Event reference

This page lists every activity event Netzilo records, grouped by category as in the All Event Types filter on Activity > Events. Each event has a display name, which the dashboard shows, and a code, which never changes. Use the code to filter events through the API or in your SIEM.

For how to search, filter and read events, see Events.

How to use this page

In the dashboard, open All Event Types and type part of the code in its search field, for example ai. for the AI events or published_app for published applications. The field matches codes, not display names. Tick the event types you want.
Through the API, pass one or more codes: GET /api/events/paginated?code=ai.blocked&code=ai.redacted.
In a SIEM fed by Event Streaming, every event carries the fields activity (the display name), activity_code and activity_category.

Events marked ¹ are recorded but are not offered in the All Event Types filter yet. Find them with the search box or the API. The activity name the API returns can differ slightly from the filter label: service.user.create is Service user created in the API and Agent created in the filter, and aidr.graph is AI behavior graph updated in the API and Session snapshot in the dashboard.

Administration

Event	Code	When it is recorded
Account AI assistant disabled for users	`account.setting.user.ai.assistant.disable`	The AI assistant was turned off for regular users.
Account AI assistant enabled for users	`account.setting.user.ai.assistant.enable`	The AI assistant was turned on for regular users.
Account AI assistant groups updated	`account.setting.user.ai.assistant.groups.update`	The groups allowed to use the AI assistant changed.
Account clientless access disabled ¹	`account.setting.clientless.access.disable`	Clientless access was turned off for the account.
Account clientless access enabled ¹	`account.setting.clientless.access.enable`	Clientless access was turned on for the account.
Account clientless proxy address updated ¹	`account.setting.clientless.proxy.address.update`	The clientless access proxy address changed.
Account created	`account.create`	A new account was created.
Account peer approval disabled	`account.setting.peer.approval.disable`	Peer approval was turned off for the account.
Account peer approval enabled	`account.setting.peer.approval.enable`	Peer approval was turned on for the account.
Account peer inactivity expiration disabled	`account.peer.inactivity.expiration.disable`	Peer inactivity expiration was turned off for the account.
Account peer inactivity expiration duration updated	`account.peer.inactivity.expiration.update`	The account-wide peer inactivity expiration period changed.
Account peer inactivity expiration enabled	`account.peer.inactivity.expiration.enable`	Peer inactivity expiration was turned on for the account.
Account peer login expiration disabled	`account.setting.peer.login.expiration.disable`	Peer login expiration was turned off for the account.
Account peer login expiration duration updated	`account.setting.peer.login.expiration.update`	The account-wide peer login expiration period changed.
Account peer login expiration enabled	`account.setting.peer.login.expiration.enable`	Peer login expiration was turned on for the account.
Activity report created	`report.activity.created`	A User Activity, AI Agent Activity or AI Usage report was generated. The report type is in the event details.
Activity report deleted	`report.activity.deleted`	A report was deleted.
Agent created	`service.user.create`	An agent (service user) was created under Team > Agents.
Agent deleted	`service.user.delete`	An agent (service user) was deleted.
AI provider created ¹	`ai.provider.create`	An AI provider was added under Integrations > Artificial Intelligence.
AI provider deleted ¹	`ai.provider.delete`	An AI provider was removed.
AI provider updated ¹	`ai.provider.update`	An AI provider was changed.
AI provider verified ¹	`ai.provider.verify`	A stored AI provider was tested against its endpoint, whether or not the test passed.
Application published	`published_app.created`	An application was published under Network > Applications.
Application unpublished	`published_app.removed`	A published application was removed.
Authentication report created	`report.authentication.created`	An Authentication Activity report was generated.
Authentication report deleted	`report.authentication.deleted`	An Authentication Activity report was deleted.
Dashboard login	`dashboard.login`	A user signed in to the dashboard.
Filter created	`filter.created`	A filter was created under Edge > Filters.
Filter deleted	`filter.deleted`	A filter was deleted.
Filter updated	`filter.updated`	A filter was changed.
Group added to disabled management DNS setting	`dns.setting.disabled.management.group.add`	A group was added to the groups whose DNS is not managed by Netzilo.
Group added to peer	`peer.group.add`	A peer was added to a group.
Group added to setup key	`setupkey.group.add`	A group was added to a setup key.
Group added to user	`user.group.add`	A user was added to a group.
Group created	`group.add`	A group was created.
Group deleted	`group.delete`	A group was deleted.
Group issuer changed ¹	`group.issuer.update`	History only: no longer recorded. Older rows show a change to where a group came from.
Group removed from disabled management DNS setting	`dns.setting.disabled.management.group.delete`	A group was removed from the groups whose DNS is not managed by Netzilo.
Group removed from peer	`peer.group.delete`	A peer was removed from a group.
Group removed from user	`user.group.delete`	A user was removed from a group.
Group removed from user setup key	`setupkey.group.delete`	A group was removed from a setup key.
Group updated	`group.update`	A group was changed.
Guardrail created	`guardrail.created`	A guardrail was created under Edge > Guardrails.
Guardrail deleted	`guardrail.deleted`	A guardrail was deleted.
Guardrail updated	`guardrail.updated`	A guardrail was changed.
Integration created	`integration.create`	An integration was set up under Integrations.
Integration deleted	`integration.delete`	An integration was removed.
Integration disabled	`integration.disabled`	An integration was turned off.
Integration updated	`integration.update`	An integration was changed.
Limit created	`gateway_limit.created`	A limit was created under Edge > Limits.
Limit deleted	`gateway_limit.deleted`	A limit was deleted.
Limit updated	`gateway_limit.updated`	A limit was changed.
MCP bundle created	`gateway_virtual_mcp.created`	An MCP bundle was created under Edge > MCP.
MCP bundle deleted	`gateway_virtual_mcp.deleted`	An MCP bundle was deleted.
MCP bundle updated	`gateway_virtual_mcp.updated`	An MCP bundle was changed.
MCP server added	`gateway_mcp_server.created`	An MCP server was added under Edge > MCP.
MCP server deleted	`gateway_mcp_server.deleted`	An MCP server was deleted.
MCP server updated	`gateway_mcp_server.updated`	An MCP server was changed.
Nameserver group created	`nameserver.group.add`	A nameserver group was created under Network > DNS.
Nameserver group deleted	`nameserver.group.delete`	A nameserver group was deleted.
Nameserver group updated	`nameserver.group.update`	A nameserver group was changed.
Network Policy added	`policy.add`	A policy was created under Network > Policies.
Network Policy deleted	`policy.delete`	A policy was deleted.
Network Policy updated	`policy.update`	A policy was changed.
Peer added	`setupkey.peer.add`	A peer joined the account with a setup key.
Peer added	`user.peer.add`	A user added a peer by signing in on a device.
Peer approval revoked	`peer.approval.revoke`	The approval of a peer was revoked.
Peer approved	`peer.approve`	A peer was approved.
Peer deleted	`user.peer.delete`	A peer was deleted.
Peer inactivity expiration disabled	`peer.inactivity.expiration.disable`	Inactivity expiration was turned off for one peer.
Peer inactivity expiration enabled	`peer.inactivity.expiration.enable`	Inactivity expiration was turned on for one peer.
Peer login expiration disabled	`peer.login.expiration.disable`	Login expiration was turned off for one peer.
Peer login expiration enabled	`peer.login.expiration.enable`	Login expiration was turned on for one peer.
Peer login expired	`peer.login.expire`	The login of a peer expired; the user must sign in again.
Peer renamed	`peer.rename`	A peer was renamed.
Peer SSH server disabled	`peer.ssh.disable`	The SSH server of a peer was turned off.
Peer SSH server enabled	`peer.ssh.enable`	The SSH server of a peer was turned on.
Personal access token created	`personal.access.token.create`	An access token was created for a user or agent.
Personal access token deleted	`personal.access.token.delete`	An access token was deleted.
Posture check created	`posture.check.created`	A posture check was created.
Posture check deleted	`posture.check.deleted`	A posture check was deleted.
Posture check updated	`posture.check.updated`	A posture check was changed.
Profile created	`profile.created`	A profile was created under Endpoint > Profiles.
Profile removed	`profile.removed`	A profile was deleted.
Profile updated	`profile.updated`	A profile was changed.
Provider created	`gateway_provider.created`	A provider was created under Edge > Providers.
Provider deleted	`gateway_provider.deleted`	A provider was deleted.
Provider updated	`gateway_provider.updated`	A provider was changed.
Published application updated	`published_app.updated`	A published application was changed.
Route created	`route.add`	A route was created under Network > Routes.
Route deleted	`route.delete`	A route was deleted.
Route updated	`route.update`	A route was changed.
Rule added	`rule.add`	History only: no longer recorded. Older rows show a legacy access rule being added.
Rule deleted	`rule.delete`	History only: no longer recorded. Older rows show a legacy access rule being deleted.
Rule updated	`rule.update`	History only: no longer recorded. Older rows show a legacy access rule being changed.
Setup key created	`setupkey.add`	A setup key was created.
Setup key deleted	`setupkey.deleted`	A setup key was deleted.
Setup key overused	`setupkey.overuse`	A setup key was used more times than its usage limit allows.
Setup key revoked	`setupkey.revoke`	A setup key was revoked.
Setup key updated	`setupkey.update`	A setup key was changed.
Subscription updated	`subscription.updated`	The account plan changed.
Support session created	`support.session.create`	A user started a support session.
Tenant updated	`tenant.updated`	Tenant settings changed.
Transferred owner role	`transferred.owner.role`	The owner role was transferred to another user.
User blocked	`user.block`	A user was blocked.
User deleted	`user.delete`	A user was deleted.
User invited	`user.invite`	A user was invited.
User joined	`user.join`	A user joined the account.
User logged in peer	`user.peer.login`	A user signed in on a peer.
User role updated	`user.role.update`	The role of a user changed.
User unblocked	`user.unblock`	A user was unblocked.

Access Control

Event	Code	When it is recorded
Accessed URL	`browser.url.access`	A URL was accessed on a peer. The event names the URL and the peer.
Application access allowed	`published_app.access_allowed`	A user was let in to a published application.
Application access denied: not admitted	`published_app.access_not_admitted`	A user tried to open a published application they are not admitted to.
Application started	`workspace.app.started`	An application was started in the Enterprise Workspace.
Credential refused at gateway	`gateway.credential_refused`	A Netzilo gateway refused a credential, for example an expired or unknown token. The event names the door (proxy, published application or AI gateway) and the reason.
MCP server connected	`mcp.connected`	A user completed the sign-in to an MCP server through the Netzilo AI Gateway.
MCP server disconnected	`mcp.disconnected`	A user disconnected from an MCP server.
MCP server needs a new sign-in	`mcp.reauth_required`	The sign-in to an MCP server could not be renewed; the user must sign in again.
Peer access blocked	`peer.access.blocked`	A peer was blocked from a destination because a posture check in a policy failed. The event names the policy, the posture check and the reason.
Peer access granted	`peer.access.granted`	A peer was granted access to destinations by a policy.
Session recorded	`session.recorded`	A desktop session recording is available. Click the play icon to watch it.
Target access blocked	`peer.access.target.blocked`	A peer was blocked from accessing a target.
Target access granted	`peer.access.target`	A peer was granted access to a target.
User logged in	`user.login`	A user signed in through the identity provider.
User logged out	`user.logout`	A user signed out.

Data Exfiltration

Event	Code	When it is recorded
Classified data found	`browser.data.classified`	Data with a classification was found on a page.
Copy/Paste blocked	`browser.data.clipboard.blocked`	A copy or paste on a page was blocked.
Download content blocked	`browser.download.content`	A download was blocked because its content matched a pattern.
Printing blocked	`browser.data.print.blocked`	Printing a page was blocked.
Printing blocked	`workspace.print.blocked`	Printing in the Enterprise Workspace was blocked.
Screenshot blocked	`browser.data.screenshot.blocked`	A screenshot of a page was blocked.
Sensitive data redacted	`browser.data.redacted`	Content on a page was redacted because it matched a pattern.
Upload source code	`browser.data.code.upload.blocked`	An upload of source code to a site was blocked.

Policy Violation

Event	Code	When it is recorded
Application access denied by posture	`published_app.access_denied`	A user was refused a published application because a posture check on the application failed.
Blocked URL	`browser.url.blocked`	Access to a URL was blocked.
Disposable browser required	`browser.isolation.redzone.required`	A site requires the Disposable Browser.
Download blocked	`browser.download.file`	A download was blocked.
Enterprise workspace required	`browser.isolation.bluezone.required`	A site requires the Enterprise Workspace.
Local browser isolation required	`browser.isolation.local.required`	A site requires local browser isolation.
Posture check failed	`workspace.posture.check`	Access to the Enterprise Workspace was blocked because a posture check failed.
Protection paused	`browser.exception.request`	A user paused protection for a site and gave a reason.
Remote browser isolation required	`browser.isolation.remote.required`	A site requires remote browser isolation.
Upload blocked	`browser.upload.file`	An upload was blocked.
URL posture check failed	`browser.posture.check`	Browsing to a URL was blocked because a posture check failed.
View source code	`browser.data.code.redacted`	Reading the source code of a page was blocked.

Suspicious

Event	Code	When it is recorded
Code injection detected	`workspace.injection.detected`	Code injection into the Enterprise Workspace was detected.
Prompt injection blocked	`browser.data.prompt.injection.blocked`	A prompt injection attempt on a page was detected and blocked.
Self-defense activated	`workspace.selfdefense.activated`	The Enterprise Workspace self-defense was activated.
User failed login	`user.failedlogin`	A sign-in failed. The event carries the reason; for a setup key it is expired, revoked, over used or key not found.

Investigation

Event	Code	When it is recorded
AI Insight	`ai.insight`	AI Smart Search answered a question. The row shows the answer and the events it cites.

AI Edge

Event	Code	When it is recorded
AI allowed	`ai.allowed`	AI traffic was checked and allowed.
AI blocked	`ai.blocked`	AI traffic was blocked by a guardrail rule, a limit or a missing grant.
AI detected	`ai.detected`	A guardrail rule in report mode matched. Nothing was changed.
AI redacted	`ai.redacted`	Content in AI traffic was redacted by a guardrail rule.
AI redirected	`ai.redirected`	AI traffic was redirected by a guardrail rule.
Semantic event	`semantic.event`	A behaviour observation for an AI session, such as a tool call, a tool response or a skill the agent acquired.
Session snapshot	`aidr.graph`	A session showed behaviour for the first time. Opens the behaviour graph of that session.

Reading AI Edge events

The five AI verdict events share one shape:

Event	Outcome
AI allowed	The traffic was checked and passed.
AI blocked	A guardrail rule, a limit or a missing model grant stopped the request.
AI redacted	A guardrail rule replaced matching content before it went on.
AI redirected	A guardrail rule sent the request somewhere else.
AI detected	A guardrail rule in report mode matched. Nothing was changed.

The row reads "<agent> on <peer> for <user>: <what> <outcome>", or "<site> in the browser for <user>: …" for the Netzilo browser extension. The raw event adds these fields:

Field	Values
`surface`	`llm_request`, `llm_response`, `tool_call`, `tool_result`, `prompt`, `sampling`, `http_request`, `connect`, `process_exec`, `periodic`
`engine`	`rules`, `semantic`, `script`, `periodic`, `policy`, `limit`
`source`	`mitm` (Netzilo client), `hook` (coding-agent hooks), `extension` (Netzilo browser extension), `gateway` (Netzilo AI Gateway), `probe` (device probe)

It also carries the rule, filter, provider, model, MCP server, tool, host, session and actor fields, and up to 8 KB of the triggering content after redaction. See Events for examples.

Retired event types

Older Netzilo clients recorded tool and scanner events (codes starting with tool. and scanner.). These event types no longer exist. Rows written with them stay in your history and show as UNKNOWN_ACTIVITY. They are not a fault, and nothing records them any more.

Events - Search, filter and read events
Event Streaming - Copy every event to Amazon S3 or Min.io
Reports - Reports built from these events
Guardrails - The rules behind AI Edge events
Events API - Query events programmatically

Custom Agents

Zero Trust Networking

Edge

Endpoint

Network

Team

Activity

Settings

Integrations