Event Forwarding
Event Forwarders deliver security events from XplicitTrust to external systems in near real time. Events cover authentication activity, session changes, configuration changes, device status and compliance, resource pressure on devices, network monitoring findings and the notifications raised in the console.
You can configure multiple forwarders per tenant. Each forwarder independently tracks its position in the event stream and supports filtering by event category or type.
Event Forwarders are configured under Settings in the management console.
Protocols
| Protocol | Transport | Use Case |
|---|---|---|
| Syslog over TLS | TCP + TLS | SIEM integration (Splunk, Wazuh, Elastic, QRadar, Graylog) |
| HTTPS Webhook | HTTPS | Webhook endpoints, custom integrations |
Both protocols require a certificate issued by a publicly trusted CA on the receiving side. Certificate verification cannot be turned off.
Event Filtering
By default, a forwarder delivers all events. You can restrict delivery using the Event Filters selector. Select an entire category to forward all events of that class, or pick individual event types. Multiple filters are combined with OR logic.
Available categories:
| Category | Example Events |
|---|---|
| Authentication | Logged In, Logged Out, Failed, Session Refresh |
| Authorization | Access Denied |
| Configuration | Created, Updated, Deleted, Enabled, Disabled |
| IdP | Groups Fetched, Groups Imported, Groups Synced |
| Client Status | Client Online, Client Offline, Asset Online, Asset Offline, Public IP Changed |
| Client Compliance | OS Version Changed, Security Product Changed, Disk Encryption Changed, Geolocation Changed |
| Client Resources | CPU Usage High, CPU Usage Normal, Memory Usage High, Memory Usage Normal |
| Network Monitoring | New Host, New Service, Host Disappeared, Service Closed, Scan Completed |
| Notifications | All raised notifications, or a single notification type |
| Notifications resolved | All resolved notifications |
Access control events (IP blocked, geo blocked, session IP mismatch) have no filter entry of their own. A forwarder without filters delivers them together with everything else.
Delivery
- New events are picked up every few seconds and delivered in the order they were recorded, in batches of up to 500 events. Expect a delay of a few seconds between an event and its arrival at the destination.
- Changes to a forwarder (filters, destination, enabling or disabling) take effect within about ten seconds.
- The forwarder's position moves only after the destination has accepted a batch. A destination that is down stalls the forwarder; nothing is skipped, and delivery resumes where it stopped once the destination is back. Events are kept for 90 days, which is the limit for how far a forwarder can fall behind.
- Delivery is at-least-once. A batch whose acceptance could not be recorded is delivered again. Both protocols carry the event id, which is the key to deduplicate on at the receiver.
- After a failed delivery the next batch is halved, down to a single event, and grows again after a success. After ten consecutive failures the forwarder backs off, with the wait between attempts growing to 30 minutes.
Status in the console
Each forwarder shows its delivery state in the list:
- the number of events waiting for delivery,
- the time of the last successful delivery, or no delivery yet,
- while deliveries fail: Failing since with the start of the outage, the number of consecutive failed deliveries, the last error, and the time of the next attempt while the forwarder is backed off.
Failure notification
A forwarder that has been failing for five minutes raises an Event forwarder failing notification in the console, and the technical contacts of the partner that manages the tenant receive one email with the destination, the last error and the number of events waiting. The next successful delivery resolves the notification and sends an all-clear. Disabling the forwarder resolves it the same way. One outage produces one email, however long it lasts.
Test event
Send Test Event delivers one synthetic configuration_change.updated event to the destination, using the saved configuration. The event names the forwarder as its object, carries "test": true and the event id 0, and does not move the forwarder's position.
Event Reference
Every event carries event_class, event_type, session_type, message, created_at and the event id, plus the fields listed per class below. The event id is an increasing integer that is unique per event.
session_type says who acted: command_console (an administrator, or the server itself), partner_portal (a partner user), client (a user's device), asset (a device without a user) or web_app (a user logging in to a Web App). remote_address is the IP address the request came from, without a port, or unknown for events the server raises on its own.
authentication
| Event Type | Description |
|---|---|
authentication.pre_auth_created |
Pre-authentication tunnel session established before user login |
authentication.logged_in |
User or asset successfully authenticated |
authentication.session_refresh |
Session token refreshed |
authentication.logged_out |
User or asset logged out |
authentication.failed |
Authentication attempt failed |
authentication.failed_refresh |
Session token refresh failed |
authentication.tenant_entered |
Partner user entered a tenant context |
authentication.tenant_left |
Partner user left a tenant context |
authentication.web_app_login_started |
A browser started a login to a Web App (object_name, route) |
authentication.web_app_login |
A user logged in to a Web App (user_email, object_name, route) |
authentication.web_app_login_denied |
A Web App login was refused (user_email, object_name, route, reason) |
authentication.web_app_sign_out_all |
An administrator signed everyone out of a Web App |
Web App logins are the user's, in a web_app session: remote_address and the location are those of the user's browser, login_ip repeats the address. client and client_name name the gateway that serves the app. The browser's address is known once it returns from the identity provider, so web_app_login_started has remote_address unknown.
authorization
| Event Type | Description |
|---|---|
authorization.access_denied |
Access to a resource was denied by policy |
access_control
| Event Type | Description |
|---|---|
access_control.ip_blocked |
Login blocked because the source IP is not in the management IP allowlist |
access_control.geo_blocked |
Login blocked because the source country is not in the allowed countries list |
access_control.session_ip_mismatch |
Session blocked because the client IP changed after login (session IP binding) |
configuration_change
Configuration change events carry object_type, object_id and object_name of the affected object.
| Event Type | Description |
|---|---|
configuration_change.created |
A configuration object was created (e.g. policy, asset, subnet) |
configuration_change.updated |
A configuration object was updated |
configuration_change.deleted |
A configuration object was deleted |
configuration_change.enabled |
A configuration object was enabled |
configuration_change.disabled |
A configuration object was disabled |
configuration_change.asset_isolation_enabled |
Asset isolation was switched on for an asset (client_id) |
configuration_change.asset_isolation_disabled |
Asset isolation was switched off for an asset (client_id) |
configuration_change.asset_isolation_rule_added |
An isolation rule was added (client_id, policy_id, service_definition_id, rule_remote_address, rule_description) |
configuration_change.asset_isolation_rule_changed |
An isolation rule was changed (client_id, policy_id, and the old_/new_ values of service_definition_id, rule_remote_address and rule_description) |
configuration_change.asset_isolation_rule_removed |
An isolation rule was removed (client_id, policy_id, service_definition_id, rule_remote_address, rule_description) |
The isolation events name the asset as client_id and client_name; rule_remote_address is the address the rule allows, remote_address the administrator's.
configuration_other
| Event Type | Description |
|---|---|
configuration_other.fetched |
User groups were fetched from the identity provider |
configuration_other.imported |
User groups were imported from the identity provider |
configuration_other.synced |
User groups were synchronized with the identity provider |
configuration_other.domains_fetched |
Domains were fetched from the identity provider |
configuration_other.configuration_downloaded |
An asset downloaded its configuration |
Until November 2026 the last two were spelled with a space (domains fetched, configuration downloaded); event forwarder filters were renamed with them.
upstream_firewall
Synchronisation of access rules to a perimeter firewall. Events carry object_type (upstream_firewall), object_id (the integration), object_name and client_id (the asset that talks to the device), vendor and management_url.
| Event Type | Description |
|---|---|
upstream_firewall.credentials_handed_over |
An administrator handed the device's API key to the asset |
upstream_firewall.credentials_delivered |
The asset picked the key up |
upstream_firewall.credentials_expired |
The handover expired before the asset picked the key up |
upstream_firewall.credentials_verified |
The device accepted the key (device_hostname, device_model, device_version, device_serial, device_vdom, device_ha_mode) |
upstream_firewall.credentials_invalid |
The device rejected the key (error) |
upstream_firewall.sync_failed |
A synchronisation failed (error, rules_applied, rules_skipped, rules_failed, objects_left) |
upstream_firewall.sync_recovered |
Synchronisation works again (detail and the same counts) |
client_status
| Event Type | Description |
|---|---|
client_status.client_online |
A client came online |
client_status.client_offline |
A client went offline |
client_status.asset_online |
An asset came online |
client_status.asset_offline |
An asset went offline |
client_status.public_ip_changed |
A client's public IP address changed |
client_compliance
| Event Type | Description |
|---|---|
client_compliance.os_version_changed |
Client operating system version changed |
client_compliance.security_product_changed |
Client security product (e.g. antivirus) changed |
client_compliance.security_provider_changed |
Client security provider changed |
client_compliance.disk_encryption_changed |
Client disk encryption state changed |
client_compliance.domain_membership_changed |
Client domain membership changed |
client_compliance.entra_id_membership_changed |
Client Microsoft Entra ID membership changed |
client_compliance.geolocation_changed |
Client geolocation changed |
client_compliance.client_version_changed |
XplicitTrust client version changed |
client_resources
Sustained CPU or memory pressure on a device. A device is flagged once most samples in a five-minute window exceed 95 % and cleared once no sample in the last three minutes does. Events carry client (device UUID); the _high events add threshold_percent, samples_over and samples_expected, the _normal events a reason (usage back below threshold or client stopped reporting).
| Event Type | Description |
|---|---|
client_resources.cpu_usage_high |
CPU stayed above the threshold |
client_resources.cpu_usage_normal |
CPU condition cleared |
client_resources.memory_usage_high |
Memory stayed above the threshold |
client_resources.memory_usage_normal |
Memory condition cleared |
network_discovery
Findings of the network monitoring feature, written when a scheduled scan completes and the picture of a monitored network has changed. Events carry client (the scanning device), interface_name and, where applicable, ip, port, mac, display_name, manufacturer and open_ports.
| Event Type | Description |
|---|---|
network_discovery.new_host |
A host not seen before appeared on the monitored network |
network_discovery.new_service |
A new open TCP port was observed on a known host |
network_discovery.host_disappeared |
A host present in the previous scan is gone |
network_discovery.service_closed |
A previously open port is no longer reachable |
network_discovery.scan_completed |
One scan finished; carries the counts new_hosts, new_services, hosts_disappeared, services_closed |
notification and notification_cleared
The notifications shown in the console, as a stream. A notification event is written when a notification is raised, a notification_cleared event when its condition stops applying. The event type is the notification type, so notification.broker_failed is one type and notification_cleared on its own is every resolution. The message is the notification text. Events carry object_type, object_id, object_name and severity.
| Notification type | Meaning |
|---|---|
policy_without_destination |
Policy without destination |
policy_without_source |
Policy without source |
asset_without_policy |
Asset without policy |
asset_version_outdated |
Asset version outdated |
asset_windows_dns_ports |
Windows DNS port exhaustion |
virtual_asset_without_policy |
Virtual asset without policy |
subnet_without_policy |
Subnet without policy |
user_client_version_outdated |
User client version outdated |
user_client_disabled_on_create |
User client waiting for activation |
info_update_failed |
Client info update failed |
split_dns_failed |
Split DNS broken |
broker_failed |
Broker unreachable |
dhcp_failed |
DHCP failed |
cpu_usage_high |
High CPU usage |
memory_usage_high |
High memory usage |
event_forwarder_failed |
Event forwarder failing |
A failing forwarder delivers its own event_forwarder_failed notification only once it works again; the email to the technical contacts is what reaches you during the outage.