Audit Events
Audit events are records or logs generated by N-central to track activities and changes that occur, for example, user log in and log out attempts. They can help monitor and review actions that impact system integrity, user access, and sensitive data.
This section lists the auditing events available in the Syslog Export, and the version of N-central where they were introduced:
| Event Name | N-central Version (from) | Notes |
|---|---|---|
| Auditing User Login | 2024.3 | This entry logs standard user login events. It does not cover logins via Identity Providers (IDP) or other alternative login methods. |
| User Logout | 2024.3 | Records the event when a user logs out of the system. |
| User Create/Modify/(single) delete | 2024.3 | Tracks the creation, modification, or deletion of a user account. |
| Role Create/Modify/delete | 2024.3 | Captures actions related to creating, modifying, or deleting roles within the system. |
| Bulk User Deletion | 2024.3 | Logs the deletion of multiple user accounts at once. |
| Bulk Role Deletion | 2024.3 | Notes when multiple roles are deleted at once. |
| Customer delete auditing | 2024.3 |
Tracks deletion events across the customer hierarchy, including:
|
| CRUD Events for SO, Customer, Site | 2024.3 |
Monitors Create, Read, Update, and Delete (CRUD) actions for:
|
| User Failed Login (with count) | 2024.6 | Records failed login attempts along with the number of attempts. |
| User Create Device (manual) | 2024.6 | Logs when a device is manually created by a user. |
| User Create Device (not imported or “Unmanaged”) | 2024.6 | Captures when a device is created by a user but it is not imported or classed as unmanaged. |
| Adjust Device Modify Message | 2024.6 | Tracks adjustments made to device modification messages. |
| User Logged In (IdP) | 2024.6 | Records when a user logs in using an Identity Provider (IDP). |
| User Logged Out (IdP) | 2024.6 | Captures the event of a user logging out via an Identity Provider (IDP). |
| User Enabled Remote Control Option | 2024.6 | Notes when a user enables the remote control option for a device. |
| User Deleted Device | 2024.6 | Logs the deletion of a device by a user. |
| User Created Device (auto import via discovery) | 2024.6 | Indicates when a device is automatically created through the discovery process. |
| User Terminated Remote control Session | 2024.6 | Records the termination of a remote control session by a user. |
| Events for User Edits | 2024.6 | Tracks edits made by a user. |
| User Enabled | 2024.6 | Captures the event of a user being enabled in the system. |
| User Unlocked | 2024.6 | Notes when a user account is unlocked. |
| User Deleted Service Organization | 2024.6 | Logs the deletion of a service organization by a user. |
| User Deleted Customer | 2024.6 | Records when a user deletes a customer from the system. |
| User Deleted Site | 2024.6 | Captures the deletion of a site by a user. |
| User Deleted | 2024.6 | Indicates when a user account is deleted. |
| User Created | 2024.6 | Notes the creation of a new user account. |
| User Edited | 2024.6 | Logs modifications made to a user account. |
| User Access Group Assigned | 2024.6 | Tracks the assignment of a user to an access group. |
| User Access Group Names Pulled from the database | 2024.6 | Records when user access group names are retrieved from the database. |
| User Logout | 2024.6 | Captures the event of a user logging out |
| user Logged in with level reflected | 2024.6 | Notes when a user logs in with their access level reflected. |
| User Locked | 2024.6 | Logs the event of a user account being locked. |
| User Disabled | 2024.6 | Records when a user account is disabled. |
| User Initiated Remote Control Session | 2024.6 | Indicates when a user starts a remote control session. |
| User Disabled Remote Control Session | 2024.6 | Captures when a user disables a remote control session. |
| Capture Reboot Events in N-central | 2024.6 | Logs reboot events captured in N-central. |
| MFA Enabled | 2024.6 | Notes when Multi-Factor Authentication (MFA) is enabled for a user. |
| MFA Disabled | 2024.6 | Records when Multi-Factor Authentication (MFA) is disabled. |
| User Role is Deleted | 2024.6 | Captures the deletion of a user role. |
| User Rule (Add/Clone) | 2024.6 | Logs the addition or cloning of a user rule. |
| User Edit Rule | 2024.6 | Tracks edits made to user rules. |
| User Delete Rule | 2024.6 | Records the deletion of a user rule. |
|
User Role Assign |
2025.2 |
Notes when a user role is assigned. |
|
User Role Unassign |
2025.2 |
Captures the event of a user role being unassigned. |
|
User Access Group Create/Modify/Delete |
2025.2 |
Logs actions related to creating, modifying, or deleting user access groups. Applies to customers and devices. |
|
User Access Group Clone |
2025.2 |
Indicates when a user access group is cloned. Applies to customers and devices. |
|
User Access Group Merge |
2025.2 |
Records the merging of user access groups. Applies to customers and devices. |
|
Service Template Create/Modify/Delete |
2025.2 |
Tracks the creation, modification, or deletion of service templates. |
|
Filter Create/Modify/Delete |
2025.2 |
Logs actions related to creating, modifying, or deleting filters. |
|
Filter Clone |
2025.2 |
Notes when a filter is cloned. |
|
Filter Import |
2025.2 |
Captures the event of importing a filter. |
|
Create Discovery Job |
2025.3 |
Records when a new discovery job is created. |
|
Modify Discovery Job |
2025.3 |
Logs any modifications made to an existing discovery job. |
| Deleting of Discovery Jobs | 2025.3 | Captures the deletion of a discovery job. |
| Creation of Scheduled Tasks | 2025.3 | Logs when a user creates a scheduled task via the UI or automation workflow. |
| Device Creation via Agent Install | 2025.3 | Captures when a device is auto-created through agent install (distinct from manual or probe-created devices). Applies to agents on Windows, macOS and Linux. |
| Enable and Disable Scheduled Tasks | 2025.3.1 | Tracks when users enable or disable scheduled tasks. |
| Modify Scheduled Task | 2025.3.1 | Logs edits made to existing scheduled tasks. |
| Delete Scheduled Task | 2025.3.1 | Records deletion of scheduled tasks. |
| SSH Login and Logout | 2025.3.1 | Captures successful and failed SSH login/logout activity. |
| Create User Script | 2025.3.1 | Logs the creation of user-created scripts. |
| Modify User Script | 2025.3.1 | Tracks edits made to user-created scripts. |
| Delete User Script | 2025.3.1 | Records deletion of user-created scripts. |
| Remote control session start | 2025.4 | Records the start of a remote control session from the Asset View |
| Remote control session end | 2025.4 | Records the end of a remote control session |
| Remote background session start | 2025.4 | Records the start of a remote background session |
| Remote background session end | 2025.4 | Records the end of a remote background session |
| Remote background file upload | 2025.4 | Logs file upload activity performed through remote background tools |
| Remote background file download | 2025.4 | Logs file download activity performed through remote background tools |
| Process termination | 2025.4 | Records process termination initiated through remote tools |
| Registry edit | 2025.4 | Tracks registry modification activity in remote background tools |
| System shell command execution | 2025.4 | Logs execution of system shell commands in remote background tools |
| Script executed | 2025.4 | Records script execution activity (Scripting in LTP) |
| Script added | 2025.4 | Tracks creation of scripts (Scripting in LTP) |
| Script edited | 2025.4 | Tracks modification of scripts (Scripting in LTP) |
| Script deleted | 2025.4 | Records deletion of scripts (Scripting in LTP) |
| Tag created | 2025.4 | Records creation of asset tags |
| Tag edited | 2025.4 | Tracks modification of asset tags |
| Tag assigned to asset | 2025.4 | Records assignment of a tag to an asset for classification and grouping |
| Tag unassigned from asset | 2025.4 | Records removal of a tag from an asset |
| Tag deleted | 2025.4 | Logs deletion of an asset tag |