> For the complete documentation index, see [llms.txt](https://docs.fenixpyre.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fenixpyre.com/fenixpyre-for-admins/admin-dashboard/audit-logs/audit-events-glossary.md). # Audit Events Glossary FenixPyre continuously records activity across your organization - file interactions, administrative changes, user sessions, and agent connectivity - as structured audit events. These events power the [**Audit Logs**](/fenixpyre-for-admins/admin-dashboard/audit-logs/audit-logs.md) dashboard and can be exported through [**Log Streaming**](/fenixpyre-for-admins/admin-dashboard/log-streaming.md) to Splunk, Datadog, or a custom HTTP endpoint. Every event is classified into one of four categories via its `event_type` field: | `event_type` | Category | | -------------- | ------------------ | | `file_access` | File Access Events | | `admin_events` | Admin Events | | `user_events` | User Events | | `agent` | Agent Events | Within each category, events are further grouped into subtypes. Below is the full list of actions tracked within each subtype, with a one-line explanation of what each one represents. *** ### File Access Events `event_type: file_access` Records of file- and folder-level interactions across FenixPyre and connected storage platforms (Desktop, Network Drive, SharePoint, Box, Egnyte, etc.). #### File Management | Action | Description | | ------------------------- | ------------------------------------------------------------ | | `file.open` | A file was opened | | `file.create` | A new file was created | | `file.edit` | A file was edited | | `file.write` | A file was written to | | `file.rename` | A file was renamed | | `file.delete` | A file was deleted | | `file.download` | A file was downloaded | | `file.upload` | A file was uploaded | | `file.access` | A file was accessed | | `file.deny` | Access to a file was denied | | `file.lock` | A file was locked to prevent concurrent edits | | `file.unlock` | A file was unlocked | | `file.co-edit` | A file was opened for collaborative editing | | `file.email-attachment` | A file was sent as an email attachment | | `file.encrypt` | A file was encrypted by FenixPyre | | `file.decrypt` | A file was decrypted | | `file.auto-encrypt` | A file was automatically encrypted per policy | | `file.offline_open` | A file was opened while the agent was offline | | `file.offline_edit` | A file was edited while the agent was offline | | `file.offline_deny` | Access to a file was denied while the agent was offline | | `file.offline_access` | A file was accessed while the agent was offline | | `file.offline-encrypt` | A file was encrypted while the agent was offline | | `file.encrypted_download` | A file was downloaded in its encrypted form via a share link | | `file.decrypted_download` | A file was downloaded in its decrypted form via a share link | #### Folder Management | Action | Description | | -------------------------------- | ------------------------------------------------ | | `folder.add-offline` | A folder was made available offline | | `folder.remove-offline` | A folder was removed from offline availability | | `folder.add-protection` | Encryption protection was applied to a folder | | `folder.remove-protection` | Encryption protection was removed from a folder | | `folder.auto-encrypt-enabled` | Automatic encryption was enabled for a folder | | `folder.auto-encrypt-disabled` | Automatic encryption was disabled for a folder | | `folder.auto_encryption_enable` | Automatic encryption was turned on for a folder | | `folder.auto_encryption_disable` | Automatic encryption was turned off for a folder | | `folder.auto_decryption_enable` | Automatic decryption was turned on for a folder | | `folder.auto_decryption_disable` | Automatic decryption was turned off for a folder | #### File Collaboration | Action | Description | | --------------------- | ------------------------------------------ | | `collaboration.join` | A user joined a collaborative file session | | `collaboration.leave` | A user left a collaborative file session | *** ### Admin Events `event_type: admin_events` Records of actions taken by administrators within the FenixPyre Dashboard — user, policy, group, identity, integration, and configuration management. #### User Management | Action | Description | | -------------------------------- | ------------------------------------- | | `authentication.password.update` | A user's password was updated | | `user.create` | A new user account was created | | `user.update` | A user account's details were updated | | `user.delete` | A user account was deleted | | `user.role.add` | A role was assigned to a user | | `user.role.remove` | A role was removed from a user | | `user.status.activate` | A user account was activated | | `user.status.deactivate` | A user account was deactivated | #### Policy Management Attaching or detaching groups and rules to/from a policy. | Action | Description | | ---------------- | ------------------------------------------ | | `group.add` | A group was attached to a policy | | `group.remove` | A group was detached from a policy | | `members.add` | Members were added to a policy's group | | `members.remove` | Members were removed from a policy's group | | `policy.create` | A policy was created | | `policy.update` | A policy was updated | | `policy.delete` | A policy was deleted | | `rules.add` | A rule was added to a policy | | `rules.update` | A rule was updated | | `rules.delete` | A rule was deleted | #### Group Management Management of the group entity itself (distinct from attaching a group to a policy above). | Action | Description | | ---------------------- | --------------------------------- | | `group.create` | A new group was created | | `group.delete` | A group was deleted | | `group.update` | A group's details were updated | | `group.members.add` | Members were added to a group | | `group.members.remove` | Members were removed from a group | #### Identity Provisioning (SSO/SCIM) | Action | Description | | ---------------------------------- | ---------------------------------------------------------- | | `automatic_account_creation.allow` | Automatic account creation for new identities was enabled | | `automatic_account_creation.deny` | Automatic account creation for new identities was disabled | | `scim.add` | A SCIM provisioning configuration was added | | `scim.remove` | A SCIM provisioning configuration was removed | | `scim.update` | A SCIM provisioning configuration was updated | | `signin_method.update` | The organization's sign-in method was changed | | `sso.add` | An SSO configuration was added | | `sso.remove` | An SSO configuration was removed | | `sso.update` | An SSO configuration was updated | #### Integration Management | Action | Description | | -------------------- | ------------------------------------- | | `integration.create` | A third-party integration was added | | `integration.update` | A third-party integration was updated | | `integration.delete` | A third-party integration was removed | #### Share Link Management Admin-initiated management of a user's share link. | Action | Description | | ------------------------ | ------------------------------------------- | | `share_link.create` | A share link was created | | `share_link.update` | A share link's settings were updated | | `share_link.enable` | A share link was enabled | | `share_link.disable` | A share link was disabled | | `share_link.user.add` | A user was granted access to a share link | | `share_link.user.remove` | A user's access to a share link was removed | #### Sharing Policy Management Organization-wide default sharing settings and permission toggles. | Action | Description | | --------------------------------------------- | -------------------------------------------------------- | | `access_levels.default_sharing_method.update` | The default sharing method for access levels was changed | | `allowed_sharing_methods.update` | The set of allowed sharing methods was updated | | `default_editor.update` | The default editor for shared files was changed | | `default_expiry.update` | The default share link expiry period was changed | | `maximum_expiry.update` | The maximum allowed share link expiry period was changed | | `permissions.can_create.update` | The create-permission default for shares was updated | | `permissions.can_delete.update` | The delete-permission default for shares was updated | | `permissions.can_download.update` | The download-permission default for shares was updated | | `permissions.can_edit.update` | The edit-permission default for shares was updated | | `permissions.can_rename.update` | The rename-permission default for shares was updated | | `permissions.can_share.update` | The re-share-permission default for shares was updated | | `permissions.can_upload.update` | The upload-permission default for shares was updated | | `permissions.can_move.update` | The move-permission default for shares was updated | | `permissions.can_copy.update` | The copy-permission default for shares was updated | #### Installer Management | Action | Description | | -------------------- | ----------------------------------------- | | `installer.download` | An agent installer package was downloaded | | `installer.update` | An installer configuration was updated | #### Application Management | Action | Description | | ------------------------- | ---------------------------------------- | | `user_application.create` | An application was registered for a user | | `user_application.delete` | An application registration was removed | | `user_application.update` | An application registration was updated | #### Domain Management | Action | Description | | --------------- | ------------------------------------------ | | `domain.add` | A domain was added to the organization | | `domain.remove` | A domain was removed from the organization | #### Auto Encryption Management | Action | Description | | --------------------------------- | -------------------------------------- | | `auto_encryption_settings.create` | An auto-encryption setting was created | | `auto_encryption_settings.update` | An auto-encryption setting was updated | | `auto_encryption_settings.delete` | An auto-encryption setting was deleted | #### Key Management | Action | Description | | ------------------ | ----------------------------- | | `key.create` | An encryption key was created | | `key.update` | An encryption key was updated | | `key_vault.create` | A key vault was created | | `key_vault.update` | A key vault was updated | #### Reports | Action | Description | | --------------------------- | ----------------------------------------- | | `user_logs.download` | A user activity log report was downloaded | | `application_logs.download` | An application log report was downloaded | *** ### User Events `event_type: user_events` Captures authentication and user-initiated activity such as logins, sharing, favourites, and file downloads. #### Authentication | Action | Description | | ------------- | ---------------------------------------- | | `user.login` | A user logged in to FenixPyre | | `agent.login` | A user logged in via the FenixPyre agent | #### Share Link Management | Action | Description | | --------------------------- | ------------------------------------------- | | `share_link.create` | A share link was created | | `share_link.update` | A share link's settings were updated | | `share_link.enable` | A share link was enabled | | `share_link.disable` | A share link was disabled | | `share_link.user.add` | A user was granted access to a share link | | `share_link.user.remove` | A user's access to a share link was removed | | `share_link.access` | A share link was accessed | | `share_link.request_access` | A user requested access to a share link | #### Favourites Management | Action | Description | | ------------------ | -------------------------------------------- | | `favourite.create` | A file or folder was marked as a favourite | | `favourite.delete` | A file or folder was removed from favourites | #### File Management | Action | Description | | --------------------- | ------------------------------------------------- | | `user.zip_download` | A user downloaded multiple files as a zip archive | | `user.quick_download` | A user downloaded a file via quick download | *** ### Agent Events `event_type: agent` Events emitted by the FenixPyre Windows Agent about its own connectivity and session state. | Action | Description | | ------------------ | ------------------------------ | | `agent.go-online` | The agent came online | | `agent.go-offline` | The agent went offline | | `agent.revoke` | The agent's access was revoked | *** ### Cross-Cutting Concepts * **Severity** (`severity`): `info`, `warn`, `error`, `fatal` — indicates how significant the event is. * **Status** (`status`): `info` or `alert` — flags events that warrant attention. * **Result status** (`event_result_info.status`): `allow` or `deny` — a `deny` result means the action was blocked (e.g. an unauthorized access attempt), and these events surface in the Audit Logs "Unauthorized Access" views. *** These four categories back both the [Audit Logs](https://docs.fenixpyre.com/fenixpyre-for-admins/admin-dashboard/audit-logs) dashboard and the [Log Streaming](https://docs.fenixpyre.com/fenixpyre-for-admins/admin-dashboard/log-streaming) export feature. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.fenixpyre.com/fenixpyre-for-admins/admin-dashboard/audit-logs/audit-events-glossary.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.