Solutions/OneLoginIAM/Parsers/OneLogin.yaml (589 lines of code) (raw):

id: cd80d5ce-6c89-4d23-9f98-77066a599982 Function: Title: Parser for OneLogin Version: '1.0.1' LastUpdated: '2023-09-25' Category: Microsoft Sentinel Parser FunctionName: OneLogin FunctionAlias: OneLogin FunctionQuery: | OneLogin_CL | extend app_name_s = column_ifexists("app_name_s", ''), app_id_d = column_ifexists("app_id_d", ''), role_name_s = column_ifexists("role_name_s", ''), role_id_d = column_ifexists("role_id_d", ''), user_attributes_username_s = column_ifexists("user_attributes_username_s", ''), user_attributes_department_s = column_ifexists("user_attributes_department_s", ''), user_attributes_title_s = column_ifexists("user_attributes_title_s", '') | project-rename TargetAppName = app_name_s, TargetAppId = app_id_d, RoleName = role_name_s, RoleId = role_id_d, PolicyName = policy_name_s, PolicyType = policy_type_s, PolicyId = policy_id_d, HttpUserAgent = user_agent_s, UserId = user_id_d, UserAttributesUsername_s = user_attributes_username_s, UserAttributesAccountId = user_attributes_account_id_d, UserAttributesDepartment = user_attributes_department_s, UserAttributesFirstname = user_attributes_firstname_s, UserAttributesEmail = user_attributes_email_s, UserAttributesOpenidName = user_attributes_openid_name_s, UserAttributesTitle = user_attributes_title_s, UserAttributesLastname = user_attributes_lastname_s, UserName = user_name_s, EventOriginalUid = create__id_g, UUID = uuid_g, ActorSystem = actor_system_s, CustomMessage = custom_message_s, AccountId = account_id_d, SrcIpAddr = ipaddr_s, ActorUserName = actor_user_name_s, ActorUserId = actor_user_id_d, Message = notes_s, EventTypeId = event_type_id_d, EventStartTime = event_timestamp_s | extend EventVendor = "OneLogin", EventProduct = "OneLogin IAM", EventType = case ( EventTypeId == 1, "APP_ADDED_TO_ROLE", EventTypeId == 2, "APP_REMOVED_FROM_ROLE", EventTypeId == 3, "USER_ASSUMED_USER", EventTypeId == 4, "USER_ASSIGNED_ROLE", EventTypeId == 5, "USER_LOGGED_INTO_ONELOGIN", EventTypeId == 6, "USER_FAILED_ONELOGIN_LOGIN", EventTypeId == 7, "USER_LOGGED_OUT_OF_ONELOGIN", EventTypeId == 8, "USER_LOGGED_INTO_APP", EventTypeId == 9, "USER_FAILED_APP_LOGIN", EventTypeId == 10, "USER_REQUESTED_NEW_PASSWORD", EventTypeId == 11, "USER_CHANGED_PASSWORD", EventTypeId == 12, "UNLOCKED_USER", EventTypeId == 13, "CREATED_USER", EventTypeId == 14, "UPDATED_USER", EventTypeId == 15, "DEACTIVATED_USER", EventTypeId == 16, "ACTIVATED_USER", EventTypeId == 17, "DELETED_USER", EventTypeId == 18, "ADMIN_APPROVED_PASSWORD_REQUEST", EventTypeId == 19, "USER_LOCKED", EventTypeId == 20, "REACHED_USERS_LIMIT", EventTypeId == 21, "SUSPENDED_USER", EventTypeId == 22, "USER_ADDED_OTP_DEVICE", EventTypeId == 23, "USER_BULK_OPERATION", EventTypeId == 24, "USER_REMOVED_OTP_DEVICE", EventTypeId == 25, "PROVISIONING_EXCEPTION", EventTypeId == 26, "PROVISIONING_EVENT", EventTypeId == 27, "USER_DOWNLOADED_CERT", EventTypeId == 28, "USER_RECENTLY_REMOVED", EventTypeId == 29, "USER_LOGGED_OUT_OF_APP", EventTypeId == 30, "UPDATED_PAYMENT_INFO", EventTypeId == 31, "FAILED_UPDATE_PAYMENT_INFO", EventTypeId == 32, "REACTIVATED_USER", EventTypeId == 33, "USERS_IMPORTED_FROM_DIRECTORY", EventTypeId == 34, "USER_REQUESTED_APP", EventTypeId == 35, "USER_LOCKED_OUT_OF_APP", EventTypeId == 36, "USER_LOST_OTP_DEVICE", EventTypeId == 37, "USER_JOIN_REQUEST", EventTypeId == 38, "APP_REACHED_USER_LIMIT", EventTypeId == 39, "CONNECTOR_BROKEN", EventTypeId == 40, "USER_UNLOCKED_OTP_DEVICE", EventTypeId == 41, "AD_CONNECTOR_STARTED", EventTypeId == 42, "AD_CONNECTOR_STOPPED", EventTypeId == 43, "AD_CONNECTOR_CONFIG_RELOAD", EventTypeId == 44, "AD_CONNECTOR_NOTIFICATION", EventTypeId == 45, "AD_CONNECTOR_EXCEPTION_OLD", EventTypeId == 46, "AD_CONNECTOR_FAIL_OVER", EventTypeId == 47, "AD_CONNECTOR_EXCEPTION", EventTypeId == 48, "IMPORTED_USER", EventTypeId == 49, "UPDATE_USER_FAILED", EventTypeId == 50, "REJECTED_USER", EventTypeId == 51, "USER_CREATED_IN_APP", EventTypeId == 52, "USER_UPDATED_IN_APP", EventTypeId == 53, "USER_SUSPENDED_IN_APP", EventTypeId == 54, "USER_REACTIVATED_IN_APP", EventTypeId == 55, "USER_DELETED_IN_APP", EventTypeId == 56, "UNMATCHED_USERS", EventTypeId == 57, "RABBIT_DOWN", EventTypeId == 58, "RABBIT_RESTARTED", EventTypeId == 59, "USER_LINKED_IN_APP", EventTypeId == 60, "PROVISIONING_DEPROVISIONING_MODE_DO_NOTHING_WARNING", EventTypeId == 61, "USER_FAILED_SUSPENDING_IN_APP", EventTypeId == 62, "USER_FAILED_REACTIVATING_IN_APP", EventTypeId == 63, "USER_FAILED_DELETING_IN_APP", EventTypeId == 64, "USER_FAILED_CREATING_IN_APP", EventTypeId == 65, "USER_FAILED_UPDATING_IN_APP", EventTypeId == 66, "NO_USERS_TO_IMPORT_FROM_DIRECTORY", EventTypeId == 67, "DIRECTORY_IMPORT_EXCEPTION", EventTypeId == 68, "USER_AUTHENTICATED_BY_RADIUS", EventTypeId == 69, "USER_REJECTED_BY_RADIUS", EventTypeId == 70, "PRIVILEGE_GRANTED_TO_ACCOUNT", EventTypeId == 71, "PRIVILEGE_REVOKED_FROM_ACCOUNT", EventTypeId == 72, "PRIVILEGE_GRANTED_TO_USER", EventTypeId == 73, "PRIVILEGE_REVOKED_FROM_USER", EventTypeId == 74, "TRUSTED_IDP_ADDED", EventTypeId == 75, "TRUSTED_IDP_REMOVED", EventTypeId == 76, "TRUSTED_IDP_MODIFIED", EventTypeId == 77, "USER_FAILED_PROXY_LOGIN", EventTypeId == 78, "USER_SUCCEEDED_PROXY_LOGIN", EventTypeId == 79, "AD_CONNECTOR_PROVISIONING_ERROR", EventTypeId == 80, "USER_CREATED_IN_DIRECTORY", EventTypeId == 81, "USER_UPDATED_IN_DIRECTORY", EventTypeId == 82, "USER_SUSPENDED_IN_DIRECTORY", EventTypeId == 83, "USER_REACTIVATED_IN_DIRECTORY", EventTypeId == 84, "USER_DELETED_IN_DIRECTORY", EventTypeId == 85, "APP_COULD_NOT_AUTHENTICATE", EventTypeId == 86, "USER_FAILED_REMOTE_AUTHENTICATION", EventTypeId == 87, "USER_VIEWED_NOTE", EventTypeId == 88, "USER_EDITED_NOTE", EventTypeId == 89, "USER_DELETED_NOTE", EventTypeId == 90, "USER_UNAUTHORIZED_APP_ACCESS", EventTypeId == 91, "USER_UNDETERMINED_BY_RADIUS", EventTypeId == 92, "USER_NTHASH_REQUESTED_BY_RADIUS", EventTypeId == 95, "DIRECTORY_GROUPS_WRITE_BACK_IMPORT_STARTED", EventTypeId == 96, "DIRECTORY_GROUPS_WRITE_BACK_IMPORT_FINISHED", EventTypeId == 100, "SELF_REGISTRATION_REQUEST", EventTypeId == 101, "SELF_REGISTRATION_APPROVED", EventTypeId == 102, "SELF_REGISTRATION_DENIED", EventTypeId == 103, "SELF_REGISTRATION_REQUEST_UNVERIFIED", EventTypeId == 104, "SELF_REGISTRATION_REQUEST_VERIFIED", EventTypeId == 105, "SMS_FAILURE", EventTypeId == 106, "USER_CHANGE_PASSWORD_FAILED", EventTypeId == 110, "APP_LOGINS_UPDATED", EventTypeId == 111, "APP_LOGINS_UPDATE_FAILED", EventTypeId == 112, "TRUSTED_IDP_MADE_DEFAULT", EventTypeId == 113, "DIRECTORY_IMPORT_STARTED", EventTypeId == 114, "DIRECTORY_IMPORT_FINISHED", EventTypeId == 115, "USER_INVITED", EventTypeId == 116, "CREATE_USER_FAILED", EventTypeId == 117, "DIRECTORY_SYNC_RUN_ID", EventTypeId == 118, "SAML_ACS_FAILED", EventTypeId == 119, "TRUSTED_IDP_REMOVED_AS_DEFAULT", EventTypeId == 120, "UNLOCKED_USER_IN_DIRECTORY", EventTypeId == 121, "SCRIPTLET_ERROR", EventTypeId == 122, "USER_AUTHENTICATED_BY_API", EventTypeId == 123, "USER_REJECTED_BY_API", EventTypeId == 124, "ENTITLEMENTS_CACHE_ACTION", EventTypeId == 125, "ENTITLEMENT_ACTION", EventTypeId == 126, "DIRECTORY_CONNECTOR_ENABLED", EventTypeId == 127, "DIRECTORY_CONNECTOR_DISABLED", EventTypeId == 128, "NO_ACTIVE_ACTIVE_DIRECTORY_CONNECTORS", EventTypeId == 129, "VLDAP_BIND_FAILURE", EventTypeId == 130, "VLDAP_BIND_SUCCESS", EventTypeId == 131, "DIRECTORY_EXPORT_STARTED", EventTypeId == 132, "DIRECTORY_EXPORT_FINISHED", EventTypeId == 133, "DIRECTORY_EXPORT_EXCEPTION", EventTypeId == 134, "DIRECTORY_REFRESH_SCHEMA_EXCEPTION", EventTypeId == 135, "CERTIFICATE_EXPIRES", EventTypeId == 136, "DIRECTORY_FIELDS_IMPORT_STARTED", EventTypeId == 137, "USER_APP_REQUEST_APPROVED", EventTypeId == 138, "USER_APP_REQUEST_DENIED", EventTypeId == 139, "DIRECTORY_FIELDS_IMPORT_FINISHED", EventTypeId == 140, "SOCIAL_SIGN_IN", EventTypeId == 141, "SOCIAL_SIGN_IN_FAILURE", EventTypeId == 145, "USER_SMART_PASSWORD_UPDATED", EventTypeId == 146, "USER_SMART_PASSWORD_UPDATE_FAILED", EventTypeId == 147, "USER_MANUALLY_ADDED_TO_ROLE", EventTypeId == 148, "USER_MANUALLY_REMOVED_FROM_ROLE", EventTypeId == 149, "USER_AUTO_ADDED_TO_ROLE", EventTypeId == 150, "USER_AUTO_REMOVED_FROM_ROLE", EventTypeId == 151, "USER_ROLE_MANAGEMENT_GRANTED", EventTypeId == 152, "USER_ROLE_MANAGEMENT_REVOKED", EventTypeId == 153, "MAC_LOGIN_SUCCESS", EventTypeId == 154, "MAC_LOGIN_FAILURE", EventTypeId == 155, "DIRECTORY_FIELDS_IMPORT_EXCEPTION", EventTypeId == 156, "POLICY_CREATED", EventTypeId == 157, "POLICY_UPDATED", EventTypeId == 158, "POLICY_DELETED", EventTypeId == 159, "PROXY_AGENT_CREATED", EventTypeId == 160, "PROXY_AGENT_DELETED", EventTypeId == 161, "RADIUS_CONFIG_CREATED", EventTypeId == 162, "RADIUS_CONFIG_UPDATED", EventTypeId == 163, "RADIUS_CONFIG_DELETED", EventTypeId == 164, "VPN_ENABLED", EventTypeId == 165, "VPN_SETTINGS_UPDATED", EventTypeId == 166, "VPN_DISABLED", EventTypeId == 167, "EMBEDDING_ENABLED", EventTypeId == 168, "EMBEDDING_SETTINGS_UPDATED", EventTypeId == 169, "EMBEDDING_DISABLED", EventTypeId == 170, "AUTHENTICATION_FACTOR_CREATED", EventTypeId == 171, "AUTHENTICATION_FACTOR_UPDATED", EventTypeId == 172, "AUTHENTICATION_FACTOR_DELETED", EventTypeId == 173, "SECURITY_QUESTIONS_UPDATED", EventTypeId == 174, "DESKTOP_SSO_SETTINGS_UPDATED", EventTypeId == 175, "DESKTOP_SSO_ENABLED", EventTypeId == 176, "DESKTOP_SSO_DISABLED", EventTypeId == 177, "CERTIFICATE_CREATED", EventTypeId == 178, "CERTIFICATE_DELETED", EventTypeId == 179, "API_CREDENTIAL_CREATED", EventTypeId == 180, "API_CREDENTIAL_DELETED", EventTypeId == 181, "API_CREDENTIAL_ENABLED", EventTypeId == 182, "API_CREDENTIAL_DISABLED", EventTypeId == 183, "VLDAP_ENABLED", EventTypeId == 184, "VLDAP_DISABLED", EventTypeId == 185, "VLDAP_SETTINGS_UPDATED", EventTypeId == 186, "BRANDING_ENABLED", EventTypeId == 187, "BRANDING_DISABLED", EventTypeId == 188, "BRANDING_UPDATED", EventTypeId == 189, "MAPPING_ADDED", EventTypeId == 190, "MAPPING_DELETED", EventTypeId == 191, "MAPPING_DISABLED", EventTypeId == 192, "MAPPING_ENABLED", EventTypeId == 193, "MAPPING_UPDATED", EventTypeId == 194, "USER_FIELD_ADDED", EventTypeId == 195, "USER_FIELD_DELETED", EventTypeId == 196, "COMPANY_INFO_UPDATED", EventTypeId == 197, "ACCOUNT_SETTINGS_UPDATED", EventTypeId == 198, "DIRECTORY_CREATED", EventTypeId == 199, "DIRECTORY_DESTROYED", EventTypeId == 200, "DIRECTORY_CONNECTOR_INSTANCE_ADDED", EventTypeId == 201, "DIRECTORY_CONNECTOR_INSTANCE_DELETED", EventTypeId == 202, "REAPPLIED_MAPPINGS", EventTypeId == 203, "SELF_REGISTRATION_PROFILE_CREATED", EventTypeId == 204, "SELF_REGISTRATION_PROFILE_UPDATED", EventTypeId == 205, "SELF_REGISTRATION_PROFILE_DESTROYED", EventTypeId == 206, "MANUALLY_ADDED_LOGIN", EventTypeId == 207, "MANUALLY_REMOVED_LOGIN", EventTypeId == 208, "RETRIED_PROVISIONING", EventTypeId == 209, "DIRECTORY_USER_IMPORT_WARNING", EventTypeId == 210, "LDAP_CONNECTOR_EXCEPTION", EventTypeId == 211, "ADMIN_CHANGED_USER_PASSWORD", EventTypeId == 212, "DIRECTORY_LOCKED", EventTypeId == 213, "PROFILE_PICTURE_UPLOADED", EventTypeId == 214, "PROFILE_PICTURE_DELETED", EventTypeId == 215, "ADMIN_CHANGED_ACCOUNT_SETTINGS", EventTypeId == 216, "JOB_IN_QUEUE", EventTypeId == 217, "DIRECTORY_IMPORT_LIMIT_REACHED", EventTypeId == 218, "REAPPLIED_MAPPINGS_FAILED", EventTypeId == 219, "WORKDAY_REAL_TIME_NOTIFICATION", EventTypeId == 220, "ADMIN_CREATED_PAYMENT_RECORD", EventTypeId == 221, "ADMIN_UPDATED_PAYMENT_RECORD", EventTypeId == 222, "ADMIN_DELETED_PAYMENT_RECORD", EventTypeId == 223, "USER_UNLICENSED", EventTypeId == 224, "USER_LICENSED_MANUALLY", EventTypeId == 225, "USER_UNLICENSED_MANUALLY", EventTypeId == 226, "USER_UNLICENSED_AUTOMATICALLY", EventTypeId == 227, "USER_LICENSE_FAILED", EventTypeId == 228, "USERS_LICENSED_BULK", EventTypeId == 229, "ACCOUNT_NEAR_LIMIT", EventTypeId == 230, "ACCOUNT_IN_LIMIT", EventTypeId == 231, "USERS_IN_UNLICENSED_STATE", EventTypeId == 232, "USER_AGREED_TERMS", EventTypeId == 233, "USER_DENIED_TERMS", EventTypeId == 234, "ADMIN_ENABLED_TERMS", EventTypeId == 235, "ADMIN_UPDATED_TERMS", EventTypeId == 236, "ADMIN_DISABLED_TERMS", EventTypeId == 237, "DELETE_USER_FAILED", EventTypeId == 238, "USER_REDIRECTED_FOR_PASSWORD_CHANGE", EventTypeId == 239, "IMPORT_USER_FAILED", EventTypeId == 240, "USER_REVEALED_PASSWORD", EventTypeId == 241, "CSV_IMPORT_FAILED", EventTypeId == 242, "JOB_START_FAILED", EventTypeId == 243, "JOB_TERMINATED", EventTypeId == 244, "REPORT_GENERATED", EventTypeId == 245, "REPORT_GENERATION_FAILED", EventTypeId == 246, "REPORT_GENERATION_TERMINATED", EventTypeId == 247, "USER_MAPPINGS_FAILED", EventTypeId == 248, "USER_MAPPINGS_SUCCEEDED", EventTypeId == 249, "USER_BULK_OPERATION_FAILED", EventTypeId == 250, "PROVISIONING_APP_CONFIG_ERROR", EventTypeId == 251, "PROVISIONING_APP_THROTTLED", EventTypeId == 252, "USER_REMOVELOGINS_FAILED", EventTypeId == 253, "ENTITLEMENT_MAPPINGS_FAILED", EventTypeId == 254, "ENTITLEMENT_MAPPINGS_REAPPLIED", EventTypeId == 255, "MANUALLY_UPDATED_LOGIN", EventTypeId == 291, "USER_CREATED_BY_TIDP", EventTypeId == 300, "LDAP_CONNECTOR_STARTED", EventTypeId == 301, "LDAP_CONNECTOR_NOTIFICATION", EventTypeId == 303, "LDAP_CONNECTOR_CONFIG_RELOAD", EventTypeId == 304, "LDAP_CONNECTOR_STOPPED", EventTypeId == 305, "LDAP_CONNECTOR_FAIL_OVER", EventTypeId == 306, "MANUALLY_ADDED_LOGIN_FAILURE", EventTypeId == 307, "LDAP_CONNECTOR_PROVISIONING_ERROR", EventTypeId == 330, "USER_DISASSOCIATED_FROM_DIRECTORY", EventTypeId == 331, "USER_ASSOCIATED_TO_DIRECTORY", EventTypeId == 332, "USER_DIRECTORY_EXTERNAL_ID_UPDATED", EventTypeId == 333, "USER_DIRECTORY_EXTERNAL_ID_DELETED", EventTypeId == 334, "USER_NOT_UPDATED_IN_APP", EventTypeId == 400, "API_BAD_REQUEST", EventTypeId == 401, "API_UNAUTHORIZED", EventTypeId == 402, "MAPPING_SKIPPED", EventTypeId == 410, "BROADCASTER_CREATED", EventTypeId == 411, "BROADCASTER_UPDATED", EventTypeId == 412, "BROADCASTER_DELETED", EventTypeId == 501, "API_INDEX_ACTION", EventTypeId == 502, "API_SHOW_ACTION", EventTypeId == 503, "API_RES_ACTION", EventTypeId == 510, "API_SET_PWD_SALT", EventTypeId == 511, "API_SET_PWD_CLEAR_TEXT", EventTypeId == 512, "API_SET_CUSTOM_ATTRS", EventTypeId == 513, "API_ADD_ROLES", EventTypeId == 514, "API_REMOVE_ROLES", EventTypeId == 515, "API_AUTH_ISSUE_TOKEN", EventTypeId == 516, "API_LOGOUT", EventTypeId == 517, "API_SET_PWD_SALT_FAILED", EventTypeId == 518, "API_SET_PWD_CLEAR_TEXT_FAILED", EventTypeId == 519, "API_SET_CUSTOM_ATTRS_FAILED", EventTypeId == 520, "API_ADD_ROLES_FAILED", EventTypeId == 521, "API_REMOVE_ROLES_FAILED", EventTypeId == 522, "API_AUTH_ISSUE_TOKEN_FAILED", EventTypeId == 523, "API_LOGOUT_FAILED", EventTypeId == 524, "API_DESTROY_USER_FAILED", EventTypeId == 525, "API_GET_INVITE_LINK_FAILED", EventTypeId == 526, "API_LOCK_USER_FAILED", EventTypeId == 527, "API_VERIFY_FACTOR_FAILED", EventTypeId == 528, "API_VERIFY_FACTOR", EventTypeId == 529, "API_UPDATE_USER", EventTypeId == 530, "API_DESTROY_USER", EventTypeId == 531, "API_LOCK_USER", EventTypeId == 532, "API_UPDATE_USER_FAILED", EventTypeId == 533, "API_CREATE_USER", EventTypeId == 534, "API_CREATE_USER_FAILED", EventTypeId == 535, "API_GET_INVITE_LINK", EventTypeId == 536, "API_USER_OTPS_RETRIEVED", EventTypeId == 537, "API_CONFIRM_FACTOR", EventTypeId == 538, "API_CONFIRM_FACTOR_FAILED", EventTypeId == 539, "API_TRIGGER_FACTOR", EventTypeId == 540, "API_ADDED_OTP_DEVICE", EventTypeId == 541, "DIRECTORY_UPDATED", EventTypeId == 542, "DIRECTORY_OUS_CHANGED", EventTypeId == 545, "API_SEND_INVITE_LINK_FAILED", EventTypeId == 546, "API_SEND_INVITE_LINK", EventTypeId == 550, "FORCE_LOGOUT_USER", EventTypeId == 551, "SUSPENDED_USER_VIA_API", EventTypeId == 552, "REACTIVATED_USER_VIA_API", EventTypeId == 553, "USER_LOCKED_VIA_API", EventTypeId == 554, "UNLOCKED_USER_VIA_API", EventTypeId == 555, "EXTERNAL_ASSUME_USER", EventTypeId == 600, "APP_CREATED_BY_USER", EventTypeId == 601, "APP_UPDATED_BY_USER", EventTypeId == 602, "APP_DELETED_BY_USER", EventTypeId == 700, "CONNECTOR_CREATED", EventTypeId == 701, "CONNECTOR_CREATE_FAILED", EventTypeId == 702, "CONNECTOR_UPDATED", EventTypeId == 703, "CONNECTOR_UPDATE_FAILED", EventTypeId == 704, "CONNECTOR_DELETED", EventTypeId == 705, "CONNECTOR_DELETE_FAILED", EventTypeId == 706, "CONNECTOR_STATS_UPDATE", EventTypeId == 800, "PARAMETER_CREATED", EventTypeId == 801, "PARAMETER_CREATE_FAILED", EventTypeId == 802, "PARAMETER_UPDATED", EventTypeId == 803, "PARAMETER_UPDATE_FAILED", EventTypeId == 804, "PARAMETER_DELETED", EventTypeId == 805, "PARAMETER_DELETE_FAILED", EventTypeId == 900, "ONELOGIN_DESKTOP_MAC_LOGIN_SUCCESS", EventTypeId == 901, "ONELOGIN_DESKTOP_MAC_LOGIN_FAILURE", EventTypeId == 902, "ONELOGIN_DESKTOP_DEVICE_DELETED", EventTypeId == 903, "ONELOGIN_DESKTOP_DEVICE_UNBIND", EventTypeId == 904, "ONELOGIN_DESKTOP_LOGIN_SUCCESS", EventTypeId == 905, "ONELOGIN_DESKTOP_LOGIN_FAILURE", EventTypeId == 906, "ONELOGIN_DESKTOP_USER_FAILED_ONELOGIN_LOGIN", EventTypeId == 907, "DIRECTORY_EXPORT_SUCCESS", EventTypeId == 911, "ONELOGIN_DESKTOP_REVOKE_CERT_FOR_USER", EventTypeId == 912, "ONELOGIN_DESKTOP_REVOKE_CERT_FOR_DEVICE", EventTypeId == 931, "ADAPTIVE_LOGIN_ENABLED", EventTypeId == 932, "ADAPTIVE_LOGIN_DISABLED", EventTypeId == 950, "OL_OTP_PUSH_REJECT", EventTypeId == 1001, "USER_LOGIN_CHALLENGE", EventTypeId == 1002, "USER_LOGIN_CHALLENGE_FAILED", EventTypeId == 1010, "USER_REAUTH_SUCCESS", EventTypeId == 1100, "TEMP_OTP_TOKEN_GENERATED", EventTypeId == 1101, "TEMP_OTP_TOKEN_REVOKED", EventTypeId == 1200, "DELEGATED_APP_PRIVILEGE_DENIED", EventTypeId == 1201, "DELEGATED_USER_PRIVILEGE_DENIED", EventTypeId == 1244, "USER_ADDED_PHONE_NUMBER", EventTypeId == 1245, "USER_UPDATED_PHONE_NUMBER", EventTypeId == 1300, "API_APP_CREATED", EventTypeId == 1301, "API_APP_CREATE_FAILED", EventTypeId == 1302, "API_APP_UPDATED", EventTypeId == 1303, "API_APP_UPDATE_FAILED", EventTypeId == 1304, "API_APP_DESTROYED", EventTypeId == 1305, "API_APP_DESTROY_FAILED", EventTypeId == 1400, "USER_VERIFIED_OTP_DEVICE", EventTypeId == 1401, "API_AUTH_APP_CREATE_FAILED", EventTypeId == 1402, "API_AUTH_APP_UPDATED", EventTypeId == 1403, "API_AUTH_APP_UPDATE_FAILED", EventTypeId == 1404, "API_AUTH_APP_DESTROYED", EventTypeId == 1405, "API_AUTH_APP_DESTROY_FAILED", EventTypeId == 1406, "API_AUTH_SCOPE_CREATED", EventTypeId == 1407, "API_AUTH_SCOPE_CREATE_FAILED", EventTypeId == 1408, "API_AUTH_SCOPE_UPDATED", EventTypeId == 1409, "API_AUTH_SCOPE_UPDATE_FAILED", EventTypeId == 1410, "API_AUTH_SCOPE_DESTROYED", EventTypeId == 1411, "API_AUTH_SCOPE_DESTROY_FAILED", EventTypeId == 1412, "API_AUTH_CLAIM_CREATED", EventTypeId == 1413, "API_AUTH_CLAIM_CREATE_FAILED", EventTypeId == 1414, "API_AUTH_CLAIM_UPDATED", EventTypeId == 1415, "API_AUTH_CLAIM_UPDATE_FAILED", EventTypeId == 1416, "API_AUTH_CLAIM_DESTROYED", EventTypeId == 1417, "API_AUTH_CLAIM_DESTROY_FAILED", EventTypeId == 1418, "API_AUTH_CLIENT_CREATED", EventTypeId == 1419, "API_AUTH_CLIENT_CREATE_FAILED", EventTypeId == 1420, "API_AUTH_CLIENT_UPDATED", EventTypeId == 1421, "API_AUTH_CLIENT_UPDATE_FAILED", EventTypeId == 1422, "API_AUTH_CLIENT_DESTROYED", EventTypeId == 1423, "API_AUTH_CLIENT_DESTROY_FAILED", EventTypeId == 1424, "API_AUTH_APP_CREATED", EventTypeId == 1500, "SANDBOX_SYNC_STARTED", EventTypeId == 1501, "SANDBOX_SYNC_FAILED", EventTypeId == 1502, "SANDBOX_SYNCED", EventTypeId == 1503, "SANDBOX_DELETED", EventTypeId == 1504, "SANDBOX_DELETE_FAILED", EventTypeId == 1505, "SANDBOX_CREATED", EventTypeId == 1506, "SANDBOX_CREATION_FAILED", EventTypeId == 1507, "SANDBOX_UPDATED", EventTypeId == 1508, "SANDBOX_UPDATE_FAILED", EventTypeId == 1509, "SANDBOX_DELETED_BY_API", EventTypeId == 1510, "SANDBOX_DELETE_FAILED_BY_API", EventTypeId == 1511, "SANDBOX_CREATED_BY_API", EventTypeId == 1512, "SANDBOX_CREATION_FAILED_BY_API", EventTypeId == 1513, "SANDBOX_UPDATED_BY_API", EventTypeId == 1514, "SANDBOX_UPDATE_FAILED_BY_API", EventTypeId == 1600, "PROFILE_DEVICES_DELETE_DEVICE", EventTypeId == 1601, "PROFILE_DEVICES_RENAME_DEVICE", EventTypeId == 1602, "PROFILE_DEVICES_UPDATE_DEFAULT", EventTypeId == 1603, "PROFILE_SETTINGS_UPDATE_LOCALE", EventTypeId == 1604, "PROFILE_SETTINGS_UPDATE_PHONE", EventTypeId == 1605, "PROFILE_SETTINGS_UPDATE_DEFAULT_TAB", EventTypeId == 1606, "PROFILE_SETTINGS_UPDATE_PROFILE_PHOTO", EventTypeId == 1607, "PROFILE_SETTINGS_UPDATE_APP_AUTO_DETECT", EventTypeId == 1608, "PROFILE_CHANGE_PASSWORD", EventTypeId == 1609, "PROFILE_SETTINGS_UPDATE_SHOW_TABS", EventTypeId == 1700, "RADIUS_ATTRIBUTE_CREATED", EventTypeId == 1701, "RADIUS_ATTRIBUTE_UPDATED", EventTypeId == 1702, "RADIUS_ATTRIBUTE_DELETED", EventTypeId == 1801, "ROLE_CREATED", EventTypeId == 1802, "ROLE_DELETED", EventTypeId == 1900, "API_BRAND_CREATED", EventTypeId == 1901, "API_BRAND_CREATE_FAILED", EventTypeId == 1902, "API_BRAND_UPDATED", EventTypeId == 1903, "API_BRAND_UPDATE_FAILED", EventTypeId == 1904, "API_BRAND_DESTROYED", EventTypeId == 1905, "API_BRAND_DESTROY_FAILED", EventTypeId == 2000, "HOOKS_LIST_FUNCTION", EventTypeId == 2001, "CUSTOM_SMTP_ERROR", EventTypeId == 2002, "SMTP_SETTINGS_UPDATED", EventTypeId == 2003, "HOOKS_CREATE_FUNCTION", EventTypeId == 2004, "HOOKS_CREATE_FUNCTION_FAILED", EventTypeId == 2005, "HOOKS_GET_FUNCTION", EventTypeId == 2006, "HOOKS_GET_FUNCTION_LOGS", EventTypeId == 2007, "HOOKS_UPDATE_FUNCTION", EventTypeId == 2008, "HOOKS_UPDATE_FUNCTION_FAILED", EventTypeId == 2009, "HOOKS_DELETE_FUNCTION", EventTypeId == 2010, "HOOKS_DELETE_FUNCTION_FAILED", EventTypeId == 2011, "HOOKS_LIST_ENVVAR", EventTypeId == 2012, "HOOKS_CREATE_ENVVAR", EventTypeId == 2013, "HOOKS_CREATE_ENVVAR_FAILED", EventTypeId == 2014, "HOOKS_GET_ENVVAR", EventTypeId == 2015, "HOOKS_UPDATE_ENVVAR", EventTypeId == 2016, "HOOKS_UPDATE_ENVVAR_FAILED", EventTypeId == 2017, "HOOKS_DELETE_ENVVAR", EventTypeId == 2018, "HOOKS_DELETE_ENVVAR_FAILED", EventTypeId == 2100, "DELEGATED_PRIVILEGE_CREATED_VIA_API", EventTypeId == 2101, "DELEGATED_PRIVILEGE_CREATED_BY_USER", EventTypeId == 2102, "DELEGATED_PRIVILEGE_UPDATED_VIA_API", EventTypeId == 2103, "DELEGATED_PRIVILEGE_UPDATED_BY_USER", EventTypeId == 2104, "DELEGATED_PRIVILEGE_DELETED_VIA_API", EventTypeId == 2105, "DELEGATED_PRIVILEGE_DELETED_BY_USER", EventTypeId == 2106, "DELEGATED_PRIVILEGE_ASSIGNED_TO_USER_VIA_API", EventTypeId == 2107, "DELEGATED_PRIVILEGE_ASSIGNED_TO_USER_BY_USER", EventTypeId == 2108, "DELEGATED_PRIVILEGE_REMOVED_FROM_USER_VIA_API", EventTypeId == 2109, "DELEGATED_PRIVILEGE_REMOVED_FROM_USER_BY_USER", EventTypeId == 2110, "DELEGATED_PRIVILEGE_ASSIGNED_TO_ROLE_VIA_API", EventTypeId == 2111, "DELEGATED_PRIVILEGE_ASSIGNED_TO_ROLE_BY_USER", EventTypeId == 2112, "DELEGATED_PRIVILEGE_REMOVED_FROM_ROLE_VIA_API", EventTypeId == 2113, "DELEGATED_PRIVILEGE_REMOVED_FROM_ROLE_BY_USER", EventTypeId == 2114, "DELEGATED_ROLE_PRIVILEGE_DENIED", EventTypeId == 2201, "REPORT_CREATED_BY_USER", EventTypeId == 2202, "REPORT_UPDATED_BY_USER", EventTypeId == 2203, "REPORT_CLONED_BY_USER", EventTypeId == 2204, "REPORT_DESTROYED_BY_USER", EventTypeId == 3000, "OIDC_GENERAL_FAIL", EventTypeId == 3001, "OIDC_IMPLICIT_FLOW_SUCCESS", EventTypeId == 3002, "OIDC_IMPLICIT_FLOW_FAILED", EventTypeId == 3003, "OIDC_GET_CODE_SUCCESS", EventTypeId == 3004, "OIDC_GET_CODE_FAILED", EventTypeId == 3005, "OIDC_AUTHORIZATION_CODE_SUCCESS", EventTypeId == 3006, "OIDC_AUTHORIZATION_CODE_FAILED", EventTypeId == 3007, "OIDC_CLIENT_CREDENTIALS_SUCCESS", EventTypeId == 3008, "OIDC_CLIENT_CREDENTIALS_FAILED", EventTypeId == 3009, "OIDC_PASSWORD_SUCCESS", EventTypeId == 3010, "OIDC_PASSWORD_FAILED", EventTypeId == 3011, "OIDC_REFRESH_TOKEN_SUCCESS", EventTypeId == 3012, "OIDC_REFRESH_TOKEN_FAILED", EventTypeId == 3013, "OIDC_VALIDATE_TOKEN_SUCCESS", EventTypeId == 3014, "OIDC_VALIDATE_TOKEN_FAILED", EventTypeId == 3015, "OIDC_REVOKE_TOKEN_SUCCESS", EventTypeId == 3016, "OIDC_REVOKE_TOKEN_FAILED", EventTypeId == 3017, "OIDC_USER_INFO_SUCCESS", EventTypeId == 3018, "OIDC_USER_INFO_FAILED", EventTypeId == 3019, "NOTIFICATION_WAS_SENT", EventTypeId == 3020, "GROUP_CREATED", EventTypeId == 3021, "GROUP_UPDATED", EventTypeId == 3022, "GROUP_DESTROYED", EventTypeId == 3023, "USER_CREATED_NOTE", EventTypeId == 3024, "DELEGATED_GROUP_PRIVILEGE_DENIED", EventTypeId == 3025, "DELEGATED_POLICY_PRIVILEGE_DENIED", EventTypeId == 3026, "PROFILE_DEVICES_UNSET_DEFAULT", EventTypeId == 3027, "DELEGATED_REPORT_PRIVILEGE_DENIED", EventTypeId == 9000, "USER_ENABLED_WORKFLOW", EventTypeId == 9001, "USER_DISABLED_WORKFLOW", EventTypeId == 9002, "USER_INITIATED_WORKFLOW", EventTypeId == 9003, "USER_COMPLETED_TASK", EventTypeId == 9004, "USER_MARKED_TASK_COMPLETE", EventTypeId == 9005, "USER_MARKED_WORKFLOW_COMPLETE", EventTypeId == 9006, "USER_MARKED_TASK_INCOMPLETE", EventTypeId == 9007, "USER_ENABLED_ONBOARDING", EventTypeId == 9008, "USER_DISABLED_ONBOARDING", EventTypeId == 9009, "USER_ENABLED_OFFBOARDING", EventTypeId == 9010, "USER_DISABLED_OFFBOARDING", EventTypeId == 9011, "USER_INITIATED_OFFBOARDING", EventTypeId == 9012, "USER_INITIATED_ONBOARDING", EventTypeId == 9013, "USER_COMPLETED_WORKFLOW", EventTypeId == 9014, "APP_RULES_LIST_SUCCESS", EventTypeId == 9015, "APP_RULES_LIST_FAILED", EventTypeId == 9016, "APP_RULES_CREATE_SUCCESS", EventTypeId == 9017, "APP_RULES_CREATE_FAILED", EventTypeId == 9018, "APP_RULES_UPDATE_SUCCESS", EventTypeId == 9019, "APP_RULES_UPDATE_FAILED", EventTypeId == 9020, "APP_RULES_GET_SUCCESS", EventTypeId == 9021, "APP_RULES_GET_FAILED", EventTypeId == 9022, "APP_RULES_DRYRUN_SUCCESS", EventTypeId == 9023, "APP_RULES_DRYRUN_FAILED", EventTypeId == 9024, "APP_RULES_DELETE_SUCCESS", EventTypeId == 9025, "APP_RULES_DELETE_FAILED", EventTypeId == 9026, "APP_RULES_SORT_SUCCESS", EventTypeId == 9027, "APP_RULES_SORT_FAILED", EventTypeId == 9028, "APP_RULES_APPLY_SUCCESS", EventTypeId == 9029, "APP_RULES_APPLY_FAILED", EventTypeId == 9030, "APP_RULES_REFRESH_ENTITLEMENTS_SUCCESS", EventTypeId == 9031, "APP_RULES_REFRESH_ENTITLEMENTS_FAILED", EventTypeId == 9032, "APP_RULES_LIST_CONDITIONS_SUCCESS", EventTypeId == 9033, "APP_RULES_LIST_CONDITIONS_FAILED", EventTypeId == 9034, "APP_RULES_LIST_CONDITION_OPERATORS_SUCCESS", EventTypeId == 9035, "APP_RULES_LIST_CONDITION_OPERATORS_FAILED", EventTypeId == 9036, "APP_RULES_LIST_ACTIONS_SUCCESS", EventTypeId == 9037, "APP_RULES_LIST_ACTIONS_FAILED", EventTypeId == 9038, "APP_RULES_LIST_ACTION_VALUES_SUCCESS", EventTypeId == 9039, "APP_RULES_LIST_ACTION_VALUES_FAILED", EventTypeId == 9040, "USER_ROLE_MANAGEMENT_GRANTED_FAILED", EventTypeId == 9041, "USER_ROLE_MANAGEMENT_REVOKED_FAILED", EventTypeId == 9042, "APP_ADDED_TO_ROLE_FAILED", EventTypeId == 9043, "APP_REMOVED_FROM_ROLE_FAILED", EventTypeId == 9044, "USER_MANUALLY_ADDED_TO_ROLE_FAILED", EventTypeId == 9045, "USER_MANUALLY_REMOVED_FROM_ROLE_FAILED", EventTypeId == 9046, "ROLE_CREATE_FAILED", EventTypeId == 9047, "ROLE_DELETE_FAILED", EventTypeId == 9048, "ROLE_LIST_SUCCESS", EventTypeId == 9049, "ROLE_LIST_FAILED", EventTypeId == 9050, "ROLE_GET_SUCCESS", EventTypeId == 9051, "ROLE_GET_FAILED", EventTypeId == 9052, "ROLE_UPDATE_SUCCESS", EventTypeId == 9053, "ROLE_UPDATE_FAILED", EventTypeId == 9054, "ROLE_LIST_APPS_SUCCESS", EventTypeId == 9055, "ROLE_LIST_APPS_FAILED", EventTypeId == 9056, "ROLE_LIST_USERS_SUCCESS", EventTypeId == 9057, "ROLE_LIST_USERS_FAILED", EventTypeId == 9058, "ROLE_LIST_ADMINISTRATORS_SUCCESS", EventTypeId == 9059, "ROLE_LIST_ADMINISTRATORS_FAILED", "" )