Action Types

Currently, there are over 100 actions tracked by the Audit Service within the Unit21 system. Unit21 may add additional actions in the future. These are the actions currently tracked:

Team

team.add_agent
team.add_permission
team.create
team.delete
team.remove_agent
team.remove_permission

Agent

agent.activate
agent.activate
agent.add_permission
agent.cancel_impersonation
agent.create
agent.deactivate
agent.login
agent.remove_permission
agent.start_impersonation

Alert

alert.add_action_event
alert.add_attachment
alert.add_entity
alert.add_instrument
alert.add_rule
alert.add_tag
alert.add_txn_event
alert.assign
alert.change_queue
alert.create
alert.create_case
alert.create_sar
alert.close
alert.disposition
alert.edit
alert.set_deadline
alert.in_review
alert.open
alert.narrative_create
alert.narrative_delete
alert.narrative_edit
alert.subdisposition
alert.trigger_action
alert.remove_action_event
alert.remove_attachment
alert.remove_entity
alert.remove_instrument
alert.remove_rule
alert.remove_tag
alert.remove_txn_event
alert.update_custom_data
alert.update_disposition_notes
alert.verification
alert.view_detail
alert.view_summary
alert.add_disposition_action
alert.run_ai_investigation

Case

case.add_action_event
case.add_alert
case.add_attachment
case.add_entity
case.add_tag
case.add_txn_event
case.add_watcher
case.assign
case.change_queue
case.close
case.create
case.create_sar
case.disposition
case.edit
case.set_deadline
case.in_review
case.open
case.narrative_create
case.narrative_delete
case.narrative_edit
case.remove_action_event
case.remove_alert
case.remove_attachment
case.remove_entity
case.remove_tag
case.remove_txn_event
case.remove_watcher
case.subdisposition
case.trigger_action
case.update_custom_data
case.update_disposition_notes
case.add_disposition_action
case.view_detail
case.view_summary
case.update_txn_fraud_metadata

Sar

sar.add_attachment
sar.create
sar.edit
sar.set_deadline
sar.submit
sar.remove_attachment
sar.assign
sar.requeue
sar.validate
sar.duplicate
sar.lock
sar.unlock
sar.view_detail
sar.view_summary
sar.reassign

GoAML

goaml.add_attachment
goaml.create
goaml.edit
goaml.submit
goaml.remove_attachment
goaml.assign
goaml.requeue
goaml.validate
goaml.duplicate
goaml.reassign

CTR

fincen_ctr.create
fincen_ctr.edit
fincen_ctr.set_deadline
fincen_ctr.lock
fincen_ctr.unlock
fincen_ctr.create_batch
fincen_ctr.add_attachment
fincen_ctr.remove_attachment
fincen_ctr.assign
fincen_ctr.requeue
fincen_ctr.validate
fincen_ctr.duplicate
fincen_ctr.submit

CTR Batch Actions

fincen_ctr_batch.create
fincen_ctr_batch.process_ack

Entity

entity.add_attachment
entity.remove_attachment
entity.remove_all_attachments
entity.trigger_action
entity.whitelist
entity.unwhitelist
entity.global_whitelist

Event

event.add_attachment
event.remove_attachment

Instrument

instrument.add_attachment
instrument.remove_attachment
instrument.whitelist
instrument.unwhitelist
instrument.global_whitelist
instrument.global_unwhitelist
instrument.deactivate
instrument.lock
instrument.unlock

Rule

rule.create
rule.deactivate
rule.deploy
rule.shadow_deploy
rule.duplicate
rule.edit
rule.set_title
rule.set_description
rule.add_queue
rule.remove_queue
rule.add_tag
rule.remove_tag
rule.trigger_execution
rule.unwhitelist
rule.whitelist

Queue

queue.create
queue.delete
queue.edit
queue.add_rule
queue.remove_rule

Deadline

deadline.create
deadline.delete
deadline.edit

Webhook

webhook.create
webhook.delete
webhook.edit
webhook.rotate_secret

Workflow Buttons

workflow_action.create
workflow_action.delete
workflow_action.edit
workflow_action.trigger

Investigation Checklist

investigation_checklist.create
investigation_checklist.delete
investigation_checklist.edit

Narrative Template

narrative_template.create
narrative_template.delete
narrative_template.edit

Sar Template

sar_template.create
sar_template.delete
sar_template.edit

Risk Scores

risk_score.create
risk_score.delete
risk_score.edit

Matchlist

matchlist.create
matchlist.delete
matchlist.edit

Risk Model

risk_model.activate
risk_model.create
risk_model.deactivate
risk_model.edit
risk_model.validate