Audit Events Common to Most Resources

These audit events are generated in response to creation events and configuration updates to most resources, except users, actors, and groups, which use different audit events. When a resource is added, deleted, updated, locked, or unlocked, the Manager generates one audit event with the following attributes:

• Device Event Class ID = resource:100 (deleted) or resource:101 (updated) or resource:102, and so on.

• Event Name = <resource type> deleted/updated/added.

• File Name = <Resource Name> (for example, John’s Filter)

• File Path = <Resource URI> (for example, /All Filters/administrator’s Filter/John’s Filter)

• File Type = <Resource Type> (for example, Filter)

  Audit Events on Resources

  Audit Event Category	Device Event Class ID	Audit Event Description
  Resource (Delete)	resource:100	Resource deleted. The Event Name describes the action and resource type (<ResourceName> deleted); for example, deleting a filter results in an event named Filter deleted.
  Resource (Update)	resource:101	Resource updated. This audit event is generated when an existing resource is modified or added. See Resource (Add). The Event Name describes the action (update) and resource type (<ResourceName> updated); for example, modifying a report, results in an event name of Report updated.
  Resource (Add)	resource:102	Resource added (inserted). The Event Name describes the action (insert) and resource type (<ResourceName> inserted); for example, adding a case, results in an event name of Case inserted. Adding a Case group results in an event name of Group [Case] inserted.
  Resource (Lock)	resource:103	Resource locked <ResourceName> locked.
  Resource (Unlock)	resource:104	Resource unlocked <ResourceName> unlocked.
  	resourcereference: 100	Could not locate a resource through the supplied universal resource identifier (URI).