Workplace security logs
Copy link
Workplace security logs keep a record of all security events. Below is a list of all the events we currently record, alongside a short explanation of what they mean.
| Event Name | Note |
| Logged in | A user has successfully logged in using either password or SSO. |
| Login Failed | A user has unsuccessfully tried to log in. |
| Logged out | A user has logged out. |
| Forced Logout | An admin has forced a user to log out via the admin panel. |
| Password Changed | A user has changed their Workplace password. |
| Password Reset Succeeded | A user has reset their Workplace password by setting a new password. |
| Password Reset Code Requested | A user's Workplace password has been requested for reset through the self-service flow. |
| Password Reset Incorrect Code | The verification code required to reset a user's Workplace password has been entered incorrectly. |
| Forced Password Reset | An admin has forced a user's password to be reset before next login. |
| Two-Factor Authentication Enabled | A user has self-enrolled in two-factor authentication. Learn more on how this is enabled. |
| Two-Factor Authentication Disabled | Two-factor authentication has been disabled by a user. |
| Two-Factor Code Entry Succeeded | A user has successfully entered their two-factor authentication code when prompted on desktop or mobile. |
| Two-Factor Code Entry Failed | A user has unsuccessfully entered their two-factor authentication code when prompted on desktop or mobile. |
| Two-Factor Code Entry Succeeded On Mobile App | A user has successfully entered their two-factor authentication code when prompted on the Android or iOS app. |
| Two-Factor Code Entry Failed On Mobile App | A user has unsuccessfully entered their two-factor authentication code when prompted on the Android or iOS app. |
| SSO Reauthentication | An admin requested SSO (Single Sign-On) Reauthentication from their users. |
| Account at Risk | There's a user whose account is at risk. Learn more about how to identify accounts at risk. |
| Account Set To Unclaimed | An admin or integration has set a user to unclaimed. |
| Profile Automaticatically Deleted | A user account has been deleted automatically after being unclaimed for 27 days or longer. |
| Account Deactivated | A user has been deactivated by an admin or an integration. |
| Account Activated | A user has been activated by an admin or an integration. |
| Account Deleted | A user account has been deleted. |
| Account Created | A user account has been created by an admin. |
| Accounts Created | An admin has created user accounts with the Excel import method. |
| Account Promoted to Admin | An existing user has been promoted to admin. |
| Created users via IDP Sync | Users have been created by a connected identity provider (Azure or G Suite). |
| Self Invite Created | A user created their account using self-invite. |
| User Invited | A user has been invited to Workplace. |
| Created Users via Coworker Invite | Users have been created through invites from other community members. |
| Invited Coworker | A user has been invited through an invite from another community member. The user account is only created after they accept the invite. |
| Email Changed | A user's email address has been updated. |
| Phone Number Added | A user has added a phone number to their account. |
| Profile Data Download Requested | A user has put in a request to download their profile data. |
| Profile Data Downloaded | A user has downloaded their profile data. |
| Admin Role Changed | An admin account's role has been updated. |
| Admin Removed | A user's admin role has been removed. |
| Admin Created | A user account has been created through the Administrators section and has been promoted to an admin role. |
| Domain Added | A domain has been added to the verification table, but it has not been verified yet. |
| Domain Verified | A domain has been verified successfully. Learn more about domain verification. |
| Domain Removed | A domain has been removed from Workplace. |
| Group File Downloaded | A file has been downloaded from a group. |
| Group File Uploaded | A file has been uploaded to a group. Learn how to upload a file to a group. |
| Malware Suspected in File | A file is suspected of having malware and has been blocked from being uploaded to a group. |
| Malware Upload Blocked | Malware found in a file upload was blocked. |
| Compromised Credentials Found | An account was found to have compromised credentials for username or password authentication. |
| Integration Created | A custom integration has been created. |
| Integration Edited | A custom integration has been edited. |
| Integration Deleted | A custom integration has been deleted. |
| Integration Added | An app from the integration directory has been added. |
| Integration Removed | A integration directory app has been removed. |
| Integration Access Token Reset | An integration access token was reset. |
| Multi-Company Group Created | A multi-company group has been created. |
| Joined Multi-Company Group | A user has joined a multi-company group. |
| Report Former Employee | Persisted events from former employee reports. |
| Reported Content | A user has reported a post for the admin to review. |
| Reseller Added | Enabled insights tab for non-admin user. |
| Reseller Removed | Disabled insights tab for non-admin user. |
| Reseller Invite Sent | A company has been invited to be linked. |
| Reseller Invite Accepted | Invited company to be linked has accepted the invite. |
| Reseller Invite Declined | Invited company to be linked has declined the invite. |
| Video Downloaded | A user has downloaded a video. |
