Admin Data Action
| eventName | Description | Sample | Rule |
|---|---|---|---|
| SENSITIVE_ | Viewed sensitive content: sensitive parameters in audit events have been retrieved or reviewed. | N | N |
| SENSITIVE_ | Removed sensitive content: sensitive parameters in audit events have been obscured. | N | N |
| SENSITIVE_ | Restored sensitive content: sensitive parameters in audit events have been made visible again. | N | N |
SENSITIVE_AUDIT_EVENTS_ACCESSED: Sensitive Audit Events Accessed
#Description
Viewed sensitive content: sensitive parameters in audit events have been retrieved or reviewed.
References #
any: Admin Data Action (any event)
#Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.
Description
Source-only rules that filter on applicationName 'admin_data_action' without specifying an eventName attribute here.