# User events

The **User Events** section in **ZTrust** provides a detailed log of all activities performed by end users within a realm. It helps administrators **track login activity, monitor security incidents, and audit user account changes**.

### **Overview**

Within the **Events** section, under the **User Events** tab, you can view:

* **Who** performed an action
* **When** the action occurred
* **What** type of event took place
* **Where** it originated from (client and IP address)

This helps administrators effectively **audit user behavior**, **investigate issues**, and **strengthen security policies**.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2Fj7z0fjJeOoekPofnEm0r%2Fimage.png?alt=media&#x26;token=6f86c170-49b5-4da2-965d-e42957cd09bd" alt=""><figcaption></figcaption></figure>

In the Events section, within the User Events tab, various actions carried out by end users can be observed.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FjUwrf7RdA3yJ0uRQyBUM%2Fimage.png?alt=media&#x26;token=8fa975a7-56d7-4cfb-9aba-b3291f9c6172" alt=""><figcaption></figcaption></figure>

**Event Table Fields:**

| **Field**      | **Description**                                                            |
| -------------- | -------------------------------------------------------------------------- |
| **Time**       | Displays the exact **date and time** when the event occurred.              |
| **User**       | Shows the **User ID** of the individual who triggered the event.           |
| **Event Type** | Indicates the **type of event** that occurred.                             |
| **IP Address** | Displays the **IP address** of the device from which the event originated. |
| **Client**     | Identifies the **client/application** associated with the event.           |

### **Types of User Events**

User events in **ZTrust** are broadly categorized into three major groups:\
**Login Events**, **Brute Force Protection Events**, and **Account Events**.

1. **Login Events:**&#x20;

These events represent **authentication and session-related activities**.

| **Event Type**    | **Description**                                                             |
| ----------------- | --------------------------------------------------------------------------- |
| **Login**         | A user successfully logs into the system.                                   |
| **Register**      | A new user registers an account.                                            |
| **Logout**        | A user signs out of an active session.                                      |
| **Code to Token** | An application exchanges an **authorization code** for an **access token**. |
| **Refresh Token** | A client or application renews an existing token.                           |

2.  #### **Brute Force Protection Events**

    These events are triggered when **multiple failed login attempts** are detected, helping to **secure user accounts**.

| **Event Type**                         | **Description**                                                              |
| -------------------------------------- | ---------------------------------------------------------------------------- |
| **User disabled by permanent lockout** | The account is **permanently locked** due to repeated failed login attempts. |
| **User disabled by temporary lockout** | The account is **temporarily locked** due to multiple failed login attempts. |

3.  #### **Account Events**

    These events track **user account updates and security changes**.

| **Event Type**          | **Description**                                                   |
| ----------------------- | ----------------------------------------------------------------- |
| **Social Link**         | A user links their account to a **social login provider**.        |
| **Remove Social Link**  | The connection to a social login provider is removed.             |
| **Update Email**        | The user updates their **registered email address**.              |
| **Update Profile**      | The user modifies their **profile details**.                      |
| **Send Password Reset** | ZTrust sends a **password reset email** to the user.              |
| **Update Password**     | The user **changes their account password**.                      |
| **Update TOTP**         | Time-based One-Time Password (**TOTP**) settings are **updated**. |
| **Remove TOTP**         | TOTP is **removed** from the user account.                        |
| **Send Verify Email**   | ZTrust sends an **email verification request**.                   |
| **Verify Email**        | The user successfully **verifies their email**.                   |

### **Filtering and Searching User Events**

ZTrust provides flexible filtering options to quickly locate specific events:

| **Filter**        | **Usage**                                                                                          |
| ----------------- | -------------------------------------------------------------------------------------------------- |
| **User ID**       | Enter a **User ID** and click **Update** to view events for that user.                             |
| **Event Type**    | Select an **event type** from the dropdown and click **Update**.                                   |
| **Client**        | Enter a **client name** and click **Update** to see events linked to that client.                  |
| **Date Range**    | Specify **From Date** and **To Date**, then click **Update** to view events within that timeframe. |
| **IP Address**    | Enter an **IP address** to view events originating from that device.                               |
| **Search Events** | After entering filter details, click **Search Events** to display results.                         |
| **Reset Filters** | Click **Reset** to clear all applied filters and start fresh.                                      |
| **Refresh Data**  | Click the **Refresh** button to load the **latest event records**.                                 |

To filter the events or search for a particular event, click on the dropdown and enter the specific detail.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FichHBinzPMNMbOSb1rKd%2F2.png?alt=media&#x26;token=a2606dc4-b833-4f1f-9ad8-d7c5945bf02b" alt=""><figcaption></figcaption></figure>

#### **User ID**

Enter the User ID, then click on Update to display events corresponding to that user ID.

#### **Event saved type**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FcIlmKLQCtPyaOWKR1G6U%2F3.png?alt=media&#x26;token=7688f354-d063-4d23-b028-4aeb734f392c" alt=""><figcaption></figcaption></figure>

By clicking on the dropdown and selecting the Event saved type and clicking on Update, all events corresponding to the selected type will be shown.

#### **Client**

Specify a client name, then after clicking on Update, events associated with that specific client will be displayed.

#### **Date (From) and Date (To)**

After specifying the Date (From) and Date (To), and clicking on Update events that occurred within this specified time frame will be displayed.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FVuCG8MGPzp74VMg96Uvh%2F4.png?alt=media&#x26;token=b34c3eed-f0f5-4083-8d65-8cbf5b9c6f8b" alt=""><figcaption></figcaption></figure>

#### **IP Address**

After you've entered the IP Address of the device and clicked on Search events, you'll be presented with the list of relevant events.

#### **Search events**

Once you've entered the necessary details, to search for user events matching those criteria, click on Search events.

#### **Reset**

If you've entered the necessary details but decide not to search for user events matching those criteria, you can click on Reset.

Click the Refresh button to see the latest settings.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F2y12XNTDC2CDUBp2qCmW%2FScreenshot%202025-06-18%20at%207.24.16%E2%80%AFPM.png?alt=media&#x26;token=9967849a-746d-443d-8bfa-ffd3df676468" alt=""><figcaption></figcaption></figure>

You can also choose how many user events you want to display on one screen. Select your preferred option from the dropdown menu as shown above.

### **Benefits of Monitoring User Events**

* **Enhanced Security** → Detect suspicious login attempts and account compromises.
* **User Activity Tracking** → Monitor when and how users access applications.
* **Compliance Auditing** → Generate reports for audits and compliance requirements.
* **Troubleshooting Support** → Investigate failed logins, registration issues, and client integration errors.

