xplicittrust XplicitTrust: $(event_class) $(event_type). 100100 ^logged_in$ XplicitTrust: user or client login. authentication_success,pci_dss_10.2.5,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AU.14, 100100 ^logged_out$ XplicitTrust: user or client logout. session_closed,pci_dss_10.2.5,gdpr_IV_32.2, 100100 ^failed$ XplicitTrust: authentication failed. authentication_failed,pci_dss_10.2.4,pci_dss_10.2.5,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AU.14, 100100 ^failed_refresh$ XplicitTrust: session refresh failed. authentication_failed,pci_dss_10.2.4,gdpr_IV_32.2, 100100 ^pre_auth_created$ XplicitTrust: pre-authentication session created. authentication_success, 100100 ^session_refresh$ XplicitTrust: session refreshed. session_opened, 100100 ^tenant_entered$ XplicitTrust: partner user entered tenant context. authentication_success,pci_dss_10.2.5,gdpr_IV_32.2, 100100 ^tenant_left$ XplicitTrust: partner user left tenant context. session_closed,pci_dss_10.2.5,gdpr_IV_32.2, 100100 ^web_app_login_started$ XplicitTrust: Web App login started. authentication, 100100 ^web_app_login$ XplicitTrust: Web App login. authentication_success,pci_dss_10.2.5,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AU.14, 100100 ^web_app_login_denied$ XplicitTrust: Web App login denied ($(reason)). access_denied,pci_dss_10.2.4,gdpr_IV_35.1,hipaa_164.312.a,nist_800_53_AC.7, 100100 ^web_app_sign_out_all$ XplicitTrust: everyone signed out of a Web App. session_closed,pci_dss_10.2.7,nist_800_53_AC.12, 100100 ^access_denied$ XplicitTrust: access denied. access_denied,pci_dss_10.2.4,gdpr_IV_35.1,hipaa_164.312.a,nist_800_53_AC.7, 100100 ^ip_blocked$ XplicitTrust: login blocked by IP allowlist. xplicittrust_login_blocked,access_denied,pci_dss_10.2.4,gdpr_IV_32.2,hipaa_164.312.a,nist_800_53_AC.7, 100100 ^geo_blocked$ XplicitTrust: login blocked by country restriction. xplicittrust_login_blocked,access_denied,pci_dss_10.2.4,gdpr_IV_32.2,hipaa_164.312.a,nist_800_53_AC.7, 100100 ^session_ip_mismatch$ XplicitTrust: session blocked due to IP address change. access_denied,pci_dss_10.2.4,gdpr_IV_32.2,hipaa_164.312.a,nist_800_53_AC.7, 100100 ^created$ XplicitTrust: configuration object created. config_changed,pci_dss_10.2.7,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_CM.3, 100100 ^updated$ XplicitTrust: configuration object updated. config_changed,pci_dss_10.2.7,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_CM.3, 100100 ^deleted$ XplicitTrust: configuration object deleted. config_changed,pci_dss_10.2.7,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_CM.3, 100100 ^enabled$ XplicitTrust: configuration object enabled. config_changed,pci_dss_10.2.7,nist_800_53_CM.3, 100100 ^disabled$ XplicitTrust: configuration object disabled. config_changed,pci_dss_10.2.7,nist_800_53_CM.3, 100100 ^fetched$ XplicitTrust: user groups fetched from IdP. config_changed, 100100 ^imported$ XplicitTrust: user groups imported from IdP. config_changed,pci_dss_10.2.7,nist_800_53_CM.3, 100100 ^synced$ XplicitTrust: user groups synced with IdP. config_changed, 100100 ^domains[ _]fetched$ XplicitTrust: domains fetched from IdP. config_changed, 100100 ^configuration[ _]downloaded$ XplicitTrust: asset configuration downloaded. config_changed, 100100 ^client_online$ XplicitTrust: client came online. connection_attempt, 100100 ^client_offline$ XplicitTrust: client went offline. session_closed, 100100 ^asset_online$ XplicitTrust: asset came online. connection_attempt, 100100 ^asset_offline$ XplicitTrust: asset went offline. service_availability, 100100 ^public_ip_changed$ XplicitTrust: client public IP address changed. network_change, 100100 ^os_version_changed$ XplicitTrust: client OS version changed. config_changed,pci_dss_11.5,gdpr_IV_35.1,hipaa_164.312.b,nist_800_53_SI.7, 100100 ^security_product_changed$ XplicitTrust: client security product changed. config_changed,pci_dss_11.5,gdpr_IV_35.1,nist_800_53_SI.7, 100100 ^disk_encryption_changed$ XplicitTrust: client disk encryption state changed. config_changed,pci_dss_11.5,gdpr_IV_35.1,nist_800_53_SI.7, 100100 ^geolocation_changed$ XplicitTrust: client geolocation changed. config_changed, 100100 ^client_version_changed$ XplicitTrust: client version changed. config_changed, 100100 ^security_provider_changed$ XplicitTrust: client security provider changed. config_changed,pci_dss_11.5,gdpr_IV_35.1,nist_800_53_SI.7, 100100 ^domain_membership_changed$ XplicitTrust: client domain membership changed. config_changed,pci_dss_11.5,nist_800_53_SI.7, 100100 ^entra_id_membership_changed$ XplicitTrust: client Entra ID membership changed. config_changed,pci_dss_11.5,nist_800_53_SI.7, 100131 \(off/|snoozed|expired XplicitTrust: a security product is off on $(client_name): $(new_value). config_changed,pci_dss_11.5,pci_dss_5.2,gdpr_IV_35.1,nist_800_53_SI.3, 100132 ^off$ XplicitTrust: disk encryption turned off on $(client_name). config_changed,pci_dss_3.4,gdpr_IV_32.2,hipaa_164.312.a.2.IV,nist_800_53_SC.28, 100135 ^poor$ XplicitTrust: $(field) degraded to poor on $(client_name). config_changed,pci_dss_11.5,gdpr_IV_35.1,nist_800_53_SI.3, 100100 ^asset_isolation_enabled$ XplicitTrust: asset isolation enabled. config_changed,pci_dss_10.2.7,nist_800_53_CM.3, 100100 ^asset_isolation_disabled$ XplicitTrust: asset isolation disabled. config_changed,pci_dss_10.2.7,nist_800_53_CM.3, 100100 ^asset_isolation_rule_added$ XplicitTrust: asset isolation rule added. config_changed,pci_dss_10.2.7,nist_800_53_CM.3, 100100 ^asset_isolation_rule_changed$ XplicitTrust: asset isolation rule changed. config_changed,pci_dss_10.2.7,nist_800_53_CM.3, 100100 ^asset_isolation_rule_removed$ XplicitTrust: asset isolation rule removed. config_changed,pci_dss_10.2.7,nist_800_53_CM.3, 100100 ^network_discovery$ ^new_host$ XplicitTrust: new host on a monitored network. network_change, 100100 ^network_discovery$ ^new_service$ XplicitTrust: new service on a monitored host. network_change, 100100 ^network_discovery$ ^host_disappeared$ XplicitTrust: monitored host disappeared. network_change, 100100 ^network_discovery$ ^service_closed$ XplicitTrust: monitored service closed. network_change, 100100 ^network_discovery$ ^scan_completed$ XplicitTrust: network scan completed. network_change, 100100 ^client_resources$ ^cpu_usage_high$ XplicitTrust: client CPU usage high. service_availability, 100100 ^client_resources$ ^cpu_usage_normal$ XplicitTrust: client CPU usage back to normal. service_availability, 100100 ^client_resources$ ^memory_usage_high$ XplicitTrust: client memory usage high. service_availability, 100100 ^client_resources$ ^memory_usage_normal$ XplicitTrust: client memory usage back to normal. service_availability, 100100 ^notification$ XplicitTrust: notification raised. notification, 100100 ^notification_cleared$ XplicitTrust: notification resolved. notification, 100180 ^broker_failed$ XplicitTrust: broker unreachable. notification,service_availability, 100180 ^split_dns_failed$ XplicitTrust: split DNS broken. notification,service_availability, 100180 ^dhcp_failed$ XplicitTrust: DHCP failed. notification,service_availability, 100180 ^event_forwarder_failed$ XplicitTrust: event forwarder failing. notification,service_availability, 100100 ^upstream_firewall$ ^credentials_handed_over$ XplicitTrust: firewall credentials handed over to the agent. config_changed,pci_dss_10.2.7,nist_800_53_CM.3, 100100 ^upstream_firewall$ ^credentials_delivered$ XplicitTrust: the agent fetched the firewall credentials. service_availability, 100100 ^upstream_firewall$ ^credentials_verified$ XplicitTrust: the firewall accepted the agent's credentials. service_availability, 100100 ^upstream_firewall$ ^credentials_expired$ XplicitTrust: firewall credentials expired before the agent fetched them. service_availability, 100100 ^upstream_firewall$ ^credentials_invalid$ XplicitTrust: the firewall rejected the agent's credentials: $(error) authentication_failed,service_availability, 100100 ^upstream_firewall$ ^sync_failed$ XplicitTrust: firewall sync failed: $(error) service_availability, 100100 ^upstream_firewall$ ^sync_recovered$ XplicitTrust: firewall sync recovered. service_availability, 100103 user_email XplicitTrust: possible brute force attack (5+ failed logins for $(user_email) in 2 minutes). authentication_failures,pci_dss_10.2.4,pci_dss_10.2.5,pci_dss_11.4,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AC.7,nist_800_53_SI.4, 100103 remote_address XplicitTrust: possible brute force attack (5+ failed logins from $(remote_address) in 2 minutes). authentication_failures,pci_dss_10.2.4,pci_dss_10.2.5,pci_dss_11.4,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AC.7,nist_800_53_SI.4, 100103 XplicitTrust: 10+ failed logins in 2 minutes, across accounts. authentication_failures,pci_dss_10.2.4,pci_dss_10.2.5,pci_dss_11.4,gdpr_IV_32.2,hipaa_164.312.b,nist_800_53_AC.7,nist_800_53_SI.4, 100192 user_email XplicitTrust: repeated Web App login denials for $(user_email). access_denied,pci_dss_10.2.4,gdpr_IV_35.1,nist_800_53_AC.7, 100101 user_email country XplicitTrust: $(user_email) logged in from two countries within an hour (now $(country)). authentication_success,pci_dss_10.2.5,gdpr_IV_35.7.d,nist_800_53_AC.7, 100105 client XplicitTrust: $(client_name) denied access 5+ times in 10 minutes. access_denied,pci_dss_10.2.4,pci_dss_11.4,gdpr_IV_35.1,nist_800_53_AC.7,nist_800_53_SI.4, xplicittrust_login_blocked client_ip XplicitTrust: 5+ blocked logins from $(client_ip) in 10 minutes. access_denied,pci_dss_10.2.4,pci_dss_11.4,gdpr_IV_35.1,nist_800_53_AC.7,nist_800_53_SI.4, 100112 user_email XplicitTrust: $(user_email) deleted 10+ objects in 5 minutes. config_changed,pci_dss_10.2.7,gdpr_IV_32.2,nist_800_53_CM.3,nist_800_53_SI.4,