Event field name

Field value

DeviceAction

user created

EventOutcome

succeeded

SourceTranslatedAddress

This field contains the value of the HTTP header x-real-ip or x-forwarded-for. If these headers are absent, the field will be empty.

SourceAddress

The address from which the user logged in. If the user logged in using a proxy, there will be a proxy address.

SourcePort

Port from which the user logged in. If the user logged in using a proxy, there will be a port on the proxy side.

SourceUserName

User login that was used to create the user account.

SourceUserID

User ID that was used to create the user account.

DestinationUserName

User login for which the user account was created.

DestinationUserID

User ID for which the user account was created.

DeviceCustomString1

Role of the created user.

DeviceCustomString1Label

role