Audit Events

Audit events are records or logs generated by N-central to track activities and changes that occur, for example, user log in and log out attempts. They can help monitor and review actions that impact system integrity, user access, and sensitive data.

This section lists the auditing events available in the Syslog Export, and the version of N-central where they were introduced :

Event Name N-central Version (from) Notes
Auditing User Login 2024.3 This entry logs standard user login events. It does not cover logins via Identity Providers (IDP) or other alternative login methods.
User Logout 2024.3 Records the event when a user logs out of the system.
User Create/Modify/(single) delete 2024.3 Tracks the creation, modification, or deletion of a user account.
Role Create/Modify/delete 2024.3 Captures actions related to creating, modifying, or deleting roles within the system.
Bulk User Deletion 2024.3 Logs the deletion of multiple user accounts at once.
Bulk Role Deletion 2024.3 Notes when multiple roles are deleted at once.
Customer delete auditing 2024.3

Tracks deletion events across the customer hierarchy, including:

  • Service Organization

  • Customer

  • Site

CRUD Events for SO, Customer, Site 2024.3

Monitors Create, Read, Update, and Delete (CRUD) actions for:

  • Service Organization

  • Customer

  • Site

User Failed Login (with count) 2024.6 Records failed login attempts along with the number of attempts.
User Create Device (manual) 2024.6 Logs when a device is manually created by a user.
User Create Device (not imported or “Unmanaged”) 2024.6 Captures when a device is created by a user but it is not imported or classed as unmanaged.
Adjust Device Modify Message 2024.6 Tracks adjustments made to device modification messages.
User Logged In (IdP) 2024.6 Records when a user logs in using an Identity Provider (IDP).
User Logged Out (IdP) 2024.6 Captures the event of a user logging out via an Identity Provider (IDP).
User Enabled Remote Control Option 2024.6 Notes when a user enables the remote control option for a device.
User Deleted Device 2024.6 Logs the deletion of a device by a user.
User Created Device (auto import via discovery) 2024.6 Indicates when a device is automatically created through the discovery process.
User Terminated Remote control Session 2024.6 Records the termination of a remote control session by a user.
Events for User Edits 2024.6 Tracks edits made by a user.
User Enabled 2024.6 Captures the event of a user being enabled in the system.
User Unlocked 2024.6 Notes when a user account is unlocked.
User Deleted Service Organization 2024.6 Logs the deletion of a service organization by a user.
User Deleted Customer 2024.6 Records when a user deletes a customer from the system.
User Deleted Site 2024.6 Captures the deletion of a site by a user.
User Deleted 2024.6 Indicates when a user account is deleted.
User Created 2024.6 Notes the creation of a new user account.
User Edited 2024.6 Logs modifications made to a user account.
User Access Group Assigned 2024.6 Tracks the assignment of a user to an access group.
User Access Group Names Pulled from the database 2024.6 Records when user access group names are retrieved from the database.
User Logout 2024.6 Captures the event of a user logging out
user Logged in with level reflected 2024.6 Notes when a user logs in with their access level reflected.
User Locked 2024.6 Logs the event of a user account being locked.
User Disabled 2024.6 Records when a user account is disabled.
User Initiated Remote Control Session 2024.6 Indicates when a user starts a remote control session.
User Disabled Remote Control Session 2024.6 Captures when a user disables a remote control session.
Capture Reboot Events in N-central 2024.6 Logs reboot events captured in N-central.
MFA Enabled 2024.6 Notes when Multi-Factor Authentication (MFA) is enabled for a user.
MFA Disabled 2024.6 Records when Multi-Factor Authentication (MFA) is disabled.
User Role is Deleted 2024.6 Captures the deletion of a user role.
User Rule (Add/Clone) 2024.6 Logs the addition or cloning of a user rule.
User Edit Rule 2024.6 Tracks edits made to user rules.
User Delete Rule 2024.6 Records the deletion of a user rule.

User Role Assign

2025.2

Notes when a user role is assigned.

User Role Unassign

2025.2

Captures the event of a user role being unassigned.

User Access Group Create/Modify/Delete

2025.2

Logs actions related to creating, modifying, or deleting user access groups. Applies to customers and devices.

User Access Group Clone

2025.2

Indicates when a user access group is cloned. Applies to customers and devices.

User Access Group Merge

2025.2

Records the merging of user access groups. Applies to customers and devices.

Service Template Create/Modify/Delete

2025.2

Tracks the creation, modification, or deletion of service templates.

Filter Create/Modify/Delete

2025.2

Logs actions related to creating, modifying, or deleting filters.

Filter Clone

2025.2

Notes when a filter is cloned.

Filter Import

2025.2 

Captures the event of importing a filter.

Create Discovery Job

2025.3

Records when a new discovery job is created.

Modify Discovery Job

2025.3

Logs any modifications made to an existing discovery job.

Deleting of Discovery Jobs 2025.3 Captures the deletion of a discovery job.
Creation of Scheduled Tasks 2025.3 Logs when a user creates a scheduled task via the UI or automation workflow.
Device Creation via Agent Install 2025.3 Captures when a device is auto-created through agent install (distinct from manual or probe-created devices). Applies to agents on Windows, macOS and Linux.
Enable and Disable Scheduled Tasks 2025.3.1 Tracks when users enable or disable scheduled tasks.
Modify Scheduled Task 2025.3.1 Logs edits made to existing scheduled tasks.
Delete Scheduled Task 2025.3.1 Records deletion of scheduled tasks.
SSH Login and Logout 2025.3.1 Captures successful and failed SSH login/logout activity.
Create User Script 2025.3.1 Logs the creation of user-created scripts.
Modify User Script 2025.3.1 Tracks edits made to user-created scripts.
Delete User Script 2025.3.1 Records deletion of user-created scripts.