Summary Event

• type
  • Policy
• action
  • created

Summary Event

• type
  • policy
• action
  • update

Summary Event

• type
  • policy
• action
  • create

Summary Event

• type
  • policy
• action
  • update

Indicates a secure draft was created in one of the virtru clients

• type
  • policy
• action
  • create
  • update

Indicates a secure email was sent

• type
  • policy
• action
  • create
  • update

Indicates a secure email was forwarded

• type
  • policy
• action
  • update

Indicates a secure email was accessed

• type
  • contract-get
• action
  • create

Indicates access to a secure email was denied

• type
  • contract-get
• action
  • create-error

Indicates a secure email was revoked

• type
  • policy
• action
  • update

Indicates a previously revoked email has been re-enabled

• type
  • policy
• action
  • update

Indicates an expiration date has been set on a secure email

• type
  • policy
• action
  • update

Indicates a previously set expiration date on a secure email was removed

• type
  • policy
• action
  • update

Indicates forwarding was disabled for a secure email

• type
  • policy
• action
  • update

Indicates forwarding was enabled for a secure email

• type
  • policy
• action
  • update

Indicates secure email watermark was enabled

• type
  • policy
• action
  • update

Indicates secure email watermark was disabled

• type
  • policy
• action
  • update

Indicates secure email one click was enabled

• type
  • policy
• action
  • update

Indicates secure email one click was disabled

• type
  • policy
• action
  • update

Indicates secure file was attached to an email

• type
  • policy
• action
  • create
  • update

Indicates an unencrypted file was encrypted

• type
  • policy
• action
  • create
  • update

Indicates an encrypted copy of a file was created

• type
  • policy
• action
  • create
  • update

Indicates a secure file was uploaded

• type
  • policy
• action
  • create

Indicates a secure file was decrypted

• type
  • policy
• action
  • create
  • update

Indicates a decrypted copy of a file was created

• type
  • policy
• action
  • create
  • update

Indicates a decrypted copy of a file was downloaded

• type
  • policy
• action
  • create
  • update

Indicates secure file was accessed. This can occur when a secure email/draft with an attachment is opened, or when a secure file in Drive is opened

• type
  • contract-get
• action
  • create

Indicates a secure file was shared

• type
  • policy
• action
  • update

A new version of a file has been added.

• type
  • policy
• action
  • update

A version of a file has been removed.

• type
  • policy
• action
  • update

Indicates a secure file was revoked

• type
  • policy
• action
  • update

Indicates a previously revoked file was reauthorized

• type
  • policy
• action
  • update

Indicates an unsuccessful attempt to access a file

• type
  • contract-get
• action
  • create-error

Indicates expiration enabled on a secure file

• type
  • policy
• action
  • update

Indicates expiration disabled on a secure file

• type
  • policy
• action
  • update

Indicates file re-sharing enabled

• type
  • policy
• action
  • update

Indicates file re-sharing disabled

• type
  • policy
• action
  • update

Indicates file watermark enabled

• type
  • policy
• action
  • update

Indicates file watermark disabled

• type
  • policy
• action
  • update

Indicates a license invitation was sent

• type
  • licenseInvitation
• action
  • create

Indicates a license invitation was accepted

• type
  • licenseInvitation
• action
  • update

Indicates the license for a non-activated user was removed

• type
  • licenseInvitation
• action
  • update

Indicates a user-activated the virtru plugin or logged into the Control Center

• type
  • appIdBundle
• action
  • create

Indicates a user has completed the activation process on one of the Virtru Clients

• type
  • appIdBundle
• action
  • update

Indicates a user logged out of the Control Center or a plugin

• type
  • appIdBundle
• action
  • update

Indicates a user was created. This can be triggered by a domain sync

• type
  • userSettings
• action
  • create

Indicates a user was updated. This can be triggered by any action that may update to a user's setting. e.g. a user updating a setting on their settings page, domain sync, or a license update

• type
  • userSettings
• action
  • update

Indicates a user was given permissions to manage dlp rules ( MANAGE DLP RULES in the permissions modal)

• type
  • unit-attributes
• action
  • update

Indicates a user was given admin permissions to manage other users within the org (EDIT PERMISSIONS in the permissions modal)

• type
  • unit-attributes
• action
  • update

Indicates a user was given permissions to view email and file meta data (VIEW SECURE METADATA in the permissions modal)

• type
  • unit-attributes
• action
  • update

Indicate a user was given permissions to decrypt any content even if they are not the intended recipient (DECRYPT SECURE CONTENT in the permissions modal)

• type
  • unit-attributes
• action
  • update

Opposite of Policy Admin Added

• type
  • unit-attributes
• action
  • update

Opposite of User Admin Added

• type
  • unit-attributes
• action
  • update

Opposite of Content Admin Added

• type
  • unit-attributes
• action
  • update

Opposite of eDiscovery Admin Added

• type
  • unit-attributes
• action
  • update

Opposite of User Permissions Added

• type
  • userSettings
• action
  • update

Indicates a user was granted super admin permissions

• type
  • userSettings
• action
  • update

Indicates a was removed as a super admin

• type
  • userSettings
• action
  • update

Indicates an OU/GROUP was created, usually during a domain sync

• type
  • unit-attributes
• action
  • create

Indicates an OU/GROUP was updated, usually during a domain sync

• type
  • unit-attributes
• action
  • update

Indicates an API token was created for the org

• type
  • api-token
• action
  • create

Indicates an Organization was created

• type
  • organization
• action
  • create

Indicates some organization-wide action, such as domain sync, occurred.

• type
  • organization
• action
  • update

Indicates the encrypted search key feature was enabled

• type
  • encrypted-search-key
• action
  • create

Indicates the encrypted search key feature was disabled

• type
  • encrypted-search-key
• action
  • update

Indicates a DLP rule was created in the Control Center

• type
  • dlp-rules
• action
  • create

Indicates a DLP rule was updated in the Control Center

• type
  • dlp-rules
• action
  • create
  • update

Indicates a DLP rule was deleted in the Control Center

• type
  • dlp-rules
• action
  • create
  • update

Indicates a DLP rule was triggered in one of the virtru clients

• type
  • policy
• action
  • create

Indicates a DLP rule was triggered but ignored in one of the virtru clients

• type
  • dlpOverride
• action
  • create

Attribute Name

Type

Description

action

String

The action that was done to the object.

Possible values:

• create
• update

created

String

The ISO8601 datetime when the token was created.

creator

String

The email address of the Virtru employee who created the token.

displayName

String

A short label that describes the purpose of the token.

lastModified

String

The date the record was last modified

orgActionType

String

The organization action the record represents.

orgId

String

The organizational ID.

owner

String

The email address of the user who requested the token.

permissions[]

Array<String>

Array of permissions the token has. This dictates what the token can be used for.

Possible values:

• servicePolicyCreate
• servicePolicyEdit
• servicePolicyContractFetch
• servicePolicyBulkExport
• servicePartnerProvision
• serviceAuditExport

recordId

String

The unique ID for this record.

timestamp

String

Datetime of the event.

Attribute Name

Type

Description

action

String

Actions taken for this record

Possible Values

• create
• update

created

String

The ISO8601 datetime when the appIdBundle was created.

groups[]

Array<String>

An array of groups that the user is in.

e.g. [ ‘Engineering@virtru.com’, ‘Gateway@virtru.com’ ]

isActivateEvent

Boolean

Whether the appId was activated as part of this event.

isDisableEvent

Boolean

Whether the appId was disabled as part of this event.

isRevokedEvent

Boolean

Whether the appId was revoked as part of this event.

lastModified

String

Datetime last modified.

ous[]

Array<String>

IDs of all organizational units of the user which the appIdBundle was created for.

e.g. [‘id%3A02f1mw1826k6eyh’,‘id%3A02f1mw182boq9zy’]

orgActionType

String

Unique Id and action of this record.

orgId

String

Unique Id of the organization

primaryOu

String

ID of primary organizational unit of the user which the appIdBundle was created for.

recordId

String

Unique Id of the record.

requestId

String

Unique id of the request

requestIp

String

IP of the requesting client.

state

String

The state of the appIdBundle.

Possible values:

• active (the appId is active and in use)
• pending (the appId is pending and awaiting verification by the user)
• disabled (the appId is disabled)
• revoked (the appId is revoked)

timestamp

String

Timestamp of the event.

type

String

Should always be "appIdBundle"

userAgent

String

User agent string of the client used for the request.

userId

String

The email address of the user who the appId was created for.

virtruClient

String

String representing the client used for the request.

Attribute Name

Type

Description

Recorded action

Possible Values

• create
• update

groups[]

Array<String>

Array of groups that the accessing user belongs to.

e.g. [ ‘engineer@virtru.com’, ‘gateway@virtru.com’ ]

isNoAuth

Boolean

True if the user accessed the contract without authenticating.

orgActionType

String

Action taken.

ous[]

Array<String>

IDs of all organizational units of the user who accessed the policy.

e.g. [‘id%3A02f1mw1826k6eyh’,‘id%3A02f1mw182boq9zy’]

policyId

String

The ID of the policy that was accessed.

primaryOu

String

ID of primary organizational unit of the user who accessed the policy.

requestId

String

Unique Id of the request

requestIp

String

IP address of the requesting user.

userId

String

The email address of the user who accessed the policy.

Attribute Name

Type

Description

created

String

The ISO8601 datetime when the DLP rule was first created.

dlpActions

Array<String>

The actions the rule takes when triggered.

Possible values:

• virtru:encrypt (The email must be encrypted)
• virtru:warn (The user must be warned of the violation)
• virtru:ignore (The user is not warned, but a violation is logged)
• virtru:addCc (An email address is added to the cc field)
• virtru:addTo (An email address is added to the email's To field)
• virtru:addBcc (An email address is added to the bcc field)
• virtru:stripAttachments (All attachemnts are removed from the email)
• virtru:addContent (Specifiied content is added to the email body)
• virtru:expire (Expires the policy after the specified time interval)
• virtru:disableForwarding (The policy will have forwarding disabled)
• virtru:noAuth (The policy does not require authentication)
• virtru:isManaged (Prevents downloading and printing of attachments)
• virtru:gateway:decrypt (Decrypt action for the Virtru Gateway)
• virtru:gateway:archive (Archive action for the Virtru Gateway)

displayName

String

The name of the DLP rule.

groups[]

Array<String>

Array of groups that the DLP rule applies to.

e.g. [ ‘Engineering@virtru.com’, ‘Gateway@virtru.com’ ]

isDeprecated

Boolean

Whether the rule is in use anymore;

Possible Values:

• False - Rule is Active
• True - Rule is Deleted

ous[]

Array<String>

IDs of all organizational units of that the DLP rule applies to.

e.g. [‘id%3A02f1mw1826k6eyh’,‘id%3A02f1mw182boq9zy’]

requestIp

String

Ip of the requesting client.

ruleGroups[]

Array<String>

Array of groups that the DLP rule applies to.

e.g. [ ‘Engineering@virtru.com’, ‘Gateway@virtru.com’ ]

ruleId

String

The unqiue ID of the DLP rule.

ruleOus[]

Array<String>

IDs of all organizational units of that the DLP rule applies to.

e.g. [‘id%3A02f1mw1826k6eyh’,‘id%3A02f1mw182boq9zy’]

scope

String

Mail flow direction for rule to be evaluated

Possible Values:

• inbound
• outbound

userId

String

The email address of the user who created or updated the DLP rule.

The action that was done to the object.

Possible values:

• create

type

String

Should always be "dlpOverride"

Array of groups that the DLP rule applies to.

e.g. [ ‘Engineering@virtru.com’, ‘Gateway@virtru.com’ ]

userId

String

The email address of the user who created or updated the DLP rule.

userOus

Array<String> 

IDs of all organizational units of the user which the appIdBundle was created for.

e.g. [‘id%3A02f1mw1826k6eyh’,‘id%3A02f1mw182boq9zy’]

userPrimaryOu

String

ID of primary organizational unit of the user which the appIdBundle was created for.

violatedRuleIds[]

Array<String>

Array of DLP rule IDs that were triggered and bypassed by the user. Corresponds with violatedRuleNames.

violatedRuleNames[]

Array<String>

Array of DLP rule IDs that were triggered and bypassed by the user. Corresponds with violatedRuleNames.

virtruClient

String

Name of the requesting client 

Attribute Name

Type

Description

Action recoreded by record

Possible Values

• create
• update

created

String

The ISO8601 datetime when the key was created.

keyId

String

The unique ID of the encrypted search key.

orgActionType

String

Organization level Action

orgId

String

Unique ID of the organization

receiverId

String

Unique Id of the recipient

recordId

String

Unique ID of the record

requestId

String

 requestIp

String

IP of the computer that requested the creation/revocation of the key

status

String

Status of the key

Possible Values

• active
• inactive

timestamp

String

Datetime of the event

userId

String

The email address of the  user who created the search key.

Attribute Name

Type

Description

acceptedOn

String

The ISO8601 datetime when/if the invitation was accepted.

created

String

The ISO8601 datetime when the invitation was created.

invitationId

String

The unique ID of the livense invitation.

receiverId

String

The email address of the user who was sent the invitation.

revokedOn

String

The ISO8601 datetime when/if the invitation was revoked.

status

String

The status of the invitation.

Possible values:

• active
• revoked
• invited

type

String

Should always be "licenseInvitation"

Attribute Name

Type

Description

action

String

The action that was done to the object. 

Possible Values

• create
• update

created

String

The ISO8601 datetime when the invitation was created.

delegationEmail

String

The delegation email address for use when triggering the automatic domain synchronization.

lastDomainRefresh

String

The ISO8601 datetime when the organization was last synchronized.

lastModified

String

Date the record was last modified.

orgActionType

orgId

String

The unique ID of the organization.

owner

String

The email address of the organization owner.

recordId

String

Unique ID of the record

requestId

String

The unique ID of the request.

requestIp

 String

 IP of the requesting client

timestamp

String

The ISO8601 datetime of the moment the audit record was created.

type

String

Should always be "organization"

userAgent

String

The web browser user agent. Contains information such as the browser and operating system.

userId

String

The email address of the user who created or updated the organization.

virtruClient

String

The Virtru client that was used to make the request.

Attribute Name

Type

Description

accessedBy[]

Array<String>

Array of all email addresses of users who have accessed the policy.

action

String 

The action that was done to the object.

Possible Values

• create
• update

appliedActions[]

Array<String>

Array of DLP actions applied to the policy as a result of the above violation.

e.g. [‘virtru:encrypt’,‘virtru:disableForwarding’]

children[]

Array<String>

Array of child policy IDs (usually attachments to an email).

created

String

The ISO8601 datetime when the policy was created.

displayName

String

The subject/name of the email/file.

expiration

String

The ISO8601 datetime for when/if the policy is set to expire.

forwardLog[]

Array<Object>

Array of forward events containing recipient, sender, and timestamp fields.

e.g.
[
{
"recipient": "some-recipient@virtru.com",
"sender": "bob@virtru.com",
"timestamp": "2017-04-28T16:04:50.181Z"
},
...
]

groups[]

Array<String>

Array of groups which the policy belongs to. Same as the groups of the user who created the policy at the time.

e.g. [‘engineering@virtru.com’,‘gateway@virtru.com’]

isExpireEvent

Boolean

True is policy expiration was set as part of this event.

isForwardEvent

Boolean

True if an email/file was forwarded as part of this event. Represents a change to the 'forwardLog' field.

isForwardingDisabled

Boolean

True if forwarding has been disabled for this policy.

isForwardingDisabledEvent

Boolean

True if policy forwarding was disabled as part of this event.

isManaged

Boolean

True if the policy is managed.

isManagedEvent

Boolean

True if policy was set to managed as part of this event.

isNoAuth

Boolean

True if the policy does not require authentication.

isNoAuthEvent

Boolean

True if authorization was disabled as part of this event.

isRevokeEvent

Boolean

True if the policy was revoked as part of this event.

isReauthorizeEvent

Boolean

True if a previously-revoked policy was re-enabled as part of this event.

isSendEvent

Boolean

True if an email/file was sent as part of this event.

lastModified

String

Datetime of the last time the record was modified

ous[]

Array<String>

IDs of all organizational units of the user who create/updated the policy.

e.g. [‘id%3A02f1mw1826k6eyh’,‘id%3A02f1mw182boq9zy’]

orgActionType

String

A simple join of the orgId, type, and action fields. Used for indexing purposes.

orgId

String

Unique ID of the organization

policyId

String

The unique ID of the policy.

policyGroups[]

Array<String>

Array of groups which the policy belongs to. Same as the groups of the user who created the policy at the time.

e.g.
[
‘engineering@virtru.com’,
‘gateway@virtru.com’
]

policyOus[]

Array<String>

IDs of all organizational units of the user who create/updated the policy.

e.g.
[
‘id%3A02f1mw1826k6eyh’,
‘id%3A02f1mw182boq9zy’
]

policyOwner

String

The email address of the policy owner (the user who originally created the policy).

policyType

String

The type of the policy.

Possible Values:

• email
• file
• draft

primaryOu

String

ID of the primary organizational unit of the user who created/updated the policy.

e.g. ‘id%3A02f1mw1826k6eyh’

recipients[]

Array<String>

Array of users (email addresses) who are authorized to access this email or file.

recordId

String

Unique ID of the record

requestId

String

The unique ID of the request.

requestIp

String

The IP address where the request originated from.

state

String

Whether the policy is active or revoked.

Possible Values:

• active
• deactivated

timestamp

String

The ISO8601 datetime of the moment the audit record was created.

type

String

Should always be "policy"

userAgent

String

The web browser user agent. Contains information such as the browser and operating system.

userId

String

The email address of the user who created or updated the policy.

violatedRuleIds[]

Array<String>

Array of IDs of DLP rules that were violated/triggered when this policy was created.

violatedRuleNames[]

Array<String>

Array of Names of DLP rules that were violated/triggered when this policy was created.

virtruClient

String

The Virtru client that was used to make the request.

Attribute Name

Type

Description

action

String 

The action that was done to the object.

Possible Values

• create
• update

adminDlp[]

Array<String>

Arrays of various administrators of this unit broken up by permissions.

adminDlpAdded[]

Array<String>

Arrays of any administrators that were added or removed segmented up by permissions type.

adminPolicyBulkExport[]

Array<String>

Arrays of various administrators of this unit broken up by permissions.

adminPolicyContractFetch[]

Array<String>

Arrays of various administrators of this unit broken up by permissions.

adminPolicyEdit[]

Array<String>

Arrays of various administrators of this unit broken up by permissions.

adminPolicyRead[]

Array<String>

Arrays of various administrators of this unit broken up by permissions.

adminPolicyRevoke[]

Array<String>

Arrays of various administrators of this unit broken up by permissions.

adminUnit[]

Array<String>

Arrays of various administrators of this unit broken up by permissions.

lastModified

String

Datetime of the last time the record was modified

orgActionType

String

A simple join of the orgId, type, and action fields. Used for indexing purposes.

orgId

String

Unique ID of the organization

An array of permissions for the users in this unit.

e.g. [
“canCreatePolicies”,
“canRevokeOwnedPolicies”,
]

recordId

String

Unique ID of the record

requestId

String

The unique ID of the request.

requestIp

String

The IP address where the request originated from.

timestamp

String

The ISO8601 datetime of the moment the audit record was created.

type

String

Should always be "unit-attributes"

String

The type of the unit.

Possible Values

• group
• organizational-unit

userAgent

String

The web browser user agent. Contains information such as the browser and operating system.

virtruClient

String

The Virtru client that was used to make the request.

Attribute Name

Type

Description

action

String 

The action that was done to the object.

Possible Values

• create
• update

created

String

The ISO8601 datetime the user was created

groups[]

Array<String>

An array of groups the user is in.

e.g. [ ‘Engineering@virtru.com’, ‘Gateway@virtru.com’ ]

lastModified

String

Datetime of the last time the record was modified

orgActionType

String

A simple join of the orgId, type, and action fields. Used for indexing purposes.

orgId

String

Unique ID of the organization

ous[]

Array<String>

IDs of all organizational units of the user.

e.g. [‘id%3A02f1mw1826k6eyh’,‘id%3A02f1mw182boq9zy’]

permissions[]

Array<String>

An array of permissions the user has.

Possible Values:

• servicePolicyCreate
• servicePolicyEdit
• servicePolicyContractFetch
• servicePolicyBulkExport
• servicePartnerProvision
• serviceAuditExport

primaryOu

String

ID of the primary organizational unit of the user.

e.g. ‘id%3A02f1mw1826k6eyh’

recordId

String

Unique ID of the record

timestamp

String

The ISO8601 datetime of the moment the audit record was created.

type

String

Should always be "userSettings"

userId

String

The user’s email address.

userSettingsGroups[]

Array<String>

An array of groups of the user settings.

e.g. [
'engineering@virtru.com',
'gateway@virtru.com'
]

userSettingsId

String

The email address of the user settings object being created or updated.

userSettingsIsSuperAdmin

Boolean

True if user settings is that of a super administrator.

userSettingsPrimaryOu

String

ID of the primary organizational unit of the user settings.

e.g. 'id%3A02f1mw1826k6eyh'

userSettingsOus[]

Array<String>

IDs of all organizational units of the user settings.

e.g. [
‘id%3A02f1mw1826k6eyh’,
‘id%3A02f1mw182boq9zy’
]