View and Export Events

The Illumio Core web console provides an ongoing log of all Organization events that occur in your Illumio Core organization. For example, Organization events capture actions such as users logging in and logging out, tenant creation, failed login attempts, and so on.

From the platform and API perspective, Organization events are referred to internally as auditable_events and are generated by the auditable_events_service.

View Events

Tip

A wealth of information about Events is available in the Core PCE documentation in the Events Administration Guide. However, please note that not all of the information in that guide pertains to your Illumio Core organization. For assistance, please send a message to [email protected].

Click the Global menu in the upper left corner.
Select Troubleshooting > Events.
Use the filters to search for events by type of event, event severity level, and when the event occurred.
Once you've defined a filter, click Go to run the query.

Export Events

You can export all Organization events or a filtered list of events to a CSV file.

Click the Global menu in the upper left corner.
Select Troubleshooting > Events.
- To export all Organization events, click Export and then select Export All.
- To export a filtered list of events, filter the list, click Export, and then select Export Filtered.
- To search for events based on event type, severity, status, timestamp, and who generated them, use the search filter.
- To use Quick Filters, click the double arrows.

List of Events

The following table provides the types of JSON events generated and their description. For each of these events, the CEF/LEEF success or failure events generated are the event name followed by .success or .failure.

For example, the CEF/LEEF success event for auth_security_principal.create is auth_security_principal.create.success and the failure event is auth_security_principal.create.failure.

Each event can generate a variety of notification messages. See Notification Messages in Events.

JSON Event Type	Description	Severity
`auth_security_principal.create`	RBAC auth security principal created	Informational
`auth_security_principal.delete`	RBAC auth security principal deleted	Informational
`auth_security_principal.update`	RBAC auth security principal updated	Informational
`authentication_settings.update`	Authentication settings updated	Informational
`org.create`	Organization created	Informational
`org.delete`	Organization deleted	Informational
`org.update`	Organization updated	Informational
`org.unpair_vens`	VENs unpaired	Informational
`orgs.ven_count`	Active VEN count for a list of orgs obtained	Informational
`password_policy.create`	Password policy created	Informational
`password_policy.delete`	Password policy deleted	Informational
`password_policy.update`	Password policy updated	Informational
`permission.create`	RBAC permission created	Informational
`permission.delete`	RBAC permission deleted	Informational
`permission.update`	RBAC permission updated	Informational
`request.authentication_failed`	API request authentication failed	Informational
`request.authorization_failed`	API request authorization failed	Informational
`request.internal_server_error`	API request failed due to internal server error	Informational
`request.invalid`	API request failed because it was invalid	Informational
`request.service_unavailable`	API request failed due to unavailable service	Informational
`request.unknown_server_error`	API request failed due to unknown server error	Informational
`saml_acs.update`	SAML assertion consumer services updated	Informational
`saml_config.create`	SAML configuration created	Informational
`saml_config.delete`	SAML configuration deleted	Informational
`saml_config.pce_signing_cert`	SAML signing certificate created or rotated	Informational
`saml_config.update`	SAML configuration updated	Informational
`security_principal.create`	RBAC security principal created	Informational
`security_principal.delete`	RBAC security principal deleted	Informational
`security_principal.update`	RBAC security principal updated	Informational
`security_principals.bulk_create`	RBAC security principals bulk created	Informational
`system_task.prune_old_log_events`	Event pruning completed	Informational
`user.accept_invitation`	User invitation accepted	Informational
`user.authenticate`	User authenticated	Informational
`user.create`	User created	Informational
`user.create_session`	User session created	Informational
`user.delete`	User deleted	Informational
`user.invite`	User invited	Informational
`user.login`	User logged in	Informational
`user.login_session_terminated`	User login session terminated	Informational
`user.logout`	User logged out	Informational
`user.pce_session_terminated`	User session terminated	Informational
`user.reset_password`	User password reset	Informational
`user.sign_in`	User session created	Informational
`user.sign_out`	User session terminated	Informational
`user.update`	User session updated	Informational
`user.update_password`	User password updated	Informational
`user.use_expired_password`	User entered expired password	Informational
`user_local_profile.create`	User local profile created	Informational
`user_local_profile.delete`	User local profile deleted	Informational
`user_local_profile.reinvite`	User local profile reinvited	Informational
`user_local_profile.update_password`	User local password updated	Informational

Notification Messages in Events

Events can generate a variety of notifications that are appended after the event type:

hard_limit.exceeded

pce.application_started

pce.application_stopped

request.authentication_failed

request.authorization_failed

request.internal_server_error

request.invalid

request.service_unavailable

request.unknown_server_error

soft_limit.exceeded

system_task.event_pruning_completed

system_task.hard_limit_recovery_completed

user.csrf_validation_failed

user.login_failed

user.login_failure_count_exceeded

user.login_session_created

user.login_session_terminated

user.pce_session_created

user.pce_session_terminated

user.pw_change_failure

user.pw_changed

user.pw_complexity_not_met

user.pw_reset_completed

user.pw_reset_requested

Managed Services Portal