Audit-eventencatalogus

Deze catalogus bevat alle openbare audit-event-namen van VaultPAM en hun categorieën. Het is bedoeld voor SIEM-ingenieurs die detectieregels opbouwen en compliancebeoordelaars die de audit-dekking valideren — niet voor het opbouwen van clientintegraties tegen het volledige event-schema. Het volledige veldschema (actor, target, metadata, retentie) is beschikbaar in de beveiligde API-referentie; neem contact op met support om toegang aan te vragen.

Deze catalogus wordt automatisch gegenereerd uit bron. Bewerk niet rechtstreeks. Voer scripts/docs/generate_audit_event_catalog.sh uit om opnieuw te genereren.

Control-Plane-events

Constant	Wire String	Categorie
AGENT_PAIRING_INITIATED	Agent Pairing Initiated	Agent / Connectiviteit
AGENT_PAIRING_COMPLETED	Agent Pairing Completed	Agent / Connectiviteit
AGENT_PAIRING_FAILED	Agent Pairing Failed	Agent / Connectiviteit
AGENT_HEARTBEAT_RECEIVED	Agent Heartbeat Received	Agent / Connectiviteit
AGENT_CONNECTIVITY_CHECK	Agent Connectivity Check	Agent / Connectiviteit
CONNECTOR_REGISTRATION	Connector Registration	Agent / Connectiviteit
CONNECTOR_UPGRADE	Connector Upgrade	Agent / Connectiviteit
CONNECTOR_DECOMMISSIONED	Connector Decommissioned	Agent / Connectiviteit
USER_ACCESS_REQUEST_CREATED	User Access Request Created	Identiteit / Toegang / Delen
ACCESS_REQUEST_APPROVED	Access Request Approved	Identiteit / Toegang / Delen
ACCESS_REQUEST_REJECTED	Access Request Rejected	Identiteit / Toegang / Delen
ACCESS_DELEGATION_GRANTED	Access Delegation Granted	Identiteit / Toegang / Delen
ACCESS_DELEGATION_REVOKED	Access Delegation Revoked	Identiteit / Toegang / Delen
ROLE_ASSIGNMENT_CHANGED	Role Assignment Changed	Identiteit / Toegang / Delen
POLICY_ASSIGNMENT_CHANGED	Policy Assignment Changed	Identiteit / Toegang / Delen
MFA_CHALLENGE_TRIGGERED	MFA Challenge Triggered	Identiteit / Toegang / Delen
MFA_VERIFICATION_SUCCEEDED	MFA Verification Succeeded	Identiteit / Toegang / Delen
MFA_VERIFICATION_FAILED	MFA Verification Failed	Identiteit / Toegang / Delen
MFA_SESSIONS_INVALIDATED	MFA Sessions Invalidated	Identiteit / Toegang / Delen
MFA_RECOVERY_REQUESTED	mfa.recovery.requested	Identiteit / Toegang / Delen
MFA_RECOVERY_VERIFIED	mfa.recovery.verified	Identiteit / Toegang / Delen
MFA_RECOVERY_PENDING_ADMIN_APPROVAL	mfa.recovery.pending_admin_approval	Identiteit / Toegang / Delen
MFA_RECOVERY_APPROVED	mfa.recovery.approved	Identiteit / Toegang / Delen
MFA_RECOVERY_DENIED	mfa.recovery.denied	Identiteit / Toegang / Delen
MFA_RECOVERY_GRANT_ISSUED	mfa.recovery.grant_issued	Identiteit / Toegang / Delen
MFA_RECOVERY_GRANT_CONSUMED	mfa.recovery.grant_consumed	Identiteit / Toegang / Delen
MFA_RECOVERY_EXPIRED	mfa.recovery.expired	Identiteit / Toegang / Delen
MFA_RECOVERY_COMPLETED	mfa.recovery.completed	Identiteit / Toegang / Delen
MFA_BACKUP_CODES_GENERATED	mfa.backup_codes.generated	Identiteit / Toegang / Delen
MFA_BACKUP_CODES_USED	mfa.backup_codes.used	Identiteit / Toegang / Delen
MFA_BACKUP_CODES_REGENERATED	mfa.backup_codes.regenerated	Identiteit / Toegang / Delen
PRIVILEGED_ACCOUNT_CREATED	Privileged Account Created	Accounts / Secrets / Credentials
PRIVILEGED_ACCOUNT_UPDATED	Privileged Account Updated	Accounts / Secrets / Credentials
PRIVILEGED_ACCOUNT_DISABLED	Privileged Account Disabled	Accounts / Secrets / Credentials
CREDENTIAL_CHECKOUT_STARTED	Credential Check-out Started	Accounts / Secrets / Credentials
CREDENTIAL_CHECKOUT_COMPLETED	Credential Check-out Completed	Accounts / Secrets / Credentials
CREDENTIAL_CHECKIN_COMPLETED	Credential Check-in Completed	Accounts / Secrets / Credentials
CREDENTIAL_ROTATION_STARTED	Credential Rotation Started	Accounts / Secrets / Credentials
CREDENTIAL_ROTATION_COMPLETED	Credential Rotation Completed	Accounts / Secrets / Credentials
CREDENTIAL_ROTATION_FAILED	Credential Rotation Failed	Accounts / Secrets / Credentials
SECRET_ACCESSED	Secret Accessed (Metadata-only)	Accounts / Secrets / Credentials
CONNECTION_DEFINITION_CREATED	Connection Definition Created	Verbindingen / Sessies
CONNECTION_DEFINITION_UPDATED	Connection Definition Updated	Verbindingen / Sessies
CONNECTION_DEFINITION_DELETED	Connection Definition Deleted	Verbindingen / Sessies
SESSION_START_REQUESTED	Session Start Requested	Verbindingen / Sessies
SESSION_ESTABLISHED	Session Established	Verbindingen / Sessies
SESSION_RECORDING_STARTED	Session Recording Started	Verbindingen / Sessies
SESSION_POLICY_ENFORCED	Session Policy Enforced	Verbindingen / Sessies
SESSION_SUSPENDED	Session Suspended	Verbindingen / Sessies
SESSION_TERMINATED_BY_USER	Session Terminated by User	Verbindingen / Sessies
SESSION_TERMINATED_BY_ADMIN	Session Terminated by Admin	Verbindingen / Sessies
SESSION_TERMINATED_BY_SYSTEM	Session Terminated by System	Verbindingen / Sessies
SESSION_RECORDING_FINALIZED	Session Recording Finalized	Verbindingen / Sessies
SESSION_PLAYBACK_ACCESSED	Session Playback Accessed	Verbindingen / Sessies
HTTP_SESSION_STARTED	HTTP_SESSION_STARTED	Verbindingen / Sessies
HTTP_SESSION_ENDED	HTTP_SESSION_ENDED	Verbindingen / Sessies
HTTP_URL_DENIED	HTTP_URL_DENIED	Verbindingen / Sessies
HTTP_CREDENTIAL_INJECTED	HTTP_CREDENTIAL_INJECTED	Verbindingen / Sessies
AUDIT_LOG_VIEWED	Audit Log Viewed	Admin / Platform / Audit
AUDIT_LOG_EXPORT_REQUESTED	Audit Log Export Requested	Admin / Platform / Audit
AUDIT_LOG_EXPORT_COMPLETED	Audit Log Export Completed	Admin / Platform / Audit
RETENTION_POLICY_CHANGED	Retention Policy Changed	Admin / Platform / Audit
TENANT_SETTINGS_UPDATED	Tenant Settings Updated	Admin / Platform / Audit
API_TOKEN_CREATED	API Token Created	Admin / Platform / Audit
API_TOKEN_REVOKED	API Token Revoked	Admin / Platform / Audit
SECURITY_INCIDENT_FLAGGED	Security Incident Flagged	Admin / Platform / Audit
SYSTEM_ERROR_LOGGED	System Error Logged	Admin / Platform / Audit
INVITATION_SENT	Invitation Sent	Uitnodigingslevenscyclus
INVITATION_ACCEPTED	Invitation Accepted	Uitnodigingslevenscyclus
INVITATION_REVOKED	Invitation Revoked	Uitnodigingslevenscyclus
INVITATION_RESENT	Invitation Resent	Uitnodigingslevenscyclus
INVITATION_EXPIRED	Invitation Expired	Uitnodigingslevenscyclus
INVITATION_ACCEPT_BLOCKED	Invitation Accept Blocked	Uitnodigingslevenscyclus
INVITE_ACCEPT_STARTED	invite_accept_started	Uitnodigingslevenscyclus
INVITE_TOKEN_INVALID_OR_EXPIRED	invite_token_invalid_or_expired	Uitnodigingslevenscyclus
INVITE_EMAIL_MISMATCH_BLOCKED	invite_email_mismatch_blocked	Uitnodigingslevenscyclus
INVITE_ACCEPTED	invite_accepted	Uitnodigingslevenscyclus
ORG_SUBMISSION_STARTED	org_submission_started	Uitnodigingslevenscyclus
ORG_SUBMISSION_SUBMITTED	org_submission_submitted	Uitnodigingslevenscyclus
ORG_SUBMISSION_APPROVED	org_submission_approved	Uitnodigingslevenscyclus
ORG_SUBMISSION_REJECTED	org_submission_rejected	Uitnodigingslevenscyclus
PROVIDER_FLOW_FAILED	provider_flow_failed	Uitnodigingslevenscyclus
PENDING_STATE_VIEWED	pending_state_viewed	Uitnodigingslevenscyclus
PLATFORM_USER_INVITED	Platform User Invited	Platformgebruikersbeheer
PLATFORM_USER_REMOVED	Platform User Removed	Platformgebruikersbeheer
PLATFORM_USER_ROLE_CHANGED	Platform User Role Changed	Platformgebruikersbeheer
PLATFORM_USER_MFA_RESET	Platform User MFA Reset	Platformgebruikersbeheer
PLATFORM_INVITATION_ACCEPTED	Platform Invitation Accepted	Platformgebruikersbeheer
PLATFORM_USER_INVITE_REJECTED	Platform User Invite Rejected	Platformgebruikersbeheer
PLATFORM_SELF_REMOVAL_BLOCKED	Platform Self Removal Blocked	Platformgebruikersbeheer
PLATFORM_LAST_ADMIN_REMOVAL_BLOCKED	Platform Last Admin Removal Blocked	Platformgebruikersbeheer
PLATFORM_LAST_ADMIN_MFA_RESET_BLOCKED	Platform Last Admin MFA Reset Blocked	Platformgebruikersbeheer
PLATFORM_USERS_LISTED	Platform Users Listed	Platformgebruikersbeheer
PLATFORM_INVITATIONS_LISTED	Platform Invitations Listed	Platformgebruikersbeheer
GROUP_CREATED	group.created	Groepen / Safe-toegang
GROUP_UPDATED	group.updated	Groepen / Safe-toegang
GROUP_DELETED	group.deleted	Groepen / Safe-toegang
GROUP_MEMBER_ADDED	group.member.added	Groepen / Safe-toegang
GROUP_MEMBER_REMOVED	group.member.removed	Groepen / Safe-toegang
SAFE_GROUP_ASSIGNMENT_CREATED	safe.group_assignment.created	Groepen / Safe-toegang
SAFE_GROUP_ASSIGNMENT_UPDATED	safe.group_assignment.updated	Groepen / Safe-toegang
SAFE_GROUP_ASSIGNMENT_REMOVED	safe.group_assignment.removed	Groepen / Safe-toegang
SAFE_MEMBER_ADDED	safe.member.added	Groepen / Safe-toegang
SAFE_MEMBER_ROLE_UPDATED	safe.member.role_updated	Groepen / Safe-toegang
SAFE_MEMBER_REMOVED	safe.member.removed	Groepen / Safe-toegang
SAFE_DERIVED_ACCESS_GRANTED	safe.derived_access.granted	Groepen / Safe-toegang
SAFE_DERIVED_ACCESS_REVOKED	safe.derived_access.revoked	Groepen / Safe-toegang
SAFE_DERIVED_ACCESS_ROLE_CHANGED	safe.derived_access.role_changed	Groepen / Safe-toegang
GROUP_MUTATION_DENIED	group.mutation.denied	Groepen / Safe-toegang
ORG_GOVERNANCE_ACTION_REQUESTED	org_governance.action_requested	Organisatiegerichte Governance-acties
ORG_GOVERNANCE_ACTION_APPROVED	org_governance.action_approved	Organisatiegerichte Governance-acties
ORG_GOVERNANCE_ACTION_REJECTED	org_governance.action_rejected	Organisatiegerichte Governance-acties
PLATFORM_CROSS_ORG_GOVERNANCE_VIEWED	platform.cross_org_governance_viewed	Cross-Organisatie Governance
ORG_GOVERNANCE_QUEUE_EXPORTED	org_governance.queue_exported	Cross-Organisatie Governance
ORG_GOVERNANCE_SELF_APPROVAL_BLOCKED	org_governance.self_approval_blocked	Cross-Organisatie Governance
PHONE_VERIFICATION_CODE_SENT	phone_verification_code_sent	Telefoon / SMS-verificatie
PHONE_VERIFICATION_SUCCEEDED	phone_verification_succeeded	Telefoon / SMS-verificatie
PHONE_VERIFICATION_FAILED	phone_verification_failed	Telefoon / SMS-verificatie
PHONE_VERIFICATION_EXPIRED	phone_verification_expired	Telefoon / SMS-verificatie
PHONE_CHANGE_REQUESTED	phone_change_requested	Telefoon / SMS-verificatie
PHONE_CHANGE_COMMITTED	phone_change_committed	Telefoon / SMS-verificatie
PHONE_CHANGE_ABANDONED	phone_change_abandoned	Telefoon / SMS-verificatie
AUDIT_PHONE_DIGEST_KEY_ROTATED	audit_phone_digest_key_rotated	Telefoon / SMS-verificatie
PHONE_VERIFICATION_CODE_SEND_BLOCKED_PROVIDER_UNAVAILABLE	phone_verification_code_send_blocked_provider_unavailable	Telefoon / SMS-verificatie
PHONE_VERIFICATION_BOOT_PROVIDER_GATE_PASSED	phone_verification_boot_provider_gate_passed	Telefoon / SMS-verificatie
PHONE_VERIFICATION_CODE_SEND_BLOCKED_RATE_LIMIT	phone_verification_code_send_blocked_rate_limit	Telefoon / SMS-verificatie
PHONE_CHANGE_CONCURRENT_MODIFICATION	phone_change_concurrent_modification	Telefoon / SMS-verificatie
PHONE_CHANGE_CANCEL	phone_change_cancel	Telefoon / SMS-verificatie
USERS_PHONE_PROPAGATED_FROM_REGISTRATION	users_phone_propagated_from_registration	Telefoon / SMS-verificatie
USERS_PHONE_PROPAGATION_SKIPPED_CONFLICT	users_phone_propagation_skipped_conflict	Telefoon / SMS-verificatie

Proxy-gedeelde SSH-events

Opnieuw geëxporteerd door het control-plane als PROXY_SSH_* event-typen.

Constant	Wire String	Beschrijving
PROXY_SSH_SESSION_OPENED	proxy.ssh.session.opened	SSH-sessie succesvol geopend — post-grant verify, upstream connect, channel ready.
PROXY_SSH_SESSION_CLOSED	proxy.ssh.session.closed	SSH-sessie gesloten — channel close, upstream EOF, of clientverbreking.
PROXY_SSH_AUTH_REJECTED	proxy.ssh.auth.rejected	SSH-authenticatie geweigerd op de proxy — ongeldige grant, verlopen grant, replay, of ongeautoriseerde sleutel.
PROXY_SSH_RECORDING_WRITTEN	proxy.ssh.recording.written	SSH-opnameaartefact gefinaliseerd en persistent gemaakt in de opnagenopslag.

Ernst niveaus

Waarde	Betekenis
DEBUG	Laagdiagnostiek; niet standaard doorgestuurd naar SIEM.
INFO	Normale bedrijfsregistratie.
WARN	Herstelbare voorwaarde die aandacht nodig kan hebben.
ERROR	Bewerking mislukt; onderzoek kan nodig zijn.
CRITICAL	Beveiligingsrelevante fout; altijd doorgestuurd naar SIEM.

Actortypes

Waarde	Beschrijving
User	Eindgebruiker die namens zichzelf handelt.
TenantAdmin	Beheerder op organisatieniveau.
System	Geautomatiseerde systeemactie zonder directe gebruikersactivering.
ServiceAccount	API-token of machineaccount.
PlatformAdmin	Cross-organisatie platformoperator.
OrgAdmin	Beheerdersrol met organisatiebereik.
Connector	Connector-agent die autonoom werkt.

Doeltypes

Waarde	Beschrijving
Account	Geprivilegieerd account of referentieobject.
Connection	Verbindingsdefinitie.
Session	Actieve of voltooide sessie.
Agent	Connector- of proxyagent.
Policy	Toegangs- of sessiebeleiding.
Secret	Secret of referentielading.
Tenant	Tenant/organisatie-entiteit.
API Token	API-tokenobject.
Invitation	Uitnodigingsregistratie.
AuditLog	Audit log-zoeking of export.
GovernanceAction	Governance-goedkeuringsverzoek.
Safe	Safe-container.