Success

{
    "action_at": "2023-06-22T19:06:47.149965+00:00",
    "action_data":
    {
        "access_token_id": null,
        "detail_str": null,
        "detection_alert_id": null,
        "detection_rule_id": null,
        "detection_rule_name": null,
        "detection_ruleset_id": null,
        "detection_ruleset_name": null,
        "element_id": null,
        "element_list_id": null,
        "element_type": null,
        "email_addresses": null,
        "email_identifier": null,
        "email_reason": null,
        "error_str": null,
        "external_entity_id": null,
        "file_id": null,
        "global_value_list_collection_id": null,
        "group_id": null,
        "group_name": null,
        "md_kind": "core.aoaudit.auditdata",
        "md_version": 1,
        "new_value": null,
        "oauth_application_id": null,
        "old_value": null,
        "platform_ingest_job_id": null,
        "policy_assessment_completion_date": null,
        "policy_assessment_id": null,
        "policy_id": null,
        "policy_name": null,
        "reason_str": null,
        "refresh_token_id": null,
        "rule_id": null,
        "ruleevent_id": null,
        "ruleexception_id": null,
        "setting_name": null,
        "sink_id": null,
        "sink_name": null,
        "tag_id": null,
        "tag_name": null,
        "target_user_id": null,
        "target_user_username": null,
        "third_party_application_id": null,
        "third_party_application_name": null,
        "type_str": null,
        "unified_identity_email": null,
        "unified_identity_id": null,
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36",
        "user_ip": "198.51.100.2",
        "user_username": "jane@example.com",
        "workflow_instance_id": null,
        "workflow_instance_name": null
    },
    "action_type": "user_login_google",
    "log_id": "ad9ddec3-8542-4d5a-b710-67928321abdc",
    "omnitab_user_id": null,
    "org_id": 176,
    "perspective_id": null,
    "perspective_name": null,
    "policy_id": null,
    "service_id": null,
    "service_name": null,
    "service_type": "None",
    "user_id": 3187
}

Failure

{
    "action_at": "2023-06-14T21:57:50.583325+00:00",
    "action_data":
    {
        "access_token_id": null,
        "detail_str": null,
        "detection_alert_id": null,
        "detection_rule_id": null,
        "detection_rule_name": null,
        "detection_ruleset_id": null,
        "detection_ruleset_name": null,
        "element_id": null,
        "element_list_id": null,
        "element_type": null,
        "email_addresses": null,
        "email_identifier": null,
        "email_reason": null,
        "error_str": null,
        "external_entity_id": null,
        "file_id": null,
        "global_value_list_collection_id": null,
        "group_id": null,
        "group_name": null,
        "md_kind": "core.aoaudit.auditdata",
        "md_version": 1,
        "new_value": null,
        "oauth_application_id": null,
        "old_value": null,
        "platform_ingest_job_id": null,
        "policy_assessment_completion_date": null,
        "policy_assessment_id": null,
        "policy_id": null,
        "policy_name": null,
        "reason_str": null,
        "refresh_token_id": null,
        "rule_id": null,
        "ruleevent_id": null,
        "ruleexception_id": null,
        "setting_name": null,
        "sink_id": null,
        "sink_name": null,
        "tag_id": null,
        "tag_name": null,
        "target_user_id": null,
        "target_user_username": null,
        "third_party_application_id": null,
        "third_party_application_name": null,
        "type_str": null,
        "unified_identity_email": null,
        "unified_identity_id": null,
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36",
        "user_ip": "198.51.100.2",
        "user_username": "pmcandrew+test10",
        "workflow_instance_id": null,
        "workflow_instance_name": null
    },
    "action_type": "user_login_failed",
    "log_id": "6cbd2dc5-c125-40d1-8dcf-9936abda6c5f",
    "omnitab_user_id": null,
    "org_id": 176,
    "perspective_id": null,
    "perspective_name": null,
    "policy_id": null,
    "service_id": null,
    "service_name": null,
    "service_type": "None",
    "user_id": null
}

Success

{
    "action_at": "2023-06-22T20:48:41.714659+00:00",
    "action_data":
    {
        "access_token_id": null,
        "detail_str": null,
        "detection_alert_id": null,
        "detection_rule_id": null,
        "detection_rule_name": null,
        "detection_ruleset_id": null,
        "detection_ruleset_name": null,
        "element_id": null,
        "element_list_id": null,
        "element_type": null,
        "email_addresses": null,
        "email_identifier": null,
        "email_reason": null,
        "error_str": null,
        "external_entity_id": null,
        "file_id": null,
        "global_value_list_collection_id": null,
        "group_id": null,
        "group_name": null,
        "md_kind": "core.aoaudit.auditdata",
        "md_version": 1,
        "new_value": null,
        "oauth_application_id": null,
        "old_value": null,
        "platform_ingest_job_id": null,
        "policy_assessment_completion_date": null,
        "policy_assessment_id": null,
        "policy_id": null,
        "policy_name": null,
        "reason_str": null,
        "refresh_token_id": null,
        "rule_id": null,
        "ruleevent_id": null,
        "ruleexception_id": null,
        "setting_name": null,
        "sink_id": null,
        "sink_name": null,
        "tag_id": null,
        "tag_name": null,
        "target_user_id": null,
        "target_user_username": null,
        "third_party_application_id": null,
        "third_party_application_name": null,
        "type_str": null,
        "unified_identity_email": null,
        "unified_identity_id": null,
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36",
        "user_ip": "198.51.100.5",
        "user_username": "bob@example.com",
        "workflow_instance_id": null,
        "workflow_instance_name": null
    },
    "action_type": "user_logout",
    "log_id": "49fc4cd2-653e-4261-bb59-25dc6ee7a1c0",
    "omnitab_user_id": null,
    "org_id": 176,
    "perspective_id": null,
    "perspective_name": null,
    "policy_id": null,
    "service_id": null,
    "service_name": null,
    "service_type": "None",
    "user_id": 3187
}

Challenge

{
    "action_at": "2023-06-23T20:11:06.106260+00:00",
    "action_data":
    {
        "access_token_id": null,
        "detail_str": null,
        "detection_alert_id": null,
        "detection_rule_id": null,
        "detection_rule_name": null,
        "detection_ruleset_id": null,
        "detection_ruleset_name": null,
        "element_id": null,
        "element_list_id": null,
        "element_type": null,
        "email_addresses": null,
        "email_identifier": null,
        "email_reason": null,
        "error_str": null,
        "external_entity_id": null,
        "file_id": null,
        "global_value_list_collection_id": null,
        "group_id": null,
        "group_name": null,
        "md_kind": "core.aoaudit.auditdata",
        "md_version": 1,
        "new_value": null,
        "oauth_application_id": null,
        "old_value": null,
        "platform_ingest_job_id": null,
        "policy_assessment_completion_date": null,
        "policy_assessment_id": null,
        "policy_id": null,
        "policy_name": null,
        "reason_str": null,
        "refresh_token_id": null,
        "rule_id": null,
        "ruleevent_id": null,
        "ruleexception_id": null,
        "setting_name": null,
        "sink_id": null,
        "sink_name": null,
        "tag_id": null,
        "tag_name": null,
        "target_user_id": 12893,
        "target_user_username": "pmcandrew_test10",
        "third_party_application_id": null,
        "third_party_application_name": null,
        "type_str": null,
        "unified_identity_email": null,
        "unified_identity_id": null,
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36",
        "user_ip": "198.51.100.5",
        "user_username": "pmcandrew_test10",
        "workflow_instance_id": null,
        "workflow_instance_name": null
    },
    "action_type": "user_mfa_totp_challenge",
    "log_id": "76812b0e-d9b0-4730-b5a1-5d4169743e2e",
    "omnitab_user_id": null,
    "org_id": 176,
    "perspective_id": null,
    "perspective_name": null,
    "policy_id": null,
    "service_id": null,
    "service_name": null,
    "service_type": "None",
    "user_id": 12893
}

Success

{
    "action_at": "2023-06-20T14:20:30.626150+00:00",
    "action_data":
    {
        "access_token_id": null,
        "detail_str": null,
        "detection_alert_id": null,
        "detection_rule_id": null,
        "detection_rule_name": null,
        "detection_ruleset_id": null,
        "detection_ruleset_name": null,
        "element_id": null,
        "element_list_id": null,
        "element_type": null,
        "email_addresses": null,
        "email_identifier": null,
        "email_reason": null,
        "error_str": null,
        "external_entity_id": null,
        "file_id": null,
        "global_value_list_collection_id": null,
        "group_id": null,
        "group_name": null,
        "md_kind": "core.aoaudit.auditdata",
        "md_version": 1,
        "new_value": null,
        "oauth_application_id": null,
        "old_value": null,
        "platform_ingest_job_id": null,
        "policy_assessment_completion_date": null,
        "policy_assessment_id": null,
        "policy_id": null,
        "policy_name": null,
        "reason_str": null,
        "refresh_token_id": null,
        "rule_id": null,
        "ruleevent_id": null,
        "ruleexception_id": null,
        "setting_name": null,
        "sink_id": null,
        "sink_name": null,
        "tag_id": null,
        "tag_name": null,
        "target_user_id": 13148,
        "target_user_username": "pmcandrew_test11",
        "third_party_application_id": null,
        "third_party_application_name": null,
        "type_str": null,
        "unified_identity_email": null,
        "unified_identity_id": null,
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36",
        "user_ip": "198.51.100.4",
        "user_username": "mallory@example.com",
        "workflow_instance_id": null,
        "workflow_instance_name": null
    },
    "action_type": "user_created",
    "log_id": "188fdcf3-143a-49e9-ba80-452b48f42e4f",
    "omnitab_user_id": null,
    "org_id": 176,
    "perspective_id": null,
    "perspective_name": null,
    "policy_id": null,
    "service_id": null,
    "service_name": null,
    "service_type": "None",
    "user_id": 3187
}

Success

{
    "action_at": "2023-06-15T02:02:19.147946+00:00",
    "action_data":
    {
        "access_token_id": null,
        "detail_str": null,
        "detection_alert_id": null,
        "detection_rule_id": null,
        "detection_rule_name": null,
        "detection_ruleset_id": null,
        "detection_ruleset_name": null,
        "element_id": null,
        "element_list_id": null,
        "element_type": null,
        "email_addresses": null,
        "email_identifier": null,
        "email_reason": null,
        "error_str": null,
        "external_entity_id": null,
        "file_id": null,
        "global_value_list_collection_id": null,
        "group_id": null,
        "group_name": null,
        "md_kind": "core.aoaudit.auditdata",
        "md_version": 1,
        "new_value": null,
        "oauth_application_id": null,
        "old_value": null,
        "platform_ingest_job_id": null,
        "policy_assessment_completion_date": null,
        "policy_assessment_id": null,
        "policy_id": null,
        "policy_name": null,
        "reason_str": null,
        "refresh_token_id": null,
        "rule_id": null,
        "ruleevent_id": null,
        "ruleexception_id": null,
        "setting_name": null,
        "sink_id": null,
        "sink_name": null,
        "tag_id": null,
        "tag_name": null,
        "target_user_id": 12893,
        "target_user_username": "pmcandrew_test10",
        "third_party_application_id": null,
        "third_party_application_name": null,
        "type_str": null,
        "unified_identity_email": null,
        "unified_identity_id": null,
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36",
        "user_ip": "198.51.100.3",
        "user_username": "john@example.com",
        "workflow_instance_id": null,
        "workflow_instance_name": null
    },
    "action_type": "user_disabled",
    "log_id": "7f75c117-f8f8-4739-bfcf-cac8a728d486",
    "omnitab_user_id": null,
    "org_id": 176,
    "perspective_id": null,
    "perspective_name": null,
    "policy_id": null,
    "service_id": null,
    "service_name": null,
    "service_type": "None",
    "user_id": 3187
}

Success

{
    "action_at": "2023-06-14T22:00:24.705316+00:00",
    "action_data":
    {
        "access_token_id": null,
        "detail_str": "TOTP",
        "detection_alert_id": null,
        "detection_rule_id": null,
        "detection_rule_name": null,
        "detection_ruleset_id": null,
        "detection_ruleset_name": null,
        "element_id": null,
        "element_list_id": null,
        "element_type": null,
        "email_addresses": null,
        "email_identifier": null,
        "email_reason": null,
        "error_str": null,
        "external_entity_id": null,
        "file_id": null,
        "global_value_list_collection_id": null,
        "group_id": null,
        "group_name": null,
        "md_kind": "core.aoaudit.auditdata",
        "md_version": 1,
        "new_value": null,
        "oauth_application_id": null,
        "old_value": null,
        "platform_ingest_job_id": null,
        "policy_assessment_completion_date": null,
        "policy_assessment_id": null,
        "policy_id": null,
        "policy_name": null,
        "reason_str": null,
        "refresh_token_id": null,
        "rule_id": null,
        "ruleevent_id": null,
        "ruleexception_id": null,
        "setting_name": null,
        "sink_id": null,
        "sink_name": null,
        "tag_id": null,
        "tag_name": null,
        "target_user_id": 12893,
        "target_user_username": "pmcandrew_test10",
        "third_party_application_id": null,
        "third_party_application_name": null,
        "type_str": null,
        "unified_identity_email": null,
        "unified_identity_id": null,
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36",
        "user_ip": "198.51.100.4",
        "user_username": "pmcandrew_test10",
        "workflow_instance_id": null,
        "workflow_instance_name": null
    },
    "action_type": "user_mfa_enabled",
    "log_id": "7ed13faf-9e3c-4905-839d-ff44309c2f72",
    "omnitab_user_id": null,
    "org_id": 176,
    "perspective_id": null,
    "perspective_name": null,
    "policy_id": null,
    "service_id": null,
    "service_name": null,
    "service_type": "None",
    "user_id": 12893
}

Success

{
    "action_at": "2023-06-23T20:12:09.106337+00:00",
    "action_data":
    {
        "access_token_id": null,
        "detail_str": null,
        "detection_alert_id": null,
        "detection_rule_id": null,
        "detection_rule_name": null,
        "detection_ruleset_id": null,
        "detection_ruleset_name": null,
        "element_id": null,
        "element_list_id": null,
        "element_type": null,
        "email_addresses": null,
        "email_identifier": null,
        "email_reason": null,
        "error_str": null,
        "external_entity_id": null,
        "file_id": null,
        "global_value_list_collection_id": null,
        "group_id": null,
        "group_name": null,
        "md_kind": "core.aoaudit.auditdata",
        "md_version": 1,
        "new_value": "+1 856-981-2588",
        "oauth_application_id": null,
        "old_value": null,
        "platform_ingest_job_id": null,
        "policy_assessment_completion_date": null,
        "policy_assessment_id": null,
        "policy_id": null,
        "policy_name": null,
        "reason_str": null,
        "refresh_token_id": null,
        "rule_id": null,
        "ruleevent_id": null,
        "ruleexception_id": null,
        "setting_name": null,
        "sink_id": null,
        "sink_name": null,
        "tag_id": null,
        "tag_name": null,
        "target_user_id": 12893,
        "target_user_username": "pmcandrew_test10",
        "third_party_application_id": null,
        "third_party_application_name": null,
        "type_str": null,
        "unified_identity_email": null,
        "unified_identity_id": null,
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36",
        "user_ip": "198.51.100.5",
        "user_username": "pmcandrew_test10",
        "workflow_instance_id": null,
        "workflow_instance_name": null
    },
    "action_type": "user_mfa_disabled",
    "log_id": "34628772-1560-46da-81d0-2371c5cc3106",
    "omnitab_user_id": null,
    "org_id": 176,
    "perspective_id": null,
    "perspective_name": null,
    "policy_id": null,
    "service_id": null,
    "service_name": null,
    "service_type": "None",
    "user_id": 12893
}

Success

{
    "action_at": "2023-06-22T15:51:50.253793+00:00",
    "action_data":
    {
        "access_token_id": null,
        "detail_str": null,
        "detection_alert_id": null,
        "detection_rule_id": null,
        "detection_rule_name": null,
        "detection_ruleset_id": null,
        "detection_ruleset_name": null,
        "element_id": null,
        "element_list_id": null,
        "element_type": null,
        "email_addresses": null,
        "email_identifier": null,
        "email_reason": null,
        "error_str": null,
        "external_entity_id": null,
        "file_id": null,
        "global_value_list_collection_id": null,
        "group_id": null,
        "group_name": null,
        "md_kind": "core.aoaudit.auditdata",
        "md_version": 1,
        "new_value": "True",
        "oauth_application_id": null,
        "old_value": "False",
        "platform_ingest_job_id": null,
        "policy_assessment_completion_date": null,
        "policy_assessment_id": null,
        "policy_id": null,
        "policy_name": null,
        "reason_str": null,
        "refresh_token_id": null,
        "rule_id": null,
        "ruleevent_id": null,
        "ruleexception_id": null,
        "setting_name": "Direct Auth Enabled",
        "sink_id": null,
        "sink_name": null,
        "tag_id": null,
        "tag_name": null,
        "target_user_id": null,
        "target_user_username": null,
        "third_party_application_id": null,
        "third_party_application_name": null,
        "type_str": null,
        "unified_identity_email": null,
        "unified_identity_id": null,
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36",
        "user_ip": "198.51.100.5",
        "user_username": "jane@example.com",
        "workflow_instance_id": null,
        "workflow_instance_name": null
    },
    "action_type": "ao_sys_setting_change",
    "log_id": "d2c46cde-44f7-43ac-84f5-79b8184c8105",
    "omnitab_user_id": null,
    "org_id": 176,
    "perspective_id": null,
    "perspective_name": null,
    "policy_id": null,
    "service_id": null,
    "service_name": null,
    "service_type": "None",
    "user_id": 3187
}

Success

{
    "action_at": "2023-06-22T20:21:55.407230+00:00",
    "action_data":
    {
        "access_token_id": null,
        "detail_str": null,
        "detection_alert_id": null,
        "detection_rule_id": null,
        "detection_rule_name": null,
        "detection_ruleset_id": null,
        "detection_ruleset_name": null,
        "element_id": null,
        "element_list_id": null,
        "element_type": null,
        "email_addresses": null,
        "email_identifier": null,
        "email_reason": null,
        "error_str": null,
        "external_entity_id": null,
        "file_id": null,
        "global_value_list_collection_id": null,
        "group_id": null,
        "group_name": null,
        "md_kind": "core.aoaudit.auditdata",
        "md_version": 1,
        "new_value": null,
        "oauth_application_id": null,
        "old_value": null,
        "platform_ingest_job_id": null,
        "policy_assessment_completion_date": null,
        "policy_assessment_id": null,
        "policy_id": 442431,
        "policy_name": "EMM Test Policy",
        "reason_str": null,
        "refresh_token_id": null,
        "rule_id": null,
        "ruleevent_id": null,
        "ruleexception_id": null,
        "setting_name": null,
        "sink_id": null,
        "sink_name": null,
        "tag_id": null,
        "tag_name": null,
        "target_user_id": null,
        "target_user_username": null,
        "third_party_application_id": null,
        "third_party_application_name": null,
        "type_str": null,
        "unified_identity_email": null,
        "unified_identity_id": null,
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36",
        "user_ip": "198.51.100.1",
        "user_username": "jane@example.com",
        "workflow_instance_id": null,
        "workflow_instance_name": null
    },
    "action_type": "policy_created",
    "log_id": "cb89b034-2f3b-4b41-9a34-6fdb289f4a6a",
    "omnitab_user_id": null,
    "org_id": 176,
    "perspective_id": null,
    "perspective_name": null,
    "policy_id": 442431,
    "service_id": null,
    "service_name": null,
    "service_type": "box",
    "user_id": 3187
}

Success

{
    "action_at": "2023-06-22T20:05:09.728571+00:00",
    "action_data":
    {
        "access_token_id": null,
        "detail_str": null,
        "detection_alert_id": null,
        "detection_rule_id": null,
        "detection_rule_name": null,
        "detection_ruleset_id": null,
        "detection_ruleset_name": null,
        "element_id": null,
        "element_list_id": null,
        "element_type": null,
        "email_addresses": null,
        "email_identifier": null,
        "email_reason": null,
        "error_str": null,
        "external_entity_id": null,
        "file_id": null,
        "global_value_list_collection_id": null,
        "group_id": null,
        "group_name": null,
        "md_kind": "core.aoaudit.auditdata",
        "md_version": 1,
        "new_value": null,
        "oauth_application_id": null,
        "old_value": null,
        "platform_ingest_job_id": null,
        "policy_assessment_completion_date": null,
        "policy_assessment_id": null,
        "policy_id": null,
        "policy_name": null,
        "reason_str": null,
        "refresh_token_id": null,
        "rule_id": null,
        "ruleevent_id": null,
        "ruleexception_id": null,
        "setting_name": null,
        "sink_id": null,
        "sink_name": null,
        "tag_id": null,
        "tag_name": null,
        "target_user_id": null,
        "target_user_username": null,
        "third_party_application_id": null,
        "third_party_application_name": null,
        "type_str": null,
        "unified_identity_email": null,
        "unified_identity_id": null,
        "user_agent": null,
        "user_ip": null,
        "user_username": "mallory@example.com",
        "workflow_instance_id": null,
        "workflow_instance_name": null
    },
    "action_type": "ms_detection_ingestion_disabled",
    "log_id": "ea080b00-2cf0-49fe-b1ba-6081f17a66ff",
    "omnitab_user_id": null,
    "org_id": 176,
    "perspective_id": null,
    "perspective_name": null,
    "policy_id": null,
    "service_id": 35781,
    "service_name": "AppOmni",
    "service_type": "box",
    "user_id": 3187
}

Success

{
    "action_at": "2023-07-12T19:07:57.569196+00:00",
    "action_data":
    {
        "md_kind": "core.aoaudit.auditdata",
        "md_version": 1,
        "policy_id": 410860,
        "policy_name": "Test Salesforce Policy",
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36",
        "user_ip": "198.51.100.4",
        "user_username": "bob@example.com"
    },
    "action_type": "policy_deleted",
    "log_id": "d4b105e8-d29b-436e-947e-52a6be5f58de",
    "org_id": 176,
    "service_type": "sfdc",
    "user_id": 3187
}

Success

{
    "action_by": null,
    "additional_details": null,
    "created_at": "2023-05-09T08:28:41-07:00",
    "created_by":
    {
        "id": "16779123456",
        "login": "alice@example.com",
        "name": "Alice Brown",
        "type": "user"
    },
    "event_id": "00000000-abcd-1234-ab08-2cfe92d42606",
    "event_type": "LOGIN",
    "ip_address": "198.51.100.1",
    "session_id": null,
    "source":
    {
        "id": "16779123456",
        "login": "alice@example.com",
        "name": "Alice Brown",
        "type": "user"
    },
    "type": "event"
}

Failure

{
    "action_by": null,
    "additional_details": null,
    "created_at": "2023-05-09T09:08:06-07:00",
    "created_by":
    {
        "id": "2",
        "login": "",
        "name": "Unknown User",
        "type": "user"
    },
    "event_id": "00000000-abcd-1234-84ee-12298e09cfa9",
    "event_type": "FAILED_LOGIN",
    "ip_address": "198.51.100.2",
    "session_id": null,
    "source":
    {
        "id": "12345648385",
        "login": "john@example.com",
        "name": "John Doe",
        "type": "user"
    },
    "type": "event"
}

Create

{
    "action_by": null,
    "additional_details": null,
    "created_at": "2023-05-09T09:34:43-07:00",
    "created_by":
    {
        "id": "12345648385",
        "login": "bob@example.com",
        "name": "Bob Smith",
        "type": "user"
    },
    "event_id": "00000000-abcd-1234-92ad-46f2f69e45cd",
    "event_type": "NEW_USER",
    "ip_address": "198.51.100.3",
    "session_id": null,
    "source":
    {
        "id": "25512345631",
        "login": "mallory@example.com",
        "name": "Mallory Jones",
        "type": "user"
    },
    "type": "event"
}

Update

{
    "action_by": null,
    "additional_details": null,
    "created_at": "2023-05-09T09:35:29-07:00",
    "created_by":
    {
        "id": "12345648385",
        "login": "jane@example.com",
        "name": "Jane Miller",
        "type": "user"
    },
    "event_id": "00000000-abcd-1234-be64-7fdc0421e478",
    "event_type": "EDIT_USER",
    "ip_address": "198.51.100.5",
    "session_id": null,
    "source":
    {
        "id": "18863123456",
        "login": "alice@example.com",
        "name": "Alice Brown",
        "type": "user"
    },
    "type": "event"
}

Delete

{
    "action_by": null,
    "additional_details": null,
    "created_at": "2023-05-09T09:35:58-07:00",
    "created_by":
    {
        "id": "12345648385",
        "login": "bob@example.com",
        "name": "Bob Smith",
        "type": "user"
    },
    "event_id": "00000000-abcd-1234-9c97-5e32f323b9f0",
    "event_type": "DELETE_USER",
    "ip_address": "198.51.100.4",
    "session_id": null,
    "source":
    {
        "id": "18863123456",
        "login": "jane@example.com",
        "name": "Jane Miller",
        "type": "user"
    },
    "type": "event"
}

Create

{
    "action_by": null,
    "additional_details": null,
    "created_at": "2023-05-09T09:36:36-07:00",
    "created_by":
    {
        "id": "18863648385",
        "login": "John Doe",
        "name": "john@example.com",
        "type": "user"
    },
    "event_id": "00000000-abcd-1234-a8a6-6f5474e5d86d",
    "event_type": "GROUP_CREATION",
    "ip_address": "198.51.100.3",
    "session_id": null,
    "source":
    {
        "group_id": "15297703631",
        "group_name": "my_sample_group"
    },
    "type": "event"
}

Update

{
    "action_by": null,
    "additional_details": null,
    "created_at": "2023-05-09T09:36:46-07:00",
    "created_by":
    {
        "id": "18863648385",
        "login": "john@example.com",
        "name": "John Doe",
        "type": "user"
    },
    "event_id": "49d24c58-a0e5-4ec7-9ccd-347827b0afed",
    "event_type": "GROUP_EDITED",
    "ip_address": "198.51.100.1",
    "session_id": null,
    "source":
    {
        "group_id": "15297703631",
        "group_name": "a_sample_group"
    },
    "type": "event"
}

Delete

{
    "action_by": null,
    "additional_details": null,
    "created_at": "2023-05-09T10:46:19-07:00",
    "created_by":
    {
        "id": "18863648385",
        "login": "alice@example.com",
        "name": "Alice Brown",
        "type": "user"
    },
    "event_id": "24ada35a-a9e9-4c67-8fc9-33b5b9f9b52b",
    "event_type": "GROUP_DELETION",
    "ip_address": "198.51.100.2",
    "session_id": null,
    "source":
    {
        "group_id": "15299083860",
        "group_name": "a_sample_group"
    },
    "type": "event"
}

Add

{
    "action_by": null,
    "additional_details":
    {
        "group_id": "15297703631",
        "group_name": "a_sample_group"
    },
    "created_at": "2023-05-09T10:24:15-07:00",
    "created_by":
    {
        "id": "18863648385",
        "login": "bob@example.com",
        "name": "Bob Smith",
        "type": "user"
    },
    "event_id": "f0545aa9-4be4-451e-a8d2-3c56aa257b8a",
    "event_type": "GROUP_ADD_USER",
    "ip_address": "198.51.100.3",
    "session_id": null,
    "source":
    {
        "id": "18863890488",
        "login": "mallory@example.com",
        "name": "Mallory Jones",
        "type": "user"
    },
    "type": "event"
}

Remove

{
    "action_by": null,
    "additional_details":
    {
        "group_id": "9744086129",
        "group_name": "a_sample_group"
    },
    "created_at": "2023-05-09T10:45:45-07:00",
    "created_by":
    {
        "id": "18863648385",
        "login": "mallory@example.com",
        "name": "Mallory Jones",
        "type": "user"
    },
    "event_id": "56ae6ebb-7d6c-418e-bdeb-98d067c52af2",
    "event_type": "GROUP_REMOVE_USER",
    "ip_address": "198.51.100.4",
    "session_id": null,
    "source":
    {
        "id": "18863890488",
        "login": "jane@example.com",
        "name": "Jane Miller",
        "type": "user"
    },
    "type": "event"
}

Add

{
    "accessible_by":
    {
        "id": "25575650631",
        "login": "john@example.com",
        "name": "John Doe",
        "type": "user"
    },
    "action_by": null,
    "additional_details":
    {
        "collab_id": "44582004179",
        "is_performed_by_admin": false,
        "role": "Editor",
        "type": "box://event/additional_details/collaboration",
        "version_id": "1328658101408"
    },
    "created_at": "2023-05-18T12:57:12-07:00",
    "created_by":
    {
        "id": "18863648385",
        "login": "jane@example.com",
        "name": "Jane Miller",
        "type": "user"
    },
    "event_id": "15f0f70a-4502-496a-badf-5a0b12e49656",
    "event_type": "COLLABORATION_INVITE",
    "ip_address": "198.51.100.5",
    "session_id": null,
    "source":
    {
        "file_id": "1209733707368",
        "file_name": "a_sample_file.doc",
        "owned_by":
        {
            "id": "18863648385",
            "login": "jane@example.com",
            "name": "Jane Miller",
            "type": "user"
        },
        "parent":
        {
            "id": "206846635609",
            "name": "My Box Notes",
            "type": "folder"
        },
        "user_id": "25575650631",
        "user_name": "John Doe"
    },
    "type": "event"
}

Remove

{
    "action_by": null,
    "additional_details":
    {
        "collab_id": "44582741378",
        "is_performed_by_admin": false,
        "type": "box://event/additional_details/collaboration",
        "version_id": "1328658101408"
    },
    "created_at": "2023-05-18T12:47:09-07:00",
    "created_by":
    {
        "id": "18863648385",
        "login": "john@example.com",
        "name": "John Doe",
        "type": "user"
    },
    "event_id": "052e68a2-7a29-4694-a77f-fec5713cb26f",
    "event_type": "COLLABORATION_REMOVE",
    "ip_address": "198.51.100.1",
    "session_id": null,
    "source":
    {
        "file_id": "1209733707368",
        "file_name": "a_sample_file.doc",
        "owned_by":
        {
            "id": "18863648385",
            "login": "john@example.com",
            "name": "John Doe",
            "type": "user"
        },
        "parent":
        {
            "id": "206846635609",
            "name": "My Box Notes",
            "type": "folder"
        },
        "user_email": "alice@example.com"
    },
    "type": "event"
}

Add

{
    "action_by": null,
    "additional_details": null,
    "created_at": "2023-05-09T09:27:03-07:00",
    "created_by":
    {
        "id": "18863648385",
        "login": "alice@example.com",
        "name": "Alice Brown",
        "type": "user"
    },
    "event_id": "7fd655c7-5a4a-4e13-8375-dc08cd2cf8b9",
    "event_type": "MULTI_FACTOR_AUTH_ENABLE",
    "ip_address": "Unknown IP",
    "session_id": null,
    "source":
    {
        "id": "18863648385",
        "login": "alice@example.com",
        "name": "Alice Brown",
        "type": "user"
    },
    "type": "event"
}

Remove

{
    "action_by": null,
    "additional_details": null,
    "created_at": "2023-05-09T09:29:19-07:00",
    "created_by":
    {
        "id": "18863648385",
        "login": "bob@example.com",
        "name": "Bob Smith",
        "type": "user"
    },
    "event_id": "0bf5e6ad-a068-4770-9979-c7f409eb976b",
    "event_type": "MULTI_FACTOR_AUTH_DISABLE",
    "ip_address": "Unknown IP",
    "session_id": null,
    "source":
    {
        "id": "18863648385",
        "login": "bob@example.com",
        "name": "Bob Smith",
        "type": "user"
    },
    "type": "event"
}

Create

{
    "action_by": null,
    "additional_details":
    {
        "ekm_id": "b87156a9-6aff-4c21-910b-c5f1a8a02afd",
        "service_id": "231318",
        "service_name": "Multiput Uploads",
        "size": 2584,
        "version_id": "1319684204015"
    },
    "created_at": "2023-05-09T11:15:47-07:00",
    "created_by":
    {
        "id": "18863648385",
        "login": "mallory@example.com",
        "name": "Mallory Jones",
        "type": "user"
    },
    "event_id": "aeffeb99-f9a5-4243-9d3c-93f862dceec7",
    "event_type": "UPLOAD",
    "ip_address": "198.51.100.4",
    "session_id": null,
    "source":
    {
        "item_id": "1209714644015",
        "item_name": "a_sample_file.csv",
        "item_type": "file",
        "owned_by":
        {
            "id": "18863648385",
            "login": "mallory@example.com",
            "name": "Mallory Jones",
            "type": "user"
        },
        "parent":
        {
            "id": "206849236842",
            "name": "Test Folder",
            "type": "folder"
        }
    },
    "type": "event"
}

Read

{
    "action_by": null,
    "additional_details":
    {
        "access_token_identifier": "16c1948d38e23d80203df77a0273928ff0eb50bad8b62fcc6b4fe73e03482a11",
        "ekm_id": "fb01c788-3be7-444d-b165-89a52741235f",
        "service_id": "553530",
        "service_name": "Box Elements (used in Box Web App)",
        "size": 2584,
        "version_id": "1319684204015"
    },
    "created_at": "2023-05-09T11:16:00-07:00",
    "created_by":
    {
        "id": "18863648385",
        "login": "jane@example.com",
        "name": "Jane Miller",
        "type": "user"
    },
    "event_id": "80ddc3b3-dd44-4377-9fe7-a634228cc952",
    "event_type": "CONTENT_ACCESS",
    "ip_address": "198.51.100.5",
    "session_id": null,
    "source":
    {
        "item_id": "1209714644015",
        "item_name": "a_sample_file.csv",
        "item_type": "file",
        "owned_by":
        {
            "id": "18863648385",
            "login": "jane@example.com",
            "name": "Jane Miller",
            "type": "user"
        },
        "parent":
        {
            "id": "206849236842",
            "name": "Test Folder",
            "type": "folder"
        }
    },
    "type": "event"
}

Update

{
    "action_by": null,
    "additional_details":
    {
        "file_hash": "0d012f12345678de3df12345b0b123a59f123456",
        "file_path": "/SAMPLE/Reference Documents",
        "hash_type": "sha1",
        "service_id": "254429",
        "service_name": "Box Drive",
        "size": 4398971,
        "version_id": "1319736874242"
    },
    "created_at": "2023-05-09T11:30:38-07:00",
    "created_by":
    {
        "id": "12345678124",
        "login": "john@example.com",
        "name": "John Doe",
        "type": "user"
    },
    "event_id": "00000000-abcd-1234-8b08-418033e43a4b",
    "event_type": "RENAME",
    "ip_address": "198.51.100.1",
    "session_id": null,
    "source":
    {
        "item_id": "12012345678942",
        "item_name": "a_sample_file.pdf",
        "item_type": "file",
        "owned_by":
        {
            "id": "12345678124",
            "login": "john@example.com",
            "name": "John Doe",
            "type": "user"
        },
        "parent":
        {
            "id": "1234567807873",
            "name": "Reference Documents",
            "type": "folder"
        }
    },
    "type": "event"
}

Delete

{
    "action_by": null,
    "additional_details":
    {
        "size": 360705,
        "version_id": "1319678729473"
    },
    "created_at": "2023-05-09T11:15:12-07:00",
    "created_by":
    {
        "id": "18863648385",
        "login": "alice@example.com",
        "name": "Alice Brown",
        "type": "user"
    },
    "event_id": "9fbcf20f-aeb7-4149-ab8e-3f56cab43337",
    "event_type": "DELETE",
    "ip_address": "198.51.100.2",
    "session_id": null,
    "source":
    {
        "item_id": "1209709863073",
        "item_name": "a_sample_file.pdf",
        "item_type": "file",
        "owned_by":
        {
            "id": "18863648385",
            "login": "alice@example.com",
            "name": "Alice Brown",
            "type": "user"
        },
        "parent":
        {
            "id": "206849236842",
            "name": "Test Folder",
            "type": "folder"
        }
    },
    "type": "event"
}

Download

{
    "action_by": null,
    "additional_details":
    {
        "ekm_id": "5b300b24-36d8-493a-a823-41ac400d284e",
        "size": 360705,
        "version_id": "1319678729473"
    },
    "created_at": "2023-05-09T11:14:52-07:00",
    "created_by":
    {
        "id": "18863648385",
        "login": "bob@example.com",
        "name": "Bob Smith",
        "type": "user"
    },
    "event_id": "f70ed75d-9a96-4aac-aef8-5cce1a5c1eb8",
    "event_type": "DOWNLOAD",
    "ip_address": "198.51.100.3",
    "session_id": null,
    "source":
    {
        "item_id": "1209709863073",
        "item_name": "a_sample_report.pdf",
        "item_type": "file",
        "owned_by":
        {
            "id": "18863648385",
            "login": "bob@example.com",
            "name": "Bob Smith",
            "type": "user"
        },
        "parent":
        {
            "id": "206849236842",
            "name": "Test Folder",
            "type": "folder"
        }
    },
    "type": "event"
}

Success

{
    "action": "admin_login",
    "description":
    {
        "device": "123-456-7890",
        "factor": "push",
        "ip_address": "192.168.10.1",
        "primary_auth_method": "Password",
        "role": "Owner"
    },
    "isotimestamp": "2024-05-17T17:24:21+00:00",
    "object": null,
    "timestamp": 1715966661,
    "username": "John Doe"
}

Failure

{
    "action": "admin_login_error",
    "description":
    {
        "email": "jane.doe@acme.com",
        "error": "Invalid password attempt",
        "ip_address": "192.168.1.1"
    },
    "isotimestamp": "2024-05-20T19:23:45+00:00",
    "object": null,
    "timestamp": 1716233025,
    "username": "Jane Doe"
}

Failure

{
    "action": "admin_2fa_error",
    "description":
    {
        "email": "john.smith@example.com",
        "error": "Invalid passcode.",
        "factor": "sms",
        "ip_address": "192.168.10.1"
    },
    "isotimestamp": "2024-05-21T17:58:04+00:00",
    "object": null,
    "timestamp": 1716314284,
    "username": "Smith, John"
}

Flagged

{
    "action": "admin_2fa_error",
    "description":
    {
        "email": "joe.smith@example.com",
        "error": "Login request reported as fraudulent.",
        "factor": "push",
        "ip_address": "192.168.1.2"
    },
    "isotimestamp": "2024-05-23T19:17:28+00:00",
    "object": null,
    "timestamp": 1716491848,
    "username": "Joe Smith"
}

User

{
    "action": "user_create",
    "description":
    {
        "email": "",
        "enable_auto_prompt": true,
        "notes": "",
        "realname": "",
        "status": "Active",
        "uname": "bbanner@example.com"
    },
    "isotimestamp": "2024-05-17T17:24:53+00:00",
    "object": "bbanner@example.com",
    "timestamp": 1715966693,
    "username": "Jane Doe"
}

Admin

{
    "action": "admin_create",
    "description":
    {
        "administrative_units": "",
        "email": "bwayne@batman.com",
        "hardtoken": null,
        "is_temporary_password": false,
        "name": "Bruce Wayne",
        "phone": null,
        "restricted_by_admin_units": false,
        "role": "Administrator",
        "status": "Pending Activation",
        "subaccount_access_tags":
        []
    },
    "isotimestamp": "2024-05-23T20:16:23+00:00",
    "object": "Bruce Wayne",
    "timestamp": 1716495383,
    "username": "Jane Doe"
}

User

{
    "action": "user_update",
    "description":
    {
        "email": "tonystark@acme.com",
        "realname": "Tony Stark"
    },
    "isotimestamp": "2024-05-23T19:41:21+00:00",
    "object": "tonystark",
    "timestamp": 1716493281,
    "username": "James Doe"
}

Admin

{
    "action": "admin_update",
    "description":
    {
        "administrative_units": "",
        "restricted_by_admin_units": false,
        "role": "Help Desk"
    },
    "isotimestamp": "2024-05-29T12:54:47+00:00",
    "object": "Bruce Banner",
    "timestamp": 1716987287,
    "username": "John Doe"
}

User

{
    "action": "user_pending_delete",
    "description":
    {
        "status": "Pending Deletion"
    },
    "isotimestamp": "2024-05-17T17:30:04+00:00",
    "object": "sally.smith@example.com",
    "timestamp": 1715967004,
    "username": "John Doe"
}

Admin

{
    "action": "admin_delete",
    "description":
    {
        "administrative_units": "",
        "email": "bob.smith@example.com",
        "hardtoken": null,
        "is_temporary_password": false,
        "name": "Bob Smith",
        "phone": null,
        "restricted_by_admin_units": false,
        "role": "Administrator",
        "status": "Pending Activation",
        "subaccount_role": "Administrator"
    },
    "isotimestamp": "2024-05-23T20:16:36+00:00",
    "object": "Bob Smith",
    "timestamp": 1716495396,
    "username": "Jane Doe"
}

Success

{
    "action": "group_create",
    "description":
    {
        "_status": "Active",
        "administrative_units": "",
        "desc": "East coast admin group",
        "name": "custom_admin_group_east"
    },
    "isotimestamp": "2024-05-17T17:31:18+00:00",
    "object": "custom_admin_group_east",
    "timestamp": 1715967078,
    "username": "Jane Doe"
}

Success

{
    "action": "group_update",
    "description":
    {
        "_status": "Disabled"
    },
    "isotimestamp": "2024-05-23T19:42:49+00:00",
    "object": "custom_group_bypass_users",
    "timestamp": 1716493369,
    "username": "John Doe"
}

Success

{
    "action": "group_delete",
    "description":
    {
        "_status": "Disabled",
        "administrative_units": "",
        "desc": "",
        "name": "local_login"
    },
    "isotimestamp": "2024-05-23T19:43:09+00:00",
    "object": "custom_group_west_users",
    "timestamp": 1716493389,
    "username": "John Doe"
}

Success

{
    "action": "user_update",
    "description":
    {
        "groups":
        [
            {
                "_status": "Bypass",
                "desc": "custom group for bypass users",
                "name": "custom_group_user_bypass"
            }
        ]
    },
    "isotimestamp": "2024-05-23T19:43:23+00:00",
    "object": "Mary Smith",
    "timestamp": 1716493403,
    "username": "Jane Doe"
}

Success

{
    "action": "user_update",
    "description":
    {
        "groups":
        [
            null
        ]
    },
    "isotimestamp": "2024-05-23T19:43:42+00:00",
    "object": "Steve Smith",
    "timestamp": 1716493422,
    "username": "Jane Doe"
}

Success

{
    "action": "webauthncredential_create",
    "description":
    {
        "authenticator_type": "Security key",
        "browser": "Chrome",
        "browser_version": "125.0.0.0",
        "credential_name": "Security key",
        "os": "Mac OS X",
        "os_version": "10.15.7",
        "owner_id": "DURTAOK2HW7ORVKHXQDU",
        "owner_name": "luke.skywalker@republic.com",
        "owner_type": "user",
        "passwordless_authorized": false,
        "transport_types": "nfc,usb",
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
    },
    "isotimestamp": "2024-05-17T17:36:03+00:00",
    "object": "WAB9XG0DD12N34EQDGTP",
    "timestamp": 1715967363,
    "username": "Jane Doe"
}

User

{
    "action": "user_update",
    "description": "{\"phones\": \"\"}",
    "isotimestamp": "2024-05-28T17:17:58+00:00",
    "object": "bob.smith@acme.com",
    "timestamp": 1716916678,
    "username": "John Doe"
}

Admin

{
    "action": "admin_update",
    "description": "{\"phone\": null}",
    "isotimestamp": "2024-05-28T17:18:45+00:00",
    "object": "Bruce Banner",
    "timestamp": 1716916725,
    "username": "Jane Doe"
}

Success

{
    "action": "cloudsso_add_saml_authsource",
    "description": null,
    "isotimestamp": "2024-05-29T15:03:35+00:00",
    "object": null,
    "timestamp": 1716995015,
    "username": "John Doe"
}