OCSF Class Events
Automox currently reports on the following OCSF class events:
Account Change Events
- User Created
- User Removed
- User Role Updated
- User Zone Assignment
- User Profile Password Changed
- User Account 2FA Enabled for Email
- User Account 2FA Enabled for Mobile
- User Account 2FA Disabled
Authentication Events
- User Log In Success
- User Log In Failure
- User Logged Out
Entity Management Events
- Create/Add API Key
- Delete/Remove API Key
- API Key Enabled
- API Key Disabled
- Zone Login Attempts Setting Change
- Zone SAML Enabled
- Zone SAML Disabled
- Zone 2FA Setting Enabled
- Zone 2FA Setting Disabled
- API Key Decrypted
- Group Created
- Group Deleted
- Group Settings Updated
- Devices Associated to Group
- Policies Associated to Group
Web Resource Activity Events
- Delete Device
- -
- Device custom_name Updated
- Device Group Updated
- Device Tag Updated
- Manual Device Reboot Request
- Manual Device Scan Request
- Manual Packaged Install Request
- Cloned Policy Created
- Manual Approval Policy Denied
- Manual Approval Policy Approved
- Policy Created
- Non-Scheduled Policy Run (Run Now)
- Policy Activated
- Policy Configuration Updated
- Policy Created from Worklet Catalog
- Policy Deactivated
- Policy Deleted
- Zone Added
- Zone Name Updated