Sample Audit Events and Definitions
In this document, you can find a partial list of some of the most important audit events tracked by Identity Security Cloud. These events are organized by their event type.
You can find more information about the audit events that have taken place in your tenant using Search.
Note
This list is not comprehensive. Contact SailPoint Support for questions about a specific audit event or to request an event be added to this list.
Access Item Events
Audit events related to managing the access items in your organization.
| Event Name | Display Name | Description |
|---|---|---|
| ENTITLEMENT_ADD_PASSED | Add Entitlement Passed | An entitlement was added to an access item successfully. |
| ENTITLEMENT_ADD_FAILED | Add Entitlement Failed | An attempt to add an entitlement to an access item failed. |
| ENTITLEMENT_REMOVE_PASSED | Remove Entitlement Passed | An entitlement was successfully removed from an access item. |
| ENTITLEMENT_REMOVE_FAILED | Remove Entitlement Failed | An attempt to remove an entitlement from an access item failed. |
| ACCESS_PROFILE_CREATE_PASSED | Create Access Profile Passed | The creation of an access profile was successful. |
| ACCESS_PROFILE_DELETE_PASSED | Delete Access Profile Passed | The access profile was successfully deleted. |
| ACCESS_PROFILE_UPDATE_PASSED | Update Access Profile Passed | The access profile was successfully updated. |
| ROLE_CREATE_PASSED | Create Role Passed | The creation of the role was successful. |
| ROLE_UPDATE_PASSED | Update Role Passed | The role was successfully updated. |
| ROLE_DELETE_PASSED | Delete Role Passed | The role was successfully deleted. |
| ROLE_ADD_PASSED | Add Role Passed | A role was added to an access item successfully. |
| APP_UPDATE_PASSED | Update App Passed | The application was successfully updated. |
| APP_CREATE_PASSED | Create App Passed | The application was successfully created. |
| APP_DELETE_PASSED | Delete App Passed | The application was successfully deleted. |
| APP_IMPORT_PASSED | Import App Passed | The application was imported successfully. |
| APP_ACCESS_PROFILE_SET_PASSED | Set App Access Profile Passed | The setup of the application’s access profile was successful. |
| IDENTITY_PROFILE_DELETE_PASSED | Delete Identity Profile Passed | The identity profile in the access item was successfully deleted. |
| IDENTITY_PROFILE_ATTRIBUTES_UPDATE_PASSED | Update Identity Profile Attributes Passed | The attribute for the identity profile was successfully updated. |
| IDENTITY_PROFILE_CREATE_PASSED | Create Identity Profile Passed | The identity profile in the access item was successfully created. |
| ENTITLEMENT_ADD_PASSED | Add Entitlement Passed | The entitlement was successfully added. |
| ENTITLEMENT_ADD_FAILED | Add Entitlement Failed | The attempt in adding an entitlement failed. |
| ENTITLEMENT_REMOVE_PASSED | Remove Entitlement Passed | The entitlement was successfully removed. |
| ENTITLEMENT_REMOVE_FAILED | Remove Entitlement Failed | The attempt in removing an entitlement failed. |
| IDENTITY_PROFILE_UPDATE_PASSED | Update Identity Profile Passed | The identity profile was successfully updated. |
| LIFECYCLE_STATE_CREATE_PASSED | Create Lifecycle State Passed | The lifecycle state was successfully created. |
| LIFECYCLE_STATE_UPDATE_PASSED | Update Lifecycle State Passed | The lifecycle state was successfully updated. |
| LIFECYCLE_STATE_DELETE_PASSED | Delete Lifecycle State Passed | The lifecycle state was successfully deleted. |
| ENTITLEMENT_SET_PASSED | Set Entitlement Passed | The entitlement was successfully set up. |
| ROLE_ADD_PASSED | Add Role Passed | The role was successfully added. |
| IDENTITY_PROFILE_ATTRIBUTE_CREATE_PASSED | Create Identity Profile Attribute Passed | The profile attribute for this identity was successfully created. |
| IDENTITY_PROFILE_ATTRIBUTE_DELETE_PASSED | Delete Identity Profile Attribute Passed | The profile attribute for this identity was successfully deleted. |
| IDENTITY_PROFILE_ATTRIBUTE_UPDATE_PASSED | Update Identity Profile Attribute Passed | The profile attribute for this identity was successfully updated. |
Provisioning Events
Audit events related to actions taken on external sources.
| Event Name | Display Name | Description |
|---|---|---|
| ACCOUNT_CREATE_FAILED | Create Account Failed | A provisioning operation to create an account on a source has failed. |
| ACCOUNT_CREATE_PASSED | Create Account Passed | A provisioning operation to create an account on a source was successful. |
| ACCOUNT_DELETE_FAILED | Delete Account Failed | A provisioning operation to delete an account on a source has failed. |
| ACCOUNT_DELETE_PASSED | Delete Account Passed | A provisioning operation to delete an account on a source was successful. |
| ACCOUNT_DISABLE_FAILED | Disable Account Failed | A provisioning operation to disable an account on a source has failed. |
| ACCOUNT_DISABLE_PASSED | Disable Account Passed | A provisioning operation to disable an account on a source was successful. |
| ACCOUNT_ENABLE_FAILED | Enable Account Failed | A provisioning operation to enable an account on a source has failed. |
| ACCOUNT_ENABLE_PASSED | Enable Account Passed | A provisioning operation to enable an account on a source was successful. |
| ACCOUNT_MANUAL_CHANGE_COMPLETE_PASSED | Complete Account Manual Change Passed | A manual account change on a disconnected source was successful. |
| ACCOUNT_MODIFY_FAILED | Modify Account Failed | A provisioning operation to modify an account on a source has failed. |
| ACCOUNT_MODIFY_PASSED | Modify Account Passed | A provisioning operation to modify an account on a source has completed successfully. |
| ACCOUNT_PROFILE_CREATED | Account Provisioning Policy Created | An account provisioning policy was successfully created for a source. |
| ACCOUNT_PROFILE_DELETED | Account Provisioning Policy Deleted | An account provisioning policy was successfully deleted. |
| ACCOUNT_PROFILE_UPDATED | Account Provisioning Policy Updated | An account provisioning policy was successfully updated. |
| ACCOUNT_UNLOCK_FAILED | Unlock Account Failed | A provisioning operation to unlock an account on a source has failed. |
| ACCOUNT_UNLOCK_PASSED | Unlock Account Passed | A provisioning operation to unlock an account on a source was successful. |
| APP_REQUEST_APPROVED | Access Request Approval Passed | A provisioning operation to approve an Application access request from the Request Center was successful. |
| APP_REQUEST_REJECTED | Access Request Rejection Passed | A provisioning operation to reject an Application access request from the Request Center was successful. |
| APPROVAL_ITEM_APPROVE_PASSED | Grant Approval Passed | A provisioning operation to grant an approval was successful. |
| ATTRIBUTE_SYNC_DISABLE_PASSED | Disable Attribute Sync Passed | Attribute synchronization for a source was successfully disabled. |
| ATTRIBUTE_SYNC_ENABLE_PASSED | Enable Attribute Sync Passed | Attribute synchronization for a source was successfully enabled. |
| CANCEL_IDENTITY_REQUESTS_COMPLETED | Identity Request Cancellation Passed | An Identity Request cancellation process on a source has completed. |
| CANCEL_IDENTITY_REQUESTS_STARTED | Identity Request Cancellation Started | A provisioning operation to start an Identity Request cancellation process was successful. |
| IDENTITY_ACCOUNT_REMOVE_PASSED | Identity Account Correlation Removal Passed | An identity’s correlation with an account on a source was successfully removed. |
| IDENTITY_ATTRIBUTE_VALUE_UPDATE_PASSED | Update Identity Attribute Value Passed | A provisioning operation to update an identity attribute value on a source was successful. |
| IDENTITY_CREATE_PASSED | Create Machine Identity Passed | A provisioning operation to create an identity object was successful, and the object was committed to the ISC database. |
| IDENTITY_DELETE_PASSED | Delete Identity Passed | A provisioning operation to delete an identity object from the ISC database was successful. |
| IDENTITY_LIFECYCLE_CHANGE_PASSED | Change Identity Lifecycle Passed | A provisioning operation to update an identity’s lifecycle state was successful. |
| IDENTITY_STATE_CHANGE_PASSED | Change Identity State Passed | A provisioning operation to change the state of an identity was successful. |
| IDENTITY_UPDATE_PASSED | Update Machine Identity Passed | A provisioning operation to update an identity was successful, and the change has been committed to the ISC database. |
| PROVISION_CHANGE_FAILED | Provisioning Setting Change Failed | A provisioning setting change on a source has failed. |
| PROVISION_CHANGE_PASSED | Provisioning Setting Change Passed | A provisioning setting on a source was successfully changed. |
| PROVISION_CHANGE_STARTED | Provisioning Setting Change Started | A provisioning setting change on a source has started. |
| WORKITEM_COMPLETE_COMMENTS_ADD_PASSED | Add Work Item Complete Comments Passed | A comment for a completed work item on a source was successfully added. |
Source Management Events
Audit events related to managing your sources within Identity Security Cloud.
| Event Name | Display Name | Description |
|---|---|---|
| CONNECTOR_FILE_DELETE_PASSED | Delete Connector File Passed | A JAR file associated with a source was deleted successfully. |
| CONNECTOR_FILE_UPLOAD_PASSED | Upload Connector File Passed | A JAR file was successfully uploaded for a source. |
| SERVICE_DESK_INTEGRATION_CREATE_FAILED | Create Service Desk Integration Failed | An attempt to create an integration between Identity Security Cloud and ServiceNow Service Desk failed. |
| SERVICE_DESK_INTEGRATION_CREATED | Integration Service Desk Created | An integration between Identity Security Cloud and ServiceNow Service Desk was created successfully. |
| SERVICE_DESK_INTEGRATION_DELETE_FAILED | Delete Service Desk Integration Failed | An attempt to delete an integration between Identity Security Cloud and ServiceNow Service Desk failed. |
| SERVICE_DESK_INTEGRATION_DELETED | Integration Service Desk Deleted | An integration between Identity Security Cloud and ServiceNow Service Desk was deleted successfully. |
| SERVICE_DESK_INTEGRATION_UPDATE_FAILED | Update Service Desk Integration Failed | An attempt to update an integration between Identity Security Cloud and ServiceNow Service Desk failed. |
| SERVICE_DESK_INTEGRATION_UPDATED | Integration Service Desk Updated | An integration between Identity Security Cloud and ServiceNow Service Desk was updated successfully. |
| SOURCE_ACCOUNT_AGGREGATE_PASSED | Aggregate Source Account Passed | Accounts were successfully aggregated from a source. |
| SOURCE_ACCOUNT_AGGREGATE_TERMINATED | Aggregate Source Account Terminated | An account aggregation was successfully canceled. |
| SOURCE_ACCOUNT_EXPORT_PASSED | Export Source Account Passed | The list of accounts was successfully exported from a source. |
| SOURCE_AGGREGATION_SCHEDULE_UPDATE_PASSED | Update Source Aggregation Schedule Passed | The aggregation schedule for a source was successfully updated. |
| SOURCE_CREATE_PASSED | Create Source Passed | A source was created successfully. |
| SOURCE_DELETE_PASSED | Delete Source Passed | A source was deleted successfully. |
| SOURCE_DELETE_THRESHOLD_UPDATE_PASSED | Update Source Delete Threshold Passed | The percentage of accounts allowed to be deleted during an account aggregation for a source was updated successfully. |
| SOURCE_ENTITLEMENT_AGGREGATION_PASSED | Aggregation Source Entitlement Passed | Entitlements were successfully aggregated from a source. |
| SOURCE_ENTITLEMENT_EXPORT_PASSED | Export Source Entitlement Passed | The list of entitlements was successfully exported from a source. |
| SOURCE_ENTITLEMENT_IMPORT_PASSED | Import Source Entitlement Passed | |
| SOURCE_ENTITLEMENT_AGGREGATION_STARTED | An entitlement aggregation was successfully started. | |
| SOURCE_ENTITLEMENT_AGGREGATION_TERMINATED | An entitlement aggregation was successfully canceled. | |
| SOURCE_RENAME_FAILED | Rename Source Failed | An attempt to rename a source failed. |
| SOURCE_RESET_PASSED | Reset Source Passed | A source was successfully reset. |
| SOURCE_SCHEMA_ATTRIBUTE_ADD_PASSED | Add Source Schema Attribute Passed | An attribute was added to a source’s account schema successfully. |
| SOURCE_SCHEMA_ATTRIBUTE_DELETE_PASSED | Delete Source Schema Attribute Passed | An attribute was deleted from a source’s account schema successfully. |
| SOURCE_SCHEMA_ATTRIBUTE_UPDATE_PASSED | Update Source Schema Attribute Passed | An attribute was updated within a source’s account schema successfully. |
| SOURCE_UPDATE_PASSED | Update Source Passed | A source was successfully updated. |