MOVEit Transfer can be configured to automatically send audit events the Windows Event Log or a syslog endpoint. This allows audit events to be ingested by log aggregation tools or SIEM tools such as Splunk, Elastic or Microsoft Sentinel. See System - Auditing for instructions on configuring Event Log and syslog settings. When Event Log or syslog output is enabled, audit events will continue to be stored in the MOVEit Transfer database.

Standard Output Fields

The following table describes the standard output fields that may appear in Event Log or syslog output. Conditional fields appear only when populated, except when there is a documented default.

Table 1. Audit Log Fields
Field Description
ID Inserted audit record ID.
InstID Organization/institution ID.
Username Actor login name.
RealName Actor's resolved display name in the formatted header.
Action Exact audit action string.
IPAddress Originating client address.
FileID ID of the affected file.
FileName Name of the affected file.
FolderID ID of the affected functional folder; normalized to 0 when none.
FolderPath Path of the affected functional folder.
VirtualFolderID ID of the affected virtual folder; emitted when different from the functional folder ID.
VirtualFolderPath Path of the affected virtual folder; emitted when different from the functional folder path.
TargetID ID of the affected target entity.
TargetName Name of the affected target entity.
AgentBrand Client or service brand; may be inherited, browser-detected, or None for internal automation.
AgentVersion Client or service version.
XFerSize Transferred byte count; defaults to 0.
Duration Elapsed seconds for actions that supply it.
Error Numeric result/error code.
Message Detail or error text when supplied.

Audit Log Action Description

The following table describes audit log actions and action-specific parameter fields (Parm1, Parm2, ParmN).

Table 2. Audit log actions and action-specific parameter fields

Category

Audit action

Description

Parameters

File

file_addasattch

File added as an attachment to a secure message package.

 None

File

file_cleardlp

Data Loss Prevention (DLP) tags cleared from the file.

Parm1: original filename of the file whose DLP violations were cleared

Parm2: containing folder display name; the verbose stylesheet uses it as the folder text when FolderPath is empty

Parm3: the cleared DLP violation or policy-name text

File

file_copyto

File copied to its destination folder.

Parm1: destination folder ID; source folder ID in the legacy layout

Parm2: ID assigned to the copied destination file

Parm3: destination folder path in the current layout

Parm4: literal attachment when the destination is the global-message attachment store; otherwise empty

File

file_copyfrom

File copied from its source folder.

Parm1: source folder ID; destination folder ID in the legacy layout

Parm2: ID of the original source file

Parm3: source folder path in the current layout

Parm4: literal attachment when the source is the global-message attachment store; otherwise empty

File

file_delete

File deleted from its folder.

Parm1: deleted file's original filename

Parm2: containing folder name; message archival uses the Messages system-folder name

File

file_deleteID

File record and content permanently purged.

—

File

file_download

File downloaded from MOVEit Transfer.

Parm1: DLP violation or policy-name text associated with the downloaded file

Parm2: parent package or parent file ID recorded for message-related downloads

Parm3: literal y when download integrity was verified; otherwise empty

Parm4: zip for a ZIP download, public-link token ID, or FileReadRaw numeric output format

File

file_dlhashchk

Downloaded file verified against its stored hash.

Parm1: audit-log ID of the earlier file_download record being checked

Parm2: logTime timestamp of that earlier file_download record

Parm3: integrity-verification marker from the referenced download record, normally y or empty

File

file_mknew

File marked as new for the user.

Parm1: username for whom the file was marked new

Parm2: target user's real or display name

File

file_mknotnew

File's new status cleared for the user.

Parm1: username for whom the file's new marker was cleared

Parm2: target user's real or display name

File

file_moveto

File moved to its destination folder.

Parm1: destination folder ID

Parm3: destination folder path in the current layout; empty in the older layout

File

file_movefrom

File moved from its source folder.

Parm1: source folder ID

Parm3: source folder path in the current layout; empty in the older layout

File

file_rename

File renamed.

Parm1: filename before the rename

Parm2: filename after the rename

File

file_upload

File uploaded into a folder.

Parm1: original filename, especially the display value used when an upload failed before a usable FileID existed

Parm2: literal attachment for a message-attachment upload; otherwise empty

Parm3: literal y when upload integrity was verified; otherwise empty

Parm4: DLP violation or policy-name text detected during the upload

File

file_view

File viewed in the web interface.

—

File

file_webpost

File submitted through a web-post form.

Parm2: original submitted filename on the direct failed-webpost path

Parm3: literal y when integrity was verified on the dynamic FileWrite path; otherwise empty

File

file_sendMDN

Message Disposition Notification sent for the file.

 none

File

file_sentemail

Email notification sent concerning the file.

Parm1: notification recipient username; blank on test notifications and some webpost confirmations

Parm2: notification recipient email address

Parm3: recipient classification: sender, recipient, or literal TEST for a custom-notification test

Parm4: notification type: 1 upload confirmation, 2 webpost confirmation, 11 new-file, 12 new-webpost, 13 new-message notification, 21 delivery receipt, or 23 non-delivery alert

File

file_avfail

Antivirus server failure recorded while scanning the file.

Parm4: content-scanner or antivirus server error text

File

file_listdownlds

File's download history listed.

none

File

file_plinkcreate

Public link created for the file.

Parm1: new public-link token ID; empty when creation fails before an ID is produced

File

file_plinkdelete

Public link deleted for the file.

Parm1: public-link token ID requested for deletion, including failed deletion attempts

Folder

folder_add

Folder created.

Parm1: new folder's base name

Parm2: new folder's functional path

Folder

folder_addvirt

Virtual folder created.

Parm1: new virtual folder's name

Parm2: new virtual folder's path

Parm3: target folder ID

Parm4: target folder path

Folder

folder_addgrp

Group permission granted on the folder.

Parm1: group ID granted folder permission

Parm2: group name

Folder

folder_adduser

User permission granted on the folder.

Parm1: username granted folder permission

Parm2: that user's real or display name

Folder

folder_copyfrom

Folder copied from its source location.

Parm1: functional source folder ID

Parm2: functional source folder path

Parm3: original or virtual source folder ID before functional-folder resolution

Parm4: original or virtual source folder path before functional-folder resolution

Folder

folder_copyto

Folder copied to its destination location.

Parm1: functional destination folder ID

Parm2: functional destination folder path

Parm3: ID assigned to the newly copied folder

Parm4: path assigned to the newly copied folder

Folder

folder_delete

Folder deleted.

Parm1: deleted folder's name

Parm2: deleted folder's functional path

Folder

folder_purge

Folder and its retained content permanently purged.

Parm1: purged folder's name

Parm2: purged folder's path captured before permanent removal

Folder

folder_delgrp

Group's permission removed from the folder.

Parm1: group ID whose folder permission was removed

Parm2: group name

Folder

folder_deluser

User's permission removed from the folder.

Parm1: username whose folder permission was removed

Parm2: that user's resolved real or display name

Folder

folder_emailnote

Email notification sent concerning the folder.

Parm1: username receiving the new-file folder notification

Folder

folder_movefrom

Folder moved from its source location.

Parm1: functional source folder ID

Parm2: functional source folder path

Folder

folder_moveto

Folder moved to its destination location.

Parm1: functional destination folder ID

Parm2: functional destination folder path

Folder

folder_xinherit

Folder's permission inheritance from its parent changed.

Parm1: boolean inheritance state encoded as 1 for enabled or 0 for disabled

Folder

folder_xkeys

Encryption keys associated with the folder changed.

none

Folder

folder_xvtarget

Virtual folder's target changed.

Parm1: new target folder ID

Parm2: new target folder path

Folder

folder_xmasks

File masks applied to the folder changed.

Parm1: folder file-mask expression or mask list

Parm2: mask rule: 0 means allow matching names and 1 means deny matching names

Folder

folder_xsetting

One folder setting changed.

Parm1: name of the folder setting changed

Parm2: new value assigned to that setting

Folder

folder_xsettings

Multiple folder settings changed.

Parm1: operation label: folder banner clear or folder banner save

Folder

folder_xcharset

File and folder name restrictions changed for the folder.

Parm1: name-restriction mode: 0 none; 1 NTFS restrictions; 2 custom disallow list; 3 custom allow list

Org

inst_acceptcert

User certificate accepted for the organization.

Parm2: certificate entry ID

Org

inst_add

Organization created.

Parm1: new organization ID

Parm2: organization name

Org

inst_delete

Organization deleted.

Parm1: organization ID

Parm2: organization name

Org

inst_addauthsrc

Authentication source added to the organization.

Parm1: authentication source type: 1 RADIUS or 2 LDAP

Parm3: authentication source ID

Parm4: authentication source name

Org

inst_enblauthsrc

Organization authentication source enabled.

No current Event Log or syslog output; no production call site found.

Org

inst_delauthsrc

Organization authentication source deleted.

Parm1: authentication source ID

Parm2: authentication source name

Org

inst_addcert

Certificate added to the organization.

Parm1: CA certificate common name

Org

inst_delsslcert

SSL certificate deleted from the organization.

Parm1: certificate ID

Parm2: certificate data type

Parm4: certificate type: 3 holding tank

Org

inst_disprofadd

Display profile added to the organization.

Parm1: display profile ID

Parm2: display profile name

Org

inst_disprofdel

Organization display profile deleted.

Parm1: display profile ID

Parm2: display profile name

Org

inst_disprofedit

Organization display profile edited.

Parm1: display profile ID

Parm2: display profile name

Org

inst_dlprlstadd

DLP ruleset added to the organization.

Parm1: DLP ruleset ID

Parm2: DLP ruleset name

Parm3: default action: 0 allow, 1 log, 2 quarantine, 3 block

Org

inst_dlprlstdel

Organization DLP ruleset deleted.

Parm1: DLP ruleset ID

Parm2: DLP ruleset name

Parm3: number of affected users reset to the class default

Org

inst_dlprlstedit

Organization DLP ruleset edited.

Parm1: DLP ruleset ID

Parm2: DLP ruleset name

Parm3: default action: 0 allow, 1 log, 2 quarantine, 3 block

Org

inst_dlpruleadd

Rule added to an organization DLP ruleset.

Parm1: DLP ruleset ID

Parm2: DLP ruleset name

Parm3: DLP rule ID

Org

inst_dlpruledel

Rule deleted from an organization DLP ruleset.

Parm1: DLP ruleset ID

Parm2: DLP ruleset name

Parm3: DLP rule ID

Org

inst_dlpruleedit

Rule in an organization DLP ruleset edited.

Parm1: DLP ruleset ID

Parm2: DLP ruleset name

Parm3: DLP rule ID

Org

inst_xdlprlsts

Default DLP ruleset changed for an organization user class.

Parm1: user class: 30 admins, 20 file admins, 14 audit users, 10 end users, 6 temporary users and guests

Parm2: default DLP ruleset ID or 0 for none

Parm3: DLP ruleset name

Parm4: apply to all users: 0 false or 1 true

Org

inst_exppoladd

Expiration policy added to the organization.

Parm1: expiration policy ID

Parm2: expiration policy name

Org

inst_exppoldel

Organization expiration policy deleted.

Parm1: expiration policy ID

Parm2: expiration policy name

Parm3: number of affected users reset to the class default

Org

inst_exppoledit

Organization expiration policy edited.

Parm1: expiration policy ID

Parm2: expiration policy name

Org

inst_passpoladd

Password policy added to the organization.

Parm1: password policy ID

Parm2: password policy name

Org

inst_passpoldel

Organization password policy deleted.

Parm1: password policy ID

Parm2: password policy name

Parm3: number of affected users reset to the class default

Org

inst_passpoledit

Organization password policy edited.

Parm1: password policy ID

Parm2: password policy name

Org

inst_iplock

Organization's IP lockout configuration changed.

Parm1: locked or reallowed IP address

Parm2: state: lockedout or reallowed

Parm3: attempted login name for an automatic lockout

Parm4: host name for an automatic lockout

Org

inst_notifyadd

Custom notification added to the organization.

Parm1: custom notification ID

Parm2: custom notification name

Org

inst_notifyedit

Organization custom notification edited.

Parm1: custom notification ID

Parm2: custom notification name

Org

inst_notifyclone

Organization custom notification cloned.

Parm1: source custom notification ID

Parm2: source custom notification name

Parm3: new custom notification ID

Parm4: new custom notification name

Org

inst_notifydel

Organization custom notification deleted.

Parm1: custom notification ID

Parm2: custom notification name

Org

inst_reportadd

Report definition added to the organization.

Parm1: report ID

Parm2: report title

Org

inst_reportdel

Organization report definition deleted.

Parm1: report ID

Parm2: report name

Org

inst_reportedit

Organization report definition edited.

Parm1: report ID

Parm2: report name

Org

inst_reportrun

Organization report run.

Parm1: report ID

Parm2: report name

Org

inst_rptruncust

Custom report run for the organization.

—

Org

inst_smladdcert

SAML certificate added to the organization.

Parm1: SAML certificate ID

Parm2: certificate subject

Parm3: certificate type: 10 SP signing, 11 SP encryption, otherwise generic SAML

Org

inst_smldelcert

Organization SAML certificate deleted.

Parm1: SAML certificate ID

Parm2: certificate subject

Parm3: certificate type: 10 SP signing, 11 SP encryption, otherwise generic SAML

Org

inst_smlenblacs

SAML assertion consumer service enabled for the organization.

Parm1: binding type: 1 HTTP-Post or 3 HTTP-Artifact

Parm2: enabled: 0 false or 1 true

Org

inst_smlordracs

Priority order of SAML assertion consumer services changed.

Parm1: binding type: 1 HTTP-Post or 3 HTTP-Artifact

Parm2: new ordering index

Org

inst_smlenblslos

SAML single logout service enabled for the organization.

Parm1: binding type: 1 HTTP-Post or 2 HTTP-Redirect

Parm2: enabled: 0 false or 1 true

Org

inst_fedaddidp

Federated identity provider added to the organization.

Parm1: identity provider ID

Parm2: SAML entity ID or OIDC display name

Parm3: metadata URL or OIDC authority URL

Org

inst_feddelidp

Organization federated identity provider deleted.

Parm1: identity provider ID

Parm2: identity provider name

Org

inst_fedxidp

Organization federated identity provider changed.

Parm1: identity provider ID

Parm2: new identity provider name

Parm3: SAML enabled value or literal OIDC

Org

inst_fedxidpsvcs

SAML services changed for a federated identity provider.

Parm1: identity provider ID

Parm2: identity provider name

Parm3: SSO binding type: 1 HTTP-Post, 2 HTTP-Redirect, 3 HTTP-Artifact, 4 SOAP

Parm4: SLO binding type: 1 HTTP-Post, 2 HTTP-Redirect, 3 HTTP-Artifact, 4 SOAP, or None

Org

inst_fedxidpusr

User settings changed for a federated identity provider.

Parm1: identity provider ID

Parm2: identity provider name

Org

inst_fedxidpgrp

Group settings changed for a federated identity provider.

Parm1: identity provider ID

Parm2: identity provider name

Org

inst_fedordidp

Priority order of federated identity providers changed.

Parm1: identity provider ID

Parm2: identity provider name

Parm3: new priority

Org

inst_fedupdidp

Federated identity provider updated from its metadata.

Parm1: identity provider ID

Parm2: identity provider name

Parm3: metadata URL when URL-based

Org

inst_fedupdsts

Security token service updated for a federated identity provider.

Parm1: identity provider ID

Parm2: identity provider name

Parm3: STS metadata URL when URL-based

Org

inst_smlxauthmd

Organization's single sign-on authentication mode changed.

Parm1: SSO authentication mode: 0 optional, 1 required, otherwise the supplied raw mode

Org

inst_xaddrbooks

Organization's address-book policy changed.

Parm1: self-address-book policy: 0 disabled, 1 enabled for all, 2 enabled by group

Org

inst_xasgen

General settings changed for an organization authentication source.

Parm1: authentication source ID

Parm2: new authentication source name

Parm3: enabled value

Org

inst_xaspriority

Authentication-source priority changed for the organization.

Parm1: authentication source ID

Parm2: authentication source name

Parm3: new priority

Org

inst_xasldaptype

LDAP authentication source's type changed.

Parm1: authentication source ID

Parm2: authentication source name

Org

inst_xasldapuser

User settings changed for an LDAP authentication source.

Parm1: authentication source ID

Parm2: authentication source name

Org

inst_xasldapgrp

Group settings changed for an LDAP authentication source.

Parm1: authentication source ID

Parm2: authentication source name

Org

inst_xasradsets

Settings changed for a RADIUS authentication source.

Parm1: authentication source ID

Parm2: authentication source name

Org

inst_xasraduser

User settings changed for a RADIUS authentication source.

Parm1: authentication source ID

Parm2: authentication source name

Org

inst_xaswstsets

Settings changed for a WS-Trust authentication source.

Parm1: authentication source ID

Parm2: authentication source name

Parm3: endpoint binding

Org

inst_xauthmethod

Authentication methods available to the organization changed.

Parm1: authentication method code

Parm2: authentication method name

Org

inst_xkeyrotrem

Organization's encryption-key rotation reminder changed.

Parm1: key rotation reminder date

Org

inst_xbullet

Organization's displayed bullet style changed.

Parm1: stock or custom bullet type

Org

inst_xcustheader

Organization's custom page header changed.

Parm1: custom header enabled value

Org

inst_xdefault

Organization's default status changed.

Parm1: new default organization ID or none marker

Parm2: new default organization name

Org

inst_xorgpendo

Organization-level pending-operation settings changed.

Parm1: in-app notifications disabled value

Parm2: telemetry disabled value

Org

inst_xsyspendo

System pending-operation settings exposed for the organization changed.

Parm1: organization override allowed value

Org

inst_xdeffilesrt

Default file-list sort order changed for organization users.

Parm1: default file-list sort code

Org

inst_xdeffolsets

Default-folder settings assigned to organization users changed.

Parm1: chroot default folder enabled value

Parm4: apply to all end users value

Org

inst_xdefmaxatch

Default maximum message attachment size changed.

Parm1: default maximum attachment size in bytes

Parm4: apply to all users value

Org

inst_xdefmultiso

Default concurrent-signon policy changed for organization users.

Parm1: multiple signons denied value

Parm2: apply to all users value

Org

inst_xdefsshpol

Default SSH policy changed for organization users.

Parm1: apply to all users value

Org

inst_xdefftppol

Default FTP policy changed for organization users.

Parm1: apply to all users value

Org

inst_xdefftpset

Default FTP interface settings changed for organization users.

—

Org

inst_xdefhttppol

Default HTTP policy changed for organization users.

Parm1: apply to all users value

Org

inst_xdefhttpset

Default HTTP interface settings changed for organization users.

—

Org

inst_xdisprofs

Display profiles assigned to an organization user class changed.

—

Org

inst_xexppols

Default expiration policy changed for an organization user class.

Parm1: user permission class code

Parm2: expiration policy ID

Parm3: expiration policy name

Parm4: apply to current users value

Org

inst_xpasspols

Default password policy changed for an organization user class.

Parm1: user permission class code

Parm2: password policy ID

Parm3: password policy name

Parm4: apply to current users value

Org

inst_xuserexpset

User-account expiration settings changed for the organization.

Parm1: days after expiration before deletion

Parm2: delete after expiration enabled value

Org

inst_xgrpgasets

Default group-administrator settings changed.

Parm1: apply to existing groups value

Org

inst_xgrpmemsets

Default group-member settings changed.

Parm1: apply to existing groups value

Org

inst_xholdtank

Organization's holding-tank settings changed.

Parm1: holding-tank retention value

Org

inst_xhomerel

Default permissions changed for organization home folders.

Parm1: home-folder permission relationship bitmask

Org

inst_xdefhpath

Default path changed for organization home folders.

Parm1: default home-folder path

Org

inst_xhostaccess

Organization's host access rule changed.

Parm1: host-permit class or trusted-host type

Org

inst_xinfo

Organization identity or contact information changed.

Parm1: organization name

Parm2: organization short name

Parm3: organization base URL

Org

inst_xipswitch

Organization's IP switching mask changed.

Parm1: IP switching prefix length

Org

inst_xrhosthead

Host-header restrictions changed for the organization.

Parm1: restrict Host header enabled value

Org

inst_xmailformat

Default email format changed for organization users.

Parm1: default email format code

Parm2: apply to all users value

Org

inst_xmaxlists

Maximum list-result counts changed for the organization.

Parm1: maximum user list count

Parm2: maximum folder list count

Org

inst_xdispformat

Display formatting changed for the organization.

Parm1: formatting locale code

Org

inst_xtdpref

Organization's time and date preferences changed.

Parm1: formatting locale code

Parm2: organization time-zone ID, empty for server time zone

Org

inst_xmetaref

Organization's browser meta-refresh behavior changed.

Parm1: meta-refresh enabled flag

Org

inst_xmotd

Organization's announcement or message of the day changed.

Parm1: organization announcement text

Org

inst_xmsg

Ad Hoc Transfer handling changed for registered senders.

Parm1: ad hoc sending mode

Parm2: self address-book mode

Parm3: unregistered-recipient sending mode

Org

inst_xunreg

Ad Hoc Transfer handling changed for unregistered recipients.

Parm1: unregistered-recipient handling type

Org

inst_xunregpw

Password handling changed for unregistered package recipients.

Parm1: ask recipient for password flag

Parm2: automatic password or password-link delivery mode

Parm3: separate credentials notification flag

Org

inst_xunregrule

Domain rules changed for unregistered package recipients.

Parm1: unregistered-recipient domain allow or deny rule

Parm2: unregistered-recipient domain masks

Org

inst_xunregsend

Ad Hoc Transfer handling changed for unregistered senders.

Parm1: unregistered-sender self-provisioning enabled flag

Org

inst_xunregsrule

Domain rules changed for unregistered package senders.

Parm1: recipient-domain allow or deny rule

Parm2: recipient-domain masks

Parm3: sender-domain allow or deny rule

Parm4: sender-domain masks

Org

inst_xattachment

File-attachment permission changed for Ad Hoc Transfer packages.

Parm1: attachment availability mode

Parm2: attachment file-mask allow or deny rule

Parm3: attachment file masks

Parm4: maximum files per package

Org

inst_xpkgflags

Default flags changed for Ad Hoc Transfer packages.

Parm1: default package type

Parm2: allow per-package type changes flag

Parm3: apply to all users flag

Org

inst_xahtdefquot

Default Ad Hoc Transfer package quotas changed.

Parm1: default user package-quota byte count

Parm2: default user package-quota time span

Parm3: default per-package quota byte count

Parm4: apply to all users flag

Org

inst_xav

Antivirus integration settings changed for the organization.

Parm1: anti-virus scanning enabled flag

Org

inst_xdlp

DLP integration settings changed for the organization.

Parm1: DLP scanning enabled flag

Org

inst_xmsgset

Aging and expiration rules changed for Ad Hoc Transfer packages.

Parm1: days packages remain new

Parm2: package cleanup type

Parm3: package expiration days

Parm4: archive expired packages flag

Org

inst_xmsgopts

Secure-messaging options changed for the organization.

Parm1: message-log visibility enabled flag

Parm2: administrator package-access mode

Org

inst_xnotesets

Notification settings changed for the organization.

Parm1: email-notification field bitmask

Org

inst_xnotesig

Organization's notification signature changed.

Parm1: notification signature

Org

inst_xprvntviewb

Permission to view files in a browser changed.

Parm1: prevent file viewing in browser flag

Org

inst_xlangintrfc

Language availability changed in organization interfaces.

Parm1: show language-selection page flag

Org

inst_xdeflang

Organization's default language changed.

Parm1: default language code

Org

inst_xlogo

Organization's logo changed.

Parm1: logo type

Org

inst_xpagelayout

Organization's page layout changed.

Parm1: layout width

Parm2: layout-width unit

Parm3: layout alignment

Org

inst_xpassaging

Password-aging settings changed for the organization.

—

Org

inst_xpasslength

Password-length requirements changed for the organization.

Parm1: required password length

Parm2: required password-strength level

Org

inst_xpassperms

Password-management permissions changed for the organization.

Parm1: deny users permission to change their own passwords flag

Parm2: password-change email-notification mode

Parm3: allow password-change requests flag

Parm4: password-change request maximum age

Org

inst_xrecaptcha

reCAPTCHA settings changed for organization password resets.

Parm1: reCAPTCHA required for password-reset requests flag

Org

inst_xsecqs

Security-question settings changed for organization password resets.

Parm1: security questions required for password-reset requests flag

Org

inst_xquotawarn

Storage-quota warning thresholds changed for the organization.

Parm1: quota-warning type

Parm2: quota-warning threshold value

Org

inst_xscheme

Organization's color scheme changed.

Parm1: color-scheme ID

Parm2: color-scheme name

Org

inst_xsec

Security requirements changed for the organization.

Parm1: minimum TLS client-certificate key strength

Org

inst_xsettings

Multiple organization settings changed.

Parm1: cookie-consent banner enabled flag

Parm2: cookie-consent banner title

Parm3: cookie-consent banner message

Org

inst_xexturl

Organization's externally visible URL changed.

Parm1: default external URL

Org

inst_xlogreten

Audit-log retention changed for the organization.

Parm1: audit-log retention time

Org

inst_xretaddr

Organization's notification return address changed.

Parm1: notification return address

Org

inst_xsecnotice

Organization's security notice changed.

Parm1: security-banner text

Parm2: security-notice text

Parm3: security-notice mobile visibility requirement

Parm4: security-notice acceptance text

Org

inst_xshowextras

Optional organization display settings changed.

Parm1: organization ID being changed, or negative for all organizations

Parm2: show skip-navigation link flag

Parm3: show GMT-offset statement flag

Parm4: show Powered by MOVEit link flag

Org

inst_xuserquota

Default storage quota changed for organization users.

Parm1: default user quota in bytes

Parm2: apply to all end and temporary users flag

Org

inst_xusrlockout

User lockout settings changed for the organization.

Parm1: user lockouts enabled flag

Parm2: failed sign-on count before lockout

Parm3: failed sign-on observation interval in minutes

Parm4: lockout expiration in minutes, with 0 meaning no expiration

Org

inst_xwlcmmsg

Organization's welcome message changed.

Parm1: welcome message

Org

inst_xmsgquotawa

Secure-message quota warnings changed for the organization.

Parm1: package quota warning type

Parm2: package quota warning threshold value

Org

inst_xmaxusers

Organization's maximum user count changed.

Parm1: maximum total users

Parm2: maximum end users

Parm3: maximum temporary users

Org

inst_xmsgui

Organization's secure-messaging interface changed.

Parm1: message user interface mode

Org

inst_xfullnames

Unique-full-name requirement changed for organization users.

Parm1: require unique full names flag

Org

inst_xunregadvop

Advanced options changed for unregistered package recipients.

—

Org

inst_xdefret

Default user folder-access cache retention changed.

Parm1: default user folder access cache retention time

Parm2: retention time unit

Parm3: apply to all users flag

Org

inst_xsharedret

Shared-administrator folder-access cache retention changed.

Parm1: shared admin folder access cache retention time

Parm2: retention time unit

Org

inst_xshowsql

Administrators' permission to display report SQL changed.

Parm1: allow showing SQL queries flag

Org

inst_xmfareq

Multi-factor authentication requirement changed.

Parm1: require MFA for admins flag

Parm2: require MFA for file admins flag

Parm3: require MFA for users flag

Parm4: require MFA for temporary users flag

Org

inst_xmfamethods

MFA methods available to organization users changed.

Parm1: authenticator app allowed flag

Parm2: email allowed for MFA flag

Org

inst_xmfatrust

Permission for MFA to trust a user's device changed.

Parm1: remember trusted device enabled flag

Org

inst_save

Organization's configuration saved.

—

Org

inst_xahtclsfld

Package-classification requirement changed.

Parm1: classification field required flag

Org

inst_xclstypechg

Package-classification types changed for the organization.

Parm1: classification type ID

Parm2: comma-separated localized classification values

Org

inst_xclstypedlt

Organization package-classification type deleted.

Parm1: classification type ID

Parm2: classification value

Org

inst_xclstypeswp

Organization package-classification types reordered.

Parm1: classification type ID being replaced

Parm2: replacement classification type ID

Parm3: replacement classification value

Org

inst_addclstypes

Package-classification types added to the organization.

Parm1: comma-separated added classification values

Org

org_krestimstart

Organization encryption-key rotation estimate started.

—

Org

org_krestimend

Encryption-key rotation estimate completed.

Parm1: estimated rotation duration in seconds

Org

org_krsetenckey

Organization's new encryption key set.

Parm1: new encryption key ID

Org

org_krbeginrot

Organization's encryption-key rotation begun.

Parm1: old encryption key ID

Parm2: new encryption key ID

Org

org_krpauserot

Organization's encryption-key rotation paused.

Parm1: old encryption key ID

Parm2: new encryption key ID

Org

org_krresumerot

Organization's encryption-key rotation resumed.

Parm1: old encryption key ID

Parm2: new encryption key ID

Org

org_krschedstop

Encryption-key rotation paused according to its schedule.

Parm1: old encryption key ID

Parm2: new encryption key ID

Org

org_krschedstart

Encryption-key rotation resumed according to its schedule.

Parm1: old encryption key ID

Parm2: new encryption key ID

Org

org_krsetsched

Organization's encryption-key rotation schedule set.

Parm1: old encryption key ID

Parm2: new encryption key ID

Org

org_krendrot

Organization's encryption-key rotation completed.

Parm1: old encryption key ID

Parm2: new encryption key ID

Org

org_exttknpvdadd

External token provider added to the organization.

Parm1: external token provider name

Parm2: external token provider URL

Org

org_exttknpvdmod

Organization external token provider changed.

Parm1: external token provider name

Parm2: external token provider URL

Org

org_exttknpvddel

Organization external token provider deleted.

Parm1: external token provider URL

Org

org_xenablmngcrt

Organization certificate-management enablement changed.

Parm1: organization certificate management enabled flag

Parm2: automatic certificate approval enabled flag

Org

org_xupldorgcrt

Certificate uploaded for the organization.

Parm1: target organization ID

Org

org_xdltorgcrt

Certificate belonging to the organization deleted.

Parm1: target organization ID

Org

org_xapprvorgcrt

Organization certificate approved.

—

Org

org_xrjctorgcrt

Organization certificate rejected.

Parm1: certificate rejection reason

Org

org_exportorgcrt

Organization certificate exported.

—

Org

org_exportlogs

Logs scoped to the organization exported.

Parm1: exported log file name

Org

org_xfileaging

File-age notification settings changed for the organization.

Parm1: maximum file age in days

Parm2: email notifications enabled flag

Parm3: exclude archive folders flag

Org

org_xaiconfig

Organization's AI configuration changed.

Parm1: AI integration enabled flag

Parm2: AI model type

Parm3: AI model name

Parm4: AI endpoint URL

Org

org_delaiconfig

Organization's AI configuration deleted.

Parm1: successful deletion confirmation text

Message

msg_post

Secure message package posted.

Parm1: package operation: empty for new, reply, replyall, forward, resend, or request for file request

Parm2: parent package ID; 0 or empty when the post has no parent

Parm4: package-level DLP violation or policy-name text

Message

msg_read

Secure message package read.

Parm3: literal y when package integrity was verified; otherwise empty

Parm4: package-level DLP violation or policy-name text

Message

msg_recall

Previously posted secure message package recalled.

—

Message

msg_attchfile

File attached to a secure message package.

Parm1: attachment-level DLP violation or policy-name text

Parm2: literal attachment, identifying the file as a package attachment

Parm3: literal y when attachment upload integrity was verified; otherwise empty

Parm4: ID of the package to which the file was attached

Message

msg_cleardlp

DLP tags cleared from a secure message package.

Parm1: package-level DLP violation or policy-name text that was cleared

Message

msg_clrattchdlp

DLP tags cleared from a package attachment.

Parm1: attachment-level DLP violation or policy-name text that was cleared

Parm2: ID of the parent package containing the attachment

Message

msg_posttouser

Secure message package posted to a user.

Parm1: recipient role: Role_TO for a To recipient, Role_CC for a Cc recipient, or Role_BCC for a Bcc recipient

Scheme

scheme_add

User-interface color scheme created.

Parm1: scheme name

Parm2: new scheme ID

Scheme

scheme_rename

User-interface color scheme renamed.

Parm1: scheme ID

Parm2: old scheme name

Parm3: new scheme name

Scheme

scheme_update

User-interface color scheme updated.

Parm1: scheme ID

Parm2: scheme name

Scheme

scheme_delete

User-interface color scheme deleted.

Parm1: scheme ID

Parm2: scheme name

Security

sec_checklog

Audit-log tamper check run.

—

Security

sec_resetlog

Audit-log tamper-check state reset.

—

Security

sec_viewlog

Audit log viewed.

Parm1: audit query text

Parm2: result page number

Security

sec_viewlogentry

Individual audit-log entry viewed.

Parm1: viewed audit record ID

Security

sec_instadm

Organization-administrator security context entered.

Parm1: organization ID entered

Parm2: organization name entered

Security

sec_signoff

Authenticated user session ended.

—

Security

sec_signon

User authenticated and session started.

Parm1: interface name on interface precheck failures

Security

sec_sshkeyauth

User authenticated with an SSH public key.

No current Event Log or syslog output; no production call site found.

Security

sec_sslcertauth

User authenticated with a client certificate.

Parm1: certificate thumbprint

Parm2: certificate subject common name

Parm3: certificate issuer common name

Security

sec_sysadm

System-administrator security context entered.

—

Security

sec_guestpkgauth

Guest recipient authenticated to a secure package.

Parm2: lockout status marker

Security

sec_selfreg

New user registered through self-registration.

—

Security

sec_noticeaccept

User's acceptance of the security notice recorded.

Parm1: accepted user field name SecNoticeAcceptanceStamp

Sys

sys_xtamper

System-wide audit tamper-check settings changed.

Parm1: tamper detection enabled value

Sys

sys_xdebuglvl

System debug-logging level changed.

Parm1: Core debug level

Parm2: FTP debug level

Parm3: SSH debug level

Sys

sys_xbaseurl

Server's base URL changed.

Parm1: new system base URL

Sys

sys_xbaseemail

Server's base email address changed.

Parm1: default From address

Parm2: error-recipient address

Sys

sys_xeventlog

Windows event-log integration settings changed.

Parm1: Windows Event Log enabled value

Parm2: Windows event source name

Sys

sys_xsyslog

System syslog integration settings changed.

Parm1: syslog enabled value

Parm2: syslog host

Parm3: syslog port

Parm4: syslog facility

Sys

sys_xiplockout

System-wide IP lockout settings changed.

Parm1: IP lockout enabled value

Parm2: failed-attempt threshold in the time window

Parm3: time window in minutes

Sys

sys_xuniqusrname

Cross-organization login-name uniqueness requirement changed.

Parm1: unique login names enabled value

Sys

sys_xshowerrors

System error display changed.

Parm1: system error display enabled value

Sys

sys_xsiteminder

System SiteMinder integration settings changed.

Parm1: SiteMinder integration enabled value

Sys

sys_xsecheaders

HTTP security headers emitted by the server changed.

Parm1: enabled header abbreviations or None

Sys

sys_xlogxbadsign

Logging of extraneous failed signon attempts changed.

Parm1: logging of insecure FTP failed signons enabled value

Sys

debug_download

System debug log downloaded.

—

Sys

sys_xcscan

System content-scanning settings changed.

Parm1: content scanner enabled value

Parm2: content scanner ID

Parm3: content scanner name

Parm4: content scanner URL

Sys

sys_cscandel

System content-scan record deleted.

Parm1: deleted content scanner ID

Sys

inst_xprvntsglog

Protection against disabling signon logging changed.

Parm1: PreventChangeSignonLogging value, 0 means protection enabled

Sys

noop

Deliberate no-operation system action recorded.

No current Event Log or syslog output; hash-reset sentinel bypasses audit output.

Sys

inst_xchpswreset

Organization administrators' password-reset permission changed.

Parm1: organization administrators may reset their passwords value

Sys

inst_xserialnum

Organization's assigned serial number changed.

Parm1: new serial number or suppressed failure marker

Parm2: target organization ID

Sys

sys_xemailauth

System email-authentication settings changed.

Parm1: OAuth authentication enabled value

Parm2: SMTP server

Parm3: SMTP SSL enabled value

Sys

sys_xwafsync

Web application firewall synchronization configuration changed.

Parm1: WAF certificate auto-sync enabled value

Sys

sys_delwafsync

Web application firewall synchronization configuration deleted.

Parm1: configuration-deleted audit note

Sys

sys_xaiintegr

System-wide AI integration configuration changed.

Parm1: system AI integration mode or organization AI-allowed value

Sys

sys_xavcontrol

System antivirus control mode changed.

Parm1: antivirus control mode, 0 organization administrator or 1 system administrator

User

user_acceptcert

Certificate or key accepted for the user account.

Parm1: certificate or key ID

Parm2: certificate or key data type

Parm3: certificate or public-key data

User

user_add

User account created.

Parm1: new login name or username

Parm2: new real name

Parm3: new permission level

Parm4: clone-source username

User

user_addcert

Certificate or key added to the user account.

Parm1: new certificate or key ID

Parm2: certificate or key data type

Parm3: certificate or public-key data

User

user_added

User account addition confirmed.

No current Event Log or syslog output; no production call site found.

User

user_addldap

User account created from LDAP.

Parm1: LDAP login name

Parm2: organization ID

Parm3: clone-source username

User

user_addextrnl

Externally authenticated user account created.

Parm1: external login name

Parm2: authentication-source type

Parm3: clone-source username

User

user_addaddr

Entry added to the user's address book.

Parm1: address-book owner's username

Parm2: address-book owner's real name

Parm3: entry type: user or group

Parm4: entry username or group ID

User

user_deladdr

Entry deleted from the user's address book.

Parm1: address-book owner's username

Parm2: address-book owner's real name

Parm3: entry type: user or group

Parm4: entry username or group ID

User

user_addshah

Shared Ad Hoc Transfer address-book entry added for the user.

Parm1: shared-mailbox owner's username

Parm2: shared-mailbox owner's real name

Parm3: entry type: user or group

Parm4: entry username or group ID

User

user_delshah

Shared Ad Hoc Transfer address-book entry deleted for the user.

Parm1: shared-mailbox owner's username

Parm2: shared-mailbox owner's real name

Parm3: entry type: user or group

Parm4: entry username or group ID

User

user_delcert

Certificate or key deleted from the user account.

Parm1: certificate or key ID

Parm2: certificate or key data type

Parm3: certificate or public-key data

Parm4: certificate owner type

User

user_delsslcert

SSL certificate deleted from the user account.

Parm1: SSL certificate ID when deleting one certificate

Parm2: certificate data type when deleting one certificate

Parm3: certificate data when deleting one certificate

Parm4: holding-tank certificate owner type

User

user_delsshkey

SSH key deleted from the user account.

Parm1: SSH key ID when deleting one key

Parm2: key data type when deleting one key

Parm3: public-key data when deleting one key

Parm4: holding-tank certificate owner type

User

user_delete

User account deleted.

Parm1: deleted username

Parm2: deleted user's real name

User

user_deleted

User account deletion confirmed.

No current Event Log or syslog output; no production call site found.

User

user_delsession

Active session belonging to the user terminated.

Parm1: removed session ID

User

user_emailnote

Email notification sent concerning the user account.

Parm1: notification recipient email address

Parm2: notification message-type ID

User

user_reqxpass

Automatic password change requested for the user.

—

User

user_suspended

User account suspended.

Parm1: suspended username

User

user_temptoend

Temporary user promoted to a permanent end-user account.

Parm1: promoted username

Parm2: promoted user's real name

User

user_xattch

User's secure-message attachment permissions changed.

Parm1: target username

Parm2: target user's real name

Parm3: attachments enabled flag

User

user_xmsgquota

User's secure-message quota changed.

Parm1: user aggregate package quota in bytes

Parm2: aggregate quota period in days

Parm3: per-package quota in bytes

User

user_xmsgexp

Secure-message expiration settings changed for the user.

Parm1: default package expiration in hours

Parm2: maximum package expiration in hours

User

user_xhomefolder

User's home folder changed.

Parm1: home-folder ID

Parm2: home-folder path

User

user_xdeffolder

User's default folder changed.

Parm1: default-folder ID

Parm2: default-folder path

User

user_xdeffolsets

Default-folder settings changed for the user.

Parm1: chroot-to-default-folder enabled flag

User

user_xdetails

User-account profile details changed.

Parm1: target username

Parm2: target user's real name

User

user_xdlprlst

DLP ruleset assigned to the user changed.

Parm1: DLP ruleset ID

Parm2: DLP ruleset name

User

user_xemail

User's email address changed.

Parm1: target username

Parm2: new email value

Parm3: new email format

User

user_xexppol

Expiration policy assigned to the user changed.

Parm1: expiration-policy ID

Parm2: expiration-policy name

User

user_xhostaccess

User's host access rule changed.

Parm1: target username

Parm2: allow or deny rule, or custom-rules enabled flag

Parm3: host or network expression

Parm4: operation: addrule, changerule, deleterule, changepriority, or changesettings

User

user_xmultiso

User's concurrent-signon permission changed.

Parm1: target username

Parm2: target user's real name

Parm3: deny-multiple-signons flag

User

user_xpass

User's password changed.

Parm1: target username

User

user_xpassexempt

User's exemption from password aging changed.

Parm1: target username

Parm2: password-aging exemption enabled flag

User

user_xpasspolicy

Password policy assigned to the user changed.

Parm1: password-policy ID

Parm2: password-policy name

User

user_xpassperms

Password-management permissions changed for the user.

Parm1: deny-password-change-requests flag

User

user_xquota

User's storage quota changed.

Parm1: target username

Parm2: new file quota in bytes

User

user_xsecurity

User account's security status changed.

Parm1: target username

Parm2: new user status

Parm3: security-status notes

User

user_xsecqs

User's password-reset security questions changed.

Parm1: number of security-question updates

User

user_xsetting

One user-account setting changed.

Parm1: target username

Parm2: setting name

Parm3: new setting value

User

user_xshared

User account's shared status changed.

Parm1: shared-account enabled flag

User

user_xsshpol

SSH policy assigned to the user changed.

Parm1: SSH access allowed flag

Parm2: SSH key required flag

Parm3: password with key required flag

User

user_xftppol

FTP policy assigned to the user changed.

Parm1: FTPS access allowed flag

Parm2: insecure FTP access allowed flag

Parm3: client certificate required flag

Parm4: password with certificate required flag

User

user_xhttppol

HTTP policy assigned to the user changed.

Parm1: HTTPS human-interface access allowed flag

Parm2: HTTPS machine-interface access allowed flag

Parm3: client certificate required flag

Parm4: password with certificate required flag

User

usrrst_lstsignon

User's last-signon timestamp reset.

—

User

usrrst_useduses

User's signon-use count reset.

—

User

user_reqnewpass

New account password requested for the user.

—

User

user_xsuppauth

Suppression of authentication logging changed for the user.

Parm1: suppress-authentication-logging enabled flag

User

user_xuserret

Folder-access cache retention changed for the user.

Parm1: folder-access cache-retention value

Parm2: cache-retention unit

User

user_xmfaauth

User's MFA authenticator changed.

Parm1: authenticator-app enabled flag

Parm2: existing authenticator edited flag

User

user_xmfaemail

Email address used for the user's MFA changed.

Parm1: email MFA enabled flag

User

user_xmfaexempt

User's exemption from MFA changed.

Parm1: MFA exemption enabled flag

User

user_addmfatrust

Trusted MFA device added for the user.

—

User

user_rmmfatrusts

All trusted MFA devices removed for the user.

—

User

user_disablemfa

MFA disabled for the user account.

—

User

user_addexttoken

External authentication token added to the user.

Parm1: new external-token record ID

Parm2: external-token type

User

user_delexttoken

External authentication token deleted from the user.

Parm1: external-token record ID

User

user_xexttoken

External authentication token changed for the user.

Parm1: external-token record ID

Parm2: new display name

User

user_xauthmethod

User's authentication method changed.

Parm1: authentication-method value

Parm2: authentication-method name

Group

user_addgrp

User group created.

Parm1: new group ID

Parm2: new group name

Parm3: clone-source group ID

Parm4: clone-source group name

Group

user_addgrpaddr

Entry added to the group's address book.

Parm1: address-book owner group ID

Parm2: address-book owner group name

Parm3: entry type: user or group

Parm4: entry username or group ID

Group

user_delgrp

User group deleted.

Parm1: deleted group ID

Parm2: deleted group name

Group

user_delgrpaddr

Entry deleted from the group's address book.

Parm1: address-book owner group ID

Parm2: address-book owner group name

Parm3: entry type: user or group

Parm4: entry username or group ID

Group

usrgrp_mbradd

User added as a group member.

Parm1: group ID

Parm2: group name

Parm3: member username

Parm4: member real name

Group

usrgrp_mbradded

User's addition to the group confirmed.

No current Event Log or syslog output; no production call site found.

Group

usrgrp_mbrdel

User removed from the group.

Parm1: group ID

Parm2: group name

Parm3: member username

Parm4: member real name

Group

usrgrp_mbrdeled

User's removal from the group confirmed.

No current Event Log or syslog output; no production call site found.

Group

usrgrp_mbrmkga

Group-administrator status granted to a member.

Parm1: group ID

Parm2: group name

Group

usrgrp_mbrrmga

Group-administrator status revoked from a member.

Parm1: group ID

Parm2: group name

Group

usrgrp_noteadd

Custom notification assigned to the group.

Parm1: custom-notification ID

Parm2: custom-notification name

Parm3: group ID

Parm4: group name

Group

usrgrp_noterem

Custom notification removed from the group.

Parm1: custom-notification ID

Parm2: custom-notification name

Parm3: group ID

Parm4: group name

Group

usrgrp_rename

User group renamed.

No current Event Log or syslog output; no production call site found.

Group

usrgrp_xdetails

Group profile details changed.

Parm1: group ID

Parm2: old group name

Parm3: new group name

Group

usrgrp_xdispprof

Display profile assigned to the group changed.

Parm1: group ID

Parm2: group name

Group

usrgrp_xgasets

Group-administrator permissions and settings changed.

Parm1: group ID

Parm2: group name

Group

usrgrp_xlogo

Group's logo changed.

Parm1: group ID

Parm2: group name

Parm3: clear-existing-logo flag

Group

usrgrp_xmemsets

Default settings changed for group members.

Parm1: group ID

Parm2: group name

Group

usrgrp_xmotd

Group's announcement or message of the day changed.

Parm1: group ID

Parm2: group name

Parm3: new announcement text

Group

usrgrp_xsetting

One group setting changed.

Parm1: group ID

Parm2: group name

Parm3: setting name

Parm4: new setting value

Group

usrgrp_xsettings

Multiple group settings changed.

No current Event Log or syslog output; no production call site found.