Audit Events Glossary

FenixPyre continuously records activity across your organization - file interactions, administrative changes, user sessions, and agent connectivity - as structured audit events. These events power the Audit Logs dashboard and can be exported through Log Streaming to Splunk, Datadog, or a custom HTTP endpoint.

Every event is classified into one of four categories via its event_type field:

event_type	Category
file_access	File Access Events
admin_events	Admin Events
user_events	User Events
agent	Agent Events

Within each category, events are further grouped into subtypes. Below is the full list of actions tracked within each subtype, with a one-line explanation of what each one represents.

---

File Access Events

event_type: file_access

Records of file- and folder-level interactions across FenixPyre and connected storage platforms (Desktop, Network Drive, SharePoint, Box, Egnyte, etc.).

File Management

Action	Description
file.open	A file was opened
file.create	A new file was created
file.edit	A file was edited
file.write	A file was written to
file.rename	A file was renamed
file.delete	A file was deleted
file.download	A file was downloaded
file.upload	A file was uploaded
file.access	A file was accessed
file.deny	Access to a file was denied
file.lock	A file was locked to prevent concurrent edits
file.unlock	A file was unlocked
file.co-edit	A file was opened for collaborative editing
file.email-attachment	A file was sent as an email attachment
file.encrypt	A file was encrypted by FenixPyre
file.decrypt	A file was decrypted
file.auto-encrypt	A file was automatically encrypted per policy
file.offline_open	A file was opened while the agent was offline
file.offline_edit	A file was edited while the agent was offline
file.offline_deny	Access to a file was denied while the agent was offline
file.offline_access	A file was accessed while the agent was offline
file.offline-encrypt	A file was encrypted while the agent was offline
file.encrypted_download	A file was downloaded in its encrypted form via a share link
file.decrypted_download	A file was downloaded in its decrypted form via a share link

Folder Management

Action	Description
folder.add-offline	A folder was made available offline
folder.remove-offline	A folder was removed from offline availability
folder.add-protection	Encryption protection was applied to a folder
folder.remove-protection	Encryption protection was removed from a folder
folder.auto-encrypt-enabled	Automatic encryption was enabled for a folder
folder.auto-encrypt-disabled	Automatic encryption was disabled for a folder
folder.auto_encryption_enable	Automatic encryption was turned on for a folder
folder.auto_encryption_disable	Automatic encryption was turned off for a folder
folder.auto_decryption_enable	Automatic decryption was turned on for a folder
folder.auto_decryption_disable	Automatic decryption was turned off for a folder

File Collaboration

Action	Description
collaboration.join	A user joined a collaborative file session
collaboration.leave	A user left a collaborative file session

---

Admin Events

event_type: admin_events

Records of actions taken by administrators within the FenixPyre Dashboard — user, policy, group, identity, integration, and configuration management.

User Management

Action	Description
authentication.password.update	A user's password was updated
user.create	A new user account was created
user.update	A user account's details were updated
user.delete	A user account was deleted
user.role.add	A role was assigned to a user
user.role.remove	A role was removed from a user
user.status.activate	A user account was activated
user.status.deactivate	A user account was deactivated

Policy Management

Attaching or detaching groups and rules to/from a policy.

Action	Description
group.add	A group was attached to a policy
group.remove	A group was detached from a policy
members.add	Members were added to a policy's group
members.remove	Members were removed from a policy's group
policy.create	A policy was created
policy.update	A policy was updated
policy.delete	A policy was deleted
rules.add	A rule was added to a policy
rules.update	A rule was updated
rules.delete	A rule was deleted

Group Management

Management of the group entity itself (distinct from attaching a group to a policy above).

Action	Description
group.create	A new group was created
group.delete	A group was deleted
group.update	A group's details were updated
group.members.add	Members were added to a group
group.members.remove	Members were removed from a group

Identity Provisioning (SSO/SCIM)

Action	Description
automatic_account_creation.allow	Automatic account creation for new identities was enabled
automatic_account_creation.deny	Automatic account creation for new identities was disabled
scim.add	A SCIM provisioning configuration was added
scim.remove	A SCIM provisioning configuration was removed
scim.update	A SCIM provisioning configuration was updated
signin_method.update	The organization's sign-in method was changed
sso.add	An SSO configuration was added
sso.remove	An SSO configuration was removed
sso.update	An SSO configuration was updated

Integration Management

Action	Description
integration.create	A third-party integration was added
integration.update	A third-party integration was updated
integration.delete	A third-party integration was removed

Share Link Management

Admin-initiated management of a user's share link.

Action	Description
share_link.create	A share link was created
share_link.update	A share link's settings were updated
share_link.enable	A share link was enabled
share_link.disable	A share link was disabled
share_link.user.add	A user was granted access to a share link
share_link.user.remove	A user's access to a share link was removed

Sharing Policy Management

Organization-wide default sharing settings and permission toggles.

Action	Description
access_levels.default_sharing_method.update	The default sharing method for access levels was changed
allowed_sharing_methods.update	The set of allowed sharing methods was updated
default_editor.update	The default editor for shared files was changed
default_expiry.update	The default share link expiry period was changed
maximum_expiry.update	The maximum allowed share link expiry period was changed
permissions.can_create.update	The create-permission default for shares was updated
permissions.can_delete.update	The delete-permission default for shares was updated
permissions.can_download.update	The download-permission default for shares was updated
permissions.can_edit.update	The edit-permission default for shares was updated
permissions.can_rename.update	The rename-permission default for shares was updated
permissions.can_share.update	The re-share-permission default for shares was updated
permissions.can_upload.update	The upload-permission default for shares was updated
permissions.can_move.update	The move-permission default for shares was updated
permissions.can_copy.update	The copy-permission default for shares was updated

Installer Management

Action	Description
installer.download	An agent installer package was downloaded
installer.update	An installer configuration was updated

Application Management

Action	Description
user_application.create	An application was registered for a user
user_application.delete	An application registration was removed
user_application.update	An application registration was updated

Domain Management

Action	Description
domain.add	A domain was added to the organization
domain.remove	A domain was removed from the organization

Auto Encryption Management

Action	Description
auto_encryption_settings.create	An auto-encryption setting was created
auto_encryption_settings.update	An auto-encryption setting was updated
auto_encryption_settings.delete	An auto-encryption setting was deleted

Key Management

Action	Description
key.create	An encryption key was created
key.update	An encryption key was updated
key_vault.create	A key vault was created
key_vault.update	A key vault was updated

Reports

Action	Description
user_logs.download	A user activity log report was downloaded
application_logs.download	An application log report was downloaded

---

User Events

event_type: user_events

Captures authentication and user-initiated activity such as logins, sharing, favourites, and file downloads.

Authentication

Action	Description
user.login	A user logged in to FenixPyre
agent.login	A user logged in via the FenixPyre agent

Share Link Management

Action	Description
share_link.create	A share link was created
share_link.update	A share link's settings were updated
share_link.enable	A share link was enabled
share_link.disable	A share link was disabled
share_link.user.add	A user was granted access to a share link
share_link.user.remove	A user's access to a share link was removed
share_link.access	A share link was accessed
share_link.request_access	A user requested access to a share link

Favourites Management

Action	Description
favourite.create	A file or folder was marked as a favourite
favourite.delete	A file or folder was removed from favourites

File Management

Action	Description
user.zip_download	A user downloaded multiple files as a zip archive
user.quick_download	A user downloaded a file via quick download

---

Agent Events

event_type: agent

Events emitted by the FenixPyre Windows Agent about its own connectivity and session state.

Action	Description
agent.go-online	The agent came online
agent.go-offline	The agent went offline
agent.revoke	The agent's access was revoked

---

Cross-Cutting Concepts

• Severity (severity): info, warn, error, fatal — indicates how significant the event is.

• Status (status): info or alert — flags events that warrant attention.

• Result status (event_result_info.status): allow or deny — a deny result means the action was blocked (e.g. an unauthorized access attempt), and these events surface in the Audit Logs "Unauthorized Access" views.

---

These four categories back both the Audit Logs dashboard and the Log Streaming export feature.