ITDR Events

The Identity Threat Detection and Response (ITDR) service levels audit events that include the following.

Alerts

  • {{Actor.Name}} updated alert {{Target.Name}}

  • Delinea System created new alert {{Target.name}}

Checks

  • Check {{Target.Name}} failed

Case

  • {{Actor.Name}} updated case {{Target.Name}}

  • Delinea System created new case {{Target.name}}

Automated Response

  • ITP response workflow Add User to Group was performed on user {{Target.Name}} and group {{AdditionalAttributes.GroupName}} in {{AdditionalAttributes.AppName}} due to {{AdditionalAttributes.TriggerType}}. Status: {{AdditionalAttributes.Status}}

  • ITP response workflow Disable User Account was performed on user {{Target.Name}} in {{AdditionalAttributes.AppName}} due to {{AdditionalAttributes.TriggerType}}. Status: {{AdditionalAttributes.Status}}

  • ITP response workflow Enable User Account was performed on user {{Target.Name}} in {{AdditionalAttributes.AppName}} due to {{AdditionalAttributes.TriggerType}}. Status: {{AdditionalAttributes.Status}}

  • ITP response workflow Remove User from Group was performed on user {{Target.Name}} and group {{AdditionalAttributes.GroupName}} in {{AdditionalAttributes.AppName}} due to {{AdditionalAttributes.TriggerType}}. Status: {{AdditionalAttributes.Status}}

  • ITP response workflow Revoke User Sessions was performed on user {{Target.Name}} in {{AdditionalAttributes.AppName}} due to {{AdditionalAttributes.TriggerType}}. Status: {{AdditionalAttributes.Status}}