AuditLogonLogoff type | Wartiva GraphQL API

Logon/Logoff audit subcategories for authentication and session events.

Fields

Field Name	Description
`logon` - `AuditPolicySetting!`	Audits each instance of a user logging on to or off from the computer.
`logoff` - `AuditPolicySetting!`	Audits user logoff events.
`accountLockout` - `AuditPolicySetting!`	Audits when a user account is locked out after exceeding failed logon attempts.
`ipsecMainMode` - `AuditPolicySetting!`	Audits IPsec Main Mode negotiation events.
`ipsecQuickMode` - `AuditPolicySetting!`	Audits IPsec Quick Mode negotiation events.
`ipsecExtendedMode` - `AuditPolicySetting!`	Audits IPsec Extended Mode negotiation events.
`specialLogon` - `AuditPolicySetting!`	Audits special logon events, such as using an account with administrator privileges.
`otherLogonLogoffEvents` - `AuditPolicySetting!`	Audits other logon/logoff events not covered by specific subcategories.
`networkPolicyServer` - `AuditPolicySetting!`	Audits Network Policy Server (NPS) authentication and authorization events.
`userDeviceClaims` - `AuditPolicySetting!`	Audits user and device claims information during logon.
`groupMembership` - `AuditPolicySetting!`	Audits group membership enumeration during logon.
`accessRights` - `AuditPolicySetting!`	Audits access rights granted or denied during logon.

Used by

AuditPolicyWindows type: Windows-specific Advanced Audit Policy Configuration.

Example

{
  "logon": "SUCCESS",
  "logoff": "SUCCESS",
  "accountLockout": "SUCCESS",
  "ipsecMainMode": "SUCCESS",
  "ipsecQuickMode": "SUCCESS",
  "ipsecExtendedMode": "SUCCESS",
  "specialLogon": "SUCCESS",
  "otherLogonLogoffEvents": "SUCCESS",
  "networkPolicyServer": "SUCCESS",
  "userDeviceClaims": "SUCCESS",
  "groupMembership": "SUCCESS",
  "accessRights": "SUCCESS"
}