User events
The User Events section in ZTrust provides a detailed log of all activities performed by end users within a realm. It helps administrators track login activity, monitor security incidents, and audit user account changes.
Overview
Within the Events section, under the User Events tab, you can view:
Who performed an action
When the action occurred
What type of event took place
Where it originated from (client and IP address)
This helps administrators effectively audit user behavior, investigate issues, and strengthen security policies.
In the Events section, within the User Events tab, various actions carried out by end users can be observed.
Event Table Fields:
Field
Description
Time
Displays the exact date and time when the event occurred.
User
Shows the User ID of the individual who triggered the event.
Event Type
Indicates the type of event that occurred.
IP Address
Displays the IP address of the device from which the event originated.
Client
Identifies the client/application associated with the event.
Types of User Events
User events in ZTrust are broadly categorized into three major groups: Login Events, Brute Force Protection Events, and Account Events.
Login Events:
These events represent authentication and session-related activities.
Event Type
Description
Login
A user successfully logs into the system.
Register
A new user registers an account.
Logout
A user signs out of an active session.
Code to Token
An application exchanges an authorization code for an access token.
Refresh Token
A client or application renews an existing token.
Event Type
Description
User disabled by permanent lockout
The account is permanently locked due to repeated failed login attempts.
User disabled by temporary lockout
The account is temporarily locked due to multiple failed login attempts.
Event Type
Description
Social Link
A user links their account to a social login provider.
Remove Social Link
The connection to a social login provider is removed.
Update Email
The user updates their registered email address.
Update Profile
The user modifies their profile details.
Send Password Reset
ZTrust sends a password reset email to the user.
Update Password
The user changes their account password.
Update TOTP
Time-based One-Time Password (TOTP) settings are updated.
Remove TOTP
TOTP is removed from the user account.
Send Verify Email
ZTrust sends an email verification request.
Verify Email
The user successfully verifies their email.
Filtering and Searching User Events
ZTrust provides flexible filtering options to quickly locate specific events:
Filter
Usage
User ID
Enter a User ID and click Update to view events for that user.
Event Type
Select an event type from the dropdown and click Update.
Client
Enter a client name and click Update to see events linked to that client.
Date Range
Specify From Date and To Date, then click Update to view events within that timeframe.
IP Address
Enter an IP address to view events originating from that device.
Search Events
After entering filter details, click Search Events to display results.
Reset Filters
Click Reset to clear all applied filters and start fresh.
Refresh Data
Click the Refresh button to load the latest event records.
To filter the events or search for a particular event, click on the dropdown and enter the specific detail.
User ID
Enter the User ID, then click on Update to display events corresponding to that user ID.
Event saved type
By clicking on the dropdown and selecting the Event saved type and clicking on Update, all events corresponding to the selected type will be shown.
Client
Specify a client name, then after clicking on Update, events associated with that specific client will be displayed.
Date (From) and Date (To)
After specifying the Date (From) and Date (To), and clicking on Update events that occurred within this specified time frame will be displayed.
IP Address
After you've entered the IP Address of the device and clicked on Search events, you'll be presented with the list of relevant events.
Search events
Once you've entered the necessary details, to search for user events matching those criteria, click on Search events.
Reset
If you've entered the necessary details but decide not to search for user events matching those criteria, you can click on Reset.
Click the Refresh button to see the latest settings.
You can also choose how many user events you want to display on one screen. Select your preferred option from the dropdown menu as shown above.
Benefits of Monitoring User Events
Enhanced Security → Detect suspicious login attempts and account compromises.
User Activity Tracking → Monitor when and how users access applications.
Compliance Auditing → Generate reports for audits and compliance requirements.
Troubleshooting Support → Investigate failed logins, registration issues, and client integration errors.
Last updated