Audit Event Types Reference

Every security-relevant action in Athena is written to the audit trail as an event with a stable event type — a short identifier like LoginFailure, AgentRevoked, or DeploymentExecuted. This page is the catalog of those event types, grouped by area and tagged with the severity Athena assigns. Use it to build SIEM correlation rules and alerts, to decide what to watch for, and to filter the audit log to exactly the activity you care about.

Anatomy of an event#

Beyond the event type, each audit record carries a consistent set of fields. These are the fields you filter, group, and correlate on in a SIEM:

For how those fields map onto the wire when forwarding to a collector (RFC 5424, RFC 3164, CEF, or JSON), see Message formats.

Severity levels#

Athena assigns each event one of these severities. Failures are generally escalated above their success counterpart — a successful login is Information, a failed one is Warning. In the audit view and in the PowerShell and REST filters, a severity filter is a minimum: choosing Warning returns Warning, Error, and Critical.

The event catalog#

The tables below list the event types Athena records, by area. Severity is the level assigned when the event is written; where an action has both a success and a failure form, both are shown.

Authentication & sessions#

Users & access#

Agents & certificates#

Agent binaries#

Deployments, commands & jobs#

Compliance, scans & reports#

Tagging rules, monitors & alerts#

Collections & credentials#

Registration tokens#

Settings sync#

With Settings Sync, the sending server records the push and the receiving server records what it did with it — so look on both sides.

Remote sessions & recordings#

RustDesk remote access#

The RustDesk session events mirror the screen-share ones above, so a SIEM rule written for one remote path can be extended to the other.

Remote file browser#

Every action taken in the remote file browser on an agent is recorded. Reads are Information; anything that changes the endpoint's file system is Warning.

Server, database & security#

System health & metrics#

These events cover the System Health view and the optional /metrics scrape token. They are recorded with the resource type Metrics, and the Action field shows how each one happened.

Licensing#

These events give you a durable record of every license change and every operation the license refused.

Module event types#

Optional modules add their own event types to the catalog, and they appear in the Audit Log filter only when the module is present. The console shows each with a friendly name; the stored identifier is the one below. See each module's page for severities and details.

No BitLocker event ever contains a recovery password or PIN — a reveal row records who, which machine and volume, and the reason given, never the value.

For Power Management, only power.apply-requested records a change actually sent to a machine. Policy, assignment and switch events record the desired state only. Both switches write power.enforcement-toggled at Warning severity, and the resource id shows which one changed (EnforcementEnabled or AutoConvergeEnabled). Applies started automatically are recorded under the user name power.autoconverge rather than an operator's name. power.apply-incomplete is written once per result, never once per setting.

Filtering by event type#

In the console, open Audit Log and use the Event Type and Severity filters to narrow the view — for example, show only LoginFailure at Warning and above over the last day. The audit view populates its event-type list from the server, so it always matches your build.

The list offers every event type the server can write — including module types — plus any other type actually found in your stored audit history (for example a legacy type from an older version). A type that has never occurred is still offered, so you can confirm that something never happened. In the list, identifiers are spaced out for readability — AlertDeleted shows as Alert Deleted and FileBrowser.FileRead as File Browser: File Read — but filters, exports, and SIEM rules always use the exact identifier, which is never translated.

To get the same list programmatically, call the catalog endpoint. The optional fromDate / toDate parameters limit the range searched for observed types:

GET api/Audit/event-types
GET api/Audit/event-types?fromDate=2026-01-01

From PowerShell, Get-AthenaAuditEventTypes returns the same list:

# Every event type related to the remote file browser
Get-AthenaAuditEventTypes | Where-Object { $_ -like "FileBrowser.*" }

Filtering from PowerShell#

The PowerShell module queries the same trail. Filter by event type, severity, actor, text, and date range:

# Failed logins in the last 24 hours
Get-AthenaAudit -EventType "LoginFailure" -StartDate (Get-Date).AddDays(-1)

# Everything at Warning severity or above this week, all pages
Get-AthenaAudit -Severity Warning -StartDate (Get-Date).AddDays(-7) -All

# Deployment activity for a specific operator
Get-AthenaAudit -Username "jsmith" -Search "deployment"

-Severity is a minimum, mirroring the console. -StartDate and -EndDate also accept the -FromDate / -ToDate aliases. Add -All to page through every match instead of a single page.

Filtering over the REST API#

The same filters are available on the read API. Every audit endpoint requires the audit.view permission (see Permission Model) — reading the trail does not require any right to change settings.

For the on-disk file locations, the audit providers, and how to forward this trail to a SIEM, see Audit & SIEM and Audit Forwarding to SIEM.

Related#

• Audit & SIEM — the audit trail, its providers, and how to query it.
• Audit Forwarding to SIEM — stream these events to a syslog collector or SIEM.
• Roles & Permissions — who can read the audit trail.
• Security Settings — lockout, session, and password controls that generate many of these events.
• System Health & Prometheus Metrics — the System Health view and the /metrics scrape token behind the metrics events.
• PowerShell Module — automate audit queries and exports.