Event Categories & Field Reference

Enpass organizes event logs into six categories covering activity across the Enpass app, Enpass Hub, and the Admin Console. Use this reference to understand what is tracked in each category.

Users

Events related to user accounts, authentication, and device management.

Event	Description
New Device Registered	A new device has been added to the user's account
MFA Changes	Enabling, updating, or resetting two-factor authentication (2FA)
Admin Password Changes	Adding, changing, or resetting the admin password
Admin Permissions Updated	Changes to a user's access scopes or permissions
Public Key Changes	Detection, resolution, or addition of a public key in the Hub
Master Password Changed	The master password has been updated
Authentication Methods Added	PIN or biometric authentication configured
Device Deprovisioned	A previously registered device has been removed
Business Admin Console Login Events	Successful logins, failed attempts, MFA failures, or blocked logins
Application Login Events	Successful logins, failed attempts, or multiple unlock failures indicating unusual activity

Vaults

Events related to vault creation, security, data handling, and synchronization.

Event	Description
Vault Management	A vault was created, removed, or renamed
Vault Data Handling	Data was exported, printed, or imported from a vault backup or file
Vault Security	The vault password was changed, revealed, or a locked vault was removed
Vault Synchronization & Backup	Sync failed, a Keyfile was exported, or the vault was backed up

Events related to sharing items and vaults with other users.

Event	Description
Item Sharing	An item was shared via email or clipboard, or a shared item was successfully added
Vault Sharing	A vault was shared with one or more users
Shared Vault Management	A new shared vault was created and added to the system
Shared Vault Permissions	Permissions for a shared vault were updated
Shared Vault Access Control	Access to a shared vault was revoked

Recovery

Events related to account and master password recovery.

Event	Description
Account Recovery Management	Initiation, expiration, approval, or decline of a recovery request; recovery link expiration or revocation
Master Password Recovery	Successful recovery of a user's account via master password
Recovery Request Issues	Failure to create a recovery request due to system or user-related issues

Organization

Events related to user management, group management, policies, and authentication configuration.

Event	Description
User Management	A user account was created, removed, activated, deactivated, or had its email updated
Group Management	A group was created, deleted, or modified; users were added or removed from a group
Administrator & Policy Management	Admin assignment, removal, or permission changes; updates to organization policies and branding
Authentication & Security	SSO was configured, enabled, disabled, or enforced; a SCIM token was generated
Hub & Recovery Management	Hub integration, SSL settings, or recovery administration was set up, removed, or modified
Password Policies	Password rules or policies were created or modified

App

Events related to the Enpass application, device settings, and data management.

Event	Description
Browser & Security Configurations	A new browser was linked to the account, or an SSL certificate validation failed
Application Settings & Proxy	Application settings or proxy configuration were modified
Data & Backup Management	Storage location or backup settings were changed; local log files were deleted
Account & Vault Updates	A personal vault was added in the application
System & Device Changes	Incorrect system time was detected, or all data was erased from the device

Item

Events related to actions performed on individual items within a vault.

Note: The Item category is disabled by default, as item-level activity (such as autofill and field access) can generate a large volume of log entries. If you'd like to enable Item event logging for your organization, please contact Enpass Support.

Event	Description
Item Lifecycle	An item was created, updated, duplicated, moved to trash, archived, restored from trash or archive, permanently deleted, or moved to a different vault
Favorites & Watch List	An item was added to or removed from favorites or the watch list
Field & Attachment Actions	A field value was copied or revealed, or an attachment was added, exported, or deleted
Autofill & Website Launch	An item was autofilled, a website was launched from the vault, or another app was launched using autofill information
Passkey Management	A passkey was created, deleted, or used for login, or was updated or deleted based on a signal from the relying party

Fields Reference

Every event log entry follows a common structure, regardless of category. The table below describes each field.

Field	Type	Description	Example
`uuid`	String (UUID)	Unique identifier for the log entry	`16a37a76-8376-4a46-807b-04291848008d`
`timestamp`	String (Unix epoch)	Time the event actually occurred	`1786443967`
`category`	String	The event category (e.g. `user`, `organization`, `vault`). See Event Categories for the full list	`user`
`component`	String	The Enpass component that generated the event (e.g. `console`, `hub`, `application`)	`console`
`action`	String	The specific action that took place, such as user registration, new device addition, etc.	`console_logged_in`
`description`	String	Human-readable description of the event	`Logged into Admin Console.`
`actor`	String	Identifier of the user or entity who performed the action	`johnnewman@acmebizness.com`
`target`	String or null	Identifier of the entity affected by the action	`shanewick@acmebizness.com`
`ip_address`	String	IP address the action was performed from	`36.255.228.228`
`severity`	String	Severity/impact level of the event: `CRITICAL`, `HIGH`, `MEDIUM`, or `LOW`	`LOW`
`device`	Object	Information about the device the action was performed from, such as device name, type, and operating system	JSON `"device": { "os": "osx", "name": "John Mac", "device_type": "desktop" }`
`software`	Object	Enpass application information, such as app version and platform	JSON `"software": { "code": "Enpass Admin Console" }`
`data`	Object	Additional context specific to the event type may include keys such as `login_type` ,`vault_uuid`, `item_uuid`, `field_type`, `attachment_uuid`, `vault_location`, `login_method`and other keys depending on the event	`{"login_type": "password+totp"}`

Note: Not every field is populated on every event. Fields such as target, device, software, and data only appear when relevant to the specific action being logged, otherwise they are omitted or returned as an empty object

Event Logs & SIEM Integration — How to enable and manage event log collection
Integrate with SIEM Tools — Forward logs to your SIEM for extended retention and alerting