Field Mapping by Event

December 9, 2025 ยท View on GitHub

This table maps old event types to their corresponding new-scale activity types. You can do the following with this table:

  • Click an old event type link to open a page that maps all of the old fields to the corresponding new-scale fields that comply with the Common Information Model.
  • Click a new-scale activity type link to open a page that provides parameters and CDI information for the selected activity type.
Old Event TypeNew-Scale Activity Type
account-creationuser-create:fail
account-deleteduser-delete:fail
account-disableduser-disable:success
account-enableduser-enable:success
account-lockoutuser-lock:fail
account-password-changeuser-password-modify:fail
account-password-change-failedpassword-modify:fail
account-password-resetuser-password-reset:fail
account-switchpassword-checkout:success
account-unlockeduser-unlock:success
alert-iotalert-trigger:success
app-activityai_agent-request:success
app-activity-failedai_agent-request:fail
app-loginapp-authentication:success
audit-log-clearlog-clear:success
audit-policy-changeaudit_policy-modify:success
authentication-failedapp-authentication:fail
authentication-successfulapp-authentication:success
aws-bucket-accessblockbucket-accessblock-modify:success
aws-bucket-accessblock-failedbucket-accessblock-modify:fail
aws-bucket-corsbucket-permission-modify:success
aws-bucket-cors-failedbucket-permission-modify:fail
aws-bucket-createbucket-create:success
aws-bucket-create-failedbucket-create:fail
aws-bucket-policybucket-policy-modify:success
aws-bucket-policy-failedbucket-policy-modify:fail
aws-compute-listendpoint-list:success
aws-compute-list-failedendpoint-list:fail
aws-function-writefunction-write:success
aws-function-write-failedfunction-write:fail
aws-general-activityapp-activity:success
aws-general-activity-failedapp-activity:fail
aws-identity-addtogroupgroup-member-add:success
aws-identity-addtogroup-failedgroup-member-add:fail
aws-identity-creds-writeuser-key-create:success
aws-identity-creds-write-faileduser-key-create:fail
aws-identity-listgroup-list:success
aws-identity-list-failedgroup-list:fail
aws-identity-loginprofileapp-activity:success
aws-identity-loginprofile-failedapp-activity:fail
aws-identity-writeuser-create:success
aws-identity-write-faileduser-create:fail
aws-image-createimage-create:success
aws-image-create-failedimage-create:fail
aws-image-modifyimage-modify:success
aws-image-modify-failedimage-modify:fail
aws-instance-commandendpoint-command:success
aws-instance-command-failedendpoint-command:fail
aws-instance-createendpoint-create:success
aws-instance-create-failedendpoint-create:fail
aws-instance-creds-readkey-read:success
aws-instance-creds-read-failedkey-read:fail
aws-instance-creds-writekey-write:success
aws-instance-creds-write-failedkey-write:fail
aws-instance-loginendpoint-login:success
aws-instance-login-failedendpoint-login:fail
aws-instance-modifyendpoint-modify:success
aws-instance-modify-failedendpoint-modify:fail
aws-instance-screenshotapp-activity:success
aws-instance-screenshot-failedapp-activity:fail
aws-loginendpoint-login:success
aws-login-failedendpoint-login:fail
aws-policy-attachgroup-policy-attach:success
aws-policy-listpolicy-list:success
aws-policy-list-failedpolicy-list:fail
aws-policy-setversionpolicy-modify:success
aws-policy-setversion-failedpolicy-modify:fail
aws-policy-writepolicy-create:success
aws-role-assumerole-assume:success
aws-role-assume-failedrole-assume:fail
aws-role-assumepolicyrole-permission-modify:success
aws-role-switchrole-assume:success
aws-role-writerole-create:fail
aws-snapshot-createsnapshot-create:success
aws-snapshot-create-failedsnapshot-create:fail
aws-snapshot-modifysnapshot-modify:success
aws-snapshot-modify-failedsnapshot-modify:fail
aws-storage-aclbucket-permission-modify:success
aws-storage-acl-failedbucket-permission-modify:fail
aws-storage-listbucket-list:success
aws-storage-list-failedbucket-list:fail
aws-storageobject-copyfile-copy:success
aws-storageobject-copy-failedfile-copy:fail
aws-storageobject-readfile-read:success
aws-storageobject-read-failedfile-read:fail
aws-storageobject-writefile-write:success
aws-storageobject-write-failedfile-write:fail
aws-volume-attachdisk-attach:success
aws-volume-attach-faileddisk-attach:fail
aws-volume-createdisk-create:success
aws-volume-create-faileddisk-create:fail
aws-volume-modifydisk-modify:success
aws-volume-modify-faileddisk-modify:fail
azure-blob-deletefile-delete:fail
azure-blob-readfile-read:fail
azure-blob-writefile-write:fail
azure-container-aclfile-permission-modify:fail
azure-container-writefile-write:fail
azure-disk-writedisk-write:success
azure-general-activityapp-activity:fail
azure-image-writeimage-write:success
azure-instance-creds-writekey-write:success
azure-instance-writeimage-write:success
azure-keyvault-readkey-read:fail
azure-keyvault-writekey-write:fail
azure-role-assignuser-role-assign:success
azure-role-writerole-write:success
azure-snapshot-writesnapshot-write:success
azure-storage-listfile-list:fail
batch-logonendpoint-login:success
cloud-admin-activity-failedapp-activity:fail
computer-logondhcp-session:success
config-changeconfiguration-modify:fail
database-accessdatabase-activity:success
database-activity-faileddatabase-activity:fail
database-alertalert-trigger:success
database-deletedatabase-delete:success
database-failed-logindatabase-login:fail
database-logindatabase-login:success
database-querydatabase-query:success
database-updatedatabase-modify:success
dcom-activation-faileddcom-activate:fail
dlp-alertalert-trigger:success
dlp-email-alert-inemail-receive:success
dlp-email-alert-in-failedemail-receive:fail
dlp-email-alert-outemail-send:success
dlp-email-alert-out-failedemail-send:fail
dns-querydns-request:fail
dns-responsedns-response:fail
ds-accessds_object-activity:success
email_rule-createemail_rule-create:success
email_rule-deleteemail_rule-delete:success
email_rule-disableapp-activity:success
email_rule-enableapp-activity:success
email_rule-modifyemail_rule-modify:success
failed-app-loginapp-login:fail
failed-ds-accessds_object-activity:fail
failed-logonendpoint-authentication:fail
failed-physical-accessphysical_location-access:fail
failed-usb-activityperipheral_device-activity:fail
failed-vpn-loginvpn-login:fail
file-alertalert-trigger:success
file-closefile-close:success
file-deletefile-delete:fail
file-downloadfile-download:success
file-movefile-move:success
file-permission-changefile-permission-modify:success
file-readfile-move:success
file-sharefile-share:success
file-uploadfile-share:success
file-writefile-copy:success
gcp-bucket-createbucket-create:success
gcp-compute-listdisk-list:success
gcp-disk-attachdisk-attach:success
gcp-disk-createdisk-create:success
gcp-function-writefunction-write:success
gcp-general-activityapp-activity:success
gcp-image-createimage-create:success
gcp-instance-createendpoint-create:success
gcp-instance-screenshotendpoint-screenshot:success
gcp-instance-setmachinetypeendpoint-modify:success
gcp-instance-setmetadataendpoint-modify:success
gcp-policy-writebucket-permission-modify:success
gcp-role-listrole-list:success
gcp-role-writerole-create:success
gcp-serviceaccount-creds-writeuser-key-create:success
gcp-serviceaccount-writeuser-create:success
gcp-snapshot-createsnapshot-create:success
gcp-storage-listbucket-list:fail
gcp-storageobject-aclfile-permission-modify:success
gcp-storageobject-readfile-read:success
gcp-storageobject-writefile-write:success
group-role-assigngroup-role-assign:success
group-role-revokegroup-role-revoke:success
image-loadeddll-load:success
kerberos-logonendpoint-authentication:success
local-logonendpoint-login:fail
logout-remoteendpoint-logout:success
m365-app-activityapp-activity:success
m365-app-activity-failapp-activity:fail
m365-file-copyfile-copy:success
m365-file-deletefile-delete:success
m365-file-downloadfile-download:success
m365-file-movefile-move:success
m365-file-readfile-read:success
m365-file-renamefile-rename:success
m365-file-writefile-write:success
m365-group-creategroup-create:success
m365-user-createuser-create:success
m365-user-create-failuser-create:fail
m365-user-deleteuser-delete:success
mailbox-item-deletemailbox-item-delete:success
mailbox-item-readmailbox-item-read:success
mailbox-modifymailbox-modify:success
mailbox-permission-modifymailbox-permission-modify:success
member-addedgroup-member-add:fail
member-removedgroup-member-remove:success
nac-failed-logonendpoint-authentication:fail
nac-logonendpoint-authentication:success
netflow-connectionnetwork-traffic:success
network-alertalert-trigger:success
network-connection-failednetwork-close:success
network-connection-successfuldns-traffic:success
network-infocertificate-expire:success
ntlm-logonendpoint-authentication:success
physical-accessphysical_location-access:success
print-activityprinter-activity:success
privileged-accessuser-privilege-assign:fail
privileged-object-accessuser-privilege-use:success
process-alertalert-trigger:success
process-createdprocess-create:success
process-created-failedprocess-create:fail
process-networknetwork-session:success
process-network-failednetwork-session:fail
registry-writeregistry-create:success
remote-accessendpoint-login:fail
remote-logonendpoint-login:fail
security-alertalert-trigger:success
service-createdservice-create:success
service-logonendpoint-login:success
share-accessshare-access:success
share-access-deniedshare-access:fail
share_link-createapp-activity:success
share_link-member-addapp-activity:success
share_link-modifyapp-activity:success
share_link-useshare_link-open:success
system-infocertificate-request:success
task-createdscheduled_task-create:fail
usb-activityperipheral_device-activity:success
usb-insertperipheral_device-insert:success
usb-readfile-read:success
usb-writefile-copy:success
user-role-assignuser-role-assign:success
user-role-revokeuser-role-revoke:success
vpn-connectionvpn-login:success
vpn-loginvpn-login:success
vpn-logoutvpn-logout:success
web-activity-allowedhttp-request:success
web-activity-deniedhttp-request:fail
web-meeting-createdmeeting-create:success
web-meeting-endedmeeting-end:success
web-meeting-participant-joinedmeeting-member-join:success
web-meeting-startedmeeting-start:success
web-meeting-updatedmeeting-modify:success
webconference-loginapp-login:success
webconference-operations-activityapp-activity:success
winsession-disconnectendpoint-logout:success
workstation-lockedendpoint-lock:success
workstation-unlockedendpoint-unlock:success