SECURITY VIOLATION

security_violation

---

AdIrRemediationFailed

Failed to remediate AD IR risk '${riskName}' with '${remediationType}' on ${objectName}.

	Severity	Status	Audit Event
Critical	Failure	No

AdIrRemediationStarted

Initiating remediation of AD IR risk '${riskName}' with '${remediationType}' on ${objectName}.

	Severity	Status	Audit Event
Info	TaskSuccess	No

AdIrRemediationSuccess

Remediated AD IR risk '${riskName}' with '${remediationType}' on ${objectName}.

	Severity	Status	Audit Event
Info	Success	No

CriticalSeverityDataViolationClosed

Critical severity violation of policy ${policyName} on ${objectName} was closed automatically

	Severity	Status	Audit Event
Critical	Success	No

CriticalSeverityDataViolationDetected

Critical severity violation of policy ${policyName} detected on  ${objectName}

	Severity	Status	Audit Event
Critical	Success	No

CriticalSeverityDataViolationDismissed

Critical severity violation of policy ${policyName} on ${objectName} was dismissed

	Severity	Status	Audit Event
Critical	Success	No

CriticalSeverityDataViolationInProgress

Critical severity violation of policy ${policyName} on ${objectName}  changed status to in progress

	Severity	Status	Audit Event
Critical	Success	No

CriticalSeverityDataViolationRemediated

Critical severity violation of policy ${policyName} on ${objectName} was remediated

	Severity	Status	Audit Event
Critical	Success	No

CriticalSeverityDataViolationReOpen

Critical severity violation of policy ${policyName} on ${objectName} changed status to open

	Severity	Status	Audit Event
Critical	Success	No

DataViolationExportActionsLogRemediationFailed

Failed to download actions log for object '${resourceName}' in  violation of policy '${policyName}'.

	Severity	Status	Audit Event
Info	Failure	No

DataViolationExportActionsLogRemediationSuccess

Actions log for object '${resourceName}' in violation  of policy '${policyName}' downloaded.

	Severity	Status	Audit Event
Info	Success	No

DataViolationExportPermissionsRemediationFailed

Failed to download permissions for object '${resourceName}' detected in violation of '${policyName}'.

	Severity	Status	Audit Event
Info	Failure	No

DataViolationExportPermissionsRemediationSuccess

Permissions for object '${resourceName}' where downloaded and detected in violation of '${policyName}'.

	Severity	Status	Audit Event
Info	Success	No

DataViolationMipLabelRemediationFailure

Failed to assign label '${labelName}' to ${FailedDocumentCount} out of  ${documentCount} documents detected in violation '${policyName}' on  object '${objectName}'.

	Severity	Status	Audit Event
Critical	Failure	No

DataViolationMipLabelRemediationFinished

Completed assignment of label  '${labelName}' to ${documentCount} documents detected in violation '${policyName}' on  object '${objectName}'.

	Severity	Status	Audit Event
Info	Success	No

DataViolationMipLabelRemediationSkipped

Skipped assignment of label '${labelName}' to ${SkippedDocumentCount}  out of ${documentCount} documents, which were detected in violation  '${policyName}'on object '${objectName}'. This occurred either due to unsupported document types or because the downgrading of MIP labels  is not allowed.

	Severity	Status	Audit Event
Info	Success	No

DataViolationMipLabelRemediationStarted

Beginning assignment of label '${labelName}' to ${documentCount} documents detected in violation '${policyName}' on  object '${objectName}'.

	Severity	Status	Audit Event
Info	TaskSuccess	No

DataViolationMipLabelRemediationSuccess

Successfully assigned label '${labelName}' to ${SuccessfulDocumentCount} out of ${documentCount} documents detected in violation '${policyName}'  on object '${objectName}'.

	Severity	Status	Audit Event
Info	Success	No

EntraIdIrRemediationFailed

Unable to remediate Entra ID IR risk '${riskName}' with  '${remediationType}' on ${objectName}. Error: ${reason}. ${remedy}.

	Severity	Status	Audit Event
Critical	Failure	No

EntraIdIrRemediationStarted

Initiating remediation of Entra ID IR risk '${riskName}' with '${remediationType}' on ${objectName}.

	Severity	Status	Audit Event
Info	TaskSuccess	No

EntraIdIrRemediationSuccess

Remediated Entra ID IR risk '${riskName}' with '${remediationType}' on  ${objectName}.

	Severity	Status	Audit Event
Info	Success	No

HighSeverityDataViolationClosed

High severity violation of policy ${policyName} on ${objectName} was closed automatically

	Severity	Status	Audit Event
Warning	Success	No

HighSeverityDataViolationDetected

High severity violation of policy ${policyName} detected on  ${objectName}

	Severity	Status	Audit Event
Warning	Success	No

HighSeverityDataViolationDismissed

High severity violation of policy ${policyName} on ${objectName} was dismissed

	Severity	Status	Audit Event
Warning	Success	No

HighSeverityDataViolationInProgress

High severity violation of policy ${policyName} on ${objectName}  changed status to in progress

	Severity	Status	Audit Event
Warning	Success	No

HighSeverityDataViolationRemediated

High severity violation of policy ${policyName} on ${objectName} was remediated

	Severity	Status	Audit Event
Warning	Success	No

HighSeverityDataViolationReOpen

High severity violation of policy ${policyName} on ${objectName} changed status to open

	Severity	Status	Audit Event
Warning	Success	No

IdentityRevokeAccessRemediationFailed

Failed to revoke access for '${identityName}' to ${documentCount} files in object ${objectName}.

	Severity	Status	Audit Event
Critical	Failure	No

IdentityRevokeAccessRemediationSuccess

Successfully revoked access for '${identityName}' to ${documentCount} files in object ${objectName}.

	Severity	Status	Audit Event
Info	Success	No

LowOrMediumSeverityDataViolationClosed

${severity} severity violation of policy ${policyName} on ${objectName} was closed automatically

	Severity	Status	Audit Event
Info	Success	No

LowOrMediumSeverityDataViolationDetected

${severity} severity violation of policy ${policyName} detected on  ${objectName}

	Severity	Status	Audit Event
Info	Success	No

LowOrMediumSeverityDataViolationDismissed

${severity} severity violation of policy ${policyName} on ${objectName} was dismissed

	Severity	Status	Audit Event
Info	Success	No

LowOrMediumSeverityDataViolationInProgress

${severity} severity violation of policy ${policyName} on ${objectName}  changed status to in progress

	Severity	Status	Audit Event
Info	Success	No

LowOrMediumSeverityDataViolationRemediated

${severity} severity violation of policy ${policyName} on ${objectName} was remediated

	Severity	Status	Audit Event
Info	Success	No

LowOrMediumSeverityDataViolationReOpen

${severity} severity violation of policy ${policyName} on ${objectName} changed status to open

	Severity	Status	Audit Event
Info	Success	No

OverExposureRevokeAccessRemediationFailed

Failed to revoke '${accessType}' access from ${documentCount} files  in object ${objectName}.

	Severity	Status	Audit Event
Critical	Failure	No

OverExposureRevokeAccessRemediationPartialSuccess

Partially revoked '${accessType}' access from ${documentCount} files  in object ${objectName}.

	Severity	Status	Audit Event
Warning	Success	No

OverExposureRevokeAccessRemediationStarted

Initiating revoke '${accessType}' access from ${documentCount} files in object ${objectName}.

	Severity	Status	Audit Event
Info	TaskSuccess	No

OverExposureRevokeAccessRemediationSuccess

Successfully revoked '${accessType}' access from ${documentCount} files  in object ${objectName}.

	Severity	Status	Audit Event
Info	Success	No

RevokeAccessRemediationInProgressForMultipleIdentities

Revoking access in progress for ${numOfViolatingIdentities} identities from ${totalAccessibleFilesAtRiskCount} files in object ${objectName}.

	Severity	Status	Audit Event
Info	TaskSuccess	No

RevokeAccessRemediationInProgressForSingleIdentity

Revoking access in progress for '${identityName}' from ${totalAccessibleFilesAtRiskCount} files in object ${objectName}.

	Severity	Status	Audit Event
Info	TaskSuccess	No