Alerting Event Catalog¶

Choose from this catalog which events your rules should watch for.

All events are available to both instance and organization rules, except those marked (instance only). Organizations see only events relevant to their own members and resources; instance-wide administration events are filtered out.

Note

Geographic sign-in anomalies (unusual country/IP, impossible travel) and same-account sessions from multiple IPs at once are not part of this catalog yet.

Identity & privileged accounts¶

Admin created (instance only)
Admin deleted (instance only)
Admin updated (roles, escalation) (instance only)
Admin password changed (instance only)
Admin 2FA disabled by an admin (instance only)
User created or invited
User deleted or removed
User activated or deactivated
Organization member updated (role, owner/admin)
User password changed
User 2FA changed
Group membership changed

Authentication & anomalies¶

Sign-in failed
Bruteforce lockout
2FA failed
Device verification failed
Sign-in succeeded
Correct password after repeated failures
Sign-out
SSO sign-in (SAML, OIDC, LDAP)
New device (unseen browser + OS)
Session IP change

Resource access¶

Resource access denied
Session opened on a resource
First access to a resource
Session closed on a resource

Platform configuration¶

Instance settings changed (instance only)
Organization updated
Machine deleted
New machine registered
Alerting configuration changed

Platform health¶

Recording storage running low (instance only): the session recording storage reached its warning threshold.
Recording storage full or unavailable (instance only): the session recording storage reached its critical threshold, or is missing, not writable or unresponsive.

These two alerts are raised automatically, without any rule to create, as soon as Alerting is enabled on the instance. To be notified through a channel, create a rule on these events.