Audit Event Types Reference

Every security-relevant action in Athena is written to the audit trail as an event with a stable event type — a short identifier like LoginFailure, AgentRevoked, or DeploymentExecuted. This page is the catalog of those event types, grouped by area and tagged with the severity Athena assigns. Use it to build SIEM correlation rules and alerts, to decide what to watch for, and to filter the audit log to exactly the activity you care about.

Anatomy of an event#

Beyond the event type, each audit record carries a consistent set of fields. These are the fields you filter, group, and correlate on in a SIEM:

For how those fields map onto the wire when forwarding to a collector (RFC 5424, RFC 3164, CEF, or JSON), see Message formats.

Severity levels#

Athena assigns each event one of these severities. Failures are generally escalated above their success counterpart — a successful login is Information, a failed one is Warning. In the audit view and in the PowerShell and REST filters, a severity filter is a minimum: choosing Warning returns Warning, Error, and Critical.

The event catalog#

The tables below list the event types Athena records, by area. Severity is the level assigned when the event is written; where an action has both a success and a failure form, both are shown.

Authentication & sessions#

Users & access#

Agents & certificates#

Agent binaries#

Deployments, commands & jobs#

Compliance & scans#

Collections & credentials#

Registration tokens#

Remote sessions & recordings#

Server, database & security#

Filtering by event type#

In the console, open Audit Log and use the Event Type and Severity filters to narrow the view — for example, show only LoginFailure at Warning and above over the last day. The audit view populates its event-type list from the server, so it always matches your build.

To discover the commonly filtered event types programmatically, call the catalog endpoint:

GET api/Audit/event-types

This returns the frequently used event types (logins, user and role changes, agent registration and revocation, deployments, commands, scheduled jobs, settings changes, and server start/stop). The full set that can appear in the log is broader — everything catalogued on this page — because any recorded action carries its own type.

Filtering from PowerShell#

The PowerShell module queries the same trail. Filter by event type, severity, actor, text, and date range:

# Failed logins in the last 24 hours
Get-AthenaAudit -EventType "LoginFailure" -StartDate (Get-Date).AddDays(-1)

# Everything at Warning severity or above this week, all pages
Get-AthenaAudit -Severity Warning -StartDate (Get-Date).AddDays(-7) -All

# Deployment activity for a specific operator
Get-AthenaAudit -Username "jsmith" -Search "deployment"

-Severity is a minimum, mirroring the console. -StartDate and -EndDate also accept the -FromDate / -ToDate aliases. Add -All to page through every match instead of a single page.

Filtering over the REST API#

The same filters are available on the read API. Both endpoints require at least the Helpdesk role.

For the on-disk file locations, the audit providers, and how to forward this trail to a SIEM, see Audit & SIEM and Audit Forwarding to SIEM.

Related#

• Audit & SIEM — the audit trail, its providers, and how to query it.
• Audit Forwarding to SIEM — stream these events to a syslog collector or SIEM.
• Roles & Permissions — who can read the audit trail.
• Security Settings — lockout, session, and password controls that generate many of these events.
• PowerShell Module — automate audit queries and exports.