User Admin Role Removal Action

Common Event Grammar › Identity Management Category › User Role Management Class › User Admin Role Removal Action

User Admin Role Removal Action

The User Admin Role Removal action occurs when removing the Admin or privileged user role on a given system or application.

Information	Level
Source - User Information	Primary
Source - Host Information	Secondary
Source - Object Information	Tertiary
Source - Process Information	Tertiary
Source - Group Information	Tertiary
Dest - User Information	Primary
Dest - Host Information	Primary
Dest - Object Information	Secondary
Dest - Group Information	Tertiary
Agent - Information	Primary
Agent - Host Information	Primary
Event Source - Host Information	Primary
Event Source - Information	Tertiary
Event - Information	Primary
Result - Information	Primary

The important information for this action is who removed the admin or privileged user role for which user on which host. The event information was expressed on which host and recorded by which agent on which host.

Result	event_result	event_severity
Success	S	3
Failure	F	3