Appendix

Created Gateway

Deleted Gateway

Initiated reboot on Gateway

Initiated Upgrade to version <ver no.> on Gateway

Initiated rollback on Gateway

Restarted services

Created configuration

Edited configuration

Deleted configuration

Initiated Config Import

Initiated Config Export

TOTP User Config Import

TOTP USer Config Export

Created Config sync rule

Deleted Config sync rule

Modified Config sync rule

Triggered Config sync rule

Created Admin Management > Authentication Servers > Local Auth Srvr, type: Local

Updated Admin Management > Authentication Servers > SAML Auth Srvr, type: SAML Custom

Deleted Admin Management > Authentication Servers > SAML Auth Srvr

Created Admin Management > Authentication Servers > Local Auth Srvr > Added user: ladmin_1

Created Admin Management > Authentication Servers > Local Auth Srvr > Added users: ladmin_2, ladmin_3

Deleted Admin Management > Authentication Servers > Local Auth Srvr > Deleted user: ladmin_1

Deleted Admin Management > Authentication Servers > Local Auth Srvr > Deleted users: ladmin_2, ladmn_3

Updated Admin Management > Authentication Servers > Local Auth Srvr > Updated user: ladmin_1

Created Admin Management > Admin Rules > admin_rule1 type: Username and value: ladmin_1

Updated Admin Management > Admin Rules > admin_rule1 type: Username and value: ladmin_1

Deleted Admin Management > Admin Rules > admin_rule1

Created Admin Roles > admin_role1

Updated Admin Roles > admin_role1 from user-group: usr_grp1 to usr_grp2

Deleted Admin Role > admin_role1

Deleted Admin Roles > admin_role1, admin_role2

Created Admin Management > Admin Groups > adm_grp1

Updated Admin Management > Admin Groups > adm_grp1 from rules: adm_rule1 to adm_rule2 and admin-policy: adm_policy1

Deleted Admin Management > Admin Groups > admin group: adm_grp1

Deleted Admin Management > Admin Groups > admin rule: adm_rule2 from adm_grp1

Created Admin Management > Admin Policies > adm_policy1

Updated Admin Management > Admin Policies > adm_policy1 with primary auth-server: pri_auth_srvr1 to pri_auth_srvr2 and secondary auth-server: sec_auth_srvr1 to sec_auth_srvr2

Deleted Admin Management > Admin Policies > adm_policy1

Deleted Admin Management > Admin Policies > admin policies: adm_policy1, adm_policy2

Created Admin Management > Device Policies > dev_policy1

Updated Admin Management > Device Policies > dev_policy1 > Rules deleted: dev_rule1, dev_rule2 Rules Added: dev_rule3, dev_rule4

Deleted Admin Management > Device Policies > dev_policy1

Deleted Admin Management > Device Policies > dev_policy1

Created Admin Management > Device Policies > device rule: dev_rule1

Updated Admin Management > Device Policies > device rule: dev_rule1

Deleted Admin Management > Device Policies > device rule: dev_rule1

Deleted Admin Management > Device Policies > device rules: dev_rule1, dev_rule2

Initiated import of Device Certificate

Initiated import of Client-Auth Certificate

Initiated creation of Device Certificate CSR

Initiated creation of Client-Auth Certificate CSR

Initiated import of Code Signing Certificate

Uploaded ESAP package version

Deleted ESAP package version

Initiated ESAP Activation on multiple nodes

Initiated MultiNode Upgrade

Initiated Cluster Upgrade

Initiated rollback on cluster

Initiated Cluster Actions like VIP-Failover, enable or disable Nodes

Initiated Cluster operations like restart or reboot

Updated cluster properties like mode, VIP, etc.

Created ICS Gateway Cluster with nodes

Added Node to ICS Gateway Cluster

Removed Node From ICS Gateway Cluster

Deleted ICS Gateway Cluster

Deleted Named user and devices

Modified Named Users Auto Delete

Updated Settings > Session Options > idle_timeout: {} and max_session_length: {}

Created Config sync scheduled job

Deleted Config sync scheduled job

Edited Config sync scheduled job

Primary authentication successful for user: admin auth-server: Admin Auth

Received Access Request from user: admin

Started authentication with primary-auth-server

Primary authentication failed for user

Admin user logged out

Secondary authentication successful for user

User mapped to groups by rule

Session created for User mapped to groups by role

Secondary authentication failed for user

Login succeeded for user

Password changed for user

Anomalies acknowledged

Anomaly - Session has been successfully terminated

Non-Compliance acknowledged

Non-Compliance - Session has been successfully terminated

User Threat score for {} reset successfully

{} - {} Job successfully created

Scheduled Jobs > Job(s): {} successfully deleted

Scheduled Jobs > Job(s): {} successfully suspended

Scheduled Jobs > Job(s): {} successfully resumed

Scheduled Jobs > Job run(s): {} successfully deleted

Scheduled Jobs > Job run(s): {} successfully suspended

Scheduled Jobs > Job run(s): {} successfully resumed

Job(s) > {} successfully downloaded

Insights > Session Management, Selected Sessions {} successfully terminated

Insights > Session Management, All Sessions successfully terminated

Insights > Session Management, Selected Active sync sessions {} successfully terminated

Insights > Session Management, All Active sync sessions successfully terminated

Insights > Session Management, Blocked access for sessions with {} successfully

Insights > Session Management, Allowed access for sessions with {} successfully

Actionable Insights > UEBA Threat Score: {} and Action Type: {} is created successfully

Actionable Insights > UEBA Threat Score: {} and Action Type: {} is updated successfully

Actionable Insights > Action Type: {} deleted successfully

Reports > UEBA_threat_rep is successfully sent to user: admin_1

Reports > UEBA_threat_rep is successfully generated

Reports > UEBA_threat_rep is successfully deleted

Reports > UEBA_threat_rep is successfully downloaded

Reports > UEBA_threat_rep is successfully updated