View and Export Events

The Illumio Managed Services Portal web console provides an ongoing log of all Organization events that occur in your Illumio Managed Services Portal organization. For example, Organization events capture actions such as users logging in and logging out, tenant creation, failed login attempts, and so on.

From the platform and API perspective, Organization events are referred to internally as auditable_events and are generated by the auditable_events_service.

View Events

1. Select Troubleshoot > Events.

2. Use the filters to search for events by type of event, event severity level, and when the event occurred.

3. Once you've defined a filter, click Go to run the query.

Export Events

You can export all Organization events or a filtered list of events to a CSV file.

1. Select Troubleshoot > Events.

   • To export all Organization events, click Export and then select Export All.

   • To export a filtered list of events, filter the list, click Export, and then select Export Filtered.

   • To search for events based on event type, severity, status, timestamp, and who generated them, use the search filter.

   • To use Quick Filters, click the double arrows.

     

List of Events

The following table provides the types of JSON events generated and their description. For each of these events, the CEF/LEEF success or failure events generated are the event name followed by .success or .failure.

For example, the CEF/LEEF success event for auth_security_principal.create is auth_security_principal.create.success and the failure event is auth_security_principal.create.failure.

Each event can generate a variety of notification messages. See Notification Messages in Events.

JSON Event Type	Description	Severity
auth_security_principal.create	RBAC auth security principal created	Informational
auth_security_principal.delete	RBAC auth security principal deleted	Informational
auth_security_principal.update	RBAC auth security principal updated	Informational
authentication_settings.update	Authentication settings updated	Informational
org.create	Organization created	Informational
org.delete	Organization deleted	Informational
org.update	Organization updated	Informational
org.unpair_vens	VENs unpaired	Informational
orgs.ven_count	Active VEN count for a list of orgs obtained	Informational
password_policy.create	Password policy created	Informational
password_policy.delete	Password policy deleted	Informational
password_policy.update	Password policy updated	Informational
permission.create	RBAC permission created	Informational
permission.delete	RBAC permission deleted	Informational
permission.update	RBAC permission updated	Informational
request.authentication_failed	API request authentication failed	Informational
request.authorization_failed	API request authorization failed	Informational
request.internal_server_error	API request failed due to internal server error	Informational
request.invalid	API request failed because it was invalid	Informational
request.service_unavailable	API request failed due to unavailable service	Informational
request.unknown_server_error	API request failed due to unknown server error	Informational
saml_acs.update	SAML assertion consumer services updated	Informational
saml_config.create	SAML configuration created	Informational
saml_config.delete	SAML configuration deleted	Informational
saml_config.pce_signing_cert	SAML signing certificate created or rotated	Informational
saml_config.update	SAML configuration updated	Informational
security_principal.create	RBAC security principal created	Informational
security_principal.delete	RBAC security principal deleted	Informational
security_principal.update	RBAC security principal updated	Informational
security_principals.bulk_create	RBAC security principals bulk created	Informational
system_task.prune_old_log_events	Event pruning completed	Informational
user.accept_invitation	User invitation accepted	Informational
user.authenticate	User authenticated	Informational
user.create	User created	Informational
user.create_session	User session created	Informational
user.delete	User deleted	Informational
user.invite	User invited	Informational
user.login	User logged in	Informational
user.login_session_terminated	User login session terminated	Informational
user.logout	User logged out	Informational
user.pce_session_terminated	User session terminated	Informational
user.reset_password	User password reset	Informational
user.sign_in	User session created	Informational
user.sign_out	User session terminated	Informational
user.update	User session updated	Informational
user.update_password	User password updated	Informational
user.use_expired_password	User entered expired password	Informational
user_local_profile.create	User local profile created	Informational
user_local_profile.delete	User local profile deleted	Informational
user_local_profile.reinvite	User local profile reinvited	Informational
user_local_profile.update_password	User local password updated	Informational

Notification Messages in Events

Events can generate a variety of notifications that are appended after the event type:

• hard_limit.exceeded
• pce.application_started

• pce.application_stopped

• request.authentication_failed

• request.authorization_failed

• request.internal_server_error

• request.invalid

• request.service_unavailable

• request.unknown_server_error

• soft_limit.exceeded

• system_task.event_pruning_completed

• system_task.hard_limit_recovery_completed

• user.csrf_validation_failed

• user.login_failed

• user.login_failure_count_exceeded

• user.login_session_created

• user.login_session_terminated

• user.pce_session_created

• user.pce_session_terminated

• user.pw_change_failure

• user.pw_changed

• user.pw_complexity_not_met

• user.pw_reset_completed

• user.pw_reset_requested