Audit Events
Audit events are records or logs generated by N-central to track activities and changes that occur, for example, user log in and log out attempts. They can help monitor and review actions that impact system integrity, user access, and sensitive data.
This section lists the auditing events available in the Syslog Export, and the version of N-central where they were introduced:
| Event Name | N-central Version (from) | Notes |
|---|---|---|
| Auditing User Login | 2024.3 | This entry logs standard user login events. It does not cover logins via Identity Providers (IDP) or other alternative login methods. |
| User Logout | 2024.3 | Records the event when a user logs out of the system. |
| User Create/Modify/(single) delete | 2024.3 | Tracks the creation, modification, or deletion of a user account. |
| Role Create/Modify/delete | 2024.3 | Captures actions related to creating, modifying, or deleting roles within the system. |
| Bulk User Deletion | 2024.3 | Logs the deletion of multiple user accounts at once. |
| Bulk Role Deletion | 2024.3 | Notes when multiple roles are deleted at once. |
| Customer delete auditing | 2024.3 |
Tracks deletion events across the customer hierarchy, including:
|
| CRUD Events for SO, Customer, Site | 2024.3 |
Monitors Create, Read, Update, and Delete (CRUD) actions for:
|
| User Failed Login (with count) | 2024.6 | Records failed login attempts along with the number of attempts. |
| User Create Device (manual) | 2024.6 | Logs when a device is manually created by a user. |
| User Create Device (not imported or “Unmanaged”) | 2024.6 | Captures when a device is created by a user but it is not imported or classed as unmanaged. |
| Adjust Device Modify Message | 2024.6 | Tracks adjustments made to device modification messages. |
| User Logged In (IdP) | 2024.6 | Records when a user logs in using an Identity Provider (IDP). |
| User Logged Out (IdP) | 2024.6 | Captures the event of a user logging out via an Identity Provider (IDP). |
| User Enabled Remote Control Option | 2024.6 | Notes when a user enables the remote control option for a device. |
| User Deleted Device | 2024.6 | Logs the deletion of a device by a user. |
| User Created Device (auto import via discovery) | 2024.6 | Indicates when a device is automatically created through the discovery process. |
| User Terminated Remote control Session | 2024.6 | Records the termination of a remote control session by a user. |
| Events for User Edits | 2024.6 | Tracks edits made by a user. |
| User Enabled | 2024.6 | Captures the event of a user being enabled in the system. |
| User Unlocked | 2024.6 | Notes when a user account is unlocked. |
| User Deleted Service Organization | 2024.6 | Logs the deletion of a service organization by a user. |
| User Deleted Customer | 2024.6 | Records when a user deletes a customer from the system. |
| User Deleted Site | 2024.6 | Captures the deletion of a site by a user. |
| User Deleted | 2024.6 | Indicates when a user account is deleted. |
| User Created | 2024.6 | Notes the creation of a new user account. |
| User Edited | 2024.6 | Logs modifications made to a user account. |
| User Access Group Assigned | 2024.6 | Tracks the assignment of a user to an access group. |
| User Access Group Names Pulled from the database | 2024.6 | Records when user access group names are retrieved from the database. |
| User Logout | 2024.6 | Captures the event of a user logging out |
| user Logged in with level reflected | 2024.6 | Notes when a user logs in with their access level reflected. |
| User Locked | 2024.6 | Logs the event of a user account being locked. |
| User Disabled | 2024.6 | Records when a user account is disabled. |
| User Initiated Remote Control Session | 2024.6 | Indicates when a user starts a remote control session. |
| User Disabled Remote Control Session | 2024.6 | Captures when a user disables a remote control session. |
| Capture Reboot Events in N-central | 2024.6 | Logs reboot events captured in N-central. |
| MFA Enabled | 2024.6 | Notes when Multi-Factor Authentication (MFA) is enabled for a user. |
| MFA Disabled | 2024.6 | Records when Multi-Factor Authentication (MFA) is disabled. |
| User Role is Deleted | 2024.6 | Captures the deletion of a user role. |
| User Rule (Add/Clone) | 2024.6 | Logs the addition or cloning of a user rule. |
| User Edit Rule | 2024.6 | Tracks edits made to user rules. |
| User Delete Rule | 2024.6 | Records the deletion of a user rule. |
|
User Role Assign |
2025.2 |
Notes when a user role is assigned. |
|
User Role Unassign |
2025.2 |
Captures the event of a user role being unassigned. |
|
User Access Group Create/Modify/Delete |
2025.2 |
Logs actions related to creating, modifying, or deleting user access groups. Applies to customers and devices. |
|
User Access Group Clone |
2025.2 |
Indicates when a user access group is cloned. Applies to customers and devices. |
|
User Access Group Merge |
2025.2 |
Records the merging of user access groups. Applies to customers and devices. |
|
Service Template Create/Modify/Delete |
2025.2 |
Tracks the creation, modification, or deletion of service templates. |
|
Filter Create/Modify/Delete |
2025.2 |
Logs actions related to creating, modifying, or deleting filters. |
|
Filter Clone |
2025.2 |
Notes when a filter is cloned. |
|
Filter Import |
2025.2 |
Captures the event of importing a filter. |
|
Create Discovery Job |
2025.3 |
Records when a new discovery job is created. |
|
Modify Discovery Job |
2025.3 |
Logs any modifications made to an existing discovery job. |
| Deleting of Discovery Jobs | 2025.3 | Captures the deletion of a discovery job. |
| Creation of Scheduled Tasks | 2025.3 | Logs when a user creates a scheduled task via the UI or automation workflow. |
| Device Creation via Agent Install | 2025.3 | Captures when a device is auto-created through agent install (distinct from manual or probe-created devices). Applies to agents on Windows, macOS and Linux. |
| Enable and Disable Scheduled Tasks | 2025.3.1 | Tracks when users enable or disable scheduled tasks. |
| Modify Scheduled Task | 2025.3.1 | Logs edits made to existing scheduled tasks. |
| Delete Scheduled Task | 2025.3.1 | Records deletion of scheduled tasks. |
| SSH Login and Logout | 2025.3.1 | Captures successful and failed SSH login/logout activity. |
| Create User Script | 2025.3.1 | Logs the creation of user-created scripts. |
| Modify User Script | 2025.3.1 | Tracks edits made to user-created scripts. |
| Delete User Script | 2025.3.1 | Records deletion of user-created scripts. |