Eco Id

[varies]

This is the administrator user's EcoID, if available.

Event Name

AuditLog

This is an audit log event.

AcceptEula

The user accepted the End-User License Agreement (the first user to log in to a newly created tenant).

AgentUpdate

The user updated the Aurora Protect Desktop agent.

ApplicationAdd

The administrator user created a custom application (on the Integration page). This includes the name of the application.

ApplicationEdit

The administrator user updated the custom application name.

ApplicationEdit

The administrator user changed the permissions for a custom application.

ApplicationEdit

The administrator user regenerated the credentials for the custom application.

ApplicationRemove

The administrator user removed a custom application.

CertificateRepositoryAddItem

The administrator user added a certificate. The message includes the name and thumbprint for the certificate.

CertificateRepositoryDeleteItem

The administrator user deleted a certificate. The message includes the name and thumbprint for the certificate.

CertificateRepositoryEditItem

The administrator user edited a certificate. The message includes the name and thumbprint for the certificate.

CertificateSafelistAddItem

The administrator user added a certificate to the safe list.

CertificateSafelistDeleteItem

The administrator user removed a certificate from the safe list.

CustomAuthenticationDisable

The administrator user disabled custom authentication.

CustomAuthenticationSave

The administrator user saved custom authentication settings.

DeleteAllQuarantinedFiles

The administrator user issued a command from the management console to delete all quarantined files on a device.

DeleteTokenThreatDataReport

The administrator user deleted the threat data report token.

DetectionExceptionAdd

The administrator user added an Aurora Focus detection exception.

DetectionExceptionEdit

The administrator user edited an Aurora Focus detection exception.

DetectionExceptionRemove

The administrator user removed an Aurora Focus detection exception.

DetectionRuleAdd

The administrator user added an Aurora Focus detection rule.

DetectionRuleEdit

The administrator user edited an Aurora Focus detection rule.

DetectionRuleRemove

The administrator user removed an Aurora Focus detection rule.

DetectionRuleSetAdd

The administrator user added an Aurora Focus detection rule set.

DetectionRuleSetEdit

The administrator user edited an Aurora Focus detection rule set.

DetectionRuleSetRemove

The administrator user removed an Aurora Focus detection rule set.

DetectionsChangeStatus

The administrator user changed the status of an Aurora Focus detection.

DetectionsRemove

The administrator user removed an Aurora Focus detection.

DeviceAdd

The administrator user registered a device.

DeviceChangeLockdownProfile

The administrator user changed the customized partial lockdown configuration for a device.

DeviceEdit

The administrator user edited a device.

DeviceFileDownload

The administrator user download a file that Aurora Focus identified as a potential threat.

DeviceLock

The administrator user locked a device.

DeviceRemove

The administrator user removed a device.

DeviceShowUnlockKey

The administrator user revealed the unlock key for a device.

DeviceUnlock

The administrator user unlocked a device.

DownloadThreatDataReport

The administrator user downloaded the deprecated threat data report.

EndUserAssignPolicy

The administrator user assigned an Aurora Protect Mobile policy to one or more users. The message indicates the assigned users and policy.

EndUserAdd

The administrator user added an Aurora Protect Mobile user. The message includes the Aurora Protect Mobile user’s email address and name.

EndUserImport

The administrator user imported Aurora Protect Mobile users. The message includes the Aurora Protect Mobile user email addresses and names.

EndUserRemove

The user administrator removed an Aurora Protect Mobile user. The message includes the Aurora Protect Mobile user’s email address and name.

EndUserSendInvitation

The administrator user sent an activation password and QR code to one or more Aurora Protect Mobile devices. The message includes the Aurora Protect Mobile user email addresses, a success count, and a failure count.

FocusDataAdd

The administrator user retrieved focus data.

GenerateTokenThreatDataReport

The administrator user generated a new token for the threat data report.

GhostLoginSettingChange

The administrator user enabled or disabled the enable support login feature.

GlobalListAdd

The administrator user added a file to the global list.

GlobalListRemove

The administrator user removed a file from the global list.

InstallationTokenDelete

The administrator user deleted the installation token.

InstallationTokenRegenerate

The administrator user generated a new installation token.

InstaQueryAdd

The administrator user added an InstaQuery.

InstaQueryRemove

The administrator user removed an InstaQuery.

InvitationUrlGenerate

The administrator user generated an invitation URL.

JobServiceStop

The administrator user stopped a package deploy job.

LockdownConfigurationAdd

The administrator user added a custom partial lockdown configuration.

LockdownConfigurationEdit

The administrator user changed a custom partial lockdown configuration.

LockdownConfigurationDelete

The administrator user deleted a custom partial lockdown configuration.

LoginFailure

The administrator user failed to log in to the management console.

LoginSuccess

The administrator user successfully logged in to the management console.

MobileAlertsExport

The administrator user exported Aurora Protect Mobile alert information from the management console. The message indicates any filters that were applied.

MobileAlertsIgnore

The administrator user selected and ignored a Aurora Protect Mobile alert. The message indicates the type and name of the mobile alert.

MobileDeviceExport

The administrator user exported Aurora Protect Mobile device information from the management console. The message indicates any filters that were applied.

MobileDeviceRemove

The administrator user removed an Aurora Protect Mobile device. The message indicates the removed user and device details.

MobileExclusionsAdd

The administrator user added an app or developer certificate to the Aurora Protect Mobile safe or unsafe list.

MobileExclusionsRemove

The administrator user removed an app or developer certificate from the Aurora Protect Mobile safe or unsafe list.

MobilePolicyAdd

The administrator user added an Aurora Protect Mobile policy. The message indicates the policy name and settings.

MobilePolicyEdit

The administrator user edited an Aurora Protect Mobile policy. The message indicates the policy name and changes.

MobilePolicyRemove

The administrator user removed an Aurora Protect Mobile policy. The message indicates the removed policy.

NightlyThreatDataReportChange

The administrator user enabled or disabled the threat data report (on the applications page).

PackageDeployAdd

The administrator user added a package deploy.

PackageDeployRemove

The administrator user removed a package deploy.

PackagePlaybookAdd

The administrator user added an Aurora Focus package playbook.

PackagePlaybookEdit

The administrator user edited an Aurora Focus package playbook.

PackagePlaybookRemove

The administrator user removed an Aurora Focus package playbook.

PlaybookResultRemove

The administrator user removed an Aurora Focus package playbook result.

PolicyAdd

The administrator user added a policy. The message includes the policy name.

PolicyEdit

The administrator user edited a policy. The message includes the policy name.

PolicyRemove

The administrator user removed a policy. The message includes the policy name.

PolicySafeListAdd

The administrator user added a file to the policy safe list. The message includes the SHA256 hash that was added.

PolicySafeListRemove

The administrator user removed a file from the policy safe list. The message includes the SHA256 hash that was removed.

RemoteResponseConnect

The administrator user opened an Aurora Focus remote response session with a device.

RemoteResponseDisconnect

The administrator user closed an Aurora Focus remote response session.

RequestToGenerateThreatDataReport

The administrator user enabled or disabled the Threat Data Report (on the Application page).

ScriptControlExclusionListAdd

The administrator user added a script to the Global Safe List.

ScriptControlExclusionListRemove

The administrator user removed a script from the Global Safe List.

SyslogDisable

The administrator user disabled the syslog feature.

SyslogSettingSave

The administrator user saved the syslog settings.

ThreatGlobalQuarantine

The administrator user added a file to the Global Quarantine List.

ThreatQuarantine

The administrator user quarantined a file for an endpoint.

ThreatSafeList

The administrator user added a file to the Global Safe List.

ThreatWaive

The administrator user waived a file for an endpoint.

UninstallAgentPasswordSave

The user saved a password after enabling the option to require a password to uninstall the Aurora Protect Desktop agent.

UninstallAgentRequirePasswordDisable

The user turned off the option to require users to specify a password to uninstall the Aurora Protect Desktop agent.

UserAdd

The administrator user created a user.

UserEdit

The administrator user edited a user.

UserRemove

The administrator user removed a user.

ZoneAdd

The administrator user added a zone.

ZoneAddDevice

The administrator user added a device to a zone.

ZoneEdit

The administrator user edited a zone.

ZoneRemove

The administrator user removed a zone.

ZoneRemoveDevice

The administrator user removed a device from a zone.

ZoneRuleAdd

The administrator user added a zone rule.

ZoneRuleEdit

The administrator user edited a zone rule.

ZoneRuleRemove

The administrator user removed a zone rule.

Message

[varies]

The message contains information related to the action. Example: When a file is added to the global quarantine list, the message might include the file hash and the reason given for adding it to the global list.

User

[varies]

The user who logged in and triggered this audit log event.