user-create
August 11, 2025 · View on GitHub
Description
A user account was created
Parameters
| Parameter | Value |
|---|---|
| Subject | user |
| Activity | create |
| Activity Type | user-create |
| Pretty Name | User Create |
Legacy Names
| Success | Fail |
|---|---|
| account-creation | account-creation |
Fields
The possible fields for this activity type will vary depending on whether the activity was a success or a fail.
user-create:success
| Field | Core | Detection | Informational |
|---|---|---|---|
| event_locality | ✓ | ||
| src_zone | |||
| local_user_name | |||
| dest_host | ✓ | ||
| src_host | ✓ | ||
| user | ✓ | ||
| dest_zone |
user-create:fail
| Field | Core | Detection | Informational |
|---|---|---|---|
| failure_code | ✓ | ||
| src_zone | |||
| local_user_name | |||
| dest_host | ✓ | ||
| failure_reason | ✓ | ||
| src_host | ✓ | ||
| user | ✓ | ||
| dest_zone |