What are Workplace security logs?
Workplace Logs are a hub for all security events and data. Below is a list of all the events we currently record, alongside an explanation of the event that's occurred.
| Event Name | Note |
| Logged in | A user has successfully logged in using either password or SSO. |
| Login Failed | A user has unsuccessfully tried to log in. |
| Logged out | A user has logged out. |
| Password Changed | A user has changed their Workplace password. |
| Password Reset Succeeded | A user has reset their Workplace password by setting a new password. |
| Password Reset Code Requested | A user's Workplace password has been requested for reset through the self-service flow. |
| Password Reset Incorrect Code | The verification code required to reset a user's Workplace password has been entered incorrectly. |
| Account at Risk | We've found a user whose account is at risk. Learn more on how to identify accounts at risk. |
| Account Set To Unclaimed | An admin or integration has set a user to unclaimed. |
| Forced Logout | An admin has forced a user to log out via the admin panel. |
| Account Deactivated | A user has been deactivated through an admin or an integration. |
| Account Activated | A user has been activated through an admin or an integration. |
| Account Deleted | A user account has been deleted. |
| Forced Password Reset | An admin has forced a user's password to be reset before next login. |
| Account Created | A user account has been created by an admin. |
| Accounts Created | An admin has created user accounts with the excel import method. |
| Admin Role Changed | An admin account has had its role modified. |
| Admin Removed | A user account has had its admin role removed. |
| Admin Created | A user account has been created through the Administrators section and has been promoted to an admin role. |
| Account Promoted to Admin | An existing user has been promoted to admin. |
| Email Changed | A user's email has been edited. |
| Domain Added | A domain has been added to the verification table, but has not been verified yet. |
| Domain Verified | A domain has been verified successfully. Learn more on domain verification. |
| Domain Removed | A domain has been removed from Workplace. |
| Two-Factor Authentication Enabled | A user has self-enrolled in two-factor authentication. Learn more on how this is enabled. |
| Two-Factor Authentication Disabled | A user has disabled their two-factor authentication. |
| Phone Number Added | A user has added a phone number against their account. |
| Two-Factor Code Entry Succeeded | A user has successfully entered in their two-factor authentication code when prompted on our desktop or mobile site. |
| Two-Factor Code Entry Failed | A user has unsuccessfully entered in their two-factor authentication code when prompted on our desktop or mobile site. |
| Two-Factor Code Entry Succeeded On Mobile App | A user has successfully entered in their two-factor authentication code when prompted on either our Android or iOS app. |
| Two-Factor Code Entry Failed On Mobile App | A user has unsuccessfully entered in their two-factor authentication code when prompted on either our Android or iOS app. |
| Group File Downloaded | A file has been downloaded from a group. |
| Group File Uploaded | A file has been uploaded to a group. Learn more on how to upload a file to a group. |
| Malware Suspected in File | A file has been suspected of having malware and has been blocked from being uploaded to a group. |
| Integration Created | A custom integration has been created. |
| Integration Edited | A custom integration has been edited. |
| Integration Deleted | A custom integration has been deleted. |
| Integration Added | An app from the integration directory has been added. |
| Integration Removed | A integration directory app has been removed. |
| Multi-Company Group Created | A multi-company group has been created. |
| Joined Multi-Company Group | A user has joined a multi-company group. |
| Created users via IDP Sync | Users have been created via a connected identity provider (Azure or G Suite). |
| Created Users via Coworker Invite | Users have been created through invites initiated by other community members. |
| Invited Coworker | Users have been invited through invites initiated by other community members. They're only created once they accept the invite. |
| Compromised Credentials Found | An account was found to have compromised credentials for username/password authentication. |
| Company Marked as Resold | |
| Malware Upload Blocked | A malware found in a file upload was blocked. |
| Profile Data Download Requested | A user put in a request to download their data. |
| Report Former Employee | Persisted events from former employee reports. |
| Reseller Added | Enabled insights tab for non-admin user. |
| Reseller Removed | Disabled insights tab for non-admin user. |
| Reseller Invite Sent | A company has been invited to be linked |
| Reseller Invite Accepted | Invited company to be linked has accepted the invite |
| Reseller Invite Declined | Invited company to be linked has declined the invite |
| Self Invite Created | A user created their account using self-invite. |
| SSO Reauthentication | An admin requested SSO Reauthentication from their users. |
| Two-Factor Authentication Enabled | Two-factor authentication was enabled for a user. |
| Two-Factor Code Entry Failed | A two-factor authentication code entry failed upon validation. |
| Two-Factor Code Entry Failed On Mobile App | A two-factor authentication code entry failed upon validation on the mobile app. |
| Two-Factor Code Entry Succeeded | A two-factor authentication code entry succeeded upon validation. |
| Two-Factor Code Entry Succeeded On Mobile App | A two-factor authentication code entry succeeded upon validation on mobile app. |
| User Invited | A two-factor authentication code entry succeeded upon validation on the mobile app. |
| Integration Access Token Reset | An integration access token was reset. |
| Profile Data Downloaded | A user downloaded their data. |
| Two-Factor Authentication Disabled | Two-factor authentication was disabled for an user. |
| Reported Content | A user has reported a post for the admin to review. |
| Video Downloaded | A user has downloaded a video |
| Profile Automaticatically Deleted | A user account has been deleted automatically after being unclaimed for 27 days or more. |
