Device audit events
Last updated July 26th, 2023
The following table contains all audit events concerning devices enrolled with Knox Manage.
| Event Category |
Event Name |
| Agent |
- Device Boot Completed
- Change Network Connectivity
- Change Agent Context
- Initialize Agent
- EMM Login Failed
- EMM Client Screen UnLock Failed
- EMM Login Failed Count Exceeded
- EMM Client Screen UnLock Failed Count Exceeded
- Change Screen Lock Password EMM Client
|
| Application |
- Application installation request (Kiosk)
- Application list request (Kiosk)
|
| Certificate |
- Cert Issue Fail (Key Generation Error)
- Cert Verification Fail (Unknown)
- BasicConstraints Check Error
- Path Check Error
- Valid Date Check Error
- CRL(Certificate Revocation List) Check Error
- Cert Verification Fail (Unknown)
- Cert Issue Request
- Cert Issue Success
- Cert Issue Fail (Parameter Error)
- Cert Issue Fail (Not-initialized Object Error)
- Cert Issue Fail (Internal Error)
- Failed to establish connection to certificate revocation status
|
| Compliance |
- Check System Forgery
- Violated version control policy (Device)
- Violated recording prevention policy (Device)
|
| Device |
- Managed Google Play token issuance (Device)
- Managed Google Play account registration (Device)
- Managed Google Play account report (Device)
- Managed Google Play account removal (Device)
- SIM card has changed.
- Network usage has been reset.
- Cellular data limit has been reached.
- Call limit has been reached.
- Agent has been started.
- Agent has been closed.
- Randomization process failed
- Policy validation failed
- Result of importing the certificates to be used for authenticating agent communications
- Managed Google Play account revoked (Device)
- Failed to lock EMM screen (Device)
- Log on status is changed to logout. (Device)
- Request to device unenrollment by user
- Request to device unenrollment by user policy is changed
|
| Device Command |
- Keepalive Time Limited
- Keepalive Notice
- Device Command Received
- Verify Device Command
- Device Command Added
- Device Command Process Started
- Device Command Process Finished
- Failure Installation Package
- Failure Installation Package in Knox
- Failure Uninstallation Package
- Failure Uninstallation Package in Knox
- Device Diagnosis Information
- Device Lock/Unlock History
- Failure Installation Package in Work Profile
- Failure Uninstallation Package in Work Profile
- Policy violation detected
- Exit due to policy violation
- Change Trigger State
- Change Profile
|
| Enrollment |
- Push Registration Succeeded
- Push Unregistration Succeeded
- Enroll EMM Agent Started
- Enroll EMM Agent
- Unenroll EMM Agent Started
- Unenroll EMM Agent
- Enable Device Admin
- Disable Device Admin
- Enrollment Request by UMC Agent
- Report for UMC Agent activation
- Report Unenrollment Completion to UMC Agent
- Activate ELM License
- Activate KLMS License
|
| Log |
- Send EMM Agent Log
- Change Audit Event Allowlist
- Start Audit Logging
- Receive Audit Event Allowlist
- Send Audit Log To Server
|
| Profile |
- Device Password Attempts Failed Count Exceeded
- Scheduler Raised
- SIM card PIN code change
- Result for applying Kiosk mode
- Factory Reset Protection policy configured successfully
|
| User |
- Agreed to disable fingerprint lock (Device)
|