Windows · xml
Windows Security 4720 — User account created
A user account was created in the local account database or directory context of the reporting host.
Log sources tagged identity. Browse source profiles associated with identity.
Windows · xml
A user account was created in the local account database or directory context of the reporting host.
Windows · xml
A member was added to a security-enabled local group.
Microsoft · json
Diagnostic export of service-principal authentication activity.
Microsoft · json
Directory audit events exported through Azure diagnostics.
Okta · json
Identity platform events with actor, client, outcome and target context.
Google · json
Admin SDK Reports API login activity.
Google · json
Admin SDK Reports API administrative activity.
GitHub · json
Organization or enterprise audit event export.