Vendor Documentation
Classification
|
Rule Name |
Rule Type |
Common Event |
Classification |
|
Keeper Security Events |
Base Rule |
General Security Information |
Information |
|
User Vault Login |
Sub Rule |
User Logon |
Authentication Success |
|
Admin Console Login |
Sub Rule |
Administration Session Started |
Authentication Success |
|
Account Recovery Declined |
Sub Rule |
Recovery Process Failure |
Error |
|
User Account Created |
Sub Rule |
User Account Created |
Account Created |
|
User Auto Provisioned |
Sub Rule |
User Account Created |
Account Created |
|
User Account Locked |
Sub Rule |
Account Locked |
Access Revoked |
|
Pending User Added To Role |
Sub Rule |
Role Attribute Modified |
Account Modified |
|
Device Approved |
Sub Rule |
Device Approval Created |
Other Audit |
|
Device Admin Approval Requested |
Sub Rule |
Device Approval Created |
Other Audit |
|
Biometric Access Configured |
Sub Rule |
User Account Attribute Modified |
Account Modified |
|
Record Added |
Sub Rule |
Object Added |
Access Success |
|
Record Opened |
Sub Rule |
Object Created |
Access Success |
|
Record Updated |
Sub Rule |
Object Modified |
Access Success |
|
Record Deleted |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Record Duplicated |
Sub Rule |
Object Created |
Access Success |
|
Record Password Changed |
Sub Rule |
Performing Password Change |
Information |
|
Password Copied To Clipboard |
Sub Rule |
Password Entry |
Other Audit |
|
Record Autofilled |
Sub Rule |
Object Modified |
Access Success |
|
File Attachment Uploaded |
Sub Rule |
File Uploaded |
Information |
|
Vault Folder Created |
Sub Rule |
Object Created |
Access Success |
|
Vault Folder Deleted |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Shared Folder Deleted |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Record Added To Shared Folder |
Sub Rule |
Object Added |
Access Success |
|
Record Removed From Shared Folder |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Record Shared |
Sub Rule |
Access Granted Activity |
Access Granted |
|
Record Share Permissions Changed |
Sub Rule |
Object Attribute Modified |
Access Success |
|
Record Share Removed |
Sub Rule |
Access Revoked Activity |
Access Revoked |
|
Record Ownership Transferred |
Sub Rule |
Role Attribute Modified |
Account Modified |
|
Account Transfer Consent Accepted |
Sub Rule |
General Audit |
Other Audit Success |
|
One-Time Share Link Generated |
Sub Rule |
General Authentication Information |
Information |
|
One-Time Share Link Opened |
Sub Rule |
General Authentication Information |
Information |
|
One-Time Share Link Re-Accessed |
Sub Rule |
General Authentication Information |
Information |
|
One-Time Share Link Expired |
Sub Rule |
General Authentication Information |
Information |
|
One-Time Share Link Removed |
Sub Rule |
General Authentication Information |
Information |
|
User Removed From Team |
Sub Rule |
Account Removed From Group |
Access Revoked |
|
Payment Card Added |
Sub Rule |
Object Created |
Access Success |
|
Audit Alert Sent |
Sub Rule |
General Audit |
Other Audit Success |
|
BreachWatch High Risk Password Detected |
Sub Rule |
General Audit Failure |
Error |
|
BreachWatch High Risk Password Ignored |
Sub Rule |
General Audit Failure |
Error |
|
Password Reuse Detected |
Sub Rule |
General Audit Failure |
Error |
|
PAM Gateway Online |
Sub Rule |
Service Start |
Startup and Shutdown |
|
Secrets Manager App Client Access |
Sub Rule |
User Logon |
Authentication Success |
|
Secrets Manager Record Updated |
Sub Rule |
Object Modified |
Access Success |
|
Scheduled Record Rotation Successful |
Sub Rule |
Scheduled Task Completed |
Information |
|
On-Demand Record Rotation Successful |
Sub Rule |
Task Completed |
Information |
|
Record Rotation Settings Updated |
Sub Rule |
Configuration Modified : Application |
Configuration |
|
Role Enforcement Policy Changed |
Sub Rule |
Role Attribute Modified |
Account Modified |
|
Admin Privilege Reduction Configured |
Sub Rule |
Configuration Modified : Security |
Configuration |
|
Admin 2FA Enforcement Configured |
Sub Rule |
Configuration Modified : Security |
Configuration |
|
Pam Tunnel Terminated - Access Revoked |
Sub Rule |
Access Revoked Activity |
Access Revoked |
|
Pam Tunnel Stopped |
Sub Rule |
Terminating Tunnel |
Information |
|
Pam Tunnel Started |
Sub Rule |
Tunnel Created |
Network Traffic |
|
Pam Session Recording Downloaded |
Sub Rule |
Object Downloaded |
Access Success |
|
Pam Connection Recording Stopped |
Sub Rule |
Session Ended |
Information |
|
Pam Connection Recording Started |
Sub Rule |
Session Started |
Other Audit Success |
|
Remote Browser Isolation Recording Stopped |
Sub Rule |
Session Ended |
Information |
|
Remote Browser Isolation Recording Started |
Sub Rule |
Session Started |
Other Audit Success |
|
Remote Browser Isolation Terminated-Access Revoked |
Sub Rule |
Access Revoked Activity |
Access Revoked |
|
Remote Browser Isolation Stopped |
Sub Rule |
Session Ended |
Information |
|
Remote Browser Isolation Started |
Sub Rule |
Session Started |
Other Audit Success |
|
Pam Connection Terminated - Access Revoked |
Sub Rule |
Access Revoked Activity |
Access Revoked |
|
Pam Connection Stopped |
Sub Rule |
Process/Service Stopped |
Startup and Shutdown |
|
Pam Connection Started |
Sub Rule |
Session Started |
Other Audit Success |
|
Secrets Manager Application Shared |
Sub Rule |
Access Granted Activity |
Access Granted |
|
Pam Discovery Job Started |
Sub Rule |
Job Started |
Other Audit Success |
|
Pam Discovery Job Completed |
Sub Rule |
Task Completed |
Information |
|
Record Revision Restored |
Sub Rule |
Object Modified |
Access Success |
|
Deleted Record Restored |
Sub Rule |
Object Modified |
Access Success |
|
Records Imported |
Sub Rule |
Object Created |
Access Success |
|
File Attachment Viewed |
Sub Rule |
File Opened |
Information |
|
File Attachment Exported |
Sub Rule |
File Download |
Information |
|
File Attachment Downloaded |
Sub Rule |
File Download |
Information |
|
File Attachment Deleted |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Records Exported |
Sub Rule |
File Download |
Information |
|
Trash Bin Emptied |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Payment Card Changed |
Sub Rule |
Object Modified |
Access Success |
|
Identity Changed |
Sub Rule |
Object Modified |
Access Success |
|
Audit Log Sync Resumed |
Sub Rule |
General Synchronization Information |
Information |
|
Audit Log Sync Restored |
Sub Rule |
General Synchronization Information |
Information |
|
Audit Log Sync Paused |
Sub Rule |
Audit Log Paused |
Information |
|
Audit Log Sync Failed |
Sub Rule |
Synchronization Failed |
Information |
|
Identity Added |
Sub Rule |
Object Created |
Access Success |
|
Shared Folder Restored |
Sub Rule |
Directory Service Object Restored |
Other Audit Success |
|
Shared Folder Record Restored |
Sub Rule |
Directory Service Object Restored |
Other Audit Success |
|
Shared Folder Restored |
Sub Rule |
Directory Service Object Restored |
Other Audit Success |
|
Shared Folder Record Restored |
Sub Rule |
Directory Service Object Restored |
Other Audit Success |
|
Record Shared Outside Company |
Sub Rule |
Access Granted Activity |
Access Granted |
|
User Removed From Folder |
Sub Rule |
Account Removed From Group |
Access Revoked |
|
Team Removed From Folder |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
User Permissions Changed In Shared Folder |
Sub Rule |
Object Attribute Modified |
Access Success |
|
Team Permissions Changed In Shared Folder |
Sub Rule |
Object Attribute Modified |
Access Success |
|
Record Permissions Changed In Shared Folder |
Sub Rule |
Object Attribute Modified |
Access Success |
|
User Added To Folder |
Sub Rule |
Access Granted Activity |
Access Granted |
|
Team Added To Folder |
Sub Rule |
Access Granted Activity |
Access Granted |
|
Folder Shared Outside Company |
Sub Rule |
Access Granted Activity |
Access Granted |
|
Share Request Rejected |
Sub Rule |
Access Object Failure |
Access Failure |
|
User Added To Team |
Sub Rule |
Account Added To Group |
Access Granted |
|
Shared Folder Added |
Sub Rule |
Object Added |
Access Success |
|
Share Request Accepted |
Sub Rule |
Access Granted Activity |
Access Granted |
|
Security Benchmark - Untrusted Extensions Blocked |
Sub Rule |
Configuration Modified : Security |
Configuration |
|
Security Benchmark - Sso Provider Locked Down |
Sub Rule |
Configuration Modified : Security |
Configuration |
|
Security Benchmark - End User 2Fa Configured |
Sub Rule |
Configuration Modified : Security |
Configuration |
|
Security Benchmark-Outside Sso Admin Config |
Sub Rule |
Configuration Modified : Security |
Configuration |
|
Security Benchmark-Strong Master Password Config |
Sub Rule |
Configuration Modified : Security |
Configuration |
|
Security Benchmark-Least Privilege Policy Config |
Sub Rule |
Configuration Modified : Security |
Configuration |
|
Security Benchmark-Account Transfer Policy Config |
Sub Rule |
Configuration Modified : Security |
Configuration |
|
Security Benchmark-Disable Browser Pwd Mgr Config |
Sub Rule |
Configuration Modified : Security |
Configuration |
|
Security Benchmark-Disable Account Recovery Config |
Sub Rule |
Configuration Modified : Security |
Configuration |
|
Security Benchmark-Org-Wide Deployment Configured |
Sub Rule |
Configuration Modified : Security |
Configuration |
|
Security Benchmark - Two Administrators Configured |
Sub Rule |
Configuration Modified : Security |
Configuration |
|
Security Benchmark - Create Alerts Configured |
Sub Rule |
Configuration Modified : Security |
Configuration |
|
Security Benchmark - Ip Allowlisting Configured |
Sub Rule |
Configuration Modified : Security |
Configuration |
|
Vault Transferred |
Sub Rule |
Role Attribute Modified |
Account Modified |
|
2Fa Disabled By Keeper Support |
Sub Rule |
Configuration Disabled : Security |
Configuration |
|
Two-Factor Code Invalid |
Sub Rule |
User Logon Failure |
Authentication Failure |
|
Two-Factor Authentication Enabled |
Sub Rule |
Configuration Enabled : Security |
Configuration |
|
Two-Factor Authentication Disabled |
Sub Rule |
Configuration Disabled : Security |
Configuration |
|
User Invited |
Sub Rule |
Object Created |
Access Success |
|
Scim Access Failure |
Sub Rule |
Authentication Failure Activity |
Authentication Failure |
|
Role Removed From Team |
Sub Rule |
Account Removed From Group |
Access Revoked |
|
Role Added To Team |
Sub Rule |
Account Added To Group |
Access Granted |
|
User Removed From Role |
Sub Rule |
Account Removed From Group |
Access Revoked |
|
Re-Authentication Prompt Throttled |
Sub Rule |
Authentication Failure Activity |
Authentication Failure |
|
Master Password Reprompt Succeeded |
Sub Rule |
User Logon |
Authentication Success |
|
Pending User Removed From Role |
Sub Rule |
Account Removed From Group |
Access Revoked |
|
Payment Method Updated |
Sub Rule |
Object Modified |
Access Success |
|
User Blocked By Ip Allowlist |
Sub Rule |
Access Blocked |
Information |
|
Admin Console Login Failed |
Sub Rule |
User Logon Failure |
Authentication Failure |
|
Master Password Expired By Admin |
Sub Rule |
Password Change Forced |
Information |
|
Converted To Consumption Billing |
Sub Rule |
Object Attribute Modified |
Access Success |
|
Enterprise Plan Changed |
Sub Rule |
Object Attribute Modified |
Access Success |
|
2Fa Disabled By Admin |
Sub Rule |
Policy Disabled : User/Password |
Policy |
|
User Enabled |
Sub Rule |
Account Enabled |
Access Granted |
|
User Unlocked Device |
Sub Rule |
Workstation Unlocked |
Authentication Success |
|
User Unlinked Devices |
Sub Rule |
Object Attribute Modified |
Access Success |
|
User Unblocked Device |
Sub Rule |
Account Unlocked |
Access Granted |
|
User Renamed Device |
Sub Rule |
Object Renamed |
Access Success |
|
User Removed Device |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
User Logged Out Device |
Sub Rule |
Logoff |
Other Audit Success |
|
User Locked Device |
Sub Rule |
Workstation Locked |
Other Audit Success |
|
User Linked Devices |
Sub Rule |
General Workstation Information |
Information |
|
User Blocked Device |
Sub Rule |
Account Locked |
Access Revoked |
|
User Requested Self Approval For Device |
Sub Rule |
Request Received |
Other Audit Success |
|
Device Approved By Admin |
Sub Rule |
Request Approved |
Other Audit Success |
|
Admin Unlocked Device |
Sub Rule |
Workstation Unlocked |
Authentication Success |
|
Admin Removed Device |
Sub Rule |
System Removed From Group |
Access Revoked |
|
Admin Logged Out Device |
Sub Rule |
Logoff |
Other Audit Success |
|
Admin Locked Device |
Sub Rule |
Workstation Locked |
Other Audit Success |
|
Admin Unlocked Device Account |
Sub Rule |
Account Unlocked |
Access Granted |
|
Admin Locked Device Account |
Sub Rule |
Account Locked |
Access Revoked |
|
User Deleted |
Sub Rule |
User Account Deleted |
Account Deleted |
|
Security Key Deleted |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Pending User Deleted |
Sub Rule |
User Account Deleted |
Account Deleted |
|
Invitation Declined |
Sub Rule |
Access Object Failure |
Access Failure |
|
Security Audit Data Cleared |
Sub Rule |
Log Cleared |
Access Success |
|
User Added To Role |
Sub Rule |
Account Added To Group |
Access Granted |
|
Admin Permissions Granted |
Sub Rule |
Privilege Granted |
Access Granted |
|
Security Key Added |
Sub Rule |
Configuration Modified : Security |
Configuration |
|
Recovery Phrase Set |
Sub Rule |
User Account Attribute Modified |
Account Modified |
|
Invitation Accepted |
Sub Rule |
Access Granted Activity |
Access Granted |
|
Cascade Node Permission Changed |
Sub Rule |
Object Attribute Modified |
Access Success |
|
Managed Node Removed From Role |
Sub Rule |
System Removed From Group |
Access Revoked |
|
Managed Node Added To Role |
Sub Rule |
System Added To Group |
Access Granted |
|
Resource Accessed With Public Api Token |
Sub Rule |
Object Accessed |
Access Success |
|
Public Api Token Deleted |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Api Token Created |
Sub Rule |
Object Created |
Access Success |
|
Scim Provisioned Team |
Sub Rule |
Group Created |
Account Created |
|
Team Deleted |
Sub Rule |
Group Deleted |
Account Deleted |
|
Team Created |
Sub Rule |
Group Created |
Account Created |
|
Sso Connect Updated |
Sub Rule |
Policy Modified : System |
Policy |
|
Sso Connect Deleted |
Sub Rule |
Policy Disabled : System |
Policy |
|
Sso Connect Activated |
Sub Rule |
Policy Enabled : System |
Policy |
|
Ssh Agent Stopped |
Sub Rule |
SSH Session Closed |
Other Operations |
|
Ssh Agent Started |
Sub Rule |
Service Start |
Startup and Shutdown |
|
Ssh Agent Approved |
Sub Rule |
SSH Connection Established |
Network Traffic |
|
Custom Vault Logo Set |
Sub Rule |
General Administrative Operation |
Information |
|
Custom Email Logo Set |
Sub Rule |
General Administrative Operation |
Information |
|
Custom Email Content Set |
Sub Rule |
Configuration Modified : Application |
Configuration |
|
Global 2Fa Configuration Set |
Sub Rule |
Configuration Modified : Security |
Configuration |
|
Scim Provisioning Updated |
Sub Rule |
Configuration Modified : Application |
Configuration |
|
Scim Provisioning Deleted |
Sub Rule |
Configuration Disabled : Application |
Configuration |
|
Scim Provisioning Activated |
Sub Rule |
Configuration Enabled : Application |
Configuration |
|
Role Deleted |
Sub Rule |
Role Deleted |
Account Deleted |
|
Role Created |
Sub Rule |
Role Created |
Account Created |
|
Report Modified |
Sub Rule |
Object Modified |
Access Success |
|
Report Deleted |
Sub Rule |
Report Deleted |
Information |
|
Report Created |
Sub Rule |
Object Created |
Access Success |
|
Record Type Updated |
Sub Rule |
Object Modified |
Access Success |
|
Record Type Deleted |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Record Type Created |
Sub Rule |
Object Created |
Access Success |
|
License Maximum Reached |
Sub Rule |
License Info |
Information |
|
Node Deleted |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Node Created |
Sub Rule |
Object Created |
Access Success |
|
Email Auto-Provisioning Deleted |
Sub Rule |
Configuration Disabled : Application |
Configuration |
|
Email Auto-Provisioning Activated |
Sub Rule |
Configuration Enabled : Application |
Configuration |
|
Ad Bridge Updated |
Sub Rule |
Configuration Modified : Application |
Configuration |
|
Ad Bridge Deleted |
Sub Rule |
Configuration Disabled : Application |
Configuration |
|
Ad Bridge Activated |
Sub Rule |
Configuration Enabled : Application |
Configuration |
|
Audit Log Sync Setup |
Sub Rule |
Object Created |
Access Success |
|
Audit Log Sync Removed |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Audit Alert Resumed |
Sub Rule |
Configuration Enabled : Application |
Configuration |
|
Audit Alert Paused |
Sub Rule |
Configuration Disabled : Application |
Configuration |
|
Audit Alert Deleted |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Audit Alert Created |
Sub Rule |
Object Created |
Access Success |
|
Epm Agent Removed Approval Request |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Managed Company Resumed |
Sub Rule |
Policy Enabled : System |
Policy |
|
Managed Company Renamed |
Sub Rule |
Object Renamed |
Access Success |
|
Managed Company Removed |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Managed Company Paused |
Sub Rule |
Configuration Disabled : Application |
Configuration |
|
Managed Company Deleted |
Sub Rule |
Group Deleted |
Account Deleted |
|
Msp Deactivated |
Sub Rule |
Account Disabled |
Access Revoked |
|
Managed Company Registered |
Sub Rule |
Object Created |
Access Success |
|
Managed Company Attached To Node |
Sub Rule |
Attach Event |
Other Audit |
|
Msp Activated |
Sub Rule |
Account Enabled |
Access Granted |
|
Gradient Msp Billing Sync Failed |
Sub Rule |
Synchronization Failed |
Information |
|
Gradient Msp Mappings Synced |
Sub Rule |
Configuration Loaded : System |
Configuration |
|
Gradient Msp Integration Setup |
Sub Rule |
Session Established |
Other Audit Success |
|
Gradient Msp Integration Removed |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Managed Company Max License Count Changed |
Sub Rule |
Object Attribute Modified |
Access Success |
|
Managed Company Plan Changed |
Sub Rule |
Object Attribute Modified |
Access Success |
|
Enterprise File Plan Changed |
Sub Rule |
Object Attribute Modified |
Access Success |
|
Enterprise Deleted |
Sub Rule |
Group Deleted |
Account Deleted |
|
Enterprise Created |
Sub Rule |
Group Created |
Account Created |
|
Enterprise Add-On Removed |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Enterprise Add-On Added |
Sub Rule |
Object Added |
Access Success |
|
Vault Login Failed |
Sub Rule |
User Logon Failure |
Authentication Failure |
|
Scheduled Record Rotation Failed |
Sub Rule |
General Audit Failure |
Error |
|
On-Demand Record Rotation Failed |
Sub Rule |
General Audit Failure |
Error |
|
Record Rotation Disabled |
Sub Rule |
Configuration Disabled : Application |
Configuration |
|
Record Rotation Settings Added |
Sub Rule |
Rotation Information |
Information |
|
Pam Gateway Removed |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Pam Gateway Offline |
Sub Rule |
Process/Service Stopped |
Startup and Shutdown |
|
Pam Gateway Created |
Sub Rule |
Object Created |
Access Success |
|
Pam Configuration Updated |
Sub Rule |
Configuration Modified : System |
Configuration |
|
Pam Configuration Deleted |
Sub Rule |
Configuration Deleted : System |
Configuration |
|
Pam Configuration Created |
Sub Rule |
Object Created |
Access Success |
|
Secrets Manager Record Shared |
Sub Rule |
Access Granted Activity |
Access Granted |
|
Secrets Manager Record Share Permission Changed |
Sub Rule |
Object Attribute Modified |
Access Success |
|
Secrets Manager Record Removed |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Secrets Manager Folder Shared |
Sub Rule |
Access Granted Activity |
Access Granted |
|
Secrets Manager Folder Share Permission Changed |
Sub Rule |
Object Modified |
Access Success |
|
Secrets Manager Folder Removed |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Secrets Manager Client Device Removed |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Secrets Manager Record Deleted |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Secrets Manager Record Created |
Sub Rule |
Object Created |
Access Success |
|
Secrets Manager Folder Updated |
Sub Rule |
Object Modified |
Access Success |
|
Secrets Manager Record Removed From Shared Folder |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Secrets Manager Folder Deleted |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Secrets Manager Folder Created |
Sub Rule |
Object Created |
Access Success |
|
Secrets Manager Client Device Access Expired |
Sub Rule |
Access Revoked Activity |
Access Revoked |
|
Secrets Manager Client Device Initialized |
Sub Rule |
Object Accessed |
Access Success |
|
Secrets Manager Client Device Added |
Sub Rule |
Object Added |
Access Success |
|
Secrets Manager Client Access Denied |
Sub Rule |
Access Denied |
Warning |
|
Session Unlocked By User |
Sub Rule |
Account Unlocked |
Access Granted |
|
Keeperai Session Terminate Enabled |
Sub Rule |
Configuration Enabled : Application |
Configuration |
|
Keeperai Session Terminate Disabled |
Sub Rule |
Configuration Disabled : Application |
Configuration |
|
Session Locked By Keeperai - Medium Threat |
Sub Rule |
Access Revoked Activity |
Access Revoked |
|
Session Locked By Keeperai - High Threat |
Sub Rule |
Access Revoked Activity |
Access Revoked |
|
Session Locked By Keeperai - Critical Threat |
Sub Rule |
Access Revoked Activity |
Access Revoked |
|
Keeperai Recording Enabled |
Sub Rule |
Configuration Enabled : Application |
Configuration |
|
Keeperai Recording Disabled |
Sub Rule |
Configuration Disabled : Application |
Configuration |
|
Keeperai Pam Configuration Enabled |
Sub Rule |
Configuration Enabled : Application |
Configuration |
|
Keeperai Pam Configuration Disabled |
Sub Rule |
Configuration Disabled : Application |
Configuration |
|
Keeperai Medium Risk Detected |
Sub Rule |
Suspicious Activity |
Suspicious |
|
Keeperai High Risk Detected |
Sub Rule |
Suspicious Activity |
Suspicious |
|
Keeperai Critical Risk Detected |
Sub Rule |
Suspicious Activity |
Suspicious |
|
Epm Agent Registered |
Sub Rule |
Object Created |
Access Success |
|
Epm Policy Updated |
Sub Rule |
Policy Modified : System |
Policy |
|
Epm Policy Removed |
Sub Rule |
Policy Disabled : System |
Policy |
|
Epm Policy Created |
Sub Rule |
Policy Created : System |
Policy |
|
Epm Deployment Updated |
Sub Rule |
Object Modified |
Access Success |
|
Epm Deployment Removed |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Epm Deployment Created |
Sub Rule |
Object Created |
Access Success |
|
Epm Deployment Authentication Failed |
Sub Rule |
Authentication Failure Activity |
Authentication Failure |
|
Epm Collection Updated |
Sub Rule |
Object Modified |
Access Success |
|
Epm Collection Removed |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Epm Collection Link Removed |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Epm Collection Link Added |
Sub Rule |
Object Added |
Access Success |
|
Epm Collection Created |
Sub Rule |
Object Created |
Access Success |
|
Epm Approval Request Status Changed |
Sub Rule |
Request Status Changed |
Other Operations |
|
Epm Approval Request Removed |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Epm Approval Request Created |
Sub Rule |
Object Created |
Access Success |
|
Epm Agent Updated |
Sub Rule |
Agent Updated |
Information |
|
Epm Agent Unregistered |
Sub Rule |
Device Unregistered |
Warning |
|
Agent Removed From Collection |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Epm Agent Removed |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Agent Created Collection |
Sub Rule |
Object Created |
Access Success |
|
Epm Agent Authentication Failed |
Sub Rule |
Connection Authentication Failed |
Authentication Failure |
|
Agent Added To Collection |
Sub Rule |
Object Added |
Access Success |
|
Agent Added Collection Link |
Sub Rule |
Object Added |
Access Success |
|
Unsaved Compliance Report Exported |
Sub Rule |
Report Generation |
Information |
|
Compliance Report Criteria Saved |
Sub Rule |
Report Information |
Information |
|
Compliance Report Criteria Edited |
Sub Rule |
Report Information |
Information |
|
Compliance Report Criteria Deleted |
Sub Rule |
Report Information |
Information |
|
Compliance Report Saved |
Sub Rule |
Report Information |
Information |
|
Compliance Report Generated |
Sub Rule |
Report Generation |
Information |
|
Compliance Report Exported |
Sub Rule |
Report Generation |
Information |
|
Compliance Report Downloaded |
Sub Rule |
File Download |
Information |
|
Compliance Report Deleted |
Sub Rule |
Report Deleted |
Information |
|
Chat Message Sent |
Sub Rule |
Message Sent |
Information |
|
Chat Message Received |
Sub Rule |
Message Received |
Information |
|
Chat Self-Destruct Message Set |
Sub Rule |
Object Modified |
Access Success |
|
Keeperchat Login Failure |
Sub Rule |
User Logon Failure |
Authentication Failure |
|
Keeperchat Login |
Sub Rule |
User Logon |
Authentication Success |
|
Chat File Sent |
Sub Rule |
File Uploaded |
Information |
|
Chat Contact Added |
Sub Rule |
Object Added |
Access Success |
|
Breachwatch High Risk Password Resolved |
Sub Rule |
Issue Resolved |
Information |
|
Administrative Permission Revoked |
Sub Rule |
Privilege Revoked |
Access Revoked |
|
Administrative Permission Granted |
Sub Rule |
Privilege Granted |
Access Granted |
|
Alternate Master Password Set |
Sub Rule |
Password Modified |
Account Modified |
|
Biometric Passkey Removed |
Sub Rule |
Object Deleted/Removed |
Access Success |
|
Biometric Passkey Added |
Sub Rule |
Object Added |
Access Success |
|
Security Question Changed |
Sub Rule |
User Account Attribute Modified |
Account Modified |
|
Master Password Changed |
Sub Rule |
Password Modified |
Account Modified |
|
Account Email Changed |
Sub Rule |
Contact Email Changed |
Other Audit Success |
|
Alternate Email Added |
Sub Rule |
Add Alias |
Information |
|
Account Recovery Requested |
Sub Rule |
Request Received |
Other Audit Success |
Mapping with LogRhythm Schema
|
Device Key in Log Message |
LogRhythm Schema |
Data Type |
Schema Description |
|
N/A |
N/A |
N/A |
N/A |
|
N/A |
N/A |
N/A |
N/A |
|
N/A |
N/A |
N/A |
N/A |
|
audit_event |
<vendorinfo>, <tag1> |
Text/String |
N/A |
|
username |
<login> |
Text/String |
N/A |
|
client_version |
<version> |
Number |
N/A |
|
remote_address |
<sip> |
IP Address |
N/A |
|
channel |
<sessiontype> |
Text/String |
Login or comms channel (e.g. Web Vault, Browser Extension, KeeperChat). |
|
result_code |
<responsecode> |
Numbers |
Failure code on login_failure-style events. |
|
|
<sender> |
Text/String |
N/A |
|
to_username |
<account> |
Text/String |
Other-party user emails. |
|
client_version_new |
N/A |
N/A |
N/A |
|
username_new |
N/A |
N/A |
N/A |
|
file_format |
N/A |
N/A |
N/A |
|
record_uid |
N/A |
N/A |
UID of a vault record. |
|
folder_uid |
N/A |
N/A |
UID of a folder (user or shared). |
|
folder_type |
<objecttype> |
Text/String |
User or shared. |
|
shared_folder_uid |
<objectname> |
Text/String |
UID of a shared folder. |
|
attachment_id |
<object> |
Text/String |
UID of a file attachment on a record. |
|
team_uid |
<group> |
Text/String |
UID of a team. |
|
role_id |
N/A |
N/A |
Role / team identifiers. |