id: cd80d5ce-6c89-4d23-9f98-77066a599982
Function:
  Title: Parser for OneLogin
  Version: '1.0.1'
  LastUpdated: '2023-09-25'
Category: Microsoft Sentinel Parser
FunctionName: OneLogin
FunctionAlias: OneLogin
FunctionQuery: |
    OneLogin_CL
    | extend app_name_s = column_ifexists("app_name_s", ''),
             app_id_d = column_ifexists("app_id_d", ''),
             role_name_s = column_ifexists("role_name_s", ''),
             role_id_d = column_ifexists("role_id_d", ''),
             user_attributes_username_s = column_ifexists("user_attributes_username_s", ''),
             user_attributes_department_s = column_ifexists("user_attributes_department_s", ''),
             user_attributes_title_s = column_ifexists("user_attributes_title_s", '')
    | project-rename    TargetAppName = app_name_s,
                        TargetAppId = app_id_d,
                        RoleName = role_name_s,
                        RoleId = role_id_d,
                        PolicyName = policy_name_s,
                        PolicyType = policy_type_s,
                        PolicyId = policy_id_d,
                        HttpUserAgent = user_agent_s,
                        UserId = user_id_d,
                        UserAttributesUsername_s = user_attributes_username_s,
                        UserAttributesAccountId = user_attributes_account_id_d,
                        UserAttributesDepartment = user_attributes_department_s,
                        UserAttributesFirstname = user_attributes_firstname_s,
                        UserAttributesEmail = user_attributes_email_s,
                        UserAttributesOpenidName = user_attributes_openid_name_s,
                        UserAttributesTitle = user_attributes_title_s,
                        UserAttributesLastname = user_attributes_lastname_s,
                        UserName = user_name_s,
                        EventOriginalUid = create__id_g,
                        UUID = uuid_g,
                        ActorSystem = actor_system_s,
                        CustomMessage = custom_message_s,
                        AccountId = account_id_d,
                        SrcIpAddr = ipaddr_s,
                        ActorUserName = actor_user_name_s,
                        ActorUserId = actor_user_id_d,
                        Message = notes_s,
                        EventTypeId = event_type_id_d,
                        EventStartTime = event_timestamp_s
    | extend    EventVendor = "OneLogin",
                EventProduct = "OneLogin IAM",
                EventType = case (
                                EventTypeId == 1, "APP_ADDED_TO_ROLE",
                                EventTypeId == 2, "APP_REMOVED_FROM_ROLE",
                                EventTypeId == 3, "USER_ASSUMED_USER",
                                EventTypeId == 4, "USER_ASSIGNED_ROLE",
                                EventTypeId == 5, "USER_LOGGED_INTO_ONELOGIN",
                                EventTypeId == 6, "USER_FAILED_ONELOGIN_LOGIN",
                                EventTypeId == 7, "USER_LOGGED_OUT_OF_ONELOGIN",
                                EventTypeId == 8, "USER_LOGGED_INTO_APP",
                                EventTypeId == 9, "USER_FAILED_APP_LOGIN",
                                EventTypeId == 10, "USER_REQUESTED_NEW_PASSWORD",
                                EventTypeId == 11, "USER_CHANGED_PASSWORD",
                                EventTypeId == 12, "UNLOCKED_USER",
                                EventTypeId == 13, "CREATED_USER",
                                EventTypeId == 14, "UPDATED_USER",
                                EventTypeId == 15, "DEACTIVATED_USER",
                                EventTypeId == 16, "ACTIVATED_USER",
                                EventTypeId == 17, "DELETED_USER",
                                EventTypeId == 18, "ADMIN_APPROVED_PASSWORD_REQUEST",
                                EventTypeId == 19, "USER_LOCKED",
                                EventTypeId == 20, "REACHED_USERS_LIMIT",
                                EventTypeId == 21, "SUSPENDED_USER",
                                EventTypeId == 22, "USER_ADDED_OTP_DEVICE",
                                EventTypeId == 23, "USER_BULK_OPERATION",
                                EventTypeId == 24, "USER_REMOVED_OTP_DEVICE",
                                EventTypeId == 25, "PROVISIONING_EXCEPTION",
                                EventTypeId == 26, "PROVISIONING_EVENT",
                                EventTypeId == 27, "USER_DOWNLOADED_CERT",
                                EventTypeId == 28, "USER_RECENTLY_REMOVED",
                                EventTypeId == 29, "USER_LOGGED_OUT_OF_APP",
                                EventTypeId == 30, "UPDATED_PAYMENT_INFO",
                                EventTypeId == 31, "FAILED_UPDATE_PAYMENT_INFO",
                                EventTypeId == 32, "REACTIVATED_USER",
                                EventTypeId == 33, "USERS_IMPORTED_FROM_DIRECTORY",
                                EventTypeId == 34, "USER_REQUESTED_APP",
                                EventTypeId == 35, "USER_LOCKED_OUT_OF_APP",
                                EventTypeId == 36, "USER_LOST_OTP_DEVICE",
                                EventTypeId == 37, "USER_JOIN_REQUEST",
                                EventTypeId == 38, "APP_REACHED_USER_LIMIT",
                                EventTypeId == 39, "CONNECTOR_BROKEN",
                                EventTypeId == 40, "USER_UNLOCKED_OTP_DEVICE",
                                EventTypeId == 41, "AD_CONNECTOR_STARTED",
                                EventTypeId == 42, "AD_CONNECTOR_STOPPED",
                                EventTypeId == 43, "AD_CONNECTOR_CONFIG_RELOAD",
                                EventTypeId == 44, "AD_CONNECTOR_NOTIFICATION",
                                EventTypeId == 45, "AD_CONNECTOR_EXCEPTION_OLD",
                                EventTypeId == 46, "AD_CONNECTOR_FAIL_OVER",
                                EventTypeId == 47, "AD_CONNECTOR_EXCEPTION",
                                EventTypeId == 48, "IMPORTED_USER",
                                EventTypeId == 49, "UPDATE_USER_FAILED",
                                EventTypeId == 50, "REJECTED_USER",
                                EventTypeId == 51, "USER_CREATED_IN_APP",
                                EventTypeId == 52, "USER_UPDATED_IN_APP",
                                EventTypeId == 53, "USER_SUSPENDED_IN_APP",
                                EventTypeId == 54, "USER_REACTIVATED_IN_APP",
                                EventTypeId == 55, "USER_DELETED_IN_APP",
                                EventTypeId == 56, "UNMATCHED_USERS",
                                EventTypeId == 57, "RABBIT_DOWN",
                                EventTypeId == 58, "RABBIT_RESTARTED",
                                EventTypeId == 59, "USER_LINKED_IN_APP",
                                EventTypeId == 60, "PROVISIONING_DEPROVISIONING_MODE_DO_NOTHING_WARNING",
                                EventTypeId == 61, "USER_FAILED_SUSPENDING_IN_APP",
                                EventTypeId == 62, "USER_FAILED_REACTIVATING_IN_APP",
                                EventTypeId == 63, "USER_FAILED_DELETING_IN_APP",
                                EventTypeId == 64, "USER_FAILED_CREATING_IN_APP",
                                EventTypeId == 65, "USER_FAILED_UPDATING_IN_APP",
                                EventTypeId == 66, "NO_USERS_TO_IMPORT_FROM_DIRECTORY",
                                EventTypeId == 67, "DIRECTORY_IMPORT_EXCEPTION",
                                EventTypeId == 68, "USER_AUTHENTICATED_BY_RADIUS",
                                EventTypeId == 69, "USER_REJECTED_BY_RADIUS",
                                EventTypeId == 70, "PRIVILEGE_GRANTED_TO_ACCOUNT",
                                EventTypeId == 71, "PRIVILEGE_REVOKED_FROM_ACCOUNT",
                                EventTypeId == 72, "PRIVILEGE_GRANTED_TO_USER",
                                EventTypeId == 73, "PRIVILEGE_REVOKED_FROM_USER",
                                EventTypeId == 74, "TRUSTED_IDP_ADDED",
                                EventTypeId == 75, "TRUSTED_IDP_REMOVED",
                                EventTypeId == 76, "TRUSTED_IDP_MODIFIED",
                                EventTypeId == 77, "USER_FAILED_PROXY_LOGIN",
                                EventTypeId == 78, "USER_SUCCEEDED_PROXY_LOGIN",
                                EventTypeId == 79, "AD_CONNECTOR_PROVISIONING_ERROR",
                                EventTypeId == 80, "USER_CREATED_IN_DIRECTORY",
                                EventTypeId == 81, "USER_UPDATED_IN_DIRECTORY",
                                EventTypeId == 82, "USER_SUSPENDED_IN_DIRECTORY",
                                EventTypeId == 83, "USER_REACTIVATED_IN_DIRECTORY",
                                EventTypeId == 84, "USER_DELETED_IN_DIRECTORY",
                                EventTypeId == 85, "APP_COULD_NOT_AUTHENTICATE",
                                EventTypeId == 86, "USER_FAILED_REMOTE_AUTHENTICATION",
                                EventTypeId == 87, "USER_VIEWED_NOTE",
                                EventTypeId == 88, "USER_EDITED_NOTE",
                                EventTypeId == 89, "USER_DELETED_NOTE",
                                EventTypeId == 90, "USER_UNAUTHORIZED_APP_ACCESS",
                                EventTypeId == 91, "USER_UNDETERMINED_BY_RADIUS",
                                EventTypeId == 92, "USER_NTHASH_REQUESTED_BY_RADIUS",
                                EventTypeId == 95, "DIRECTORY_GROUPS_WRITE_BACK_IMPORT_STARTED",
                                EventTypeId == 96, "DIRECTORY_GROUPS_WRITE_BACK_IMPORT_FINISHED",
                                EventTypeId == 100, "SELF_REGISTRATION_REQUEST",
                                EventTypeId == 101, "SELF_REGISTRATION_APPROVED",
                                EventTypeId == 102, "SELF_REGISTRATION_DENIED",
                                EventTypeId == 103, "SELF_REGISTRATION_REQUEST_UNVERIFIED",
                                EventTypeId == 104, "SELF_REGISTRATION_REQUEST_VERIFIED",
                                EventTypeId == 105, "SMS_FAILURE",
                                EventTypeId == 106, "USER_CHANGE_PASSWORD_FAILED",
                                EventTypeId == 110, "APP_LOGINS_UPDATED",
                                EventTypeId == 111, "APP_LOGINS_UPDATE_FAILED",
                                EventTypeId == 112, "TRUSTED_IDP_MADE_DEFAULT",
                                EventTypeId == 113, "DIRECTORY_IMPORT_STARTED",
                                EventTypeId == 114, "DIRECTORY_IMPORT_FINISHED",
                                EventTypeId == 115, "USER_INVITED",
                                EventTypeId == 116, "CREATE_USER_FAILED",
                                EventTypeId == 117, "DIRECTORY_SYNC_RUN_ID",
                                EventTypeId == 118, "SAML_ACS_FAILED",
                                EventTypeId == 119, "TRUSTED_IDP_REMOVED_AS_DEFAULT",
                                EventTypeId == 120, "UNLOCKED_USER_IN_DIRECTORY",
                                EventTypeId == 121, "SCRIPTLET_ERROR",
                                EventTypeId == 122, "USER_AUTHENTICATED_BY_API",
                                EventTypeId == 123, "USER_REJECTED_BY_API",
                                EventTypeId == 124, "ENTITLEMENTS_CACHE_ACTION",
                                EventTypeId == 125, "ENTITLEMENT_ACTION",
                                EventTypeId == 126, "DIRECTORY_CONNECTOR_ENABLED",
                                EventTypeId == 127, "DIRECTORY_CONNECTOR_DISABLED",
                                EventTypeId == 128, "NO_ACTIVE_ACTIVE_DIRECTORY_CONNECTORS",
                                EventTypeId == 129, "VLDAP_BIND_FAILURE",
                                EventTypeId == 130, "VLDAP_BIND_SUCCESS",
                                EventTypeId == 131, "DIRECTORY_EXPORT_STARTED",
                                EventTypeId == 132, "DIRECTORY_EXPORT_FINISHED",
                                EventTypeId == 133, "DIRECTORY_EXPORT_EXCEPTION",
                                EventTypeId == 134, "DIRECTORY_REFRESH_SCHEMA_EXCEPTION",
                                EventTypeId == 135, "CERTIFICATE_EXPIRES",
                                EventTypeId == 136, "DIRECTORY_FIELDS_IMPORT_STARTED",
                                EventTypeId == 137, "USER_APP_REQUEST_APPROVED",
                                EventTypeId == 138, "USER_APP_REQUEST_DENIED",
                                EventTypeId == 139, "DIRECTORY_FIELDS_IMPORT_FINISHED",
                                EventTypeId == 140, "SOCIAL_SIGN_IN",
                                EventTypeId == 141, "SOCIAL_SIGN_IN_FAILURE",
                                EventTypeId == 145, "USER_SMART_PASSWORD_UPDATED",
                                EventTypeId == 146, "USER_SMART_PASSWORD_UPDATE_FAILED",
                                EventTypeId == 147, "USER_MANUALLY_ADDED_TO_ROLE",
                                EventTypeId == 148, "USER_MANUALLY_REMOVED_FROM_ROLE",
                                EventTypeId == 149, "USER_AUTO_ADDED_TO_ROLE",
                                EventTypeId == 150, "USER_AUTO_REMOVED_FROM_ROLE",
                                EventTypeId == 151, "USER_ROLE_MANAGEMENT_GRANTED",
                                EventTypeId == 152, "USER_ROLE_MANAGEMENT_REVOKED",
                                EventTypeId == 153, "MAC_LOGIN_SUCCESS",
                                EventTypeId == 154, "MAC_LOGIN_FAILURE",
                                EventTypeId == 155, "DIRECTORY_FIELDS_IMPORT_EXCEPTION",
                                EventTypeId == 156, "POLICY_CREATED",
                                EventTypeId == 157, "POLICY_UPDATED",
                                EventTypeId == 158, "POLICY_DELETED",
                                EventTypeId == 159, "PROXY_AGENT_CREATED",
                                EventTypeId == 160, "PROXY_AGENT_DELETED",
                                EventTypeId == 161, "RADIUS_CONFIG_CREATED",
                                EventTypeId == 162, "RADIUS_CONFIG_UPDATED",
                                EventTypeId == 163, "RADIUS_CONFIG_DELETED",
                                EventTypeId == 164, "VPN_ENABLED",
                                EventTypeId == 165, "VPN_SETTINGS_UPDATED",
                                EventTypeId == 166, "VPN_DISABLED",
                                EventTypeId == 167, "EMBEDDING_ENABLED",
                                EventTypeId == 168, "EMBEDDING_SETTINGS_UPDATED",
                                EventTypeId == 169, "EMBEDDING_DISABLED",
                                EventTypeId == 170, "AUTHENTICATION_FACTOR_CREATED",
                                EventTypeId == 171, "AUTHENTICATION_FACTOR_UPDATED",
                                EventTypeId == 172, "AUTHENTICATION_FACTOR_DELETED",
                                EventTypeId == 173, "SECURITY_QUESTIONS_UPDATED",
                                EventTypeId == 174, "DESKTOP_SSO_SETTINGS_UPDATED",
                                EventTypeId == 175, "DESKTOP_SSO_ENABLED",
                                EventTypeId == 176, "DESKTOP_SSO_DISABLED",
                                EventTypeId == 177, "CERTIFICATE_CREATED",
                                EventTypeId == 178, "CERTIFICATE_DELETED",
                                EventTypeId == 179, "API_CREDENTIAL_CREATED",
                                EventTypeId == 180, "API_CREDENTIAL_DELETED",
                                EventTypeId == 181, "API_CREDENTIAL_ENABLED",
                                EventTypeId == 182, "API_CREDENTIAL_DISABLED",
                                EventTypeId == 183, "VLDAP_ENABLED",
                                EventTypeId == 184, "VLDAP_DISABLED",
                                EventTypeId == 185, "VLDAP_SETTINGS_UPDATED",
                                EventTypeId == 186, "BRANDING_ENABLED",
                                EventTypeId == 187, "BRANDING_DISABLED",
                                EventTypeId == 188, "BRANDING_UPDATED",
                                EventTypeId == 189, "MAPPING_ADDED",
                                EventTypeId == 190, "MAPPING_DELETED",
                                EventTypeId == 191, "MAPPING_DISABLED",
                                EventTypeId == 192, "MAPPING_ENABLED",
                                EventTypeId == 193, "MAPPING_UPDATED",
                                EventTypeId == 194, "USER_FIELD_ADDED",
                                EventTypeId == 195, "USER_FIELD_DELETED",
                                EventTypeId == 196, "COMPANY_INFO_UPDATED",
                                EventTypeId == 197, "ACCOUNT_SETTINGS_UPDATED",
                                EventTypeId == 198, "DIRECTORY_CREATED",
                                EventTypeId == 199, "DIRECTORY_DESTROYED",
                                EventTypeId == 200, "DIRECTORY_CONNECTOR_INSTANCE_ADDED",
                                EventTypeId == 201, "DIRECTORY_CONNECTOR_INSTANCE_DELETED",
                                EventTypeId == 202, "REAPPLIED_MAPPINGS",
                                EventTypeId == 203, "SELF_REGISTRATION_PROFILE_CREATED",
                                EventTypeId == 204, "SELF_REGISTRATION_PROFILE_UPDATED",
                                EventTypeId == 205, "SELF_REGISTRATION_PROFILE_DESTROYED",
                                EventTypeId == 206, "MANUALLY_ADDED_LOGIN",
                                EventTypeId == 207, "MANUALLY_REMOVED_LOGIN",
                                EventTypeId == 208, "RETRIED_PROVISIONING",
                                EventTypeId == 209, "DIRECTORY_USER_IMPORT_WARNING",
                                EventTypeId == 210, "LDAP_CONNECTOR_EXCEPTION",
                                EventTypeId == 211, "ADMIN_CHANGED_USER_PASSWORD",
                                EventTypeId == 212, "DIRECTORY_LOCKED",
                                EventTypeId == 213, "PROFILE_PICTURE_UPLOADED",
                                EventTypeId == 214, "PROFILE_PICTURE_DELETED",
                                EventTypeId == 215, "ADMIN_CHANGED_ACCOUNT_SETTINGS",
                                EventTypeId == 216, "JOB_IN_QUEUE",
                                EventTypeId == 217, "DIRECTORY_IMPORT_LIMIT_REACHED",
                                EventTypeId == 218, "REAPPLIED_MAPPINGS_FAILED",
                                EventTypeId == 219, "WORKDAY_REAL_TIME_NOTIFICATION",
                                EventTypeId == 220, "ADMIN_CREATED_PAYMENT_RECORD",
                                EventTypeId == 221, "ADMIN_UPDATED_PAYMENT_RECORD",
                                EventTypeId == 222, "ADMIN_DELETED_PAYMENT_RECORD",
                                EventTypeId == 223, "USER_UNLICENSED",
                                EventTypeId == 224, "USER_LICENSED_MANUALLY",
                                EventTypeId == 225, "USER_UNLICENSED_MANUALLY",
                                EventTypeId == 226, "USER_UNLICENSED_AUTOMATICALLY",
                                EventTypeId == 227, "USER_LICENSE_FAILED",
                                EventTypeId == 228, "USERS_LICENSED_BULK",
                                EventTypeId == 229, "ACCOUNT_NEAR_LIMIT",
                                EventTypeId == 230, "ACCOUNT_IN_LIMIT",
                                EventTypeId == 231, "USERS_IN_UNLICENSED_STATE",
                                EventTypeId == 232, "USER_AGREED_TERMS",
                                EventTypeId == 233, "USER_DENIED_TERMS",
                                EventTypeId == 234, "ADMIN_ENABLED_TERMS",
                                EventTypeId == 235, "ADMIN_UPDATED_TERMS",
                                EventTypeId == 236, "ADMIN_DISABLED_TERMS",
                                EventTypeId == 237, "DELETE_USER_FAILED",
                                EventTypeId == 238, "USER_REDIRECTED_FOR_PASSWORD_CHANGE",
                                EventTypeId == 239, "IMPORT_USER_FAILED",
                                EventTypeId == 240, "USER_REVEALED_PASSWORD",
                                EventTypeId == 241, "CSV_IMPORT_FAILED",
                                EventTypeId == 242, "JOB_START_FAILED",
                                EventTypeId == 243, "JOB_TERMINATED",
                                EventTypeId == 244, "REPORT_GENERATED",
                                EventTypeId == 245, "REPORT_GENERATION_FAILED",
                                EventTypeId == 246, "REPORT_GENERATION_TERMINATED",
                                EventTypeId == 247, "USER_MAPPINGS_FAILED",
                                EventTypeId == 248, "USER_MAPPINGS_SUCCEEDED",
                                EventTypeId == 249, "USER_BULK_OPERATION_FAILED",
                                EventTypeId == 250, "PROVISIONING_APP_CONFIG_ERROR",
                                EventTypeId == 251, "PROVISIONING_APP_THROTTLED",
                                EventTypeId == 252, "USER_REMOVELOGINS_FAILED",
                                EventTypeId == 253, "ENTITLEMENT_MAPPINGS_FAILED",
                                EventTypeId == 254, "ENTITLEMENT_MAPPINGS_REAPPLIED",
                                EventTypeId == 255, "MANUALLY_UPDATED_LOGIN",
                                EventTypeId == 291, "USER_CREATED_BY_TIDP",
                                EventTypeId == 300, "LDAP_CONNECTOR_STARTED",
                                EventTypeId == 301, "LDAP_CONNECTOR_NOTIFICATION",
                                EventTypeId == 303, "LDAP_CONNECTOR_CONFIG_RELOAD",
                                EventTypeId == 304, "LDAP_CONNECTOR_STOPPED",
                                EventTypeId == 305, "LDAP_CONNECTOR_FAIL_OVER",
                                EventTypeId == 306, "MANUALLY_ADDED_LOGIN_FAILURE",
                                EventTypeId == 307, "LDAP_CONNECTOR_PROVISIONING_ERROR",
                                EventTypeId == 330, "USER_DISASSOCIATED_FROM_DIRECTORY",
                                EventTypeId == 331, "USER_ASSOCIATED_TO_DIRECTORY",
                                EventTypeId == 332, "USER_DIRECTORY_EXTERNAL_ID_UPDATED",
                                EventTypeId == 333, "USER_DIRECTORY_EXTERNAL_ID_DELETED",
                                EventTypeId == 334, "USER_NOT_UPDATED_IN_APP",
                                EventTypeId == 400, "API_BAD_REQUEST",
                                EventTypeId == 401, "API_UNAUTHORIZED",
                                EventTypeId == 402, "MAPPING_SKIPPED",
                                EventTypeId == 410, "BROADCASTER_CREATED",
                                EventTypeId == 411, "BROADCASTER_UPDATED",
                                EventTypeId == 412, "BROADCASTER_DELETED",
                                EventTypeId == 501, "API_INDEX_ACTION",
                                EventTypeId == 502, "API_SHOW_ACTION",
                                EventTypeId == 503, "API_RES_ACTION",
                                EventTypeId == 510, "API_SET_PWD_SALT",
                                EventTypeId == 511, "API_SET_PWD_CLEAR_TEXT",
                                EventTypeId == 512, "API_SET_CUSTOM_ATTRS",
                                EventTypeId == 513, "API_ADD_ROLES",
                                EventTypeId == 514, "API_REMOVE_ROLES",
                                EventTypeId == 515, "API_AUTH_ISSUE_TOKEN",
                                EventTypeId == 516, "API_LOGOUT",
                                EventTypeId == 517, "API_SET_PWD_SALT_FAILED",
                                EventTypeId == 518, "API_SET_PWD_CLEAR_TEXT_FAILED",
                                EventTypeId == 519, "API_SET_CUSTOM_ATTRS_FAILED",
                                EventTypeId == 520, "API_ADD_ROLES_FAILED",
                                EventTypeId == 521, "API_REMOVE_ROLES_FAILED",
                                EventTypeId == 522, "API_AUTH_ISSUE_TOKEN_FAILED",
                                EventTypeId == 523, "API_LOGOUT_FAILED",
                                EventTypeId == 524, "API_DESTROY_USER_FAILED",
                                EventTypeId == 525, "API_GET_INVITE_LINK_FAILED",
                                EventTypeId == 526, "API_LOCK_USER_FAILED",
                                EventTypeId == 527, "API_VERIFY_FACTOR_FAILED",
                                EventTypeId == 528, "API_VERIFY_FACTOR",
                                EventTypeId == 529, "API_UPDATE_USER",
                                EventTypeId == 530, "API_DESTROY_USER",
                                EventTypeId == 531, "API_LOCK_USER",
                                EventTypeId == 532, "API_UPDATE_USER_FAILED",
                                EventTypeId == 533, "API_CREATE_USER",
                                EventTypeId == 534, "API_CREATE_USER_FAILED",
                                EventTypeId == 535, "API_GET_INVITE_LINK",
                                EventTypeId == 536, "API_USER_OTPS_RETRIEVED",
                                EventTypeId == 537, "API_CONFIRM_FACTOR",
                                EventTypeId == 538, "API_CONFIRM_FACTOR_FAILED",
                                EventTypeId == 539, "API_TRIGGER_FACTOR",
                                EventTypeId == 540, "API_ADDED_OTP_DEVICE",
                                EventTypeId == 541, "DIRECTORY_UPDATED",
                                EventTypeId == 542, "DIRECTORY_OUS_CHANGED",
                                EventTypeId == 545, "API_SEND_INVITE_LINK_FAILED",
                                EventTypeId == 546, "API_SEND_INVITE_LINK",
                                EventTypeId == 550, "FORCE_LOGOUT_USER",
                                EventTypeId == 551, "SUSPENDED_USER_VIA_API",
                                EventTypeId == 552, "REACTIVATED_USER_VIA_API",
                                EventTypeId == 553, "USER_LOCKED_VIA_API",
                                EventTypeId == 554, "UNLOCKED_USER_VIA_API",
                                EventTypeId == 555, "EXTERNAL_ASSUME_USER",
                                EventTypeId == 600, "APP_CREATED_BY_USER",
                                EventTypeId == 601, "APP_UPDATED_BY_USER",
                                EventTypeId == 602, "APP_DELETED_BY_USER",
                                EventTypeId == 700, "CONNECTOR_CREATED",
                                EventTypeId == 701, "CONNECTOR_CREATE_FAILED",
                                EventTypeId == 702, "CONNECTOR_UPDATED",
                                EventTypeId == 703, "CONNECTOR_UPDATE_FAILED",
                                EventTypeId == 704, "CONNECTOR_DELETED",
                                EventTypeId == 705, "CONNECTOR_DELETE_FAILED",
                                EventTypeId == 706, "CONNECTOR_STATS_UPDATE",
                                EventTypeId == 800, "PARAMETER_CREATED",
                                EventTypeId == 801, "PARAMETER_CREATE_FAILED",
                                EventTypeId == 802, "PARAMETER_UPDATED",
                                EventTypeId == 803, "PARAMETER_UPDATE_FAILED",
                                EventTypeId == 804, "PARAMETER_DELETED",
                                EventTypeId == 805, "PARAMETER_DELETE_FAILED",
                                EventTypeId == 900, "ONELOGIN_DESKTOP_MAC_LOGIN_SUCCESS",
                                EventTypeId == 901, "ONELOGIN_DESKTOP_MAC_LOGIN_FAILURE",
                                EventTypeId == 902, "ONELOGIN_DESKTOP_DEVICE_DELETED",
                                EventTypeId == 903, "ONELOGIN_DESKTOP_DEVICE_UNBIND",
                                EventTypeId == 904, "ONELOGIN_DESKTOP_LOGIN_SUCCESS",
                                EventTypeId == 905, "ONELOGIN_DESKTOP_LOGIN_FAILURE",
                                EventTypeId == 906, "ONELOGIN_DESKTOP_USER_FAILED_ONELOGIN_LOGIN",
                                EventTypeId == 907, "DIRECTORY_EXPORT_SUCCESS",
                                EventTypeId == 911, "ONELOGIN_DESKTOP_REVOKE_CERT_FOR_USER",
                                EventTypeId == 912, "ONELOGIN_DESKTOP_REVOKE_CERT_FOR_DEVICE",
                                EventTypeId == 931, "ADAPTIVE_LOGIN_ENABLED",
                                EventTypeId == 932, "ADAPTIVE_LOGIN_DISABLED",
                                EventTypeId == 950, "OL_OTP_PUSH_REJECT",
                                EventTypeId == 1001, "USER_LOGIN_CHALLENGE",
                                EventTypeId == 1002, "USER_LOGIN_CHALLENGE_FAILED",
                                EventTypeId == 1010, "USER_REAUTH_SUCCESS",
                                EventTypeId == 1100, "TEMP_OTP_TOKEN_GENERATED",
                                EventTypeId == 1101, "TEMP_OTP_TOKEN_REVOKED",
                                EventTypeId == 1200, "DELEGATED_APP_PRIVILEGE_DENIED",
                                EventTypeId == 1201, "DELEGATED_USER_PRIVILEGE_DENIED",
                                EventTypeId == 1244, "USER_ADDED_PHONE_NUMBER",
                                EventTypeId == 1245, "USER_UPDATED_PHONE_NUMBER",
                                EventTypeId == 1300, "API_APP_CREATED",
                                EventTypeId == 1301, "API_APP_CREATE_FAILED",
                                EventTypeId == 1302, "API_APP_UPDATED",
                                EventTypeId == 1303, "API_APP_UPDATE_FAILED",
                                EventTypeId == 1304, "API_APP_DESTROYED",
                                EventTypeId == 1305, "API_APP_DESTROY_FAILED",
                                EventTypeId == 1400, "USER_VERIFIED_OTP_DEVICE",
                                EventTypeId == 1401, "API_AUTH_APP_CREATE_FAILED",
                                EventTypeId == 1402, "API_AUTH_APP_UPDATED",
                                EventTypeId == 1403, "API_AUTH_APP_UPDATE_FAILED",
                                EventTypeId == 1404, "API_AUTH_APP_DESTROYED",
                                EventTypeId == 1405, "API_AUTH_APP_DESTROY_FAILED",
                                EventTypeId == 1406, "API_AUTH_SCOPE_CREATED",
                                EventTypeId == 1407, "API_AUTH_SCOPE_CREATE_FAILED",
                                EventTypeId == 1408, "API_AUTH_SCOPE_UPDATED",
                                EventTypeId == 1409, "API_AUTH_SCOPE_UPDATE_FAILED",
                                EventTypeId == 1410, "API_AUTH_SCOPE_DESTROYED",
                                EventTypeId == 1411, "API_AUTH_SCOPE_DESTROY_FAILED",
                                EventTypeId == 1412, "API_AUTH_CLAIM_CREATED",
                                EventTypeId == 1413, "API_AUTH_CLAIM_CREATE_FAILED",
                                EventTypeId == 1414, "API_AUTH_CLAIM_UPDATED",
                                EventTypeId == 1415, "API_AUTH_CLAIM_UPDATE_FAILED",
                                EventTypeId == 1416, "API_AUTH_CLAIM_DESTROYED",
                                EventTypeId == 1417, "API_AUTH_CLAIM_DESTROY_FAILED",
                                EventTypeId == 1418, "API_AUTH_CLIENT_CREATED",
                                EventTypeId == 1419, "API_AUTH_CLIENT_CREATE_FAILED",
                                EventTypeId == 1420, "API_AUTH_CLIENT_UPDATED",
                                EventTypeId == 1421, "API_AUTH_CLIENT_UPDATE_FAILED",
                                EventTypeId == 1422, "API_AUTH_CLIENT_DESTROYED",
                                EventTypeId == 1423, "API_AUTH_CLIENT_DESTROY_FAILED",
                                EventTypeId == 1424, "API_AUTH_APP_CREATED",
                                EventTypeId == 1500, "SANDBOX_SYNC_STARTED",
                                EventTypeId == 1501, "SANDBOX_SYNC_FAILED",
                                EventTypeId == 1502, "SANDBOX_SYNCED",
                                EventTypeId == 1503, "SANDBOX_DELETED",
                                EventTypeId == 1504, "SANDBOX_DELETE_FAILED",
                                EventTypeId == 1505, "SANDBOX_CREATED",
                                EventTypeId == 1506, "SANDBOX_CREATION_FAILED",
                                EventTypeId == 1507, "SANDBOX_UPDATED",
                                EventTypeId == 1508, "SANDBOX_UPDATE_FAILED",
                                EventTypeId == 1509, "SANDBOX_DELETED_BY_API",
                                EventTypeId == 1510, "SANDBOX_DELETE_FAILED_BY_API",
                                EventTypeId == 1511, "SANDBOX_CREATED_BY_API",
                                EventTypeId == 1512, "SANDBOX_CREATION_FAILED_BY_API",
                                EventTypeId == 1513, "SANDBOX_UPDATED_BY_API",
                                EventTypeId == 1514, "SANDBOX_UPDATE_FAILED_BY_API",
                                EventTypeId == 1600, "PROFILE_DEVICES_DELETE_DEVICE",
                                EventTypeId == 1601, "PROFILE_DEVICES_RENAME_DEVICE",
                                EventTypeId == 1602, "PROFILE_DEVICES_UPDATE_DEFAULT",
                                EventTypeId == 1603, "PROFILE_SETTINGS_UPDATE_LOCALE",
                                EventTypeId == 1604, "PROFILE_SETTINGS_UPDATE_PHONE",
                                EventTypeId == 1605, "PROFILE_SETTINGS_UPDATE_DEFAULT_TAB",
                                EventTypeId == 1606, "PROFILE_SETTINGS_UPDATE_PROFILE_PHOTO",
                                EventTypeId == 1607, "PROFILE_SETTINGS_UPDATE_APP_AUTO_DETECT",
                                EventTypeId == 1608, "PROFILE_CHANGE_PASSWORD",
                                EventTypeId == 1609, "PROFILE_SETTINGS_UPDATE_SHOW_TABS",
                                EventTypeId == 1700, "RADIUS_ATTRIBUTE_CREATED",
                                EventTypeId == 1701, "RADIUS_ATTRIBUTE_UPDATED",
                                EventTypeId == 1702, "RADIUS_ATTRIBUTE_DELETED",
                                EventTypeId == 1801, "ROLE_CREATED",
                                EventTypeId == 1802, "ROLE_DELETED",
                                EventTypeId == 1900, "API_BRAND_CREATED",
                                EventTypeId == 1901, "API_BRAND_CREATE_FAILED",
                                EventTypeId == 1902, "API_BRAND_UPDATED",
                                EventTypeId == 1903, "API_BRAND_UPDATE_FAILED",
                                EventTypeId == 1904, "API_BRAND_DESTROYED",
                                EventTypeId == 1905, "API_BRAND_DESTROY_FAILED",
                                EventTypeId == 2000, "HOOKS_LIST_FUNCTION",
                                EventTypeId == 2001, "CUSTOM_SMTP_ERROR",
                                EventTypeId == 2002, "SMTP_SETTINGS_UPDATED",
                                EventTypeId == 2003, "HOOKS_CREATE_FUNCTION",
                                EventTypeId == 2004, "HOOKS_CREATE_FUNCTION_FAILED",
                                EventTypeId == 2005, "HOOKS_GET_FUNCTION",
                                EventTypeId == 2006, "HOOKS_GET_FUNCTION_LOGS",
                                EventTypeId == 2007, "HOOKS_UPDATE_FUNCTION",
                                EventTypeId == 2008, "HOOKS_UPDATE_FUNCTION_FAILED",
                                EventTypeId == 2009, "HOOKS_DELETE_FUNCTION",
                                EventTypeId == 2010, "HOOKS_DELETE_FUNCTION_FAILED",
                                EventTypeId == 2011, "HOOKS_LIST_ENVVAR",
                                EventTypeId == 2012, "HOOKS_CREATE_ENVVAR",
                                EventTypeId == 2013, "HOOKS_CREATE_ENVVAR_FAILED",
                                EventTypeId == 2014, "HOOKS_GET_ENVVAR",
                                EventTypeId == 2015, "HOOKS_UPDATE_ENVVAR",
                                EventTypeId == 2016, "HOOKS_UPDATE_ENVVAR_FAILED",
                                EventTypeId == 2017, "HOOKS_DELETE_ENVVAR",
                                EventTypeId == 2018, "HOOKS_DELETE_ENVVAR_FAILED",
                                EventTypeId == 2100, "DELEGATED_PRIVILEGE_CREATED_VIA_API",
                                EventTypeId == 2101, "DELEGATED_PRIVILEGE_CREATED_BY_USER",
                                EventTypeId == 2102, "DELEGATED_PRIVILEGE_UPDATED_VIA_API",
                                EventTypeId == 2103, "DELEGATED_PRIVILEGE_UPDATED_BY_USER",
                                EventTypeId == 2104, "DELEGATED_PRIVILEGE_DELETED_VIA_API",
                                EventTypeId == 2105, "DELEGATED_PRIVILEGE_DELETED_BY_USER",
                                EventTypeId == 2106, "DELEGATED_PRIVILEGE_ASSIGNED_TO_USER_VIA_API",
                                EventTypeId == 2107, "DELEGATED_PRIVILEGE_ASSIGNED_TO_USER_BY_USER",
                                EventTypeId == 2108, "DELEGATED_PRIVILEGE_REMOVED_FROM_USER_VIA_API",
                                EventTypeId == 2109, "DELEGATED_PRIVILEGE_REMOVED_FROM_USER_BY_USER",
                                EventTypeId == 2110, "DELEGATED_PRIVILEGE_ASSIGNED_TO_ROLE_VIA_API",
                                EventTypeId == 2111, "DELEGATED_PRIVILEGE_ASSIGNED_TO_ROLE_BY_USER",
                                EventTypeId == 2112, "DELEGATED_PRIVILEGE_REMOVED_FROM_ROLE_VIA_API",
                                EventTypeId == 2113, "DELEGATED_PRIVILEGE_REMOVED_FROM_ROLE_BY_USER",
                                EventTypeId == 2114, "DELEGATED_ROLE_PRIVILEGE_DENIED",
                                EventTypeId == 2201, "REPORT_CREATED_BY_USER",
                                EventTypeId == 2202, "REPORT_UPDATED_BY_USER",
                                EventTypeId == 2203, "REPORT_CLONED_BY_USER",
                                EventTypeId == 2204, "REPORT_DESTROYED_BY_USER",
                                EventTypeId == 3000, "OIDC_GENERAL_FAIL",
                                EventTypeId == 3001, "OIDC_IMPLICIT_FLOW_SUCCESS",
                                EventTypeId == 3002, "OIDC_IMPLICIT_FLOW_FAILED",
                                EventTypeId == 3003, "OIDC_GET_CODE_SUCCESS",
                                EventTypeId == 3004, "OIDC_GET_CODE_FAILED",
                                EventTypeId == 3005, "OIDC_AUTHORIZATION_CODE_SUCCESS",
                                EventTypeId == 3006, "OIDC_AUTHORIZATION_CODE_FAILED",
                                EventTypeId == 3007, "OIDC_CLIENT_CREDENTIALS_SUCCESS",
                                EventTypeId == 3008, "OIDC_CLIENT_CREDENTIALS_FAILED",
                                EventTypeId == 3009, "OIDC_PASSWORD_SUCCESS",
                                EventTypeId == 3010, "OIDC_PASSWORD_FAILED",
                                EventTypeId == 3011, "OIDC_REFRESH_TOKEN_SUCCESS",
                                EventTypeId == 3012, "OIDC_REFRESH_TOKEN_FAILED",
                                EventTypeId == 3013, "OIDC_VALIDATE_TOKEN_SUCCESS",
                                EventTypeId == 3014, "OIDC_VALIDATE_TOKEN_FAILED",
                                EventTypeId == 3015, "OIDC_REVOKE_TOKEN_SUCCESS",
                                EventTypeId == 3016, "OIDC_REVOKE_TOKEN_FAILED",
                                EventTypeId == 3017, "OIDC_USER_INFO_SUCCESS",
                                EventTypeId == 3018, "OIDC_USER_INFO_FAILED",
                                EventTypeId == 3019, "NOTIFICATION_WAS_SENT",
                                EventTypeId == 3020, "GROUP_CREATED",
                                EventTypeId == 3021, "GROUP_UPDATED",
                                EventTypeId == 3022, "GROUP_DESTROYED",
                                EventTypeId == 3023, "USER_CREATED_NOTE",
                                EventTypeId == 3024, "DELEGATED_GROUP_PRIVILEGE_DENIED",
                                EventTypeId == 3025, "DELEGATED_POLICY_PRIVILEGE_DENIED",
                                EventTypeId == 3026, "PROFILE_DEVICES_UNSET_DEFAULT",
                                EventTypeId == 3027, "DELEGATED_REPORT_PRIVILEGE_DENIED",
                                EventTypeId == 9000, "USER_ENABLED_WORKFLOW",
                                EventTypeId == 9001, "USER_DISABLED_WORKFLOW",
                                EventTypeId == 9002, "USER_INITIATED_WORKFLOW",
                                EventTypeId == 9003, "USER_COMPLETED_TASK",
                                EventTypeId == 9004, "USER_MARKED_TASK_COMPLETE",
                                EventTypeId == 9005, "USER_MARKED_WORKFLOW_COMPLETE",
                                EventTypeId == 9006, "USER_MARKED_TASK_INCOMPLETE",
                                EventTypeId == 9007, "USER_ENABLED_ONBOARDING",
                                EventTypeId == 9008, "USER_DISABLED_ONBOARDING",
                                EventTypeId == 9009, "USER_ENABLED_OFFBOARDING",
                                EventTypeId == 9010, "USER_DISABLED_OFFBOARDING",
                                EventTypeId == 9011, "USER_INITIATED_OFFBOARDING",
                                EventTypeId == 9012, "USER_INITIATED_ONBOARDING",
                                EventTypeId == 9013, "USER_COMPLETED_WORKFLOW",
                                EventTypeId == 9014, "APP_RULES_LIST_SUCCESS",
                                EventTypeId == 9015, "APP_RULES_LIST_FAILED",
                                EventTypeId == 9016, "APP_RULES_CREATE_SUCCESS",
                                EventTypeId == 9017, "APP_RULES_CREATE_FAILED",
                                EventTypeId == 9018, "APP_RULES_UPDATE_SUCCESS",
                                EventTypeId == 9019, "APP_RULES_UPDATE_FAILED",
                                EventTypeId == 9020, "APP_RULES_GET_SUCCESS",
                                EventTypeId == 9021, "APP_RULES_GET_FAILED",
                                EventTypeId == 9022, "APP_RULES_DRYRUN_SUCCESS",
                                EventTypeId == 9023, "APP_RULES_DRYRUN_FAILED",
                                EventTypeId == 9024, "APP_RULES_DELETE_SUCCESS",
                                EventTypeId == 9025, "APP_RULES_DELETE_FAILED",
                                EventTypeId == 9026, "APP_RULES_SORT_SUCCESS",
                                EventTypeId == 9027, "APP_RULES_SORT_FAILED",
                                EventTypeId == 9028, "APP_RULES_APPLY_SUCCESS",
                                EventTypeId == 9029, "APP_RULES_APPLY_FAILED",
                                EventTypeId == 9030, "APP_RULES_REFRESH_ENTITLEMENTS_SUCCESS",
                                EventTypeId == 9031, "APP_RULES_REFRESH_ENTITLEMENTS_FAILED",
                                EventTypeId == 9032, "APP_RULES_LIST_CONDITIONS_SUCCESS",
                                EventTypeId == 9033, "APP_RULES_LIST_CONDITIONS_FAILED",
                                EventTypeId == 9034, "APP_RULES_LIST_CONDITION_OPERATORS_SUCCESS",
                                EventTypeId == 9035, "APP_RULES_LIST_CONDITION_OPERATORS_FAILED",
                                EventTypeId == 9036, "APP_RULES_LIST_ACTIONS_SUCCESS",
                                EventTypeId == 9037, "APP_RULES_LIST_ACTIONS_FAILED",
                                EventTypeId == 9038, "APP_RULES_LIST_ACTION_VALUES_SUCCESS",
                                EventTypeId == 9039, "APP_RULES_LIST_ACTION_VALUES_FAILED",
                                EventTypeId == 9040, "USER_ROLE_MANAGEMENT_GRANTED_FAILED",
                                EventTypeId == 9041, "USER_ROLE_MANAGEMENT_REVOKED_FAILED",
                                EventTypeId == 9042, "APP_ADDED_TO_ROLE_FAILED",
                                EventTypeId == 9043, "APP_REMOVED_FROM_ROLE_FAILED",
                                EventTypeId == 9044, "USER_MANUALLY_ADDED_TO_ROLE_FAILED",
                                EventTypeId == 9045, "USER_MANUALLY_REMOVED_FROM_ROLE_FAILED",
                                EventTypeId == 9046, "ROLE_CREATE_FAILED",
                                EventTypeId == 9047, "ROLE_DELETE_FAILED",
                                EventTypeId == 9048, "ROLE_LIST_SUCCESS",
                                EventTypeId == 9049, "ROLE_LIST_FAILED",
                                EventTypeId == 9050, "ROLE_GET_SUCCESS",
                                EventTypeId == 9051, "ROLE_GET_FAILED",
                                EventTypeId == 9052, "ROLE_UPDATE_SUCCESS",
                                EventTypeId == 9053, "ROLE_UPDATE_FAILED",
                                EventTypeId == 9054, "ROLE_LIST_APPS_SUCCESS",
                                EventTypeId == 9055, "ROLE_LIST_APPS_FAILED",
                                EventTypeId == 9056, "ROLE_LIST_USERS_SUCCESS",
                                EventTypeId == 9057, "ROLE_LIST_USERS_FAILED",
                                EventTypeId == 9058, "ROLE_LIST_ADMINISTRATORS_SUCCESS",
                                EventTypeId == 9059, "ROLE_LIST_ADMINISTRATORS_FAILED",
                                ""
                                                            )