A customer admin performed an auditable action.

Subscription filters

• action — one of: ACKNOWLEDGED_AI_GOVERNANCE_SENSOR_TERMS, ACKNOWLEDGED_SMS_VOICE_PHISHING_TERMS, ACTIONED_EMAIL_SECURITY_EVENT, ACTIVATED_AI_GOVERNANCE_POLICY, ADDED_ADMIN, ADDED_ADMIN_AUTHENTICATION_METHOD, ADDED_AI_GOVERNANCE_TRACKING_EXCLUSION, ADDED_EMPLOYEE_AUTHENTICATION_METHOD, ADDED_EMPLOYEE_TO_TRAINING_CAMPAIGN, ADDED_INDIVIDUAL_EMPLOYEE, ADMIN_LOGGED_IN, ADMIN_RESET_PASSWORD, ASSIGNED_INBOX_DOMAIN_OWNER, ATTESTED_EMAIL_IP_WHITELIST, BATCH_GENERATE_EXECUTIVE_REPORTS, BULK_DELETED_COMPANY_LIBRARY_ASSETS, BULK_DELETED_EXCLUSION_RULES, BULK_DELETED_SENDER_RULES, BULK_UPDATED_EMPLOYEES_PHISHING_FAILURE_STATUSES, CHANGED_ADMIN_ROLE, CLONED_PHISHING_SIMULATION_CAMPAIGN, CLONED_TRAINING_CAMPAIGN, CONNECTED_ENRICHMENT_DATA_SOURCE, CONNECTED_INTEGRATION, CONNECTED_PRIMARY_IDENTITY_SOURCE, CREATED_AI_GOVERNANCE_POLICY, CREATED_API_KEY, CREATED_CALL_GUARD_INTEGRATION, CREATED_EMAIL_DOMAIN_CONFIGURATION, CREATED_EXECUTIVE_REPORT, CREATED_FEATURE_ANNOUNCEMENT, CREATED_GROUP, CREATED_INTEGRATION_LINK, CREATED_INTEGRATION_OAUTH_CREDENTIALS, CREATED_MCP_OAUTH_CLIENT, CREATED_MODULE, CREATED_PERSONA, CREATED_PHISHING_DOMAIN, CREATED_PHISHING_SIMULATION_CAMPAIGN, CREATED_PRONUNCIATION_OVERRIDE, CREATED_RISK_SIGNAL, CREATED_SCENARIO, CREATED_SENDER_RULE, CREATED_TRAINING_CAMPAIGN, CREATED_WEBHOOK_ENDPOINT, DEACTIVATED_EMPLOYEE, DELETED_ADMIN, DELETED_AI_GOVERNANCE_POLICY, DELETED_API_KEY, DELETED_CLASSIFIER_THRESHOLD, DELETED_CUSTOM_ATTRIBUTE_SCHEMA, DELETED_EMAIL_DOMAIN_CONFIGURATION, DELETED_EXECUTIVE_REPORT, DELETED_FEATURE_ANNOUNCEMENT, DELETED_MODULE_TRANSLATIONS, DELETED_PERSONA, DELETED_PERSONA_WITH_DEPENDENT_CONTENT, DELETED_PHISHING_SIMULATION_CAMPAIGN, DELETED_PRONUNCIATION_OVERRIDE, DELETED_RISK_SIGNAL, DELETED_SCENARIO, DELETED_SENDER_RULE, DELETED_TRAINING_CAMPAIGN, DELETED_WEBHOOK_ENDPOINT, DISABLED_WEBHOOK_ENDPOINT, DISCONNECTED_ENRICHMENT_DATA_SOURCE, DISCONNECTED_INTEGRATION, DISCONNECTED_PRIMARY_IDENTITY_SOURCE, DOWNLOADED_AI_PERSONA_AUDIO_CLIP, DOWNLOADED_AI_PERSONA_IMAGE, DOWNLOADED_AI_PERSONA_VIDEO_CLIP, DOWNLOADED_AI_PERSONA_VOICE_SAMPLE, DOWNLOADED_EMAIL_ATTACHMENT, DOWNLOADED_SCORM_PACKAGE, DUPLICATED_SCENARIO, EDITED_ADMIN, EDITED_AI_GOVERNANCE_POLICY, EDITED_CAMPAIGN_MODULE, EDITED_CAMPAIGN_POSTBACKS, EDITED_CAMPAIGN_SCHEDULE, EDITED_FEATURE_ANNOUNCEMENT, EDITED_GROUP, EDITED_LATE_COMPLETIONS, EDITED_LEARNER_SETTINGS, EDITED_MANAGER_ESCALATIONS, EDITED_MANAGER_PHISH_FAILURE_NOTIFICATION, EDITED_MODULE, EDITED_MODULE_TRANSLATIONS, EDITED_NOTIFICATION_CADENCE, EDITED_NOTIFICATION_EXCLUSIONS_LIST, EDITED_NOTIFICATION_MESSAGE, EDITED_PERSONA, EDITED_PHISHING_IP_BLOCKLIST, EDITED_PHISHING_SIMULATION_CAMPAIGN, EDITED_PRONUNCIATION_OVERRIDE, EDITED_RISK_SIGNAL, EDITED_SCENARIO, EDITED_TRAINING_CAMPAIGN, EDITED_WORKSPACE_NAME, ENABLED_SPAM_DETECTION, ENDED_AI_GOVERNANCE_POLICY, ENDED_PHISHING_SIMULATION_CAMPAIGN, ENDED_TRAINING_CAMPAIGN, EXCLUDED_EMPLOYEE, EXPORTED_EMAIL_ANNOTATION_CONTENT, EXPORTED_TRIAGE_SECURITY_EVENTS_CSV, GENERATED_AI_PERSONA_AUDIO_CLIP, GENERATED_AI_PERSONA_VIDEO_CLIP, GENERATED_THREAT_LANDSCAPE_REPORT, HARD_DELETED_EMPLOYEE, IMPORTED_EXCLUSION_RULES, IMPORTED_INTEGRATION_SENDER_RULES, IMPORTED_SENDER_RULES, INTERNAL_ACCESS_EXTENDED, INTERNAL_ACCESS_REQUESTED, INTERNAL_SESSION_ENDED, LAUNCHED_VIDEO_CALL_ATTACK, MARKED_EMPLOYEE_COMPLETED_TRAINING_CAMPAIGN, MARKED_EMPLOYEE_NOT_FAILED_PHISHING_SIMULATION, MARKED_KNOWN_SENDER, MARKED_MODULE_TRANSLATIONS_UP_TO_DATE, MARKED_SCENARIO_TRANSLATIONS_UP_TO_DATE, OVERRODE_EMAIL_ANNOTATION, OVERRODE_EMPLOYEE_ATTRIBUTE, PATCHED_CAMPAIGN_FRAMES, PROMOTED_EMAIL_DOMAIN_CONFIGURATION, PUBLISHED_INDUSTRY_BENCHMARK_REPORT, REACTIVATED_EMPLOYEE, REENABLED_WEBHOOK_ENDPOINT, REFRESHED_DIRECTORY_INTEGRATION, REFRESHED_INTEGRATION, REGENERATED_FRAME_NARRATIONS, REGENERATED_THREAT_LANDSCAPE_REPORT, REGENERATED_WEBHOOK_ENDPOINT_SECRET, REGENERATE_EXECUTIVE_REPORT, REMOVED_ADMIN_AUTHENTICATION_METHOD, REMOVED_AI_GOVERNANCE_TRACKING_EXCLUSION, REMOVED_EMPLOYEE_AUTHENTICATION_METHOD, REMOVED_EMPLOYEE_FROM_TRAINING_CAMPAIGN, REMOVED_SCENARIO_TRANSLATIONS, RENAMED_COMPANY_LIBRARY_ASSET, REQUESTED_COMPANY_PROVISIONING, REQUESTED_MODULE_TRANSLATION_CANCELLATION, REQUESTED_MODULE_TRANSLATION_GENERATION, REQUESTED_MODULE_TRANSLATION_RECOVERY, REQUESTED_SCENARIO_TRANSLATION_GENERATION, RESET_EMAIL_IP_WHITELIST, RESOLVED_CALL_GUARD_SECURITY_EVENT, RESTORED_CAMPAIGN_FRAMES, RESTORED_NOTIFICATION_MESSAGE_DEFAULT, RESTORED_SCENARIO_DEFAULT, REVEALED_WEBHOOK_ENDPOINT_SECRETS, REVERTED_EMPLOYEE_ATTRIBUTE_OVERRIDE, REVIEWED_INTEGRATION_ONBOARDING_CHANGES, REVOKED_CALL_GUARD_INTEGRATION, REVOKED_MCP_OAUTH_CLIENT, SCHEDULED_PHISHING_SIMULATION_CAMPAIGN, SCHEDULED_TRAINING_CAMPAIGN, SELECTED_AI_IMAGE, SENT_ADHOC_PHISHING_SIMULATION_NOTIFICATION, SENT_ADHOC_TRAINING_NOTIFICATION, SENT_EMAIL_DOMAIN_TEST, SENT_PHISHING_CAMPAIGN_NOTIFICATION_TEST_SENDS, SENT_TRAINING_CAMPAIGN_NOTIFICATION_TEST_SENDS, SENT_WEBHOOK_TEST_EVENT, STARTED_AI_IMAGE_GENERATION, STARTED_PROVISIONING_CONTENT_WORKFLOW, SUBMITTED_EMAIL_ANNOTATION, TOGGLED_AUTOMATED_BOT_EXCLUSION_RULE, TOGGLED_AUTO_ACTIVATE_ALL_AVAILABLE_DOMAINS, TOGGLED_EMAIL_SECURITY_REMEDIATE_SIMILAR_MESSAGES, TOGGLED_EMAIL_SECURITY_REMEDIATION, TOGGLED_PHISHING_DOMAIN, TOGGLED_PHISHING_EMAIL_SENDER_SUBDOMAINS, TOGGLED_PRONUNCIATION_OVERRIDE, UNKNOWN, UNPUBLISHED_INDUSTRY_BENCHMARK_REPORT, UNSCHEDULED_PHISHING_SIMULATION_CAMPAIGN, UNSCHEDULED_TRAINING_CAMPAIGN, UPDATED_AI_GOVERNANCE_PROMPT_RETENTION, UPDATED_API_KEY_PERMISSIONS, UPDATED_API_KEY_STATUS, UPDATED_CALL_GUARD_PHONE_ROUTING, UPDATED_COMPANY_ATTRIBUTE, UPDATED_COMPANY_CONTEXT_ADDENDUM, UPDATED_COMPANY_PRODUCT_STATUS, UPDATED_CUSTOM_ATTRIBUTE_SCHEMA, UPDATED_DIRECTORY_INTEGRATION_SYNC_TYPE, UPDATED_EMAIL_BANNER_SETTINGS, UPDATED_EMAIL_SECURITY_REMEDIATION_RULES, UPDATED_EMAIL_WHITELISTING_VENDORS, UPDATED_EMAIL_WHITELISTING_VENDOR_STATUS, UPDATED_INTEGRATION_CREDENTIALS, UPDATED_INTEGRATION_DISPLAY_NAME, UPDATED_INTEGRATION_SYNC_TYPE, UPDATED_LANGUAGE_SOURCES, UPDATED_LMS_INTEGRATION, UPDATED_NOTIFICATION_SENDER_SETTINGS, UPDATED_PHISHING_DELIVERY_METHOD, UPDATED_PHISHING_DOMAIN_STATUS, UPDATED_PHISH_FORWARDING_RULES, UPDATED_SCENARIO_VOICE_PHISHING_REVEAL, UPDATED_TRIAGE_SETTINGS, UPDATED_USER_ATTRIBUTE_SOURCE_PRIORITIES, UPDATED_WEBHOOK_ENDPOINT, UPLOADED_AI_PERSONA_AUDIO, UPLOADED_AI_PERSONA_IMAGE, UPLOADED_COMPANY_LIBRARY_ASSET, UPLOADED_EMPLOYEE_LIST_CSV, UPSERTED_CLASSIFIER_THRESHOLD, VERIFIED_EMAIL_DOMAIN_CONFIGURATION, VIEWED_CALL_GUARD_LIVE_TRANSCRIPTS, VIEWED_EMAIL_CONTENT, VIEWED_GOVERNANCE_AGENT_INSTRUCTION, VIEWED_GOVERNANCE_PROMPT, VIEWED_GOVERNANCE_PROMPT_AGENT_ACTIONS, VIEWED_GOVERNANCE_SENSITIVE_CONTENT, VIEWED_MISSING_IDENTIFIER_USERS
• category — one of: AI_GOVERNANCE, API, CALL_GUARD, EMAIL_SECURITY, LLM_SECURITY, SAT_PROGRAM, USERS, WORKSPACE
• subcategory — one of: ADMINS, AI_PERSONAS, API_KEYS, ASSET_LIBRARY, AUTHENTICATION, CALL_GUARD_SECURITY_EVENTS, COMPANY_CONTEXT, COMPANY_SETTINGS, DETECTION_THRESHOLDS, EMAIL_ANNOTATIONS, EMAIL_SECURITY_EVENTS, EMPLOYEES, EXCLUSION_RULES, EXECUTIVE_RISK, GOVERNANCE_POLICIES, GOVERNANCE_PROMPTS, GOVERNANCE_SETTINGS, GROUPS, INTEGRATIONS, PHISHING_SIMULATION, PRONUNCIATIONS, REMEDIATION_SETTINGS, SENDER_RULES, THREAT_LANDSCAPE, TRAINING, WEBHOOKS
• success — true or false

{
  "data": {
    "payload": {
      "action": "CREATED_TRAINING_CAMPAIGN",
      "actor": {
        "email": "alex.morgan@example.com",
        "id": "7d3f2a1b-9c8e-4d6f-a5b4-3c2d1e0f9a87",
        "name": "Alex Morgan",
        "role": "ACCOUNT_OWNER",
        "type": "ADMIN"
      },
      "category": "SAT_PROGRAM",
      "client_info": {
        "browser": "Chrome",
        "browser_version": "125",
        "device": "Mac",
        "ip": "203.0.113.42",
        "os": "macOS",
        "os_version": "14.5"
      },
      "entities": [
        {
          "id": "a1b2c3d4-e5f6-4789-a0b1-c2d3e4f5a6b7",
          "name": "Q3 Security Essentials",
          "type": "CAMPAIGN"
        }
      ],
      "id": "123e4567-e89b-12d3-a456-426614174000",
      "message": "Created training campaign.",
      "subcategory": "TRAINING",
      "success": true
    }
  },
  "datacontenttype": "application/json",
  "id": "9b2f6c1e-8d3a-4f0b-a1c2-5e7d9f3b6a48",
  "source": "/adaptive",
  "specversion": "1.0",
  "time": "2026-06-09T18:00:00Z",
  "type": "admin.audit_log.created"
}