These API calls are included in the Aurora Endpoint Security console audit log when an item is created or updated. The Who field displays the application name, not the username.

• Policy: create, update, or delete
• Global List: add or delete
• Zone: create, update, or delete
• Tenant User: create, update, or delete
• Device: update device, update device threat, or delete device