15.6 Common audit events

Display names are those shown in the console, reports and alert mails.

Event id	Display name	Category	Severity	Meaning
`label_applied`	Label applied	Labeling	Low	A user or add-in applied a label. Variants `_on_save`, `_on_send`, `_auto_rule`, `_dlp` say when or how.
`agent_labeled`	Auto-labeled by file agent	Labeling	Low	The file agent applied a label enforced by a rule.
`agent_upgraded`	Label raised to meet policy	Labeling	Low	The file agent raised a label to the level a rule requires.
`label_downgraded`	Label downgraded	Labeling	Medium	A lower label replaced a higher one; carries previous label and justification.
`label_removed`	Label removed (rollback)	Labeling	High	A label was removed (agent `unlabel` command).
`label_migrated`	Label migrated from another product	Labeling	Low	A Purview/Titus label was converted to its mapped Ada label.
`file_label_registered`	Label registered on server (unwritable file)	Labeling	Low	A server-held label was created (section 15.3.9).
`agent_prompted`	Classification prompt shown	Recommendations	Low	The user was asked to classify.
`agent_recommendation`	Sensitive content detected	Recommendations	Low	A rule matched in an unlabeled or lower-labeled file; a label was recommended.
`agent_unlabeled`	Unlabeled file detected	Recommendations	Low	A file without a label was found.
`content_warning_shown`	Content warning shown	Recommendations	Low	A Warn rule showed its message.
`content_warning_acknowledged`	Content warning acknowledged (user continued)	Allowed activity	Medium	The user continued past a Warn rule.
`content_masked`	Content masked (***)	Masking	Medium	Matching content was masked at save/send; finding summary names rule × count, never the values.
`content_mask_pending`	Masking pending (user warned)	Masking	Medium	The background scanner found content to mask and warned the user.
`save_blocked_unlabeled`	Save blocked — no label	Blocking	High	Save stopped because the document has no label.
`save_blocked_policy`	Save blocked — policy	Blocking	High	Save stopped by a label restriction.
`send_blocked_unlabeled`	Send blocked — no label	Blocking	High	Mail send stopped: no label.
`send_blocked_attachment`	Send blocked — attachment label	Blocking	High	An attachment’s label forbids sending.
`send_blocked_policy`	Send blocked — policy	Blocking	High	The mail’s label forbids sending to these recipients.
`print_blocked_policy`	Print blocked — policy	Blocking	High	Printing forbidden by the label.
`copy_blocked_policy`	Copy blocked — policy	Blocking	High	Copying forbidden by the label.
`downgrade_blocked`	Downgrade blocked	Blocking	High	Lowering the label was refused.
`content_mask_blocked`	Send blocked — content must be masked	Blocking	High	Web add-in could not mask on send; user directed to desktop Office.
`send_allowed_exception`	Sending allowed by recipient exception	Allowed activity	Low	A restricted item went to recipients on the label’s exception list.
`copy_justified`	Copy allowed with justification	Allowed activity	Low	Copy allowed after the user typed a justification.
`print_traced`	Print traced	Printing	Low	A document was printed with a trace code (search Trace code).
`watermark_shown`	Screen watermark shown	Screen watermark	Low	Screen watermark displayed; carries viewer and trace code.
`screen_capture_protected`	Screen capture protection applied	Screen watermark	Low	A labeled document’s window was hidden from screen capture.
`ai_shadow_match`	AI rule in test mode matched	AI classification	Info	An AI rule in test mode would have applied its label.
`ai_training_completed` / `_failed`	AI training completed / failed	AI classification	Info	Result of training custom document types.
`agent_command_done` / `_failed`	Agent command applied / failed	Agent operations	Info	Result of a console command on an agent.
`agent_skipped_too_large`	Agent skipped (too large)	Agent operations	Info	A file exceeded the agent’s size limit.
`tamper_detected`	Tampering detected (service restored)	Security	Critical	The agent service was stopped or altered and restored.
`addin_disable_attempt`	User switched the Office add-in off	Security	Critical	Disabling the COM add-in was attempted.
`agent_binary_missing`	Agent file missing (renamed/deleted)	Security	Critical	An agent file is missing; protection is off.
`agent_unprotected`	Agent unprotected (tamper protection not delivered)	Security	Critical	Tamper protection is on in the policy but did not reach the agent.
`overlay_stopped`	Screen overlay stopped	Security	Critical	The screen-watermark overlay process was stopped; Detail shows off screen: Ns.
`uninstall_attempt_failed`	Uninstall attempt failed	Security	Critical	Agent removal without valid password/token.
`agent_auth_rejected`	Agent authentication rejected	Security	Critical	A request with an invalid or revoked agent identity.
`agent_policy_stale`	Policy stale — strictest restrictions applied	Security	Medium	The agent could not reach the server longer than allowed and switched to strictest restrictions.
`admin_login_failed`	Admin login failed	Security	High	Console sign-in failed; Detail gives the reason (wrong password, no role, locked, directory unreachable, network not allowed …).
`admin_login`	Admin login	Administration	Info	Console sign-in (method AD or local, role, IP).
`policy_published`	Policy published	Administration	Info	Publish & Sign; Detail lists every change item by item.
`agent_command_issued`	Agent command issued	Administration	Info	An administrator sent a command to an agent.
`security_config_changed`	Security policy changed	Administration	Info	Settings → Security saved.
`backup_downloaded` / `backup_restored`	Backup downloaded / restored	Administration	Info	Backup actions (section 16.4).
`backup_failed`	Scheduled backup failed	Administration	Info	A scheduled backup failed (also a Service health alert).
`audit_exported`	Audit exported	Administration	Info	CSV/JSON export with filter and count.
`report_generated` / `report_emailed`	Report generated / emailed	Administration	Info	Report actions (section 15.4).
`service_restarted`	Service restarted	Administration	Info	Restart from Status (section 16.1).
`service_down` / `service_restored`	Service down / restored	Administration	Info	Health transitions.
`tls_cert_expiring`	TLS certificate expiring soon	Administration	Info	Certificate expiry warning.
`license_expiring`	License expiring soon	Administration	Info	Licence warning period started.