ManagedAccount
| Action | Sample | Rule |
|---|---|---|
| Managed account (catch-all) | N | N |
| Add Managed Company | N | N |
| Launch Into Managed Company | N | N |
| Unlink Managed Company | N | N |
any: Managed account (catch-all)
#Description
Matches any managed account event.
Fields #
| Name | Description |
|---|---|
uuid | Unique event identifier. |
timestamp | Time the event occurred. |
actor_uuid | Actor identifier. |
actor_details.uuid | Actor identifier. |
actor_details.name | Actor's full name. |
actor_details.email | Actor's email address. |
actor_type | Type of actor. |
actor_account_uuid | 1Password account identifier of the actor. |
account_uuid | 1Password account identifier. |
action | Action performed. |
object_type | Type of affected object. |
object_uuid | Identifier of the affected object. |
object_details.uuid | Affected user identifier, when applicable. |
object_details.name | Affected user's full name, when applicable. |
object_details.email | Affected user's email address, when applicable. |
aux_id | Numeric identifier for related event data. |
aux_uuid | Identifier for related event data. |
aux_details.uuid | Related user identifier, when applicable. |
aux_details.name | Related user's full name, when applicable. |
aux_details.email | Related user's email address, when applicable. |
aux_info | Additional event information. |
session.uuid | Session identifier. |
session.login_time | Time the session started. |
session.device_uuid | Identifier of the session device. |
session.ip | IP address used for the session. |
location.country | Client country inferred from IP address. |
location.region | Client region inferred from IP address. |
location.city | Client city inferred from IP address. |
location.longitude | Client longitude inferred from IP address. |
location.latitude | Client latitude inferred from IP address. |
mngdacc-create: Add Managed Company
#Description
A managed company was added to an MSP account.
Fields #
| Name | Description |
|---|---|
uuid | Unique event identifier. |
timestamp | Time the event occurred. |
actor_uuid | Actor identifier. |
actor_details.uuid | Actor identifier. |
actor_details.name | Actor's full name. |
actor_details.email | Actor's email address. |
actor_type | Type of actor. |
actor_account_uuid | 1Password account identifier of the actor. |
account_uuid | 1Password account identifier. |
action | Action performed. |
object_type | Type of affected object. |
object_uuid | Identifier of the affected object. |
object_details.uuid | Affected user identifier, when applicable. |
object_details.name | Affected user's full name, when applicable. |
object_details.email | Affected user's email address, when applicable. |
aux_id | Numeric identifier for related event data. |
aux_uuid | Identifier for related event data. |
aux_details.uuid | Related user identifier, when applicable. |
aux_details.name | Related user's full name, when applicable. |
aux_details.email | Related user's email address, when applicable. |
aux_info | Additional event information. |
session.uuid | Session identifier. |
session.login_time | Time the session started. |
session.device_uuid | Identifier of the session device. |
session.ip | IP address used for the session. |
location.country | Client country inferred from IP address. |
location.region | Client region inferred from IP address. |
location.city | Client city inferred from IP address. |
location.longitude | Client longitude inferred from IP address. |
location.latitude | Client latitude inferred from IP address. |
mngdacc-launchi: Launch Into Managed Company
#Description
An MSP technician launched into a managed company.
Fields #
| Name | Description |
|---|---|
uuid | Unique event identifier. |
timestamp | Time the event occurred. |
actor_uuid | Actor identifier. |
actor_details.uuid | Actor identifier. |
actor_details.name | Actor's full name. |
actor_details.email | Actor's email address. |
actor_type | Type of actor. |
actor_account_uuid | 1Password account identifier of the actor. |
account_uuid | 1Password account identifier. |
action | Action performed. |
object_type | Type of affected object. |
object_uuid | Identifier of the affected object. |
object_details.uuid | Affected user identifier, when applicable. |
object_details.name | Affected user's full name, when applicable. |
object_details.email | Affected user's email address, when applicable. |
aux_id | Numeric identifier for related event data. |
aux_uuid | Identifier for related event data. |
aux_details.uuid | Related user identifier, when applicable. |
aux_details.name | Related user's full name, when applicable. |
aux_details.email | Related user's email address, when applicable. |
aux_info | Additional event information. |
session.uuid | Session identifier. |
session.login_time | Time the session started. |
session.device_uuid | Identifier of the session device. |
session.ip | IP address used for the session. |
location.country | Client country inferred from IP address. |
location.region | Client region inferred from IP address. |
location.city | Client city inferred from IP address. |
location.longitude | Client longitude inferred from IP address. |
location.latitude | Client latitude inferred from IP address. |
mngdacc-unlink: Unlink Managed Company
#Description
A managed company was unlinked from an MSP account.
Fields #
| Name | Description |
|---|---|
uuid | Unique event identifier. |
timestamp | Time the event occurred. |
actor_uuid | Actor identifier. |
actor_details.uuid | Actor identifier. |
actor_details.name | Actor's full name. |
actor_details.email | Actor's email address. |
actor_type | Type of actor. |
actor_account_uuid | 1Password account identifier of the actor. |
account_uuid | 1Password account identifier. |
action | Action performed. |
object_type | Type of affected object. |
object_uuid | Identifier of the affected object. |
object_details.uuid | Affected user identifier, when applicable. |
object_details.name | Affected user's full name, when applicable. |
object_details.email | Affected user's email address, when applicable. |
aux_id | Numeric identifier for related event data. |
aux_uuid | Identifier for related event data. |
aux_details.uuid | Related user identifier, when applicable. |
aux_details.name | Related user's full name, when applicable. |
aux_details.email | Related user's email address, when applicable. |
aux_info | Additional event information. |
session.uuid | Session identifier. |
session.login_time | Time the session started. |
session.device_uuid | Identifier of the session device. |
session.ip | IP address used for the session. |
location.country | Client country inferred from IP address. |
location.region | Client region inferred from IP address. |
location.city | Client city inferred from IP address. |
location.longitude | Client longitude inferred from IP address. |
location.latitude | Client latitude inferred from IP address. |