, provider, template, or recipients are changed. The new conditions apply to events arriving after the change. |
| Notification Branding Updated | 0 | Recorded when the branding applied to outbound email is changed, such as the logo, header and footer text, or call to action. Nothing is recorded if the change leaves the branding unaltered. |
Discover service configuration ¶
| Event | Criticality | Description |
|---|---|---|
| Service Configuration | 0 | Recorded when the scan targets of a discovery integration service are saved. The record includes how many targets and ports were stored, and the assigned VSatellite picks that list up on its next scan. |
Discovery ¶
| Event | Criticality | Description |
|---|---|---|
| Company Domain Added | 0 | Recorded when a domain is added to the list of external search domains. Later external and internet discovery scans include that domain when looking for certificates issued for your organization outside your network. |
| Integration Service Created | 0 | Recorded when an integration service is created, including its service type, its work types, and the VSatellites that run it. A Service Configuration record follows when its scan targets are saved. |
| Integration Service Deleted | 0 | Recorded when an integration service is deleted. Its schedule stops, its scan targets are removed, and the record shows whether the certificates it found were retired. |
| Integration Service Scan Requested | 0 | Recorded when a user starts an integration service scan instead of waiting for its schedule. The scan runs against the targets currently saved for that service. |
| Integration Service Updated | 0 | Recorded when an integration service is changed, including its name, work types, VSatellites, and scan schedule. The record includes both the previous and the new schedule settings. |
| Machine Discovery Abort Requested | 0 | Recorded when a user asks to stop a discovery run on a machine. The run stops at its next checkpoint, which is recorded as Machine Discovery Aborted. |
| Machine Discovery Aborted | 0 | Recorded when a discovery run on a machine stops before finishing, either because it was asked to or because the run could not continue. What it found so far stays in your inventory, so treat the machine's installation list as out of date. |
| Machine Discovery Certificate Error | 0 | Recorded when one certificate found on a machine cannot be read, parsed, or stored. The run continues with the rest, so a single run can produce several of these. |
| Machine Discovery Completed | 0 | Recorded when a discovery run on a machine finishes. The machine's installation inventory is accurate as of this time. |
| Machine Discovery Failed | 0 | Recorded when a discovery run on a machine ends without a usable inventory. Common causes are an unreachable VSatellite, credentials the machine rejects, and a connector error. |
| Machine Discovery Initiated | 0 | Recorded when a user starts discovery on a machine. Machine Discovery Started follows once the run is picked up. |
| Machine Discovery Installation Error | 0 | Recorded when one certificate installation found on a machine cannot be processed. The run continues, but that installation is missing from the machine's inventory. |
| Machine Discovery Schedule Created | 0 | Recorded when recurring discovery is turned on for a machine. Runs it produces are logged as scheduled discovery, with no user attached. |
| Machine Discovery Schedule Deleted | 0 | Recorded when recurring discovery stops being registered for a machine, either because the schedule was removed or because the machine was deleted. The machine is then scanned only when someone starts discovery. |
| Machine Discovery Schedule Updated | 0 | Recorded when the cadence of a machine's discovery schedule is changed. Check this record when the interval between scheduled runs changes. |
| Machine Discovery Started | 0 | Recorded when a discovery run on a machine is picked up, before the VSatellite is contacted. Machine identity records and any per-item errors follow until the run finishes. |
| Machine Identity Created | 0 | Recorded when discovery finds a certificate installed on a machine that had no installation record, and creates one. No user is attached, because this reports what the scan found. |
| Machine Identity Deleted | 0 | Recorded when discovery removes an installation because the certificate is no longer on the machine. Several of these after a scheduled run usually mean the target was decommissioned or reconfigured. |
| Machine Identity Updated | 0 | Recorded when discovery finds that a known installation has changed, such as a different certificate being served, or marks it as missing when this run did not find it. This is the highest-volume discovery event on a busy machine. |
Distributed Issuer Configuration ¶
| Event | Criticality | Description |
|---|---|---|
| Configuration Created | 0 | Recorded when a distributed issuer configuration is created, binding a policy to a sub CA provider. The issuer running in your cluster authenticates with the service account attached to it. |
| Configuration Deleted | 0 | Recorded when a distributed issuer configuration is deleted. The issuer in your cluster can no longer obtain or renew a sub CA certificate, so it stops issuing when its current one expires. |
| Configuration Updated | 0 | Recorded when a distributed issuer configuration is changed, such as its policy, its sub CA provider, or its sharing settings. The issuer picks the change up the next time it reads its configuration. |
Distributed Issuer Policy ¶
| Event | Criticality | Description |
|---|---|---|
| Policy Created | 0 | Recorded when a distributed issuer policy is created. The policy sets the validity period, subject fields, allowed subject alternative names, key usages, and key algorithms an in-cluster issuer can use. It takes effect once a configuration references it. |
| Policy Deleted | 0 | Recorded when a distributed issuer policy is deleted. A policy can only be deleted once no configuration references it, so no cluster is affected. |
| Policy Updated | 0 | Recorded when a distributed issuer policy is changed. Every configuration referencing the policy inherits the change, so the next certificates issued in your clusters use the new constraints. |
Distributed Issuer Sub CA Certificate ¶
| Event | Criticality | Description |
|---|---|---|
| Sub CA Certificate Deleted | 0 | Recorded when a sub CA certificate is deleted. Sub CA certificates cannot be changed after they are signed, so deleting one is the only change that can be made to it. |
| Sub CA Certificate Issued | 0 | Recorded when the certificate authority returns a signed sub CA certificate. The chain is handed to the issuer in your cluster, which then issues workload certificates locally under the bound policy. |
| Sub CA Certificate Not Issued | 1 | Recorded when a sub CA certificate request ends without a certificate, and includes the error from the certificate authority. The issuer in your cluster cannot issue workload certificates until the sub CA provider is corrected and the request is retried. |
| Sub CA Certificate Requested | 0 | Recorded when an issuer in your cluster requests a sub CA certificate, either at startup or as its current one nears expiration. Sub CA Certificate Issued or Sub CA Certificate Not Issued follows. |
Distributed Issuer Sub CA Provider ¶
| Event | Criticality | Description |
|---|---|---|
| Sub CA Provider Created | 0 | Recorded when a sub CA provider is created, naming the certificate authority account, product, and validity period used to sign sub CA certificates. A distributed issuer configuration then references it. |
| Sub CA Provider Deleted | 0 | Recorded when a sub CA provider is deleted. Configurations that pointed at it can no longer resolve a provider, so the next sub CA request from those clusters fails before it reaches a certificate authority. |
| Sub CA Provider Updated | 0 | Recorded when a sub CA provider is changed, such as its certificate authority account, product, or validity period. Sub CA certificates already issued are unaffected, and the new settings apply to the next request. |
Expiration Notifications ¶
| Event | Criticality | Description |
|---|---|---|
| Certificate Notification Failure | 1 | Recorded when an expiration notification for a certificate cannot be sent. Nobody is warned about that certificate on this pass. |
| Certificate Notification Sent | 0 | Recorded when an expiration notification for a certificate is sent. The record includes the certificate name, fingerprint, and the recipients. |
| Configuration Read Denied | 1 | Recorded when a request to view the expiration notification settings is refused. The caller does not see the thresholds or the recipients. |
| Notification Configuration Updated | 0 | Recorded when the expiration notification settings are changed, such as whether notifications are on and who receives them. The new recipients apply from the next monitoring run. |
Expiration Reports ¶
| Event | Criticality | Description |
|---|---|---|
| Certificates Report Completed | 0 | Recorded when a certificate expiration report is generated and sent. The record includes the recipients. |
| Certificates Report Failed | 1 | Recorded when a certificate expiration report cannot be generated or sent. The recipients get no report for that period. |
| Configuration Read Denied | 1 | Recorded when a request to view the expiration report settings is refused. No settings are shown and no report is started. |
| Expiration Reports | 0 | Recorded when the expiration report settings are changed, such as the schedule, the recipients, or whether reports are on. The next report follows the new settings. |
| On-demand Scan | 0 | Recorded when a user runs the expiration report immediately instead of waiting for its schedule. Certificates Report Completed or Certificates Report Failed follows. |
External Email ¶
| Event | Criticality | Description |
|---|---|---|
| External Email Recipient Created | 0 | Recorded when an external email recipient is added, so that notifications can reach an address with no account in your tenant. The address is committed only after the welcome email to it succeeds. |
| External Email Recipient Disabled | 0 | Recorded when an external email recipient is turned off. The address stays configured and attached to notifications, but is skipped when they are sent. |
| External Email Recipient Enabled | 0 | Recorded when an external email recipient is turned back on. Notifications that include the address deliver to it again. |
| External Email Recipient Query Denied | 1 | Recorded when a request to view external email recipients is refused because the caller does not hold the required administrator role. No recipient data is returned. |
| External Email Recipients Deleted | 0 | Recorded when external email recipients are deleted. The record includes how many were removed, and they drop out of every notification that used them. |
Inventory Monitoring Configuration ¶
| Event | Criticality | Description |
|---|---|---|
| Certificate Expiration Inventory Monitoring Configuration Changed | 0 | Recorded when the certificate expiration monitoring settings are changed without turning monitoring on or off. The record includes the day thresholds, the applications in scope, and whether unassigned certificates are included. |
| Certificate Expiration Inventory Monitoring Configuration Disabled | 0 | Recorded when certificate expiration monitoring is turned off. No expiration notifications are generated until it is turned back on. |
| Certificate Expiration Inventory Monitoring Configuration Enabled | 0 | Recorded when certificate expiration monitoring is turned on. Expiration notifications start from the next daily run. |
Issuing Templates ¶
| Event | Criticality | Description |
|---|---|---|
| Issuing Template Created | 0 | Recorded when an issuing template is created. The template names the certificate authority account and product to use and sets what may be requested, such as subject and subject alternative name rules, key types, and validity period. |
| Issuing Template Deleted | 0 | Recorded when an issuing template is deleted. Applications lose that issuance option, and requests and automation still naming it start failing. |
| Issuing Template Domains Updated | 0 | Recorded when an issuing template's allowed domains are synchronized from its certificate authority account. The template's permitted common names and DNS subject alternative names are replaced with the validated ones, and one record is written for each template updated. |
| Issuing Template Resource Consumers Added | 0 | Recorded when users or teams are given access to an issuing template. The record names who gained access, and they can then select the template when requesting certificates. |
| Issuing Template Resource Consumers Removed | 0 | Recorded when users or teams lose access to an issuing template. The record names who lost access. Certificates already issued through the template are unaffected. |
| Issuing Template Updated | 0 | Recorded when an issuing template's rules are changed, such as its validity period, allowed domains, key types, or the certificate authority product it uses. Requests naming the template are checked against the new rules from this point. |
Kubernetes Clusters ¶
| Event | Criticality | Description |
|---|---|---|
| Kubernetes Cluster Automatically Created | 0 | Recorded when an agent checks in with a service account that has no cluster registered against it, and the cluster is created from that check-in. The cluster appears in discovery and later uploads go to it. |
| Kubernetes Cluster Created | 0 | Recorded when a cluster is registered by hand and paired with the service account its agent authenticates as. Uploads from that agent go to this cluster instead of creating one. |
| Kubernetes Cluster Deleted | 0 | Recorded when a cluster is deleted. Its certificate and discovery data leave the Kubernetes inventory, and an agent still pointed at it fails its uploads. |
| Kubernetes Cluster Updated | 0 | Recorded when a cluster's name, description, or service account is changed. |
Machine Identities ¶
| Event | Criticality | Description |
|---|---|---|
| Machine Identity Delete Denied | 1 | Recorded when a request to delete machine identities in a cloud keystore is refused because the caller is not in the keystore's owning team, authorized teams, or authorized service accounts. Nothing in the selection is deleted. |
| Machine Identity Deleted | 0 | Recorded when a machine identity is removed from a cloud keystore. The record names the fingerprint and the keystore, and the certificate's list of cloud installations is updated. |
| Stale Machine Identities Found | 0 | Recorded when cloud keystore discovery finds machine identities with nothing matching them in the cloud, because they were removed outside the platform. Machine Identity Deleted records follow for each one. |
| User Permissions | 1 | Recorded when a machine identity operation is refused because the caller does not hold the required permission, or because a service account is not authorized on the keystore. Nothing is returned or changed. |
Notification Provider ¶
| Event | Criticality | Description |
|---|---|---|
| External Email Recipient Created | 0 | Recorded when an external email recipient is added, so that notifications can reach an address with no account in your tenant. The address is committed only after the welcome email to it succeeds. |
| External Email Recipient Disabled | 0 | Recorded when an external email recipient is turned off. The address stays configured and attached to notifications, but is skipped when they are sent. |
| External Email Recipient Enabled | 0 | Recorded when an external email recipient is turned back on. Notifications that include the address deliver to it again. |
| External Email Recipient Query Denied | 1 | Recorded when a request to view external email recipients is refused because the caller does not hold the required administrator role. No recipient data is returned. |
| External Email Recipient Updated | 0 | Recorded when an external email recipient's display name is changed. The address itself cannot be changed, so delivery is unaffected. |
| External Email Recipients Deleted | 0 | Recorded when external email recipients are deleted. The record includes how many were removed, and they drop out of every notification provider and notification that used them. |
| Notification Provider Created | 0 | Recorded when a notification provider is created. A webhook provider is saved only if a test call to its URL succeeds. The provider can then be selected on custom notifications. |
| Notification Provider Deleted | 0 | Recorded when notification providers are deleted. Custom notifications still pointing at one stop delivering. |
| Notification Provider Updated | 0 | Recorded when a notification provider's settings are changed, such as its credentials, URL, name, or whether it is enabled. Later deliveries use the new settings. |
| PagerDuty Notification Provider Created | 0 | Recorded when a PagerDuty notification provider is created. Matching events then arrive in PagerDuty as incidents. |
| PagerDuty Notification Provider Updated | 0 | Recorded when a PagerDuty notification provider's settings are changed, such as its routing key or its name. Incidents from later events go to the new destination. |
| Zoom Team Chat Notification Provider Create Denied | 1 | Recorded when a request to create a Zoom Team Chat notification provider is refused because the caller does not hold the required administrator role. No provider is created. |
| Zoom Team Chat Notification Provider Created | 0 | Recorded when a Zoom Team Chat notification provider is created. Messages for matching events are posted to the channel it names. |
| Zoom Team Chat Notification Provider Updated | 0 | Recorded when a Zoom Team Chat notification provider's settings are changed, such as its channel, credentials, or name. Later messages use the new settings. |
Notifications ¶
| Event | Criticality | Description |
|---|---|---|
| Certificate Expiration Notifications Job Manually Started | 0 | Recorded when a user runs the expiration monitoring pass immediately instead of waiting for the daily run. The request is refused if a run is already in progress. |
| Certificate Expiration Notifications Sent | 0 | Recorded when an expiration monitoring pass finishes for your tenant. It marks the end of the sweep, not a single message. |
| Notification sent | 0 | Recorded when a scheduled notification email is delivered. One record is written for each recipient, with the notification type. Failures are not recorded here. |
Platform Security ¶
| Event | Criticality | Description |
|---|---|---|
| SSO Disabled | 1 | Recorded when the single sign-on configuration is removed. The tenant falls back to local passwords, and identity provider claims stop driving role and team membership. |
| SSO Enabled | 1 | Recorded when a single sign-on configuration is created or changed. Users are then redirected to the identity provider to sign in, and its claims feed the user matching rules on teams. |
Provisioning ¶
| Event | Criticality | Description |
|---|---|---|
| Certificate Generational Management | 0 | Recorded when the platform checks whether a superseded copy of a certificate was removed from the target after a new one was installed. One record is written for each outcome, so it shows both successful cleanup and cleanup that did not happen. |
| Machine Batch Provisioning Abort Requested | 0 | Recorded when a user asks to stop a batch provisioning run on a machine. The run stops at its next checkpoint, which is recorded as Machine Batch Provisioning Aborted. |
| Machine Batch Provisioning Aborted | 0 | Recorded when a batch provisioning run stops before finishing. The reason is included, such as a requested abort or another run already in progress. Machine identities already provisioned in the run stay provisioned. |
| Machine Batch Provisioning Completed | 0 | Recorded when a batch provisioning run finishes every machine identity on the machine. The counts of successes and failures are written to the run before this record. |
| Machine Batch Provisioning Failed | 0 | Recorded when a batch provisioning run itself fails, rather than an individual installation. The remaining machine identities are not provisioned. |
| Machine Batch Provisioning Schedule Created | 0 | Recorded when a recurring provisioning window is turned on for a machine. Renewed certificates for that machine are then held for the window instead of being installed immediately. |
| Machine Batch Provisioning Schedule Deleted | 0 | Recorded when a machine's recurring provisioning window is turned off. Renewed certificates for its installations are installed immediately again. |
| Machine Batch Provisioning Schedule Updated | 0 | Recorded when the timing of a machine's provisioning window is changed. The next run follows the new timing. |
| Machine Batch Provisioning Started | 0 | Recorded when a batch provisioning run over a machine's identities begins, either on its schedule or because a user started it. The run ends as completed, failed, or aborted, with per-identity records in between. |
| Machine Created | 0 | Recorded when a machine is added as a target for installing certificates, naming its type, the VSatellite that reaches it, and its connection details. Machine identities are attached to it next. |
| Machine Deleted | 0 | Recorded when a machine has been removed, along with its schedules and machine identities. The record includes how many machine identities went with it. Certificates already installed on the target are left in place. |
| Machine Deletion Initiated | 0 | Recorded when a machine is marked for deletion. No new provisioning can start against it, and Machine Deleted follows once its schedules and machine identities have been removed. |
| Machine Identity Created | 0 | Recorded when a machine identity is created, saying which certificate belongs at which location on a machine. Nothing is sent to the machine until it is provisioned. |
| Machine Identity Deleted | 0 | Recorded when a machine identity is deleted, either on its own or because the machine was deleted. The certificate and the copy already on the target are left in place, and that location stops being tracked. |
| Machine Identity Installed | 0 | Recorded when the certificate and key are written to the machine. Configuring the binding comes next, and success there is recorded as Machine Identity Provisioning Finished. |
| Machine Identity Provisioning Failed | 1 | Recorded when provisioning one machine identity fails. Common causes are an unreachable VSatellite, credentials the machine rejects, a rejected write, and a binding or restart action that returns an error. Nothing further is attempted until it is retried. |
| Machine Identity Provisioning Finished | 0 | Recorded when the certificate has been installed and the binding applied on the machine. The certificate is in service at that location. |
| Machine Identity Provisioning Skipped | 0 | Recorded when a renewed certificate is not installed immediately because the target machine has a provisioning window. It is installed during the machine's next scheduled run. |
| Machine Identity Provisioning Started | 0 | Recorded when provisioning starts for one machine identity. The steps that follow are recorded as Machine Identity Installed and then either Provisioning Finished or Provisioning Failed. |
| Machine Identity Updated | 0 | Recorded when a machine identity is changed, such as the certificate at that location or its keystore and binding details. The change reaches the machine on the next provisioning run. |
| Machine Updated | 0 | Recorded when a machine is changed, such as its name, VSatellite, credentials, owning team, or its schedules. Schedule changes also produce their own batch provisioning schedule records. |
Report Inventory ¶
| Event | Criticality | Description |
|---|---|---|
| Custom Report Created | 0 | Recorded when a custom report is created, including its query and any schedule. It then appears in the report inventory. |
| Custom Report Deleted | 0 | Recorded when a custom report is deleted. Its schedule is cancelled and its stored results are removed. |
| Custom Report Run Initiated | 0 | Recorded when a user runs a saved report instead of waiting for its schedule. The request is refused if a run is already in progress. The run's own completion is not recorded here. |
SCEP RA Certificate Issuance ¶
| Event | Criticality | Description |
|---|---|---|
| SCEP RA Certificates Issued | 0 | Recorded when the registration authority signing and encryption certificates for a SCEP server are issued. The server becomes ready and devices can start enrolling. |
SCEP Server Management ¶
| Event | Criticality | Description |
|---|---|---|
| SCEP Certificate Issued | 0 | Recorded when a SCEP enrollment produces a certificate. The device receives it on the same request or on its next poll, and the certificate appears in your inventory. |
| SCEP Enrollment Failed | 1 | Recorded when a SCEP enrollment ends without a certificate. Common causes are a signing request the server's issuing template does not allow and a certificate authority that refuses it. Compare the device's request against the issuing template. |
| SCEP Enrollment Request Received | 0 | Recorded when a device's enrollment request is accepted, before issuance is attempted. Either SCEP Certificate Issued or SCEP Enrollment Failed follows for the same transaction. |
| SCEP RA Certificate Issuance Failed | 0 | Recorded when the registration authority certificates for a SCEP server cannot be issued. The cause is included, and the server has nothing new provisioned. |
| SCEP RA Certificates Issued | 0 | Recorded when the registration authority signing and encryption certificates for a SCEP server are issued. The server becomes ready and devices can start enrolling. |
| SCEP Server Challenge Password Regenerated | 0 | Recorded when a SCEP server's challenge password is replaced. The new password is shown once, and devices still configured with the old one fail their next enrollment. |
| SCEP Server Created | 0 | Recorded when a SCEP server is created, naming the issuing templates for enrolled devices and for the registration authority certificates. The server is usable once SCEP RA Certificates Issued is recorded. |
| SCEP Server Deactivated | 0 | Recorded when a SCEP server is deactivated. Enrollments on it are refused and its challenge password cannot be reset, but the server and its transaction history stay visible. |
| SCEP Server Deleted | 0 | Recorded when a SCEP server is deleted. Its registration authority keys are destroyed and its enrollment history is removed with it. |
Service Accounts ¶
| Event | Criticality | Description |
|---|---|---|
| Service Account Create Denied | 1 | Recorded when a request to create a service account is refused, such as when the caller is not in the team they named as owner or has no rights on the applications they scoped it to. No service account is created. |
| Service Account Created | 0 | Recorded when a service account is created, with its scopes, owning team, applications, and credential. Its automation can then exchange that credential for access tokens. |
| Service Account Deleted | 0 | Recorded when a service account is deleted. Automation using it is refused on its next token request. |
| Service Account Read Denied | 1 | Recorded when a request to view a service account is refused because the caller is not a member of the team that owns it. Repeated records for one user are worth looking at. |
| Service Account Update Denied | 1 | Recorded when a change to a service account is refused, such as reassigning it to a team the caller is not in. Nothing is changed, and the attempted change is included in the record. |
| Service Account Updated | 0 | Recorded when a service account is changed, such as its public key, credential lifetime, scopes, owning team, or whether it is enabled. Its automation sees the change on its next token request. |
Tags ¶
| Event | Criticality | Description |
|---|---|---|
| Tag Key Deleted | 0 | Recorded when a tag key is deleted. Every value under it and every assignment of those values goes with it, so saved searches, filters, and reports built on that key stop matching. |
| Tags Created | 0 | Recorded when tags or tag values are created. They can then be assigned to certificates, named on certificate requests, and used to filter and group inventory and reports. |
| Tags Deleted | 0 | Recorded when tag values are deleted. Certificates carrying those values lose them, so filters and reports that used them return nothing until the estate is tagged again. |
Tags Assignment ¶
| Event | Criticality | Description |
|---|---|---|
| Certificate All Tags Deleted | 0 | Recorded when every tag is removed from a certificate. One record is written for each certificate, and those certificates drop out of every filter, saved search, and report that uses tags. |
| Certificate Tags Added | 0 | Recorded when tags are added to certificates. Existing tags are left in place, and the certificates start matching filters and reports that use the added tags. |
| Certificate Tags Deleted | 0 | Recorded when specific tags are removed from certificates. Other tags on those certificates are left in place. |
| Certificate Tags Replaced | 0 | Recorded when a certificate's tags are replaced with a new set. Anything not in the new set is removed, which is what separates this from Certificate Tags Added. |
| Tags Assignment On Certificate Request | 0 | Recorded when the tags included on a certificate request are applied to the issued certificate. The record names the tags, the certificate, and its fingerprint. |
Teams ¶
| Event | Criticality | Description |
|---|---|---|
| Team Created | 0 | Recorded when a team is created, with its role, owners, members, and any user matching rules. A team's role is what grants its members their entitlements. |
| Team Deleted | 0 | Recorded when a team is deleted. Members who held their role through it have their role recalculated from their remaining teams, so User Role Changed records often follow. |
| Team Members Changed | 0 | Recorded when a team's membership changes, whether an administrator edited it, a user matching rule applied at sign-in, or an invited person completed registration. Each affected user's role is recalculated afterwards. |
| Team Owners Changed | 0 | Recorded when a team's owners change. Owners can edit the team, manage its membership, and administer the service accounts and resources it owns. |
| Team Updated | 0 | Recorded when a team's definition changes, such as its name, its role, or its user matching rules. Changing the role recalculates every member's entitlements, and changing the rules changes who is enrolled at their next sign-in. |
Trusted CA Certificates ¶
| Event | Criticality | Description |
|---|---|---|
| Trusted CA Certificate Created | 0 | Recorded when certificate authority certificates are uploaded to your trust store. The record includes how many were added, and chains that depend on them can then be validated. |
| Trusted CA Certificate deleted | 0 | Recorded when a certificate authority certificate is removed from your trust store. Certificates that chained through it start reporting an incomplete or untrusted chain. |
User Security ¶
| Event | Criticality | Description |
|---|---|---|
| ApiKey Created | 0 | Recorded when a user generates an API key from their own preferences page. |
| ApiKey Deleted | 0 | Recorded when a user deletes one of their own API keys. Calls that still present the key are refused and logged as Login Failed. |
| ApiKey Rotation Requested | 0 | Recorded when the holder of an API-type account requests a replacement key. The new key becomes usable only after the emailed rotation link is followed. |
| ApiKey Updated | 0 | Recorded when a user changes the properties of an existing API key, such as its validity period, without replacing it. |
| Password Changed | 1 | Recorded when a user sets a new password after following a reset link. The previous password stops working immediately. |
| Password Reset Requested | 0 | Recorded when a password reset is requested for a user from the sign-in page. The account is unchanged until the emailed link is followed. |
| User Active State Changed | 0 | Recorded when an administrator enables or disables another user's account. A disabled user cannot sign in, and their API keys stop working. |
| User Local Login Changed | 0 | Recorded when an administrator allows or prevents a user from signing in with a local password instead of your identity provider. |
User Settings ¶
| Event | Criticality | Description |
|---|---|---|
| Notifications Updated | 0 | Recorded when a user turns one of their own notification categories on or off. |
Users ¶
| Event | Criticality | Description |
|---|---|---|
| Invitation Accepted | 0 | Recorded when an invited person completes the registration form behind their invite link. The account is not usable until User Activated. |
| Invitation Link Created | 0 | Recorded when an administrator invites a person to the tenant. The role and teams chosen when the link is created are granted to whoever redeems it. |
| USER_ACCOUNT_TYPE_CHANGED | 0 | Recorded when an administrator switches an account between the interactive web type and the API type. The type determines how the account can authenticate. |
| USER_FORCE_LOCAL_PASSWORD_EXPIRED_CHANGED | 0 | Recorded when an administrator sets or clears the flag that forces a user's local password to expire. Setting it requires the user to reset their password before signing in again. |
| User Activated | 0 | Recorded when a new user follows the activation link in their welcome email. The account can sign in only after this point. |
| User Created | 0 | Recorded when a user account is added to the tenant, either by self-registration or by completing an invitation. |
| User Deleted | 0 | Recorded when an administrator removes a user from the tenant. Their API keys stop working and their team memberships are removed. |
| User Role Changed | 0 | Recorded when a user's role changes, either because an administrator edited it or because a change in team membership caused it to be recalculated. |
VSatellite Workers ¶
| Event | Criticality | Description |
|---|---|---|
| VSatellite Worker Created | 0 | Recorded when a VSatellite worker is created and its pairing code is issued. The worker is not usable until it is installed and paired, which is recorded as VSatellite Worker Paired. |
| VSatellite Worker Deleted | 0 | Recorded when a VSatellite worker is deleted. Work stops being routed to it, and the software still running on your host can be uninstalled. |
| VSatellite Worker Paired | 0 | Recorded when a worker is installed and bound to a VSatellite. That VSatellite can then send discovery and provisioning work through the worker. |
VSatellites ¶
| Event | Criticality | Description |
|---|---|---|
| VSatellite Active | 0 | Recorded when a VSatellite that had lost its connection starts checking in again. It is eligible for discovery and provisioning work and for scheduled updates again. |
| VSatellite Deleted | 0 | Recorded when a VSatellite is deleted. Work stops being routed to it, workers attached to it are no longer reachable, and the software can be removed from your host. |
| VSatellite Encryption Configuration Updated | 0 | Recorded when the encryption used to protect VSatellite secrets is changed. The setting is enforced the next time a VSatellite is paired, and recovery is not available when hardware-backed protection is in use. |
| VSatellite Lost Connection | 0 | Recorded when a VSatellite stops checking in for longer than the allowed delay. It stops receiving discovery and provisioning work until it reconnects or is recovered. |
| VSatellite Manual Update | 0 | Recorded when a user updates a VSatellite immediately instead of waiting for its update window. The VSatellite restarts on the new version. |
| VSatellite Name Changed | 0 | Recorded when a VSatellite is renamed. The record includes the previous and new names, and nothing about the deployment changes. |
| VSatellite Paired | 0 | Recorded when a VSatellite is installed with a pairing code and registers itself. It then starts checking in and can have workers attached. |
| VSatellite Pairing Code Created | 0 | Recorded when a pairing code is created for a new VSatellite. The code is short-lived and can be used a limited number of times. |
| VSatellite Recovered | 0 | Recorded when a VSatellite that had lost its connection is rebuilt with a recovery code, keeping its identity. VSatellite Active follows once it reconnects. |
| VSatellite Recovery Code Created | 0 | Recorded when a recovery code is created for a VSatellite that has lost its connection. The code expires, and it is used up by the recovery it enables. |
| VSatellite Update Config Updated | 0 | Recorded when the VSatellite update settings are changed, such as the update window or detached mode. This is the earlier name for VSatellite Updates Configuration Updated. |
| VSatellite Updates Configuration Updated | 0 | Recorded when the VSatellite update settings are changed, such as the update window or detached mode. With detached mode on, updates are never applied automatically and manual updates are refused. |
Event index ¶
Every event name, with the event types it can appear under.
| Event | Event type |
|---|---|
| ACME Account Created | ACME Account Creation |
| ACME Order Created | ACME Order Creation |
| ACME Server Created | ACME Server Creation |
| ACME Server Deactivated | ACME Server Deactivation |
| ACME Server Deleted | ACME Server Deletion |
| ACME Server HMAC Key Regenerated | ACME Server HMAC Key Regeneration |
| ACME Server Updated | ACME Server Update |
| ApiKey Created | User Security |
| ApiKey Deleted | User Security |
| ApiKey Rotation Requested | User Security |
| ApiKey Updated | User Security |
| Application Auto-Renewal Options Update Denied | Auto-Renewal |
| Application Created | Applications |
| Application Deleted | Applications |
| Application Owners Changed | Applications |
| Application Updated | Applications |
| Assigned Certificates Changed | Certificates |
| Auto-Renewal Completed | Auto-Renewal |
| Auto-Renewal Status Read Denied | Auto-Renewal |
| CSR Generated | Certificates |
| Certificate All Tags Deleted | Tags Assignment |
| Certificate Approval Bulk Operation | Certificates |
| Certificate Approval Rule Created | Certificate Approval Rules, Certificate Issuance Approval Rules, Certificate Revocation Approval Rules |
| Certificate Approval Rule Deleted | Certificate Approval Rules, Certificate Issuance Approval Rules, Certificate Revocation Approval Rules |
| Certificate Approval Rule Reordered | Certificate Approval Rules, Certificate Issuance Approval Rules, Certificate Revocation Approval Rules |
| Certificate Approval Rule Triggered | Certificate Approval Rules, Certificates |
| Certificate Approval Rule Updated | Certificate Approval Rules, Certificate Issuance Approval Rules, Certificate Revocation Approval Rules |
| Certificate Assigned | CodeSign |
| Certificate Assignment Cleared | Certificates |
| Certificate Assignment Updated | Certificates |
| Certificate Authority Created | Certificate Authorities |
| Certificate Authority Deleted | Certificate Authorities |
| Certificate Authority Issuer Changed | Certificate Authorities |
| Certificate Authority Updated | Certificate Authorities |
| Certificate Blocklisted | Certificates |
| Certificate Created | Certificates |
| Certificate Deleted | Certificates |
| Certificate Downloaded | Certificates |
| Certificate Expiration Inventory Monitoring Configuration Changed | Inventory Monitoring Configuration |
| Certificate Expiration Inventory Monitoring Configuration Disabled | Inventory Monitoring Configuration |
| Certificate Expiration Inventory Monitoring Configuration Enabled | Inventory Monitoring Configuration |
| Certificate Expiration Notifications Job Manually Started | Notifications |
| Certificate Expiration Notifications Sent | Notifications |
| Certificate Generational Management | Provisioning |
| Certificate Issued | Certificate Issuance, Certificates |
| Certificate Keystore Downloaded | Certificates |
| Certificate Not Issued | Certificates |
| Certificate Not Reissued | Certificates |
| Certificate Not Renewed | Certificates |
| Certificate Notification Failure | Expiration Notifications |
| Certificate Notification Sent | Expiration Notifications |
| Certificate Recovered | Certificates |
| Certificate Renewal Failed | Auto-Renewal |
| Certificate Renewal Triggered | Auto-Renewal |
| Certificate Request Approved | Certificate Workflow Approvals |
| Certificate Request Automatically Approved | Certificate Workflow Approvals |
| Certificate Request Automatically Rejected | Certificate Workflow Approvals |
| Certificate Request Created | Certificate Request Creation, Certificates |
| Certificate Request Failure | CodeSign |
| Certificate Request Rejected | Certificate Workflow Approvals |
| Certificate Request Resubmitted | Certificate Workflow Approvals |
| Certificate Request Submitted to CA | Certificates |
| Certificate Requested | Certificates |
| Certificate Retired | Certificates |
| Certificate Revocation Approved | Certificates |
| Certificate Revocation Automatically Rejected | Certificates |
| Certificate Revocation Rejected | Certificates |
| Certificate Revocation Request Failed | Certificates |
| Certificate Revocation Request Submitted | Certificates |
| Certificate Tags Added | Tags Assignment |
| Certificate Tags Deleted | Tags Assignment |
| Certificate Tags Replaced | Tags Assignment |
| Certificate Unblocklisted | Certificates |
| Certificate Validation Finished | Certificates |
| Certificate Validation Started | Certificates |
| Certificate skipped | Auto-Renewal |
| Certificates Imports | Certificates |
| Certificates Report Completed | Expiration Reports |
| Certificates Report Failed | Expiration Reports |
| Cloud Authentication Configuration Created | Cloud Authentication Configurations |
| Cloud Authentication Configuration Rotated | Cloud Authentication Configurations |
| Cloud Authentication Configuration Updated | Cloud Authentication Configurations |
| Cloud Discovery Aborted | Cloud Keystores |
| Cloud Discovery Completed | Cloud Keystores |
| Cloud Discovery Did Not Abort | Cloud Keystores |
| Cloud Discovery Did Not Start | Cloud Keystores |
| Cloud Discovery Did Not Update | Cloud Keystores |
| Cloud Discovery Started | Cloud Keystores |
| Cloud Discovery Starting | Cloud Keystores |
| Cloud Keystore Auto-Provisioning | Cloud Keystores |
| Cloud Keystore Auto-Provisioning Failed | Cloud Keystores |
| Cloud Keystore Certificate Import | Cloud Keystores |
| Cloud Keystore Certificate Import Failed | Cloud Keystores |
| Cloud Keystore Certificate Listing Denied | Cloud Keystores |
| Cloud Keystore Certificates Downloaded | Cloud Keystores |
| Cloud Keystore Certificates Listed | Cloud Keystores |
| Cloud Keystore Certificates Partially Downloaded | Cloud Keystores |
| Cloud Keystore Created | Cloud Keystores |
| Cloud Keystore Delete Denied | Cloud Keystores |
| Cloud Keystore Deleted | Cloud Keystores |
| Cloud Keystore Discovery Denied | Cloud Keystores |
| Cloud Keystore Discovery Schedule Created | Cloud Keystores |
| Cloud Keystore Discovery Schedule Creation Failed | Cloud Keystores |
| Cloud Keystore Discovery Schedule Deleted | Cloud Keystores |
| Cloud Keystore Discovery Schedule Update Failed | Cloud Keystores |
| Cloud Keystore Discovery Schedule Updated | Cloud Keystores |
| Cloud Keystore Duplicated | Cloud Keystores |
| Cloud Keystore Provisioning | Cloud Keystores |
| Cloud Keystore Provisioning Denied | Cloud Keystores |
| Cloud Keystore Provisioning Failed | Cloud Keystores |
| Cloud Keystore Update Denied | Cloud Keystores |
| Cloud Keystore Updated | Cloud Keystores |
| Cloud Provider Create Denied | Cloud Providers |
| Cloud Provider Created | Cloud Providers |
| Cloud Provider Delete Denied | Cloud Providers |
| Cloud Provider Delete Failed | Cloud Providers |
| Cloud Provider Deleted | Cloud Providers |
| Cloud Provider Details Denied | Cloud Providers |
| Cloud Provider Duplicated | Cloud Providers |
| Cloud Provider Secrets Rotated | Cloud Providers |
| Cloud Provider Update Denied | Cloud Providers |
| Cloud Provider Updated | Cloud Providers |
| Cloud Provider Validation | Cloud Providers |
| Cloud Provider Validation Denied | Cloud Providers |
| Company Domain Added | Discovery |
| Configuration Created | Credential management, Distributed Issuer Configuration |
| Configuration Deleted | Credential management, Distributed Issuer Configuration |
| Configuration Read Denied | Credential management, Expiration Notifications, Expiration Reports |
| Configuration Update | CodeSign |
| Configuration Update Denied | Auto-Renewal |
| Configuration Updated | Credential management, Distributed Issuer Configuration |
| Credential Assigned | Credential management |
| Credential Assignment Failed | Credential management |
| Credential Create Denied | Credential management |
| Credential Created | Credential management |
| Credential Delete Denied | Credential management |
| Credential Deleted | Credential management |
| Credential Read Denied | Credential management |
| Credential Unassigned | Credential management |
| Credential Unassignment Failed | Credential management |
| Credential Updated | Credential management |
| Custom Notification Created | Custom Notification |
| Custom Notification Deleted | Custom Notification |
| Custom Notification Template Created | Custom Notification |
| Custom Notification Template Deleted | Custom Notification |
| Custom Notification Updated | Custom Notification |
| Custom Report Created | Report Inventory |
| Custom Report Deleted | Report Inventory |
| Custom Report Run Initiated | Report Inventory |
| Daily Scan | Auto-Renewal |
| Environment Created | CodeSign |
| Environment Updated | CodeSign |
| Environment(s) Deleted | CodeSign |
| Environment(s) Status Change | CodeSign |
| Expiration Reports | Expiration Reports |
| External Email Recipient Created | External Email, Notification Provider |
| External Email Recipient Disabled | External Email, Notification Provider |
| External Email Recipient Enabled | External Email, Notification Provider |
| External Email Recipient Query Denied | External Email, Notification Provider |
| External Email Recipient Updated | Notification Provider |
| External Email Recipients Deleted | External Email, Notification Provider |
| Failed Import Certificates | Certificates |
| Integration Service Created | Discovery |
| Integration Service Deleted | Discovery |
| Integration Service Scan Requested | Discovery |
| Integration Service Updated | Discovery |
| Invitation Accepted | Users |
| Invitation Link Created | Users |
| Issuing Template Created | Issuing Templates |
| Issuing Template Deleted | Issuing Templates |
| Issuing Template Domains Updated | Issuing Templates |
| Issuing Template Resource Consumers Added | Issuing Templates |
| Issuing Template Resource Consumers Removed | Issuing Templates |
| Issuing Template Updated | Issuing Templates |
| Key Pair Deleted | CodeSign |
| Key Pair Generation Failure | CodeSign |
| KeyPair Generated | Certificates |
| Kubernetes Cluster Automatically Created | Kubernetes Clusters |
| Kubernetes Cluster Created | Kubernetes Clusters |
| Kubernetes Cluster Deleted | Kubernetes Clusters |
| Kubernetes Cluster Updated | Kubernetes Clusters |
| Login Failed | Authentication |
| Login Succeeded | Authentication |
| Logout | Authentication |
| Machine Batch Provisioning Abort Requested | Provisioning |
| Machine Batch Provisioning Aborted | Provisioning |
| Machine Batch Provisioning Completed | Provisioning |
| Machine Batch Provisioning Failed | Provisioning |
| Machine Batch Provisioning Schedule Created | Provisioning |
| Machine Batch Provisioning Schedule Deleted | Provisioning |
| Machine Batch Provisioning Schedule Updated | Provisioning |
| Machine Batch Provisioning Started | Provisioning |
| Machine Created | Provisioning |
| Machine Deleted | Provisioning |
| Machine Deletion Initiated | Provisioning |
| Machine Discovery Abort Requested | Discovery |
| Machine Discovery Aborted | Discovery |
| Machine Discovery Certificate Error | Discovery |
| Machine Discovery Completed | Discovery |
| Machine Discovery Failed | Discovery |
| Machine Discovery Initiated | Discovery |
| Machine Discovery Installation Error | Discovery |
| Machine Discovery Schedule Created | Discovery |
| Machine Discovery Schedule Deleted | Discovery |
| Machine Discovery Schedule Updated | Discovery |
| Machine Discovery Started | Discovery |
| Machine Identity Created | Discovery, Provisioning |
| Machine Identity Delete Denied | Machine Identities |
| Machine Identity Deleted | Certificate Deletion, Certificate Retirement, Discovery, Machine Identities, Provisioning |
| Machine Identity Installed | Provisioning |
| Machine Identity Provisioning Failed | Provisioning |
| Machine Identity Provisioning Finished | Provisioning |
| Machine Identity Provisioning Skipped | Provisioning |
| Machine Identity Provisioning Started | Provisioning |
| Machine Identity Updated | Certificate Renewal, Discovery, Provisioning |
| Machine Updated | Provisioning |
| Manual Trigger Denied | Auto-Renewal |
| New Key Pair Created | CodeSign |
| Notification Branding Updated | Custom Notification |
| Notification Configuration Updated | Expiration Notifications |
| Notification Provider Created | Notification Provider |
| Notification Provider Deleted | Notification Provider |
| Notification Provider Updated | Notification Provider |
| Notification sent | Notifications |
| Notifications Updated | User Settings |
| On-demand Scan | Auto-Renewal, Expiration Reports |
| PagerDuty Notification Provider Created | Notification Provider |
| PagerDuty Notification Provider Updated | Notification Provider |
| Password Changed | User Security |
| Password Reset Requested | User Security |
| Policy Created | Distributed Issuer Policy |
| Policy Deleted | Distributed Issuer Policy |
| Policy Updated | Distributed Issuer Policy |
| Project Created | CodeSign |
| Project Updated | CodeSign |
| Project(s) Deleted | CodeSign |
| RetrieveCredential failed | Credential management |
| SCEP Certificate Issued | SCEP Server Management |
| SCEP Enrollment Failed | SCEP Server Management |
| SCEP Enrollment Request Received | SCEP Server Management |
| SCEP RA Certificate Issuance Failed | SCEP Server Management |
| SCEP RA Certificates Issued | SCEP RA Certificate Issuance, SCEP Server Management |
| SCEP Server Challenge Password Regenerated | SCEP Server Management |
| SCEP Server Created | SCEP Server Management |
| SCEP Server Deactivated | SCEP Server Management |
| SCEP Server Deleted | SCEP Server Management |
| SSO Disabled | Platform Security |
| SSO Enabled | Platform Security |
| Service Account Access Token Denied | Authentication |
| Service Account Access Token Granted | Authentication |
| Service Account Create Denied | Service Accounts |
| Service Account Created | Service Accounts |
| Service Account Deleted | Service Accounts |
| Service Account Read Denied | Service Accounts |
| Service Account Update Denied | Service Accounts |
| Service Account Updated | Service Accounts |
| Service Configuration | Discover service configuration |
| Signing Failed | CodeSign |
| Signing Key Created | CodeSign |
| Signing Key Updated | CodeSign |
| Signing Key(s) Deleted | CodeSign |
| Signing Key(s) Status Change | CodeSign |
| Signing Succeeded | CodeSign |
| Stale Machine Identities Found | Machine Identities |
| Sub CA Certificate Deleted | Distributed Issuer Sub CA Certificate |
| Sub CA Certificate Issued | Distributed Issuer Sub CA Certificate |
| Sub CA Certificate Not Issued | Distributed Issuer Sub CA Certificate |
| Sub CA Certificate Requested | Distributed Issuer Sub CA Certificate |
| Sub CA Provider Created | Distributed Issuer Sub CA Provider |
| Sub CA Provider Deleted | Distributed Issuer Sub CA Provider |
| Sub CA Provider Updated | Distributed Issuer Sub CA Provider |
| Tag Key Deleted | Tags |
| Tags Assignment On Certificate Request | Tags Assignment |
| Tags Created | Tags |
| Tags Deleted | Tags |
| Team Created | Teams |
| Team Deleted | Teams |
| Team Members Changed | Teams |
| Team Owners Changed | Teams |
| Team Permissions | Cloud Providers |
| Team Updated | Teams |
| Trusted CA Certificate Created | Trusted CA Certificates |
| Trusted CA Certificate deleted | Trusted CA Certificates |
| USER_ACCOUNT_TYPE_CHANGED | Users |
| USER_FORCE_LOCAL_PASSWORD_EXPIRED_CHANGED | Users |
| User Activated | Users |
| User Active State Changed | User Security |
| User Created | Users |
| User Deleted | Users |
| User Local Login Changed | User Security |
| User Permissions | Cloud Keystores, Cloud Providers, Machine Identities |
| User Role Changed | Users |
| VSatellite Active | VSatellites |
| VSatellite Deleted | VSatellites |
| VSatellite Encryption Configuration Updated | VSatellites |
| VSatellite Lost Connection | VSatellites |
| VSatellite Manual Update | VSatellites |
| VSatellite Name Changed | VSatellites |
| VSatellite Paired | VSatellites |
| VSatellite Pairing Code Created | VSatellites |
| VSatellite Recovered | VSatellites |
| VSatellite Recovery Code Created | VSatellites |
| VSatellite Update Config Updated | VSatellites |
| VSatellite Updates Configuration Updated | VSatellites |
| VSatellite Worker Created | VSatellite Workers |
| VSatellite Worker Deleted | VSatellite Workers |
| VSatellite Worker Paired | VSatellite Workers |
| Zoom Team Chat Notification Provider Create Denied | Notification Provider |
| Zoom Team Chat Notification Provider Created | Notification Provider |
| Zoom Team Chat Notification Provider Updated | Notification Provider |