Audit Events
Audit events are records or logs generated by N-central to track activities and changes that occur, for example, user log in and log out attempts. They can help monitor and review actions that impact system integrity, user access, and sensitive data.
This section lists the auditing events available in the Syslog Export, and the version of N-central where they were introduced :
| Event Name | N-central Version (from) | Notes |
|---|---|---|
| Auditing User Login | 2024.3 | This entry does not include IDP or other login methods. |
| User Logout | 2024.3 | |
| User Create/Modify/(single) delete | 2024.3 | |
| Role Create/Modify/delete | 2024.3 | |
| Bulk User Deletion | 2024.3 | |
| Bulk Role Deletion | 2024.3 | |
| Customer delete auditing | 2024.3 |
Covers the deletion of:
|
| CRUD Events for SO, Customer, Site | 2024.3 |
Covers Create, Update, Delete (CRUD) events for:
|
| User Failed Login (with count) | 2024.6 | |
| User Create Device (manual) | 2024.6 | |
| User Create Device (not imported or “Unmanaged”) | 2024.6 | |
| Adjust Device Modify Message | 2024.6 | |
| User Logged In (IDP) | 2024.6 | |
| User Logged Out (IDP) | 2024.6 | |
| User Enabled Remote Control Option | 2024.6 | |
| User Deleted Device | 2024.6 | |
| User Created Device (auto import via discovery) | 2024.6 | |
| User Terminated Remote control Session | 2024.6 | |
| Events for User Edits | 2024.6 | |
| User Enabled | 2024.6 | |
| User Unlocked | 2024.6 | |
| User Deleted Service Organization | 2024.6 | |
| User Deleted Customer | 2024.6 | |
| User Deleted Site | 2024.6 | |
| User Deleted | 2024.6 | |
| User Created | 2024.6 | |
| User Edited | 2024.6 | |
| User Access Group Assigned | 2024.6 | |
| User Access Group Names Pulled from the database | 2024.6 | |
| User Logout | 2024.6 | |
| user Logged in with level reflected | 2024.6 | |
| User Locked | 2024.6 | |
| User Disabled | 2024.6 | |
| User Initiated Remote Control Session | 2024.6 | |
| User Disabled Remote Control Session | 2024.6 | |
| Capture Reboot Events in N-central | 2024.6 | |
| MFA Enabled | 2024.6 | |
| MFA Disabled | 2024.6 | |
| User Role is Deleted | 2024.6 | |
| User Rule (Add/Clone) | 2024.6 | |
| User Edit Rule | 2024.6 | |
| User Delete Rule | 2024.6 | |
|
User Role Assign |
2025.2 |
|
|
User Role Unassign |
2025.2 |
|
|
User Access Group Create/Modify/Delete |
2025.2 |
Applies to customers and devices. |
|
User Access Group Clone |
2025.2 |
Applies to customers and devices. |
|
User Access Group Merge |
2025.2 |
Applies to customers and devices. |
|
Service Template Create/Modify/Delete |
2025.2 |
|
|
Filter Create/Modify/Delete |
2025.2 |
|
|
Filter Clone |
2025.2 |
|
|
Filter Import |
2025.2 |
|