# Rubrik Developer Center

# Rubrik Security Cloud

## Getting Started

The Rubrik Security Cloud (RSC) API is GraphQL.

### GraphQL Features

1. Single Endpoint - The RSC API endpoint will always be /api/graphql.
1. Single HTTP method - Everything is an HTTP POST.
1. Introspection - The API documentation is built in to the API itself, providing integrated development help and schema checking.
1. Customized Response - Queries are customized to only return the fields that is needed.

## GraphQL Basics

GraphQL is a "query language" comparable to SQL. In SQL, one might say, "Select name and ID from the VM table." GraphQL is similar in this idea. A query is much like a SQL table. Properties (called fields in GraphQL) are like columns in that table. Unlike SQL, GraphQL fields can be complex types with their own fields, allowing functionality of a SQL join.

### Example

Click on the arrow annotation (1) in the code to see an explanation of that part of the code.

1. This is an annotation!

> Retrieve all MSSQL databases, and return the name, ID, and the name and ID of the Rubrik Cluster that protect's this MSSQL database.

```graphql
query mssqlDatabasesExample { #(1)!
  mssqlDatabases { # (2)!
    nodes  { #(3)!
      name #(4)! 
      id
      cluster { #(5)!
        name #(6)!
        id
      }
    }
  }
}
```

1. `mssqlDatabasesExample` is an operation name, You can change this to whatever you want.
1. `mssqlDatabases` is the name of the query in the API.
1. `nodes` is a paginated array of objects, in this case, mssqlDatabases.
1. `name` is a property, known as a `field` in GraphQL. It has a specific type, in this case `name` is a `String`.
1. `cluster` is also a field in the API, but unlike `name` that is of type `String`, `cluster` is a `Cluster` type, and it has its own fields.
1. This is the cluster `name` field. It's a field on the `Cluster` type in the API.

To learn more about the query syntax, check out [GraphQL Language Syntax](https://graphql.org/learn/queries).

Next: [API Playground](API-playground/)

The API Playground is an integrated development environment (IDE) that you can use to browse, explore, and run GraphQL APIs offered by Rubrik Security Cloud (RSC). The IDE also provides reference to the Rubrik GraphQL API documentation for your version. Running GraphQL queries and mutations in API Playground validates the GraphQL operations so that you can confirm that your queries or mutations will achieve the desired result when included in automation scripts.

Initially, access to the playground uses the currently authenticated user credentials. Running queries as a service account is useful for testing permissions and can be accomplished by clicking the "Test with Service Account" button in the upper right of the Playground.

The ability to access objects and queries depends on the RBAC roles assigned to the user account or service account. For enhanced security, API Playground does not persist the service account access credentials.

Danger

The GraphQL mutations that run in API Playground perform actions against this instance of RSC. This can result in data loss.

## Accessing API Playground

Access the API Playground through the RSC Settings menu or directly through the browser's url bar.

1. Log in to RSC.
1. Open the app tray and select Settings. The Settings menu appears.
1. Click API Playground. The API Playground page appears.
1. Click Open API Playground. API Playground opens in a new browser tab.

Alternatively, The playground can be accessed directly by supplying the url in this format:

```text
https://<INSTANCE>.my.rubrik.com/playground/
```

Copy and paste the below example query into the playground query pane, and click the execute button.

```graphql
{
  slaDomains {
    nodes {
      name
      id
    }
  }
}
```

### Sample output

```json
{
  "data": {
    "slaDomains": {
      "nodes": [
        {
          "name": "Bronze",
          "id": "00000000-0000-0000-0000-000000000002"
        },
        {
          "name": "Gold",
          "id": "00000000-0000-0000-0000-000000000000"
        },
        {
          "name": "Silver",
          "id": "00000000-0000-0000-0000-000000000001"
        }
      ]
    }
  }
}
```

Building on the query for SLA Domains, it may be desirable to search by name. The following will walk through using the API documentation in the playground to identify arguments that can be specified for a particular query, and how to implement the arguments.

1. Hover the mouse cursor over `slaDomains` in the query.
1. Click on the `slaDomains` link when the tooltip appears.

A side pane will appear with the API documentation for `slaDomains.`

There are 3 sections in the documentation:

- `Type` - The type of object that gets returned.
- `Arguments` - Variables that can be passed into the query, such as filters or sorting preferences.
- `Implementations` - Additional object types that have their own properties

The arguments have types specified next to the name. The `filter` argument is a type of `[GlobalSlaFilterInput!]`

- `[]` The square braces indicate that we can pass in multiple`GlobalSlaFilterInput` objects. This means multiple filter objects can be passed in.
- `!` The exclamation point means "Non-Null." This symbol is used both in arguments and fields that get returned indicating that the field must be supplied.

Click on the `GlobalSlaFilterInput` type in the documentation. The documentation will navigate to the documentation for this type.

To search by name, set the `field` to `NAME`. Clicking on `GlobalSlaQueryFilterInputField` will display the enum values that are available to filter on.

Set `text` to the name of the SLA domain to search for.

Note

Some queries will have their own filtering arguments that are unique to the context of that object. The API documentation for each query will specify the filtering syntax and capabilities for each query.

Arguments are supplied to a query in parenthesis `()` after the query name. Create the filter object as an argument to the `slaDomains` query. Change the `text` content to an SLA domain name in the currently connected RSC instance.

```graphql
{
  slaDomains(filter: {field: NAME text: "bronze"}) {
    nodes {
      name
      id
    }
  }
}
```

The result will be only SLA Domains starting with `bronze`

```json
{
  "data": {
    "slaDomains": {
      "nodes": [
        {
          "name": "Bronze",
          "id": "00000000-0000-0000-0000-000000000002"
        }
      ]
    }
  }
}
```

## Troubleshooting

For GraphQL errors, see the [troubleshooting](../troubleshooting/) page.

### 401 JWT is missing.

This error indicates that the user session has expired. Refreshing the page will take you to the RSC login page to reauthenticate.

Next: [Authentication](../authentication/)

## Service Accounts (OAuth2 Client Credentials Grant)

A service account represents an application that needs authentication and authorization to invoke Rubrik APIs, as opposed to a user account that represents an individual user. A client ID and client secret are used to authenticate to an authorization server and obtain an access token to invoke the Rubrik APIs. Similar to user accounts, Rubrik allows assigning roles to the service accounts to enable role-based access control. But contrary to user accounts, service accounts cannot be used to access the Rubrik web UI.

### Security

Service accounts enable client applications and other services to invoke the Rubrik APIs securely. When creating a service account, the authorization server assigns a unique client ID and client secret to the account. The combination of client ID and client secret is known as client credentials. The client credentials are known only to the client that is represented by the service account and the authorization server that grants the credentials to the service account. The client application authenticates to the authorization server using the client credentials and obtains an access token to authenticate to the Rubrik API server and access the protected resources.

### Guidelines

Consider the following best practices when using service accounts:

- One service account should represent only one client application.
- The role assigned to the service account should be the one with least number of privileges that would be sufficient for the client application being represented by the service account to access the Rubrik APIs.
- The client credentials must be saved when they are first created as Rubrik does not provide an option to display them again.
- The client secret must be treated like a password and stored in a secure location.
- Service account access tokens should be cached and reused until they are valid.

### Usage

#### Adding a service account

Refer to the RSC user guide: [adding a service account](https://docs.rubrik.com/en-us/saas/saas/adding_a_service_account.html)

#### Obtaining an access token

In this example, the service account client ID and secret are exported into environment variables and posted to the RSC client_token endpoint. The response contains the access token needed for authenticated API calls. The `jq` tool is used to parse the access token from the JSON response and stored in a variable for usage.

```bash
export RSC_FQDN="example.my.rubrik.com"
export RSC_CLIENT_ID="client|c9bba9a9-1234-1234-b7c6-123440b4cf64"
export RSC_CLIENT_SECRET="ExampleServiceAccountSecret"

RSC_TOKEN=$(curl --silent --location "https://$RSC_FQDN/api/client_token" \
  --header "Content-Type: application/x-www-form-urlencoded" \
  --data "client_id=$RSC_CLIENT_ID&client_secret=$RSC_CLIENT_SECRET&grant_type=client_credentials" | jq -r '.access_token')

export RSC_TOKEN
```

An example response from the authorization server shows the access token and the number of seconds when the token will expire. This time is configurable up to 24 hours within the RSC session security settings.

```json
{"client_id":"client|c9bba9a9-1234-1234-b7c6-123440b4cf64","access_token":"eyJ...","expires_in":43200}
```

#### Using the access token

The access token is used as a `Bearer` token in the `Authorization` header of all subsequent API calls.

```bash
curl --location "https://$RSC_FQDN/api/graphql" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $RSC_TOKEN" \
--data '{"query":"query slaDomains {nodes {name id}}}","variables":{}}'
```

#### Deleting a session

While there is no restriction on the number of active sessions a service account can have, Rubrik provides an API endpoint to delete an existing session.

Run the following command to revoke the session established for the service account. Successful revocation will result in an HTTP status code of `204`.

```bash
curl -X DELETE --location "https://$RSC_FQDN/api/session" \
--header "Authorization: Bearer $RSC_TOKEN"
```

## User Accounts (OAuth2 Authorization Code with PKCE)

Note

This OAuth2 flow is only supported for Annapurna retrievers.

OAuth2 Authorization Code with Proof Key for Code Exchange (PKCE) is a more secure OAuth2 flow, primarily used by mobile and native applications but can also be applied in web applications. It ensures that an authentication code, specifically a hashed code verifier (called a code challenge), is presented to an authorization server along with the authorization code.

### Security

This OAuth2 flow requires a two-step exchange to obtain an access token. First, the client application requests an authorization code from an authorization server, specifying the code challenge and the method used to generate it. The authorization server responds with an authorization code, which is later exchanged, along with the original code verifier, for an access token. This process mitigates the risk of authorization codes being intercepted by attackers.

### Guidelines

Consider the following best practices when using OAuth2 Authorization Code with PKCE:

- Ensure the client securely generates a sufficiently random code verifier for every authorization request.
- The code verifier must be securely stored in the client for retrieval during the token exchange step.
- The code challenge method supported by Rubrik APIs is `S256` (SHA-256).
- Tokens must be securely stored and handled to avoid unauthorized access.

### Usage

#### OAuth Application Registration

OAuth2 Authorization Code grants requires registration of the OAuth application in Rubrik Security Cloud. During registration, a client ID and secret will be generated for the application, and will be used in the authorization request.

#### Initiating Authorization Request

To initiate an authorization request, the client application generates a random code verifier and a code challenge (SHA-256 hash of the code verifier). The authorization URL is constructed with necessary parameters, including the client ID, response type, redirect URI, and code challenge method.

The following python example results in an access token printed to the screen by a locally running HTTP service. It can be stored in a python file (e.g. rsc_oauth_example.py) and executed using python (e.g. `python rsc_oauth_example.py`). Modify the configuration items in the script as needed.

```python
import hashlib
import os
import base64
import random
import string
import requests
import urllib.parse
from http.server import HTTPServer, BaseHTTPRequestHandler

# Configuration
CLIENT_ID = '1233455-39b3-43fd-bd56-2243avd234vm' # This is the client ID for your registered OAuth application
CLIENT_SECRET = 'Epc01j4k3w4sh3r38nbFjFM' # This is the client secret for your registered OAuth application
AUTHORIZATION_ENDPOINT = 'https://example.my.rubrik.com/oauth_authorize' # change the example to your RSC instance
TOKEN_ENDPOINT = 'https://example.my.rubrik.com/api/oauth/token' # change the example to your RSC instance
REDIRECT_URI = 'http://localhost:8001/callback'
SCOPE = 'annapurna' # annapurna is currently the only scope available

# Generate code verifier
def generate_code_verifier(length=128):
    return ''.join(random.choices(string.ascii_letters + string.digits + '-', k=length))

# Generate code challenge
def generate_code_challenge(verifier):
    verifier_bytes = verifier.encode('ascii')
    challenge_digest = hashlib.sha256(verifier_bytes).digest()
    challenge_base64 = base64.urlsafe_b64encode(challenge_digest).decode('ascii').rstrip('=')
    return challenge_base64

code_verifier = generate_code_verifier()
code_challenge = generate_code_challenge(code_verifier)
state = ''.join(random.choices(string.ascii_letters + string.digits, k=16))

# Build authorization URL
authorization_url = (
    f"{AUTHORIZATION_ENDPOINT}?"
    f"response_type=code&"
    f"client_id={CLIENT_ID}&"
    f"redirect_uri={urllib.parse.quote(REDIRECT_URI)}&"
    f"scope={urllib.parse.quote(SCOPE)}&"
    f"state={state}&"
    f"code_challenge={code_challenge}&"
    f"code_challenge_method=S256"
)

# Open the authorization URL in the user's browser
print("Opening the following URL in your browser:")
print(authorization_url)
os.system(f"start {authorization_url}" if os.name == "nt" else f"open {authorization_url}")

# HTTP server to handle the callback
class CallbackHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        query_components = urllib.parse.parse_qs(urllib.parse.urlparse(self.path).query)
        if "code" in query_components:
            authorization_code = query_components["code"][0]
            state_received = query_components["state"][0]
            if state_received != state:
                self.send_response(400)
                self.end_headers()
                self.wfile.write(b"Error: State mismatch")
                return

            # Exchange authorization code for access token
            token_response = requests.post(TOKEN_ENDPOINT, data={
                'grant_type': 'authorization_code',
                'client_id': CLIENT_ID,
                'client_secret': CLIENT_SECRET,
                'code': authorization_code,
                'redirect_uri': REDIRECT_URI,
                'code_verifier': code_verifier
            })
            token_data = token_response.json()

            self.send_response(200)
            self.end_headers()
            self.wfile.write(b"Authentication successful, you can close this window.")

            print("Access Token:")
            print(token_data["access_token"])
        else:
            self.send_response(400)
            self.end_headers()
            self.wfile.write(b"Error: Missing authorization code")

httpd = HTTPServer(('localhost', 8001), CallbackHandler)
print("Listening for callback on http://localhost:8001/callback")
httpd.serve_forever()
```

Note

The response code of the HTTP request will be 200, and the body of the response will contain the HTTP error code.

Note

It can extremely difficult to troubleshoot code logic without much context. If additional help from the Rubrik support team is required, limit the code shared to only the offending query or SDK method. Include literal variable values to verify what is being passed in to the query or SDK method.

## Error code **400**

______________________________________________________________________

### Reason

These occur when the query is incorrect according to the schema.

### Solution

Verify the query and variables supplied to the query are in accordance with the schema. This can be done with any tool that can validate the query against the schema. The RSC API playground is the easiest way to accomplish this.

Example Erroneous Query

```graphql
query {
  slaDomains {
    nodes {
      name
      id
      description
    }
  }
}
```

Example Error Response

```json
{
  "code": 400,
  "uri": "/api/graphql",
  "traceSpan": {
    "traceId": "yQq0Pl2VftOESD4kCtiFdg==",
    "operation": "/api/graphql",
    "spanId": "hEMkvglH1gc="
  },
  "message": "[QueryAnalysisError] [DLC Team] Encountered Client error (400) executing query with operations: [] and variables {}. Error: Query does not pass validation. Violations:\n\nCannot query field 'description' on type 'SlaDomain'. Did you mean to use an inline fragment on 'GlobalSlaReply'? (line 6, column 7):\n      description\n      ^"
}
```

The error message states the query doesn't pass validation, and describes the violations saying it cannot query the field `description`. Many times, the API will give suggestions as to what can be done to correct the query such as "Did you mean to use an inline fragment on 'GlobalSlaReply'?" This indicates the field `description` is actually located on an 'implementation' of the `SlaDomain` type.

### Corrected Query

```graphql
query {
  slaDomains {
    nodes {
      name
      id
      ... on GlobalSlaReply {
        description
      }
    }
  }
}
```

## Error Code **403**

### Reason

These errors are the result of a permissions issue. While RBAC is a common cause, the other reason could be that the query, or even a field in the query is behind a feature flag that is not enabled. This occurs when a development feature is deployed into the production API schema behind a feature flag, or the query is a part of licensing that has not been purchased or approved.

### Solution

Remove the field, find an alternative query, or be sure that the permissions applied to the service account are sufficient to perform this query.

### Example Erroneous Query

```graphql
query {
  clusterConnection(filter: {name: "example"}) {
    nodes {
      name
      isTprEnabled
    }
  }
}
```

### Example Error Response

```json
{
  "data": {
    "clusterConnection": {
      "nodes": [
        {
          "name": "example",
          "isTprEnabled": null
        }
      ]
    }
  },
  "errors": [
    {
      "message": "Account does not have the appropriate features enabled to access the field.",
      "path": [
        "clusterConnection",
        "nodes",
        0,
        "isTprEnabled"
      ],
      "locations": [
        {
          "line": 5,
          "column": 7
        }
      ],
      "extensions": {
        "code": 403,
        "trace": {
          "operation": "/api/graphql",
          "traceId": "9v0wj/Sm9UVOdUFd1ottJQ==",
          "spanId": "Jygbg58zl/M="
        }
      }
    }
  ]
}
```

### Corrected Query

```graphql
query {
  clusterConnection(filter: {name: "example"}) {
    nodes {
      name
    }
  }
}
```

The offending field mentioned in the error has been removed.

## Error Code **404**

### Reason

These errors indicate you've provided an ID that does not exist for an object using the supplied query.

### Solution

Identify the correct ID or query to be used.

### Example Erroneous Query

```graphql
query {
  vSphereVmNew(fid: "7d303326-7c2c-4ea2-b463-dedb8910d98a") {
    name
    id
  }
}
```

### Example Error Response

```json
{
  "data": null,
  "errors": [
    {
      "message": "NOT_FOUND: Unable to find managed object for ID or you are not authorized to access it",
      "path": [
        "vSphereVmNew"
      ],
      "locations": [
        {
          "line": 2,
          "column": 3
        }
      ],
      "extensions": {
        "code": 404,
        "trace": {
          "operation": "/api/graphql",
          "traceId": "gwzt2HR5GinN4PrhQfJ+Bg==",
          "spanId": "/MR1LoaAiD8="
        }
      }
    }
  ]
}
```

## Error Code **500**

### Reason

These errors are server-side, and a defect should be filed immediately. It could be that the query is not being used as intended, but the API should catch this. This error indicates that the API let the call through to the back-end service and the service is responding with an error. Essentially this is an “uncaught exception.

### Solution

File an engineering case with the product team that owns this query. If possible, use a different query.

### Example Erroneous Query

```graphql
mutation {
  takeOnDemandSnapshot(input: {workloadIds: "fef3f155-7092-5b19-bcea-fe8021c38dc6" slaId: "c2c3823f-d74d-49a1-afbe-8d7e0a4d3b7c"}) {
    taskchainUuids {
      taskchainUuid
    }
  }
}
```

### Example Error Response

```json
{
  "data": null,
  "errors": [
    {
      "message": "The on-demand snapshot is not supported for given workload type: Mssql",
      "path": [
        "takeOnDemandSnapshot"
      ],
      "locations": [
        {
          "line": 2,
          "column": 3
        }
      ],
      "extensions": {
        "code": 500,
        "trace": {
          "operation": "/api/graphql",
          "traceId": "7hcbDGDPt7EqAkBQ1vSu/A==",
          "spanId": "HrzcWppCISg="
        }
      }
    }
  ]
}
```

### Corrected Query

```graphql
mutation {
 createOnDemandMssqlBackup(
  input: {
    id: "fef3f155-7092-5b19-bcea-fe8021c38dc6" 
    config:{
      baseOnDemandSnapshotConfig: {
        slaId: "c2c3823f-d74d-49a1-afbe-8d7e0a4d3b7c"
      }
    }
  }) {
    id
  }
}
```

The query was updated to utilize the correct mutation for performing an on-demand snapshot of an MSSQL server.

## What is Rubrik Annapurna?

Rubrik Annapurna turns snapshot data into a secure, central library of knowledge for AI applications.

- **No Expensive Data Lake Required**

  ______________________________________________________________________

  Rubrik provides a centralized place to create retrievers for a multitude of data sources. This greatly simplifies the process by having a single API and retriever for heterogeneus data.

- **Built-in Data Security Policies**

  ______________________________________________________________________

  Policies applied to a retriever can eliminate the accidental leakage of sensitive data to LLMs. This protects against sensitive data leakage to Large Language Models(LLMs).

- **Pass-Through File Permissions**

  ______________________________________________________________________

  Permissions set on the source file are respected by the retriever. Only users that have access to the file in production will have access from the retriever.

- **Application-Aware Embedding**

  ______________________________________________________________________

  Leverage intelligent embeddings tailored for third-party or custom app data schemas to enhance compatibility, performance, and time to value.

______________________________________________________________________

## How Annapurna works

Rubrik Annapurna retrievers or "Chatbots" are created from protected object data within Rubrik.

Sensitive data policies can also be defined for the retriever, blocking access to any data containing data such as social security or credit card numbers.

The retriever itself is a vector database with an API, resulting in a data source for Retrieval Augmented Generation (RAG).

Large Language Models (LLMs) can use the retrieved data to provide a contextually accurate, human readable response, free of any sensitive data according to the policy, to any question related to the data in the retriever.

```
flowchart TD
  subgraph B[Annapurna Retriever]
    direction TB
    subgraph data
      direction TB
      confluence[Confluence Data]
      onedrive[M365 OneDrive Data]
      exchange[Exchange Mailbox Data]
    end
    subgraph Security
    direction TB
      sdd[Sensitive Data Policy]
      filepermissions[File Permissions]
      retrieverpermissions[Retriever Permissions]
    end 
    subgraph vector[Vector Database]
    end
    data --> vector
    Security --> vector

  end
  A[User submits query] --> B --> C[Relevant Documents] --> D[Language Model] --> E[Generate Final Answer]
```

In this end-to-end example, [LangChain](https://langchain.com) is used to query a Rubrik Annapurna retriever and pass the relevant documents to Azure OpenAI to provide a relevant response.

## Setup Instructions

______________________________________________________________________

### Create a Python environment

```shell
python3 -m venv venv
source venv/bin/activate
```

### Install required Python packages

```shell
pip install -U langchain langchain-openai requests
```

### Set environment variables

```shell
export AZURE_OPENAI_API_KEY="your-azure-openai-api-key"
export AZURE_OPENAI_ENDPOINT="https://your-instance.openai.azure.com"
export AZURE_DEPLOYMENT_NAME="your-gpt-4o-deployment"
export AZURE_OPENAI_MODEL="gpt-4o"
export RSC_FQDN="your-instance.my.rubrik.com"
export RSC_TOKEN="your-rubrik-api-token"
```

______________________________________________________________________

## Rubrik Retriever Class

Save the below code in a file called `rubrik_retriever.py`. This is the Rubrik LangChain `BaseRetriever` which will fetch documents from the retriever through the Rubrik API.

rubrik_retriever.py

```python
import os
import requests
import json
from typing import List
from langchain.schema import Document
from langchain.schema.retriever import BaseRetriever

class RubrikRetriever(BaseRetriever):
    """Custom LangChain retriever for querying the Rubrik vector database via REST API."""

    retriever_id: str  # This is the retriever or "Chatbot" ID from Rubrik.
    rsc_fqdn: str = os.getenv("RSC_FQDN")  # This is your RSC instance e.g. example.my.rubrik.com
    rsc_token: str = os.getenv("RSC_TOKEN")  # RSC API Token

    def _get_relevant_documents(self, query: str) -> List[Document]:
        """Sends a query to the API and retrieves relevant chunks."""

        headers = {
            "Content-Type": "application/json",
            "Authorization": f"Bearer {self.rsc_token}"
        }
        api_url = f"https://{self.rsc_fqdn}/api/annapurna/{self.retriever_id}/retrieve"

        payload = {"query": query}
        response = requests.post(api_url, headers=headers, json=payload)

        if response.status_code != 200:
            raise Exception(f"Error from API: {response.status_code} - {response.text}")

        results = response.json().get("results", [])

        return [
            Document(page_content=result["content"], metadata={"source_url": result["sourceUrl"]})
            for result in results
        ]
```

______________________________________________________________________

## Langchain with Rubrik and Azure OpenAI

Save the below code in a file called `annapurna_query.py`. This performs the chain to query the Rubrik retriever, pass the results to Azure OpenAI, and print the response.

annapurna_query.py

```python
import argparse
import os
from rubrik_retriever import RubrikRetriever  # Import the retriever class
from langchain.chains import RetrievalQA
from langchain.prompts import PromptTemplate
from langchain_openai import AzureChatOpenAI

# Set up argument parsing
parser = argparse.ArgumentParser(description="Run a query using RubrikRetriever and Azure OpenAI GPT-4o.")
parser.add_argument("retriever_id", type=str, help="The retriever ID for RubrikRetriever.")
parser.add_argument("query", type=str, help="The query to be processed by the retriever and LLM.")
args = parser.parse_args()

# Initialize the retriever with the retriever ID
retriever = RubrikRetriever(retriever_id=args.retriever_id)

# Initialize the Azure OpenAI GPT-4o model
llm = AzureChatOpenAI(
    openai_api_version="2024-02-15-preview",
    azure_endpoint=os.getenv("AZURE_OPENAI_ENDPOINT"),
    openai_api_key=os.getenv("AZURE_OPENAI_API_KEY"),
    deployment_name=os.getenv("AZURE_DEPLOYMENT_NAME"),
    model=os.getenv("AZURE_OPENAI_MODEL", "gpt-4o"),
)

# Define a custom prompt
custom_prompt = PromptTemplate(
    template="""You are a helpful assistant. Use the following retrieved documents to answer the question:

    Retrieved Documents:
    {context}

    Question: {question}

    Answer:""",
    input_variables=["question", "context"],
)

# Create the RAG pipeline using LangChain's RetrievalQA
qa_chain = RetrievalQA.from_chain_type(
    llm=llm,
    retriever=retriever,
    chain_type="stuff",
    return_source_documents=False,  # Only return the LLM response
    chain_type_kwargs={"prompt": custom_prompt},
)

# Retrieve the LLM response
response = qa_chain.invoke({"query": args.query})

# Extract and print only the LLM-generated response. For full response, change the below to print(response)
if isinstance(response, dict) and "result" in response:
    print(response["result"])  # Correct way to access the response
else:
    print("⚠️ Unexpected response format:", response)  # Debugging fallback
```

______________________________________________________________________

### Usage

Run `annapurna_query.py` by providing the Rubrik retriever ID and a query relevant to the data contained in the Rubrik retriever.

```shell
python annapurna_query.py <retriever_id> "Your query here"
```

## Listing Retrievers

Performing a query against a retriever requires a retriever ID. To list retrievers, perform the following API call against the Rubrik Security Cloud API.

```graphql
query {
    chatbots {
        nodes {
            name
            id
        }
    }
}
```

```python
import requests
import json
import os

# Get RSC access token from environment variable
RSC_TOKEN = os.getenv("RSC_TOKEN")

# Define the GraphQL query
query = {
    "query": "query { chatbots(nameSearchFilter: \"exampleRetriever\") { nodes { name id } } }"
}

# Set headers
headers = {
    "Content-Type": "application/json",
    "Authorization": f"Bearer {RSC_TOKEN}"
}

# Define the GraphQL API endpoint
url = "https://example.my.rubrik.com/api/graphql"

# Execute the GraphQL query
response = requests.post(url, headers=headers, data=json.dumps(query))

# Print the response
print(response.json())
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { chatbots { nodes { name id } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

### API Endpoint: `POST /api/annapurna/{id}/retrieve`

### Summary

Retrieve relevant chunks with Annapurna retriever. To retrieve chunks from files with user-level file permissions, authentication must take place using [OAuth2 Authorization Code](../../../authentication/#user-accounts-oauth2-authorization-code-with-pkce)

### Request Parameters

| Name               | In   | Type   | Required | Description                    |
| ------------------ | ---- | ------ | -------- | ------------------------------ |
| `id`               | path | string | Yes      | ID of the retriever            |
| `retrieve_request` | body | object | Yes      | Query parameters for retrieval |

### Request Body

```json
{
  "query": "string"
}
```

### Example

```python

```

```bash

```

### Response (200)

```json
{
  "results": [
    {
      "content": "string",
      "sourceUrl": "string"
    }
  ]
}
```

The Data Protection App provides the core tools and features for protecting, managing, and analyzing your data.

## Retrieving Job Status of all Cloud Native Objects (AWS, Azure, GCP)

```graphql
query {
    taskchain(taskchainId: "019523cf-0ded-7373-9e35-cdddc24e5233") {
    state
    progress
    error
    startTime
    endTime
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery taskchain -AddField State,Progress,Error,StartTime,EndTime
$query.Var.taskchainId = "019523cf-0ded-7373-9e35-cdddc24e5233"
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { taskchain(taskchainId: \\\"019523cf-0ded-7373-9e35-cdddc24e5233\\\") { state progress error startTime endTime } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## On-Demand Backup for Cloud Native Objects (AWS, Azure, GCP)

```graphql
mutation {
  takeOnDemandSnapshot(input: {
    workloadIds: ["0966c161-7156-495a-9a9c-73ec08e61e0d"]
    slaId: "603d0b87-966a-4eb7-9705-d29fd45cf663"
  }) {
    taskchainUuids {
      workloadId
      taskchainUuid
    }
    errors {
      workloadId
      error
    }
  }
}
```

```powershell
$workload = Get-RscAzureNativeVm -NameSubstring "example"

$query = New-RscMutation -GqlMutation takeOnDemandSnapshot
$query.Var.Input = Get-RscType -Name TakeOnDemandSnapshotInput
$query.Var.Input.workloadIds = $workload.id
$query.Var.Input.slaId = $workload.effectiveSlaDomain.Id
$query.Field = Get-RscType -Name TakeOnDemandSnapshotReply -InitialProperties `
    taskchainUuids.workloadId,`
    taskchainUuids.taskchainUuid,`
    errors.workloadId,`
    errors.errors
$taskchain = $query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation { takeOnDemandSnapshot(input: { workloadIds: [\\\"0966c161-7156-495a-9a9c-73ec08e61e0d\\\"] slaId: \\\"603d0b87-966a-4eb7-9705-d29fd45cf663\\\" }) { taskchainUuids { workloadId taskchainUuid } errors { workloadId error } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving AWS EBS Volumes

```graphql
query {
  awsNativeEbsVolumes(ebsVolumeFilters: {
    #nameOrIdSubstringFilter: {nameOrIdSubstring: "example"}
    #regionFilter: {regions: [US_EAST_1]}
    #tagFilter: {tagFilterParams: {tagKey: "foo" tagValue: "bar" filterType: TAG_KEY_VALUE}}
    #typeFilter: {ebsVolumeTypes: [IO1,IO2]}
  }) {
    nodes {
      name
      id
      nativeName
      cloudNativeId
      volumeType
      sizeInGiBs
      iops
      region
      availabilityZone
      tags {
        key
        value
      }
      awsAccountRubrikId
      awsAccount {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery awsNativeEbsVolumes
$query.Field.Nodes = @(Get-RscType -Name AwsNativeEbsVolume -InitialProperties `
      name,`
      idm,`
      nativeName,`
      cloudNativeId,`
      volumeType,`
      sizeInGiBs,`
      iops,`
      region,`
      availabilityZone,`
      tags.key, tags.value,`
      awsAccountRubrikId,`
      awsAccount.name, awsAccount.id,`
      effectiveSlaDomain.name, effectiveSlaDomain.id
)
$query.invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { awsNativeEbsVolumes(ebsVolumeFilters: { }) { nodes { name id nativeName cloudNativeId volumeType sizeInGiBs iops region availabilityZone tags { key value } awsAccountRubrikId awsAccount { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving AWS EC2 Instances

```graphql
query {
  awsNativeEc2Instances(ec2InstanceFilters: {
    #nameOrIdSubstringFilter: {nameOrIdSubstring: "example"}
    #regionFilter: {regions: [US_EAST_1]}
    #tagFilter: {tagFilterParams: {tagKey: "foo" tagValue: "bar" filterType: TAG_KEY_VALUE}}
    #vpcFilter: {vpcIds: ["093e5470-22b4-483c-8910-fff0cbb982b1"]}
  }) {
    nodes {
      name
      id
      instanceName
      instanceNativeId
      instanceType
      publicIp
      privateIp
      vpcName
      vpcId
      region
      availabilityZone
      osType
      attachmentSpecs {
        awsNativeEbsVolumeId
        devicePath
        isRootVolume
        isExcludedFromSnapshot
      }
      tags {
        key
        value
      }
      awsAccountRubrikId
      awsAccount {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
Get-RscAwsNativeEc2Instance
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { awsNativeEc2Instances(ec2InstanceFilters: { }) { nodes { name id instanceName instanceNativeId instanceType publicIp privateIp vpcName vpcId region availabilityZone osType attachmentSpecs { awsNativeEbsVolumeId devicePath isRootVolume isExcludedFromSnapshot } tags { key value } awsAccountRubrikId awsAccount { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving AWS RDS Instances

```graphql
query {
  awsNativeRdsInstances(rdsInstanceFilters: {
    #nameSubstringFilter: {nameSubstring: "example"}
    #regionFilter: {regions: [US_EAST_1]}
    #tagFilter: {tagFilterParams: {tagKey: "foo" tagValue: "bar" filterType: TAG_KEY_VALUE}}
    #vpcFilter: {vpcIds: ["093e5470-22b4-483c-8910-fff0cbb982b1"]}
  }) {
    nodes {
      name
      id
      dbInstanceName
      dbiResourceId
      dbInstanceClass
      dbEngine
      readReplicaSourceName
      rdsType
      vpcName
      vpcId
      isMultiAz
      allocatedStorageInGibi
      region
      primaryAvailabilityZone
      tags {
        key
        value
      }
      awsAccountRubrikId
      awsAccount {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery awsNativeRdsInstances
$query.field.Nodes = @(Get-RscType -Name AwsNativeRdsInstance -InitialProperties name,`
    id,`
    dbInstanceName,`
    dbiResourceId,`
    dbInstanceClass,`
    dbEngine,`
    readReplicaSourceName,`
    rdsType,`
    vpcName,`
    vpcId,`
    isMultiAz,`
    allocatedStorageInGibi,`
    region,`
    primaryAvailabilityZone,`
    tags.key,tags.value,`
    awsAccountRubrikId,`
    awsAccount.name,awsAccount.id,`
    effectiveSlaDomain.name,effectiveSlaDomain.id)
$query.invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { awsNativeRdsInstances(rdsInstanceFilters: { }) { nodes { name id dbInstanceName dbiResourceId dbInstanceClass dbEngine readReplicaSourceName rdsType vpcName vpcId isMultiAz allocatedStorageInGibi region primaryAvailabilityZone tags { key value } awsAccountRubrikId awsAccount { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving AWS S3 Buckets

```graphql
query {
  awsNativeRoot {
    objectTypeDescendantConnection(
      objectTypeFilter: AWS_NATIVE_S3_BUCKET
      filter: [
        #{field: NAME_EXACT_MATCH texts: "example"}
        #{field: AWS_TAG tagFilterParams: {tagKey: "foo" tagValue: "bar" filterType: TAG_KEY_VALUE}}
      ]
    ) {
      nodes {
        name
        id
        nativeName
        cloudNativeId
        region
        tags {
          key
          value
        }
        ... on AwsNativeS3Bucket {
          numberOfObjects
          bucketSizeBytes
          isOnboarding
        }
        effectiveSlaDomain {
          name
          id
        }
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery awsNativeRoot
$query.Field.ObjectTypeDescendantConnection = Get-RscType -Name AwsNativeHierarchyObjectConnection
$query.field.ObjectTypeDescendantConnection.PageInfo = Get-RscType -Name PageInfo -InitialProperties hasNextPage,EndCursor
$query.field.ObjectTypeDescendantConnection.Nodes = @(Get-RscType -Name AwsNativeS3Bucket -InitialProperties `
    Name,`
    id,`
    nativeName,`
    cloudNativeId,`
    region,`
    tags.key,`
    tags.value,`
    numberOfObjects,`
    bucketSizeBytes,`
    isOnboarding,`
    effectiveSladomain.name,`
    effectiveSladomain.id)
$query.field.Vars.ObjectTypeDescendantConnection.objectTypeFilter = [RubrikSecurityCloud.Types.HierarchyObjectTypeEnum]::AWS_NATIVE_S3_BUCKET
$query.invoke().ObjectTypeDescendantConnection.nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { awsNativeRoot { objectTypeDescendantConnection( objectTypeFilter: AWS_NATIVE_S3_BUCKET filter: [ ] ) { nodes { name id nativeName cloudNativeId region tags { key value } ... on AwsNativeS3Bucket { numberOfObjects bucketSizeBytes isOnboarding } effectiveSlaDomain { name id } } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```


## Retrieving Managed Instance SQL Databases

```graphql
query {
  azureSqlManagedInstanceDatabases( azureSqlManagedInstanceDatabaseFilters: {
      #nameSubstringFilter: {nameSubstring: "example"}
      #resourceGroupFilter: {resourceGroupNames: ["example"]}
      #serverFilter: {serverNames: ["example"]}
      #subscriptionFilter: {subscriptionIds: ["7d0d81dc-3323-4f45-bd0b-cc37e5bf9f37"]}
      #regionFilter: {regions: [EAST_US, EAST_US2]}
      #relicFilter: {relic: false}
  }) {
    nodes {
      name
      id
      region
      persistentStorage {
        name
        id
      }
      azureSqlManagedInstanceServer {
        name
        id
      }
      persistentStorage {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell

```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { azureSqlManagedInstanceDatabases( azureSqlManagedInstanceDatabaseFilters: { }) { nodes { name id region persistentStorage { name id } azureSqlManagedInstanceServer { name id } persistentStorage { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Managed Instance SQL Servers

```graphql
query {
  azureSqlManagedInstanceServers( azureSqlManagedInstanceServerFilters: {
      #nameSubstringFilter: {nameSubstring: "example"}
      #tagFilter: {tagFilterParams: {tagKey: "foo", tagValue: "bar", filterType: TAG_KEY_VALUE}}
      #resourceGroupFilter: {resourceGroupNames: ["example"]}
      #subscriptionFilter: {subscriptionIds: ["7d0d81dc-3323-4f45-bd0b-cc37e5bf9f37"]}
      #regionFilter: {regions: [EAST_US, EAST_US2]}
  }) {
    nodes {
      name
      id
      region
      vCoresCount
      storageSizeGib
      instancePoolName
      serviceTier
      vnetName
      subnetName
      azureNativeResourceGroup {
        name
        id
      }
      tags {
        key
        value
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell

```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { azureSqlManagedInstanceServers( azureSqlManagedInstanceServerFilters: { }) { nodes { name id region vCoresCount storageSizeGib instancePoolName serviceTier vnetName subnetName azureNativeResourceGroup { name id } tags { key value } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Azure SQL Databases

```graphql
query {
  azureSqlDatabases( azureSqlDatabaseFilters: {
      #nameSubstringFilter: {nameSubstring: "example"}
      #tagFilter: {tagFilterParams: {tagKey: "foo", tagValue: "bar", filterType: TAG_KEY_VALUE}}
      #resourceGroupFilter: {resourceGroupNames: ["example"]}
      #subscriptionFilter: {subscriptionIds: ["7d0d81dc-3323-4f45-bd0b-cc37e5bf9f37"]}
      #regionFilter: {regions: [EAST_US, EAST_US2]}
      #relicFilter: {relic: false}
  }) {
    nodes {
      name
      id
      region
            elasticPoolName
      backupStorageRedundancy
      serviceTier
      maximumSizeInBytes
      persistentStorage {
        name
        id
      }
      serviceObjectiveName
      azureSqlDatabaseServer {
        name
        id
      }
      tags {
        key
        value
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery azureSqlDatabases
# $query.Var.azureSqlDatabaseFilters = Get-RscType -Name AzureSqlDatabaseFilters -InitialProperties `
#     nameSubstringFilter,`
#     tagFilter.tagFilterParams,`
#     resourceGroupFilter,`
#     subscriptionFilter,`
#     regionFilter,`
#     relicFilter
# $query.Var.azureSqlDatabaseFilters.nameSubstringFilter.nameSubstring = "example"
# $query.Var.azureSqlDatabaseFilters.tagFilter.tagFilterParams.key = "foo"
# $query.Var.azureSqlDatabaseFilters.tagFilter.tagFilterParams.value = "bar"
# $query.Var.azureSqlDatabaseFilters.tagFilter.tagFilterParams.filterType = [RubrikSecurityCloud.Types.TagFilterType]::TAG_KEY_VALUE
# $query.Var.azureSqlDatabaseFilters.resourceGroupFilter.resourceGroupNames = @("example")
# $query.Var.azureSqlDatabaseFilters.subscriptionFilter.subscriptionIds = @("7d0d81dc-3323-4f45-bd0b-cc37e5bf9f37")
# $query.Var.azureSqlDatabaseFilters.regionFilter.regions = @([RubrikSecurityCloud.Types.AzureRegion]::US_CENTRAL,[RubrikSecurityCloud.Types.AzureRegion]::US_EAST)
# $query.Var.azureSqlDatabaseFilters.relicFilter.relic = $false
$query.Field.nodes = @(Get-RscType -Name AzureSqlDatabaseDb -InitialProperties `
    name, `
    id, `
    region,`
    elasticPoolName,`
    backupStorageRedundancy,`
    serviceTier,`
    maximumSizeInBytes,`
    persistentStorage.name, persistentStorage.id,`
    serviceObjectiveName,`
    azureSqlDatabaseServer.name, azureSqlDatabaseServer.id,`
    tags.key, tags.value,`
    effectiveSlaDomain.name, effectiveSlaDomain.id
)
$query.Invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { azureSqlDatabases( azureSqlDatabaseFilters: { }) { nodes { name id region elasticPoolName backupStorageRedundancy serviceTier maximumSizeInBytes persistentStorage { name id } serviceObjectiveName azureSqlDatabaseServer { name id } tags { key value } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Azure SQL Database Servers

```graphql
# https://docs.microsoft.com/en-us/azure/azure-sql/database/logical-servers
query {
  azureSqlDatabaseServers( azureSqlDatabaseServerFilters: {
      #nameSubstringFilter: {nameSubstring: "example"}
      #resourceGroupFilter: {resourceGroupNames: ["example"]}
      #subscriptionFilter: {subscriptionIds: ["7d0d81dc-3323-4f45-bd0b-cc37e5bf9f37"]}
      #regionFilter: {regions: [EAST_US, EAST_US2]}
  }) {
    nodes {
      name
      id
      region
      tags {
        key
        value
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell

```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { azureSqlDatabaseServers( azureSqlDatabaseServerFilters: { }) { nodes { name id region tags { key value } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

______________________________________________________________________

## Azure Virtual Machines

## Retrieving Azure Virtual Machines

```graphql
query {
  azureNativeVirtualMachines( virtualMachineFilters: {
      #nameSubstringFilter: {nameSubstring: "example"}
      #tagFilter: {tagFilterParams: {tagKey: "foo", tagValue: "bar", filterType: TAG_KEY_VALUE}}
      #resourceGroupFilter: {resourceGroupNames: ["example"]}
      #subscriptionFilter: {subscriptionIds: ["7d0d81dc-3323-4f45-bd0b-cc37e5bf9f37"]}
      #regionFilter: {regions: [EAST_US, EAST_US2]}
      #relicFilter: {relic: false}
  }) {
    nodes {
      name
      id
      nativeName
      cloudNativeId
      availabilitySetNativeId
      resourceGroup {
        name
        id
      }
      region
      sizeType
      osType
      vnetName
      subnetName
      privateIp
      attachedManagedDisks {
        name
        id
        cloudNativeId
        diskSizeGib
      }
      tags {
        key
        value
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
Get-RscAzureNativeVm
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { azureNativeVirtualMachines( virtualMachineFilters: { }) { nodes { name id nativeName cloudNativeId availabilitySetNativeId resourceGroup { name id } region sizeType osType vnetName subnetName privateIp attachedManagedDisks { name id cloudNativeId diskSizeGib } tags { key value } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Google Compute Engine (GCE) Instances

```graphql
query {
  gcpNativeGceInstances( gceInstanceFilters: {
      #nameOrIdSubstringFilter: {nameOrIdSubstring: "example"}
      #labelFilter: {labelFilterParams: {labelKey: "foo", labelValue: "bar", filterType: LABEL_KEY_VALUE}}
      #projectFilter: {projectIds: ["7d0d81dc-3323-4f45-bd0b-cc37e5bf9f37"]}
      #machineTypeFilter: {machineTypes: ["example"]}
      #networkFilter: {networkNames: ["example"]}
      #regionFilter: {regions: ["example"]}
      #relicFilter: {relic: false}
  }) {
    nodes {
      name
      id
      nativeName
            nativeId
      region
            zone
      machineType
      vpcName
      attachedDisks {
        diskName
        diskId
        deviceName
        sizeInGiBs
        isBootDisk
        isExcluded
      }
      labels {
        key
        value
      }
      networkHostProjectNativeId
      gcpNativeProject {
        name
        id
        nativeName
        nativeId
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell

```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { gcpNativeGceInstances( gceInstanceFilters: { }) { nodes { name id nativeName nativeId region zone machineType vpcName attachedDisks { diskName diskId deviceName sizeInGiBs isBootDisk isExcluded } labels { key value } networkHostProjectNativeId gcpNativeProject { name id nativeName nativeId } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```


## Retrieving Fileset Templates and Filesets

```graphql
query {
  filesetTemplates( hostRoot: WINDOWS_HOST_ROOT filter: [
    #{field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      osType
      exceptions
      excludes
      osType
      preBackupScript
      postBackupScript
      allowBackupNetworkMounts
      allowBackupHiddenFoldersInNetworkMounts
      shareType
      descendantConnection {
        nodes {
          name
          id
          physicalPath {
            name
            fid
          }
        }
      }
      cluster {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
# Get Linux Fileset Templates
Get-RscFilesetTemplate -OsType Linux

# Get Linux Filesets
Get-RscHost -OsType Linux | Get-RscFileset
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { filesetTemplates( hostRoot: WINDOWS_HOST_ROOT filter: [ {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cdmId osType exceptions excludes osType preBackupScript postBackupScript allowBackupNetworkMounts allowBackupHiddenFoldersInNetworkMounts shareType descendantConnection { nodes { name id physicalPath { name fid } } } cluster { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Job Status of Fileset Jobs

```graphql
query {
  filesetRequestStatus(input: {
    id: "CREATE_FILESET_SNAPSHOT_14852a49-8fbf-4aba-a772-91afbd0eb77a_0b734ff4-7465-463b-97b7-649def71388d:::0"
    clusterUuid: "8417a938-96f5-43c6-9905-b36e051c5f98"
  }) {
    startTime
    endTime
    error {
      message
    }
    progress
    status
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery filesetRequestStatus
$query.Var.input = Get-RscType -Name GetFilesetAsyncRequestStatusInput
$query.Var.input.Id = "CREATE_FILESET_SNAPSHOT_14852a49-8fbf-4aba-a772-91afbd0eb77a_0b734ff4-7465-463b-97b7-649def71388d:::0"
$query.Var.input.ClusterUuid = "654230DC-C83C-428B-A239-1A585C05AE0F"
$query.Field = Get-RscType -Name AsyncRequestStatus -InitialProperties `
    StartTime,`
    EndTime,`
    error.message,`
    result,`
    status
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { filesetRequestStatus(input: { id: \\\"CREATE_FILESET_SNAPSHOT_14852a49-8fbf-4aba-a772-91afbd0eb77a_0b734ff4-7465-463b-97b7-649def71388d:::0\\\" clusterUuid: \\\"8417a938-96f5-43c6-9905-b36e051c5f98\\\" }) { startTime endTime error { message } progress status } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Fileset On-Demand Backup

```graphql
mutation filesetSnapshot {
  createFilesetSnapshot(input: {
    id: "f79b1102-77b5-4434-8400-c2a66c9b2dc1"
    config: {
      slaId: "c7bd8eb2-7132-4c8f-8592-682d507520dc"
    }
  }) {
    id
  }
}
```

```powershell
$fileset = Get-RscHost -OsType Linux -Name "fileserver.example.com" | Get-RscFileset | Select-Object -First 1
$sla = Get-RscSla -Name "example"

$query = New-RscMutation -GqlMutation createFilesetSnapshot
$query.Var.input = Get-RscType -Name CreateFilesetSnapshotInput -InitialProperties config
$query.Var.input.id = $fileset.Id
$query.Var.input.Config.slaId = $sla.Id
$query.Field = Get-RscType -Name AsyncRequestStatus -InitialProperties id
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation filesetSnapshot { createFilesetSnapshot(input: { id: \\\"f79b1102-77b5-4434-8400-c2a66c9b2dc1\\\" config: { slaId: \\\"c7bd8eb2-7132-4c8f-8592-682d507520dc\\\" } }) { id } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving DB2 instances

```graphql
query {
  objects: db2Instances(
    filter: [
      {field: NAME texts: "example"}
      {field: IS_RELIC texts: "false"}
      {field: IS_REPLICATED texts: "false"}
    ]
    ) {
    nodes {
      name
      id
      effectiveSlaDomain {
        name
        id
      }
      cluster {
        name
        id
      }
      primaryClusterUuid
      hosts {
        name
        id
      }
      status
      statusMessage
      instanceType
    }
  }
}
```

```powershell
Get-RscDb2Instance
```

```bash

```

## Retrieving DB2 databases

```graphql
query {
  db2Databases(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      effectiveSlaDomain {
        name
        id
      }
      cluster {
        name
        id
      }
      db2DbType
      db2Instance {
        name
        id
      }
      status
      statusMessage
      backupSessions
      backupParallelism
    }
  }
}
```

```powershell
Get-RscDb2Database
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { db2Databases(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cdmId effectiveSlaDomain { name id } cluster { name id } db2DbType db2Instance { name id } status statusMessage backupSessions backupParallelism } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving DB2 Database Job Status

```graphql
query {
  db2DatabaseJobStatus(input: {
    id: "CREATE_DB2_FULL_SNAPSHOT_809663d4-b82a-485e-a7ba-cf7cf88e9fdf_966044a8-89a8-441c-90ca-d360279543df:::0"
    clusterUuid: "85e98e61-4c1f-496a-b846-5eb871966025"
  }) {
    progress
    status
    result
    error {
      message
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery db2DatabaseJobStatus
$query.Var.input = Get-RscType -Name GetDb2DatabaseAsyncRequestStatusInput
$query.Var.input.id = "CREATE_DB2_FULL_SNAPSHOT_809663d4-b82a-485e-a7ba-cf7cf88e9fdf_966044a8-89a8-441c-90ca-d360279543df:::0"
$query.Var.input.ClusterUuid = "85e98e61-4c1f-496a-b846-5eb871966025"
$query.Field = Get-RscType -Name AsyncRequestStatus -InitialProperties `
    StartTime,`
    EndTime,`
    error.message,`
    result,`
    status
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { db2DatabaseJobStatus(input: { id: \\\"CREATE_DB2_FULL_SNAPSHOT_809663d4-b82a-485e-a7ba-cf7cf88e9fdf_966044a8-89a8-441c-90ca-d360279543df:::0\\\" clusterUuid: \\\"85e98e61-4c1f-496a-b846-5eb871966025\\\" }) { progress status result error { message } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

```graphql
mutation db2OnDemandBackup {
  createOnDemandDb2Backup(input: {
    id: "c7bd8eb2-7132-4c8f-8592-682d507520dc"
    config: {
      slaId: "f79b1102-77b5-4434-8400-c2a66c9b2dc1"
      }
    }) {
      id
  }
}
```

```powershell
$db2Database = Get-RscDb2Database -Name "example"

$query = New-RscMutation -GqlMutation createOnDemandDb2Backup
$query.Var.input = Get-RscType -Name CreateOnDemandDb2BackupInput -InitialProperties config
$query.Var.input.id = $db2Database.Id
$query.Var.input.Config.slaId = $db2Database.effectiveSlaDomain.Id
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation db2OnDemandBackup { createOnDemandDb2Backup(input: { id: \\\"c7bd8eb2-7132-4c8f-8592-682d507520dc\\\" config: { slaId: \\\"f79b1102-77b5-4434-8400-c2a66c9b2dc1\\\" } }) { id } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving SLA Managed Volumes

```graphql
query {
  slaManagedVolumes( filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      managedVolumeType
      provisionedSize
      numChannels
      clientNamePatterns
      host {
        name
        osName
        id
      }
      hostDetail {
        name
        id
        status
      }
      smbShare {
        domainName
        validIps
        validUsers
        activeDirectoryGroups
      }
      nfsSettings {
        version
      }
      clientConfig {
        username
        backupScript {
          scriptCommand
        }
        preBackupScript {
          scriptCommand
        }
        successfulPostBackupScript {
          scriptCommand
        }
        failedPostBackupScript {
          scriptCommand
        }
        channelHostMountPaths
        hostId
      }
      cluster {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery slaManagedVolumes
$query.Var.filter = @((Get-RscType -Name Filter),(Get-RscType -Name Filter))
$query.Var.filter[0].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_RELIC
$query.Var.filter[0].texts = "false"
$query.Var.filter[1].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_REPLICATED
$query.Var.filter[1].texts = "false"

$query.Field.nodes = @(Get-RscType -Name ManagedVolume -InitialProperties `
    name,`
    id,`
    cdmId,`
    managedVolumeType,`
    provisionedSize,`
    numChannels,`
    host.name,host.osName,host.id,`
    hostDetail.name,hostDetail.id,hostDetail.status,`
    nfsSettings.version,`
    clientConfig.username,`
    clientConfig.backupScript.scriptCommand,`
    clientConfig.preBackupScript.scriptCommand,`
    clientConfig.successfulPostBackupScript.scriptCommand,`
    clientConfig.failedPostBackupScript.scriptCommand,`
    channelHostMountPaths,`
    hostId,`
    cluster.name,cluster.id,`
    effectiveSlaDomain.name,effectiveSlaDomain.id
)
$query.invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { slaManagedVolumes( filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cdmId managedVolumeType provisionedSize numChannels clientNamePatterns host { name osName id } hostDetail { name id status } smbShare { domainName validIps validUsers activeDirectoryGroups } nfsSettings { version } clientConfig { username backupScript { scriptCommand } preBackupScript { scriptCommand } successfulPostBackupScript { scriptCommand } failedPostBackupScript { scriptCommand } channelHostMountPaths hostId } cluster { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Managed Volumes

```graphql
query {
  managedVolumes( filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      managedVolumeType
      provisionedSize
      numChannels
      clientNamePatterns
      host {
        name
        osName
        id
      }
      hostDetail {
        name
        id
        status
      }
      smbShare {
        domainName
        validIps
        validUsers
        activeDirectoryGroups
      }
      nfsSettings {
        version
      }
      clientConfig {
        username
        backupScript {
          scriptCommand
        }
        preBackupScript {
          scriptCommand
        }
        successfulPostBackupScript {
          scriptCommand
        }
        failedPostBackupScript {
          scriptCommand
        }
        channelHostMountPaths
        hostId
      }
      cluster {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
Get-RscManagedVolume
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { managedVolumes( filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cdmId managedVolumeType provisionedSize numChannels clientNamePatterns host { name osName id } hostDetail { name id status } smbShare { domainName validIps validUsers activeDirectoryGroups } nfsSettings { version } clientConfig { username backupScript { scriptCommand } preBackupScript { scriptCommand } successfulPostBackupScript { scriptCommand } failedPostBackupScript { scriptCommand } channelHostMountPaths hostId } cluster { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Managed Volume Live Mounts

```graphql
query {
  managedVolumeLiveMounts {
    nodes {
      name
      id
      logicalUsedSize
      managedVolume {
        name
        id
      }
      sourceSnapshot {
        id
      }
      channels {
        mountPath
        floatingIpAddress
        id
        mountSpec {
          mountDir
          imageSizeOpt
          node {
            id
          }
        }
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery managedVolumeLiveMounts

$query.Field.nodes = @(Get-RscType -Name ManagedVolumeMount -InitialProperties `
    name,`
    id,`
    cdmId,`
    logicalUsedSize,`
    managedVolume.name,managedVolume.id,`
    sourceSnapshot.id,`
    channels.mountpath,`
    channels.floatingIpAddress,`
    channels.id,`
    channels.mountSpec.mountDir,`
    channels.mountSpec.imageSizeOpt,`
    channels.mountSpec.node.id
)
$query.invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { managedVolumeLiveMounts { nodes { name id logicalUsedSize managedVolume { name id } sourceSnapshot { id } channels { mountPath floatingIpAddress id mountSpec { mountDir imageSizeOpt node { id } } } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving SLA Managed Volume Snapshot Job Status

```graphql
query {
  jobInfo(input: {
    requestId: "MANAGED_VOLUME_BACKUP_41447105-61f3-4def-873e-f7df1a37fc71_0522978f-c79e-4f82-9d02-c93711b387b8:::0"
    clusterUuid: "f79b1102-77b5-4434-8400-c2a66c9b2dc1"
    type: TAKE_MANAGED_VOLUME_ON_DEMAND_SNAPSHOT
    additionalInfo: {}
  }) {
    status
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery jobInfo
$query.Var.input = Get-RscType -Name JobInfoRequest -InitialProperties additionalInfo
$query.Var.input.Type = [RubrikSecurityCloud.Types.JobType]::TAKE_MANAGED_VOLUME_ON_DEMAND_SNAPSHOT
$query.Var.input.requestId = "MANAGED_VOLUME_BACKUP_41447105-61f3-4def-873e-f7df1a37fc71_0522978f-c79e-4f82-9d02-c93711b387b8:::0"
$query.Var.input.ClusterUuid = "f79b1102-77b5-4434-8400-c2a66c9b2dc1"
$query.field = Get-RscType -Name JobInfo -InitialProperties status
$query.Invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { jobInfo(input: { requestId: \\\"MANAGED_VOLUME_BACKUP_41447105-61f3-4def-873e-f7df1a37fc71_0522978f-c79e-4f82-9d02-c93711b387b8:::0\\\" clusterUuid: \\\"f79b1102-77b5-4434-8400-c2a66c9b2dc1\\\" type: TAKE_MANAGED_VOLUME_ON_DEMAND_SNAPSHOT additionalInfo: {} }) { status } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Managed Volume Begin Snapshot Job Status

```graphql
query {
  jobInfo(input: {
    requestId: "MANAGED_VOLUME_BEGIN_SNAPSHOT_89c2fe66-46f9-489b-8650-7eacfab37608_b5bfbeaf-8e45-4ccd-a9da-541dec38b0b9:::0"
    clusterUuid: "f79b1102-77b5-4434-8400-c2a66c9b2dc1"
    type: BEGIN_MANAGED_VOLUME_SNAPSHOT
    additionalInfo: {}
  }) {
    status
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery jobInfo
$query.Var.input = Get-RscType -Name JobInfoRequest -InitialProperties additionalInfo
$query.Var.input.Type = [RubrikSecurityCloud.Types.JobType]::BEGIN_MANAGED_VOLUME_SNAPSHOT
$query.Var.input.requestId = "MANAGED_VOLUME_BEGIN_SNAPSHOT_89c2fe66-46f9-489b-8650-7eacfab37608_b5bfbeaf-8e45-4ccd-a9da-541dec38b0b9:::0"
$query.Var.input.ClusterUuid = "f79b1102-77b5-4434-8400-c2a66c9b2dc1"
$query.field = Get-RscType -Name JobInfo -InitialProperties status
$query.Invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { jobInfo(input: { requestId: \\\"MANAGED_VOLUME_BEGIN_SNAPSHOT_89c2fe66-46f9-489b-8650-7eacfab37608_b5bfbeaf-8e45-4ccd-a9da-541dec38b0b9:::0\\\" clusterUuid: \\\"f79b1102-77b5-4434-8400-c2a66c9b2dc1\\\" type: BEGIN_MANAGED_VOLUME_SNAPSHOT additionalInfo: {} }) { status } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Managed Volume End Snapshot Job Status

```graphql
query {
  jobInfo(input: {
    requestId: "MANAGED_VOLUME_END_SNAPSHOT_89c2fe66-46f9-489b-8650-7eacfab37608_b5bfbeaf-8e45-4ccd-a9da-541dec38b0b9:::0"
    clusterUuid: "f79b1102-77b5-4434-8400-c2a66c9b2dc1"
    type: END_MANAGED_VOLUME_SNAPSHOT
    additionalInfo: {}
  }) {
    status
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery jobInfo
$query.Var.input = Get-RscType -Name JobInfoRequest -InitialProperties additionalInfo
$query.Var.input.Type = [RubrikSecurityCloud.Types.JobType]::END_MANAGED_VOLUME_SNAPSHOT
$query.Var.input.requestId = "MANAGED_VOLUME_END_SNAPSHOT_89c2fe66-46f9-489b-8650-7eacfab37608_b5bfbeaf-8e45-4ccd-a9da-541dec38b0b9:::0"
$query.Var.input.ClusterUuid = "f79b1102-77b5-4434-8400-c2a66c9b2dc1"
$query.field = Get-RscType -Name JobInfo -InitialProperties status
$query.Invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { jobInfo(input: { requestId: \\\"MANAGED_VOLUME_END_SNAPSHOT_89c2fe66-46f9-489b-8650-7eacfab37608_b5bfbeaf-8e45-4ccd-a9da-541dec38b0b9:::0\\\" clusterUuid: \\\"f79b1102-77b5-4434-8400-c2a66c9b2dc1\\\" type: END_MANAGED_VOLUME_SNAPSHOT additionalInfo: {} }) { status } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## SLA Managed Volume Snapshot

```graphql
mutation slaManagedVolumeSnapshot {
  takeManagedVolumeOnDemandSnapshot(input: {
    id: "f79b1102-77b5-4434-8400-c2a66c9b2dc1"
    config: {
      retentionConfig: {
        slaId: "c7bd8eb2-7132-4c8f-8592-682d507520dc"
      }
    }
  }) {
    id
  }
}
```

```powershell
$query = New-RscMutation -GqlMutation takeManagedVolumeOnDemandSnapshot
$query.Var.input = Get-RscType -Name TakeManagedVolumeOnDemandSnapshotInput -InitialProperties config.retentionconfig
$query.Var.input.id = "132b4b62-7d49-5972-9fcc-23d8dce2e1ad"
$query.var.input.config.retentionconfig.slaId = "4a67543d-7f43-4a42-9953-dfefaa8bee6e"
$query.field = Get-RscType -Name AsyncRequestStatus -InitialProperties id
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation slaManagedVolumeSnapshot { takeManagedVolumeOnDemandSnapshot(input: { id: \\\"f79b1102-77b5-4434-8400-c2a66c9b2dc1\\\" config: { retentionConfig: { slaId: \\\"c7bd8eb2-7132-4c8f-8592-682d507520dc\\\" } } }) { id } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Begin Managed Volume Snapshot

```graphql
mutation beginManagedVolumeSnapshot {
  beginManagedVolumeSnapshot(input: {
    id: "f79b1102-77b5-4434-8400-c2a66c9b2dc1"
  }) {
    asyncRequestStatus {
      id
    }
  }
}
```

```powershell
Start-RscManagedVolumeSnapshot
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation beginManagedVolumeSnapshot { beginManagedVolumeSnapshot(input: { id: \\\"f79b1102-77b5-4434-8400-c2a66c9b2dc1\\\" }) { asyncRequestStatus { id } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## End Managed Volume Snapshot

```graphql
mutation endManagedVolumeSnapshot {
  endManagedVolumeSnapshot(input: {
    id: "f79b1102-77b5-4434-8400-c2a66c9b2dc1"
    params: {
      retentionConfig: {
        slaId: "c7bd8eb2-7132-4c8f-8592-682d507520dc"
      }
    }
    #endSnapshotDelayInSeconds: 5
  }) {
    asyncRequestStatus {
      id
    }
  }
}
```

```powershell
Stop-RscManagedVolumeSnapshot
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation endManagedVolumeSnapshot { endManagedVolumeSnapshot(input: { id: \\\"f79b1102-77b5-4434-8400-c2a66c9b2dc1\\\" params: { retentionConfig: { slaId: \\\"c7bd8eb2-7132-4c8f-8592-682d507520dc\\\" } } }) { asyncRequestStatus { id } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Microsoft Active Directory Domain Controllers

```graphql
query {
  activeDirectoryDomainControllers(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      domainControllerGuid
      adServiceStatus {
        serviceStatus
      }
      hostname
      fsmoRoles
      serverRoles
      isGlobalCatalog
      host {
        name
        id
      }
      dcLocation
      effectiveSlaDomain {
        name
        id
      }
      cluster {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery activeDirectoryDomainControllers
$query.Var.filter = @((Get-RscType -Name Filter),(Get-RscType -Name Filter))
$query.Var.filter[0].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_RELIC
$query.Var.filter[0].texts = "false"
$query.Var.filter[1].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_REPLICATED
$query.Var.filter[1].texts = "false"

$query.field.nodes = @(Get-RscType -Name ActiveDirectoryDomainController -InitialProperties `
    name,`
    id,`
    domainControllerGuid,`
    adServiceStatus.serviceStatus,`
    hostname,`
    fsmoRoles,`
    serverRoles,`
    isGlobalCatalog,`
    dcLocation,`
    host.name,host.Id,`
    effectiveSlaDomain.name,effectiveSlaDomain.id,`
    cluster.name,cluster.id
)
$query.Invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { activeDirectoryDomainControllers(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id domainControllerGuid adServiceStatus { serviceStatus } hostname fsmoRoles serverRoles isGlobalCatalog host { name id } dcLocation effectiveSlaDomain { name id } cluster { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Microsoft Active Directory Domains

```graphql
query {
  activeDirectoryDomains(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      domainName
      domainSid
      registeredDomainControllersCount
      smbDomain {
        name
        domainId
        accountName
        status
      }
      effectiveSlaDomain {
        name
        id
      }
      cluster {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery activeDirectoryDomains
$query.Var.filter = @((Get-RscType -Name Filter),(Get-RscType -Name Filter))
$query.Var.filter[0].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_RELIC
$query.Var.filter[0].texts = "false"
$query.Var.filter[1].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_REPLICATED
$query.Var.filter[1].texts = "false"

$query.field.nodes = @(Get-RscType -Name ActiveDirectoryDomain -InitialProperties `
    name,`
    id,`
    domainName,`
    domainSid,`
    registeredDomainControllersCount,`
    smbDomain.name,smbDomain.domainId,smbDomain.accountName,smbDomain.status,`
    effectiveSlaDomain.name,effectiveSlaDomain.id,`
    cluster.name,cluster.id
)
$query.Invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { activeDirectoryDomains(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id domainName domainSid registeredDomainControllersCount smbDomain { name domainId accountName status } effectiveSlaDomain { name id } cluster { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Microsoft Exchange Database Availability Groups

```graphql
query {
  exchangeDags(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      totalHosts
      backupPreference
      cluster {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery exchangeDags
$query.Var.filter = @((Get-RscType -Name Filter),(Get-RscType -Name Filter))
$query.Var.filter[0].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_RELIC
$query.Var.filter[0].texts = "false"
$query.Var.filter[1].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_REPLICATED
$query.Var.filter[1].texts = "false"

$query.Field.nodes = @(
    Get-RscType -Name ExchangeDag -InitialProperties `
    name,`
    id,`
    cdmId,`
    totalHosts,`
    backupPreference,`
    cluster.name,cluster.id,`
    effectiveSlaDomain.name,effectiveSlaDomain.Id
)
$query.Invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { exchangeDags(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cdmId totalHosts backupPreference cluster { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Microsoft Exchange Servers

```graphql
query {
  exchangeServers(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      totalDbs
      version
      exchangeDag {
        name
        id
      }
      cluster {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery exchangeServers
$query.Var.filter = @((Get-RscType -Name Filter),(Get-RscType -Name Filter))
$query.Var.filter[0].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_RELIC
$query.Var.filter[0].texts = "false"
$query.Var.filter[1].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_REPLICATED
$query.Var.filter[1].texts = "false"

$query.Field.nodes = @(
    Get-RscType -Name ExchangeServer -InitialProperties `
    name,`
    id,`
    cdmId,`
    totalDbs,`
    version,`
    exchangeDag.name,exchangeDag.id
)
$query.Invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { exchangeServers(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cdmId totalDbs version exchangeDag { name id } cluster { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Microsoft Exchange Databases

```graphql
query {
  exchangeDatabases(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      totalCopies
      activeCopies
      exchangeServer {
        name
        id
      }
      cluster {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery exchangeDatabases
$query.Var.filter = @((Get-RscType -Name Filter),(Get-RscType -Name Filter))
$query.Var.filter[0].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_RELIC
$query.Var.filter[0].texts = "false"
$query.Var.filter[1].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_REPLICATED
$query.Var.filter[1].texts = "false"

$query.Field.nodes = @(
    Get-RscType -Name ExchangeDatabase -InitialProperties `
    name,`
    id,`
    cdmId,`
    totalCopies,`
    activeCopies,`
    exchangeServer.name,exchangeServer.Id
)
$query.Invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { exchangeDatabases(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cdmId totalCopies activeCopies exchangeServer { name id } cluster { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Exchange On-Demand Backup

```graphql
mutation {
  createOnDemandExchangeBackup(input: {
    id: "f79b1102-77b5-4434-8400-c2a66c9b2dc1"
    config: {
      forceFullSnapshot: false
      baseOnDemandSnapshotConfig: {
        slaId: "c7bd8eb2-7132-4c8f-8592-682d507520dc"
      }
    }
  }) {
    id
  }
}
```

```powershell
$query = New-RscMutation -GqlMutation createOnDemandExchangeBackup
$query.Var.input = Get-RscType -Name CreateOnDemandExchangeDatabaseBackupInput -InitialProperties config.baseOnDemandSnapshotConfig
$query.Var.input.id = "f79b1102-77b5-4434-8400-c2a66c9b2dc1"
$query.Var.input.Config.forceFullSnapshot = $false
$query.Var.input.Config.baseOnDemandSnapshotConfig.slaId = "c7bd8eb2-7132-4c8f-8592-682d507520dc"
$query.Field = Get-RscType -Name AsyncRequestStatus -InitialProperties id
$query.Invoke()
```

```bash
mutation {
  createOnDemandExchangeBackup(input: {
    id: "f79b1102-77b5-4434-8400-c2a66c9b2dc1"
    config: {
      forceFullSnapshot: false
      baseOnDemandSnapshotConfig: {
        slaId: "c7bd8eb2-7132-4c8f-8592-682d507520dc"
      }
    }
  }) {
    id
  }
}
```

## Retrieving Microsoft Hyper-V System Center Virtual Machine Managers

```graphql
query {
  hypervScvmms(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      hostName
      scvmmInfo {
        version
      }
      connectionStatus
      status {
        connectivity
      }
      cluster {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery hypervScvmms
$query.Var.filter = @((Get-RscType -Name Filter),(Get-RscType -Name Filter))
$query.Var.filter[0].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_RELIC
$query.Var.filter[0].texts = "false"
$query.Var.filter[1].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_REPLICATED
$query.Var.filter[1].texts = "false"

$query.field.nodes = @(Get-RscType -Name HyperVscvmm -InitialProperties `
    name,`
    id,`
    hostName,`
    scvmmInfo.version,`
    connectionStatus,`
    status.connectivity,`
    effectiveSlaDomain.name,effectiveSlaDomain.id,`
    cluster.name,cluster.id
)
$query.Invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { hypervScvmms(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id hostName scvmmInfo { version } connectionStatus status { connectivity } cluster { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Microsoft Hyper-V Servers

```graphql
query {
  hypervServersPaginated(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      connectionStatus
      status {
        connectivity
      }
      cluster {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery hypervServersPaginated
$query.Var.filter = @((Get-RscType -Name Filter),(Get-RscType -Name Filter))
$query.Var.filter[0].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_RELIC
$query.Var.filter[0].texts = "false"
$query.Var.filter[1].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_REPLICATED
$query.Var.filter[1].texts = "false"

$query.field.nodes = @(Get-RscType -Name HypervServer -InitialProperties `
    name,`
    id,`
    hostName,`
    scvmmInfo.version,`
    connectionStatus,`
    status.connectivity,`
    effectiveSlaDomain.name,effectiveSlaDomain.id,`
    cluster.name,cluster.id
)
$query.Invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { hypervServersPaginated(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id connectionStatus status { connectivity } cluster { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Microsoft Hyper-V Virtual Machines

```graphql
query {
  hypervVirtualMachines(filter: [
    #{field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      osType
      agentStatus {
        connectionStatus
        disconnectReason
      }
      cluster {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
Get-RscHypervVm
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { hypervVirtualMachines(filter: [ {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cdmId osType agentStatus { connectionStatus disconnectReason } cluster { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

```graphql
query {
  jobInfo(input: {
    requestId: "CREATE_HYPERV_SNAPSHOT_89ac2296-565d-4199-8aea-36b8a836c64e_a1be6a78-3ce9-454d-964c-0ce30e19d080:::0:::0"
    clusterUuid: "f79b1102-77b5-4434-8400-c2a66c9b2dc1"
    type: HYPERV_VM_SNAPSHOT
    additionalInfo: {}
  }) {
    status
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery jobInfo
$query.Var.input = Get-RscType -Name JobInfoRequest -InitialProperties additionalInfo
$query.Var.input.Type = [RubrikSecurityCloud.Types.JobType]::HYPERV_VM_SNAPSHOT
$query.Var.input.requestId = "CREATE_HYPERV_SNAPSHOT_89ac2296-565d-4199-8aea-36b8a836c64e_a1be6a78-3ce9-454d-964c-0ce30e19d080:::0:::0"
$query.Var.input.ClusterUuid = "f79b1102-77b5-4434-8400-c2a66c9b2dc1"
$query.field = Get-RscType -Name JobInfo -InitialProperties status
$query.Invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { jobInfo(input: { requestId: \\\"CREATE_HYPERV_SNAPSHOT_89ac2296-565d-4199-8aea-36b8a836c64e_a1be6a78-3ce9-454d-964c-0ce30e19d080:::0:::0\\\" clusterUuid: \\\"f79b1102-77b5-4434-8400-c2a66c9b2dc1\\\" type: HYPERV_VM_SNAPSHOT additionalInfo: {} }) { status } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

```graphql
mutation {
  hypervOnDemandSnapshot(input: {
    id: "f79b1102-77b5-4434-8400-c2a66c9b2dc1"
    config: {
      slaId: "c7bd8eb2-7132-4c8f-8592-682d507520dc"
    }
  }) {
    id
  }
}
```

```powershell
$vm = Get-RscHypervVm -Name "example"
$sla = Get-RscSla -Name "example"

$query = New-RscMutation -GqlMutation hypervOnDemandSnapshot
$query.Var.input = Get-RscType -Name HypervOnDemandSnapshotInput -InitialProperties config
$query.Var.input.id = $vm.id
$query.Var.input.Config.slaId = $sla.id
$query.Field = Get-RscType -Name AsyncRequestStatus -InitialProperties id
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation { hypervOnDemandSnapshot(input: { id: \\\"f79b1102-77b5-4434-8400-c2a66c9b2dc1\\\" config: { slaId: \\\"c7bd8eb2-7132-4c8f-8592-682d507520dc\\\" } }) { id } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Microsoft SQL Instances

```graphql
query {
  mssqlTopLevelDescendants(filter: [
    {field: NAME_EXACT_MATCH, texts: "example"}
    {field: IS_RELIC, texts: "false"}
    {field: IS_ARCHIVED, texts: "false"}
    {field: IS_REPLICATED, texts: "false"}
    ]) {
      nodes {
        id
        name
        numWorkloadDescendants
        ... on PhysicalHost {
          id
          name
          cbtStatus
          physicalChildConnection {
            nodes {
              ... on MssqlInstance {
                id
                name
                slaAssignment
                effectiveSlaDomain {
                  name
                  id
                  version
                }
              }
            }
          }
        }
      }
  }
}
```

```powershell
Get-RscMssqlInstance -Hostname "mssql.example.com" -Relic:$false -Replica:$false
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { mssqlTopLevelDescendants(filter: [ {field: NAME_EXACT_MATCH, texts: \\\"example\\\"} {field: IS_RELIC, texts: \\\"false\\\"} {field: IS_ARCHIVED, texts: \\\"false\\\"} {field: IS_REPLICATED, texts: \\\"false\\\"} ]) { nodes { id name numWorkloadDescendants ... on PhysicalHost { id name cbtStatus physicalChildConnection { nodes { ... on MssqlInstance { id name slaAssignment effectiveSlaDomain { name id version } } } } } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Microsoft SQL Databases

```graphql
query {
  mssqlDatabases(
    filter: [
      {field: NAME_EXACT_MATCH, texts: "example"}
      {field: IS_RELIC, texts: "false"}
      #{field: LOCATION, texts: "hostname\instancename"}
      {field: IS_ARCHIVED, texts: "false"}
      {field: IS_REPLICATED, texts: "false"}]
  ) {
    nodes {
      name
      id
      logicalPath {
        name
        objectType
      }
      effectiveSlaDomain {
        id
        name
      }
    }
  }
}
```

```powershell
Get-RscMssqlDatabase -Relic:$false -Replica:$false
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { mssqlDatabases( filter: [ {field: NAME_EXACT_MATCH, texts: \\\"example\\\"} {field: IS_RELIC, texts: \\\"false\\\"} {field: IS_ARCHIVED, texts: \\\"false\\\"} {field: IS_REPLICATED, texts: \\\"false\\\"}] ) { nodes { name id logicalPath { name objectType } effectiveSlaDomain { id name } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Job Status of Microsoft SQL Jobs

```graphql
query {
  mssqlJobStatus(input: {
    id: "fb5342f3-daf6-475d-8aa7-14f23932c683"
    clusterUuid: "8417a938-96f5-43c6-9905-b36e051c5f98"
  }) {
    startTime
    endTime
    error {
      message
    }
    progress
    status
  }
}
```

```powershell
$requestId = "MSSQL_DB_BACKUP_00000000-0000-0000-0000-000000000000_00000000-0000-0000-0000-000000000000:::0"
$clusterId = "00000000-0000-0000-0000-000000000000"
$query = New-RscQuery -GqlQuery mssqlJobStatus -FieldProfile FULL
$query.var.input = New-Object -Typename RubrikSecurityCloud.Types.GetMssqlAsyncRequestStatusInput
$query.var.input.Id = $requestId
$query.var.input.ClusterUuid = $clusterId
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { mssqlJobStatus(input: { id: \\\"fb5342f3-daf6-475d-8aa7-14f23932c683\\\" clusterUuid: \\\"8417a938-96f5-43c6-9905-b36e051c5f98\\\" }) { startTime endTime error { message } progress status } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Microsoft SQL On-Demand Backup

```graphql
mutation mssqlDatabaseSnapshot {
  createOnDemandMssqlBackup(
    input: {
      id: "85e98e61-4c1f-496a-b846-5eb871966025" 
      config: {
        baseOnDemandSnapshotConfig: {
          slaId: "9f706c3c-4678-44e5-99fe-50ebde6b308e"
        }
      }
    }) {
    id
  }
}
```

```powershell
$db = Get-RscMssqlDatabase -Name "example" -Relic:$false -Replica:$false
$sla = Get-RscSla -Name "example"
$db | New-RscMssqlSnapshot -RscSlaDomain $sla
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation mssqlDatabaseSnapshot { createOnDemandMssqlBackup( input: { id: \\\"85e98e61-4c1f-496a-b846-5eb871966025\\\" config: { baseOnDemandSnapshotConfig: { slaId: \\\"9f706c3c-4678-44e5-99fe-50ebde6b308e\\\" } } }) { id } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Mongo Collections

```graphql
query {
  mongoCollections(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      source {
        name
        id
      }
      database {
        name
        id
      }
      cluster {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
Get-RscMongoCollection
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { mongoCollections(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cdmId source { name id } database { name id } cluster { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Mongo Databases

```graphql
query {
  mongoDatabases(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      source {
        name
        id
      }
      activeCollectionCount
      protectedCollectionCount
      cluster {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
Get-RscMongoDatabase
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { mongoDatabases(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cdmId source { name id } activeCollectionCount protectedCollectionCount cluster { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Mongo Sources

```graphql
query {
  mongoSources(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      sourceType
      status
      discoveryStatus
      hostDetails {
        name
        id
        connectionStatus
      }
      managementType
      activeCollectionCount
      protectedCollectionCount
      cluster {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
Get-RscMongoSource
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { mongoSources(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cdmId sourceType status discoveryStatus hostDetails { name id connectionStatus } managementType activeCollectionCount protectedCollectionCount cluster { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving NAS Shares

```graphql
query {
  nasShares(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      shareType
      exportPoint
      isChangelistEnabled
      isStale
      nasSystem {
        name
        id
      }
      nasVolume {
        name
        id
        nasNamespace {
          name
          id
        }
      }
      primaryFileset {
        name
        id
      }
      connectedThrough
      hostAddress
      hostIdForRestore
      cluster {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
Get-RscNasShare
```

```bash

```

## Retrieving NAS Systems

```graphql
query {
  nasSystems(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      osVersion
      lastRefreshTime
      vendorType
      isSmbSupported
      isNfsSupported
      lastStatus
      volumeCount
      shareCount
      namespaceCount
      cluster {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
Get-RscNasSystem
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { nasSystems(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cdmId osVersion lastRefreshTime vendorType isSmbSupported isNfsSupported lastStatus volumeCount shareCount namespaceCount cluster { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving NAS Namespaces

```graphql
query {
  nasNamespaces(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      vendorType
      cluster {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery nasNamespaces
$query.Var.filter = @((Get-RscType -Name Filter),(Get-RscType -Name Filter))
$query.Var.filter[0].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_RELIC
$query.Var.filter[0].texts = "false"
$query.Var.filter[1].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_REPLICATED
$query.Var.filter[1].texts = "false"

$query.field.nodes = @(Get-RscType -Name NasNamespace -InitialProperties `
    name,`
    id,`
    cdmId,`
    cluster.name,cluster.id
)
$query.Invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { nasNamespaces(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cdmId vendorType cluster { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Cloud Direct NAS Shares

```graphql
query {
  cloudDirectNasShares(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      protocol
      ncdPolicyName
      systemId
      namespaceId
      cloudDirectId
      cloudDirectNasSystem {
        name
        id
      }
      cloudDirectNasNamespace {
        name
        id
      }
      excludes {
        path
        pattern
      }

      cluster {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery cloudDirectNasShares
$query.Var.filter = @((Get-RscType -Name Filter),(Get-RscType -Name Filter))
$query.Var.filter[0].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_RELIC
$query.Var.filter[0].texts = "false"
$query.Var.filter[1].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_REPLICATED
$query.Var.filter[1].texts = "false"

$query.field.nodes = @(Get-RscType -Name CloudDirectNasShare -InitialProperties `
    name,`
    id,`
    namespaceId,`
    protocol,`
    ncdPolicyName,`
    systemId,`
    cloudDirectId,`
    cloudDirectNasSystem.name,cloudDirectNasSystem.id,`
    cloudDirectNasNamespace.name,cloudDirectNasNamespace.id,`
    excludes.path,excludes.pattern,`
    shareCount,`
    cluster.name,cluster.id
)
$query.Invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { cloudDirectNasShares(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id protocol ncdPolicyName systemId namespaceId cloudDirectId cloudDirectNasSystem { name id } cloudDirectNasNamespace { name id } excludes { path pattern } cluster { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Cloud Direct NAS Systems

```graphql
query {
  nasSystems(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      osVersion
      lastRefreshTime
      vendorType
      isSmbSupported
      isNfsSupported
      lastStatus
      volumeCount
      shareCount
      namespaceCount
      cluster {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
Get-RscNasSystem
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { nasSystems(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cdmId osVersion lastRefreshTime vendorType isSmbSupported isNfsSupported lastStatus volumeCount shareCount namespaceCount cluster { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Cloud Direct NAS Namespaces

```graphql
query {
  cloudDirectNasNamespaces(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cloudDirectId
      cloudDirectNasSystem {
        name
        id
      }
      shareCount
      cluster {
        name
        id
      }
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery cloudDirectNasNamespaces
$query.Var.filter = @((Get-RscType -Name Filter),(Get-RscType -Name Filter))
$query.Var.filter[0].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_RELIC
$query.Var.filter[0].texts = "false"
$query.Var.filter[1].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_REPLICATED
$query.Var.filter[1].texts = "false"

$query.field.nodes = @(Get-RscType -Name CloudDirectNasNamespace -InitialProperties `
    name,`
    id,`
    cloudDirectId,`
    cloudDirectNasSystem.name,cloudDirectNasSystem.id,`
    shareCount,`
    cluster.name,cluster.id,`
    effectiveSlaDomain.name,effectiveSlaDomain.id
)
$query.Invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { cloudDirectNasNamespaces(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cloudDirectId cloudDirectNasSystem { name id } shareCount cluster { name id } effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Nutanix VMs

```graphql
query {
  nutanixVms(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      vmUuid
      osType
      vmDisks {
        label
        uuid
        vmDiskUuid
        sizeInBytes
        isSnapshottable
        storageContainerName
        storageContainerId
      }
      preBackupScript {
        scriptPath
      }
      postSnapScript {
        scriptPath
      }
      postBackupScript {
        scriptPath
      }
      snapshotConsistencyMandate
      agentStatus {
        connectionStatus
        disconnectReason
      }
      isAgentRegistered
      hypervisorType
      effectiveSlaDomain {
        name
        id
      }
      cluster {
        name
        id
      }
    }
  }
}
```

```powershell
Get-RscNutanixVm
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { nutanixVms(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cdmId vmUuid osType vmDisks { label uuid vmDiskUuid sizeInBytes isSnapshottable storageContainerName storageContainerId } preBackupScript { scriptPath } postSnapScript { scriptPath } postBackupScript { scriptPath } snapshotConsistencyMandate agentStatus { connectionStatus disconnectReason } isAgentRegistered hypervisorType effectiveSlaDomain { name id } cluster { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Nutanix Clusters

```graphql
query {
  nutanixClusters(filter: [
    #{field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      hostName
      naturalId
      nosVersion
      connectionStatus {
        message
        status
      }
      clusterNetworks {
        name
        uuid
      }
      storageContainers {
        name
        uuid
        freeBytes
        usedBytes
        totalBytes
      }
      effectiveSlaDomain {
        name
        id
      }
      cluster {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery nutanixClusters
$query.Var.filter = @((Get-RscType -Name Filter),(Get-RscType -Name Filter))
$query.Var.filter[0].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_RELIC
$query.Var.filter[0].texts = "false"
$query.Var.filter[1].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_REPLICATED
$query.Var.filter[1].texts = "false"

$query.field.nodes = @(Get-RscType -Name NutanixCluster -InitialProperties `
    name,`
    id,`
    cdmId,`
    hostName,`
    naturalId,`
    nosVersion,`
    clusterNetworks.name,clusterNetworks.uuid,`
    storageContainers.name,storageContainers.uuid,storageContainers.freeBytes,storageContainers.usedBytes,storageContainers.totalBytes,`
    connectionStatus.message,connectionStatus.status,`
    cluster.name,cluster.id
)
$query.Invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { nutanixClusters(filter: [ {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cdmId hostName naturalId nosVersion connectionStatus { message status } clusterNetworks { name uuid } storageContainers { name uuid freeBytes usedBytes totalBytes } effectiveSlaDomain { name id } cluster { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retreiving Nutanix Prism Central Servers

```graphql
query {
  nutanixPrismCentrals(filter: [
    #{field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      hostName
      naturalId
      nosVersion
      nutanixClusters {
        nodes {
          name
          id
        }
      }
      isDrEnabled
      connectionStatus {
        message
        status
      }
      effectiveSlaDomain {
        name
        id
      }
      cluster {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery nutanixPrismCentrals
$query.Var.filter = @((Get-RscType -Name Filter),(Get-RscType -Name Filter))
$query.Var.filter[0].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_RELIC
$query.Var.filter[0].texts = "false"
$query.Var.filter[1].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_REPLICATED
$query.Var.filter[1].texts = "false"

$query.field.nodes = @(Get-RscType -Name NutanixPrismCentral -InitialProperties `
    name,`
    id,`
    cdmId,`
    hostName,`
    naturalId,`
    isDrEnabled,`
    connectionStatus.message,connectionStatus.status,`
    cluster.name,cluster.id
)
$query.Invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { nutanixPrismCentrals(filter: [ {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cdmId hostName naturalId nosVersion nutanixClusters { nodes { name id } } isDrEnabled connectionStatus { message status } effectiveSlaDomain { name id } cluster { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Job Status of Nutanix VM Jobs

```graphql
query {
  nutanixVmAsyncRequestStatus(input: {
    id: "CREATE_NUTANIX_SNAPSHOT_6450b2bb-3114-45ab-a45e-049c7f27b58e-vm-f5bc5502-b9a6-4759-bf02-05dc5a48f9f7_b83291a3-fa87-4aab-863a-60b415215b19:::0"
    clusterUuid: "85e98e61-4c1f-496a-b846-5eb871966025"
  }) {
    progress
    status
    result
    error {
      message
    }
  }
}
```

```powershell
$requestId = "CREATE_NUTANIX_SNAPSHOT_6450b2bb-3114-45ab-a45e-049c7f27b58e-vm-f5bc5502-b9a6-4759-bf02-05dc5a48f9f7_b83291a3-fa87-4aab-863a-60b415215b19:::0"
$vm = Get-RscNutanixVm -name "example"

$query = New-RscQuery -GqlQuery nutanixVmAsyncRequestStatus
$query.var.input.id = $requestId
$query.var.input.clusterUuid = $vm.cluster.Id
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { nutanixVmAsyncRequestStatus(input: { id: \\\"CREATE_NUTANIX_SNAPSHOT_6450b2bb-3114-45ab-a45e-049c7f27b58e-vm-f5bc5502-b9a6-4759-bf02-05dc5a48f9f7_b83291a3-fa87-4aab-863a-60b415215b19:::0\\\" clusterUuid: \\\"85e98e61-4c1f-496a-b846-5eb871966025\\\" }) { progress status result error { message } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Job Status of Nutanix Cluster Jobs

```graphql
query {
  nutanixClusterAsyncRequestStatus(input: {
    id: "REFRESH_NUTANIX_CLUSTER_21fb4363-2510-4ce3-bca2-d4c2ad0f50ab_4b2e24a8-5712-40e9-808b-06fef83423d1:::0"
    clusterUuid: "85e98e61-4c1f-496a-b846-5eb871966025"
  }) {
    progress
    status
    result
    error {
      message
    }
  }
}
```

```powershell
$requestId = "REFRESH_NUTANIX_CLUSTER_21fb4363-2510-4ce3-bca2-d4c2ad0f50ab_4b2e24a8-5712-40e9-808b-06fef83423d1:::0"
$clusterId = "85e98e61-4c1f-496a-b846-5eb871966025"

$query = New-RscQuery -GqlQuery nutanixClusterAsyncRequestStatus
$query.var.input.id = $requestId
$query.var.input.clusterUuid = $clusterId
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { nutanixClusterAsyncRequestStatus(input: { id: \\\"REFRESH_NUTANIX_CLUSTER_21fb4363-2510-4ce3-bca2-d4c2ad0f50ab_4b2e24a8-5712-40e9-808b-06fef83423d1:::0\\\" clusterUuid: \\\"85e98e61-4c1f-496a-b846-5eb871966025\\\" }) { progress status result error { message } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Nutanix VM On-Demand Backup

```graphql

```

```powershell

```

```bash

```

## Retrieving Oracle Databases

```graphql
query {
  oracleDatabases(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      cdmId
      dbUniqueName
      numTablespaces
      numInstances
      numChannels
      logRetentionHours
      hostLogRetentionHours
      useSecureThrift
      osType
      osNames
      tablespaces
      numLogSnapshots
      pdbs {
        name
        dbId
        openMode
        isApplicationPdb
        isApplicationRoot
        applicationRootContainerId
      }
      dbRole
      dataGuardType
      dataGuardGroup {
        name
        id
      }
      lastValidationResult {
        isSuccess
        snapshotId
      }
      instances {
        instanceName
        hostId
      }
      effectiveSlaDomain {
        name
        id
      }
      cluster {
        name
        id
      }
    }
  }
}
```

```powershell
Get-RscOracleDatabase
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { oracleDatabases(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id cdmId dbUniqueName numTablespaces numInstances numChannels logRetentionHours hostLogRetentionHours useSecureThrift osType osNames tablespaces numLogSnapshots pdbs { name dbId openMode isApplicationPdb isApplicationRoot applicationRootContainerId } dbRole dataGuardType dataGuardGroup { name id } lastValidationResult { isSuccess snapshotId } instances { instanceName hostId } effectiveSlaDomain { name id } cluster { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Oracle Hosts and Clusters

```graphql
query {
  oracleTopLevelDescendants(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      objectType
      ... on OracleHost {
        descendantConnection {
          nodes {
            name
            id
            objectType
          }
        }
      }
      ... on OracleRac {
        descendantConnection {
          nodes {
            name
            id
            objectType
          }
        }
      }
      effectiveSlaDomain {
        name
        id
      }
      cluster {
        name
        id
      }
    }
  }
}
```

```powershell
Get-RscOracleHost
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { oracleTopLevelDescendants(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id objectType ... on OracleHost { descendantConnection { nodes { name id objectType } } } ... on OracleRac { descendantConnection { nodes { name id objectType } } } effectiveSlaDomain { name id } cluster { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Job Status of Oracle Database Jobs

```graphql
query {
  oracleDatabaseAsyncRequestDetails(input: {
    id: "CREATE_ORACLE_SNAPSHOT_734cc78a-2fb3-41f1-9906-d2262c604aad_96678e6a-ceb4-439d-be56-352ff0c80a7a:::0"
    clusterUuid: "85e98e61-4c1f-496a-b846-5eb871966025"
  }) {
    progress
    status
    result
    error {
      message
    }
  }
}
```

```powershell
$requestId = "CREATE_ORACLE_SNAPSHOT_734cc78a-2fb3-41f1-9906-d2262c604aad_96678e6a-ceb4-439d-be56-352ff0c80a7a:::0"
$clusterId = "00000000-0000-0000-0000-000000000000"

$query = New-RscQuery -GqlQuery oracleDatabaseAsyncRequestDetails -FieldProfile FULL
$query.var.input = Get-RscType -Name GetOracleAsyncRequestStatusInput
$query.var.input.Id = $requestId
$query.var.input.ClusterUuid = $clusterId
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { oracleDatabaseAsyncRequestDetails(input: { id: \\\"CREATE_ORACLE_SNAPSHOT_734cc78a-2fb3-41f1-9906-d2262c604aad_96678e6a-ceb4-439d-be56-352ff0c80a7a:::0\\\" clusterUuid: \\\"85e98e61-4c1f-496a-b846-5eb871966025\\\" }) { progress status result error { message } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Oracle Database On-Demand Backup

```graphql
mutation {
  takeOnDemandOracleDatabaseSnapshot(input: {
    id: "40bac7c1-87ad-4ac0-b4a6-34ac592d8e77"
    config: {
      forceFullSnapshot: false
      baseOnDemandSnapshotConfig: {
        slaId: "7d40e858-b8ec-4096-8112-cab8eff1a4e2"
      }
    }
  }) {
    id
  }
}
```

```powershell
$oracleDb = Get-RscOracleDatabase -name "example"

$query = New-RscMutation -GqlMutation takeOnDemandOracleDatabaseSnapshot
$query.Var.input = Get-RscType -Name TakeOnDemandOracleDatabaseSnapshotInput -InitialProperties config.baseOnDemandSnapshotConfig
$query.Var.input.id = $oracleDb.id
$query.Var.input.Config.forceFullSnapshot = $false
$query.Var.input.Config.baseOnDemandSnapshotConfig.slaId = $oracleDb.EffectiveSlaDomain.id
$query.Field = Get-RscType -Name AsyncRequestStatus -InitialProperties id
$query.Invoke()

# mutation {
#     takeOnDemandOracleDatabaseSnapshot(input: {
#       id: "40bac7c1-87ad-4ac0-b4a6-34ac592d8e77"
#       config: {
#         forceFullSnapshot: false
#         baseOnDemandSnapshotConfig: {
#             slaId: "7d40e858-b8ec-4096-8112-cab8eff1a4e2"
#         }
#       }
#     }) {
#       id
#     }
#   }
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation { takeOnDemandOracleDatabaseSnapshot(input: { id: \\\"40bac7c1-87ad-4ac0-b4a6-34ac592d8e77\\\" config: { forceFullSnapshot: false baseOnDemandSnapshotConfig: { slaId: \\\"7d40e858-b8ec-4096-8112-cab8eff1a4e2\\\" } } }) { id } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Oracle Database On-Demand Log Backup

```graphql
mutation {
  takeOnDemandOracleLogSnapshot(input: {
    id: "40bac7c1-87ad-4ac0-b4a6-34ac592d8e77"
  }) {
    id
  }
}
```

```powershell
$oracleDb = Get-RscOracleDatabase -name "example"

$query = New-RscMutation -GqlMutation takeOnDemandOracleLogSnapshot
$query.Var.input = Get-RscType -Name TakeOnDemandOracleLogSnapshotInput -InitialProperties config.baseOnDemandSnapshotConfig
$query.Var.input.id = $oracleDb.id
$query.Field = Get-RscType -Name AsyncRequestStatus -InitialProperties id
$query.Invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation { takeOnDemandOracleLogSnapshot(input: { id: \\\"40bac7c1-87ad-4ac0-b4a6-34ac592d8e77\\\" }) { id } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving SAP HANA Databases

```graphql
query {
  sapHanaDatabases(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      info {
        databaseType
        status
        backintPath
        paramFilePath
        numChannels
        approxDbSizeInMb
        logBackupIntervalSecs
        restoreConfiguredSrcDatabaseId
        logMode
      }
      dataPathType
      dataPathSpec {
        name
      }
      sapHanaSystem {
        name
        id
      }
      forceFull
      effectiveSlaDomain {
        name
        id
      }
      cluster {
        name
        id
      }
    }
  }
}
```

```powershell
Get-RscSapHanaDatabase
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { sapHanaDatabases(filter: [ {field: NAME_EXACT_MATCH texts: \\\"example\\\"} {field: IS_RELIC texts: \\\"false\\\"} {field: IS_REPLICATED texts: \\\"false\\\"} ]) { nodes { name id info { databaseType status backintPath paramFilePath numChannels approxDbSizeInMb logBackupIntervalSecs restoreConfiguredSrcDatabaseId logMode } dataPathType dataPathSpec { name } sapHanaSystem { name id } forceFull effectiveSlaDomain { name id } cluster { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving SAP HANA Systems

```graphql
query {
  sapHanaSystems(filter: [
    {field: NAME_EXACT_MATCH texts: "example"}
    {field: IS_RELIC texts: "false"}
    {field: IS_REPLICATED texts: "false"}
  ]) {
    nodes {
      name
      id
      objectType
      sid
      instanceNumber
      status
      statusMessage
      systemInfo {
        hanaVersion
        isDtEnabled
        authType
      }
      hosts {
        hostName
        hostUuid
        hostType
        status
        systemHost {
          name
          id
        }
      }
            descendantConnection {
        nodes {
          name
          id
          objectType
        }
      }
      effectiveSlaDomain {
        name
        id
      }
      cluster {
        name
        id
      }
    }
  }
}
```

```powershell
Get-RscSapHanaSystem
```

```bash

```

## Retrieving SAP HANA Database Job Status

```graphql
query {
    jobInfo(input: {
    requestId: "CREATE_SAP_HANA_FULL_SNAPSHOT_cbf8fff1-8f31-477b-b2f0-6ebe1f53b507_dc3a6e12-e1f1-4ad4-ab02-14491c06b208:::0"
    clusterUuid: "85e98e61-4c1f-496a-b846-5eb871966025"
    type: SAP_HANA_DATABASE
  }) {
    status
  }
}
```

```powershell
query {
    jobInfo(input: {
    requestId: "CREATE_SAP_HANA_FULL_SNAPSHOT_cbf8fff1-8f31-477b-b2f0-6ebe1f53b507_dc3a6e12-e1f1-4ad4-ab02-14491c06b208:::0"
    clusterUuid: "85e98e61-4c1f-496a-b846-5eb871966025"
    type: SAP_HANA_DATABASE
  }) {
    status
  }
}
```

```bash
query {
    jobInfo(input: {
    requestId: "CREATE_SAP_HANA_FULL_SNAPSHOT_cbf8fff1-8f31-477b-b2f0-6ebe1f53b507_dc3a6e12-e1f1-4ad4-ab02-14491c06b208:::0"
    clusterUuid: "85e98e61-4c1f-496a-b846-5eb871966025"
    type: SAP_HANA_DATABASE
  }) {
    status
  }
}
```

## SAP HANA Database On-Demand Backup

```graphql
mutation {
  createOnDemandSapHanaBackup(input: {
    id: "40bac7c1-87ad-4ac0-b4a6-34ac592d8e77"
    config: {
      slaId: "7d40e858-b8ec-4096-8112-cab8eff1a4e2"
    }
  }) {
    id
  }
}
```

```powershell
$hanaDb = Get-RscSapHanaDatabase -name "example"

$query = New-RscMutation -GqlMutation createOnDemandSapHanaBackup
$query.Var.input = Get-RscType -Name CreateOnDemandSapHanaBackupInput -InitialProperties config
$query.Var.input.id = $hanaDb.id
$query.Var.input.Config.slaId = $hanaDb.EffectiveSlaDomain.id
$query.Field = Get-RscType -Name AsyncRequestStatus -InitialProperties id
$query.Invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation { createOnDemandSapHanaBackup(input: { id: \\\"40bac7c1-87ad-4ac0-b4a6-34ac592d8e77\\\" config: { slaId: \\\"7d40e858-b8ec-4096-8112-cab8eff1a4e2\\\" } }) { id } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Description

For information on protection capabilities, see the [Rubrik Security Cloud documentation](https://docs.rubrik.com/en-us/saas/saas/vs_virtual_machines.html)

### Retrieving vSphere Virtual Machine Information

To list virtual machines known by Rubrik, you can perform the following. There are various filters to search by name, MOID, cluster, organization, and more.

```graphql
query {
  vSphereVmNewConnection(
    filter: [
      # {field: NAME_EXACT_MATCH texts: "foo"}
      {field: IS_RELIC texts: "false"},
      {field: IS_REPLICATED texts: "false"}
    ]
  ) {
    nodes {
      name
      id
      cdmId
      effectiveSlaDomain {
        name
        id
      }
      guestCredentialAuthorizationStatus
      objectType
      powerStatus
      slaAssignment
      snapshotConsistencyMandate
      blueprintId
      guestCredentialId
      guestOsName
      isActive
      isArrayIntegrationPossible
      isBlueprintChild
      isRelic
      numWorkloadDescendants
      slaPauseStatus
      agentStatus {
        agentStatus
      }
      allOrgs {
        id
        name
      }
      cluster {
        id
        name
      }
    }
    pageInfo {
      endCursor
      hasNextPage
    }
  }
}
```

```powershell
Get-RscVmwareVm -Name "Foo" -Relic:$false -Replica:$false
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { vSphereVmNewConnection( filter: [ {field: IS_RELIC texts: \\\"false\\\"}, {field: IS_REPLICATED texts: \\\"false\\\"} ] ) { nodes { name id cdmId effectiveSlaDomain { name id } guestCredentialAuthorizationStatus objectType powerStatus slaAssignment snapshotConsistencyMandate blueprintId guestCredentialId guestOsName isActive isArrayIntegrationPossible isBlueprintChild isRelic numWorkloadDescendants slaPauseStatus agentStatus { agentStatus } allOrgs { id name } cluster { id name } } pageInfo { endCursor hasNextPage } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving VMware vSphere Compute Clusters

Querying for vSphere Compute Clusters is the easiest way to get the IDs for all recovery destinations.

```graphql
query {
  vSphereComputeClusters(filter: {
    field: NAME_EXACT_MATCH texts: "foo"
    }) {
    nodes {
      name
      id
      logicalPath {
        name
        fid
        objectType
      }
      descendantConnection(typeFilter: [VSphereHost,VSphereNetwork,VSphereDatastore,VSphereResourcePool]) {
        nodes {
          name
          id
          objectType
        }
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery vSphereComputeClusters
$query.var.filter = @(Get-RscType -Name Filter)
$query.var.filter[0].Texts = "example"
$query.var.filter[0].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::NAME_EXACT_MATCH
$query.var.filter += Get-RscType -Name Filter
$query.var.filter[1].field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_RELIC
$query.var.filter[1].Texts = "false"
$query.var.filter += Get-RscType -Name Filter
$query.var.filter[2].Field = [RubrikSecurityCloud.Types.HierarchyFilterField]::IS_REPLICATED
$query.var.filter[2].Texts = "false"
$query.field.Nodes[0].descendantConnection = Get-RscType -Name VsphereComputeClusterDescendantTypeConnection
$query.field.nodes[0].Vars.DescendantConnection.typeFilter = @(
    [RubrikSecurityCloud.Types.HierarchyObjectTypeEnum]::VSPHERE_HOST
    [RubrikSecurityCloud.Types.HierarchyObjectTypeEnum]::VSPHERE_NETWORK
    [RubrikSecurityCloud.Types.HierarchyObjectTypeEnum]::VSPHERE_DATASTORE
    [RubrikSecurityCloud.Types.HierarchyObjectTypeEnum]::VSPHERE_RESOURCE_POOL
)
$query.field.nodes[0].DescendantConnection.Nodes = @(
    (Get-RscType -Name VsphereHost -InitialProperties name,id,objectType)
    (Get-RscType -Name VsphereNetwork -InitialProperties name,id,objectType)
    (Get-RscType -Name VsphereDatastore -InitialProperties name,id,objectType)
    (Get-RscType -Name VsphereResourcePool -InitialProperties name,id,objectType)
)

$query.invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { vSphereComputeClusters(filter: { field: NAME_EXACT_MATCH texts: \\\"foo\\\" }) { nodes { name id logicalPath { name fid objectType } descendantConnection(typeFilter: [VSphereHost,VSphereNetwork,VSphereDatastore,VSphereResourcePool]) { nodes { name id objectType } } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving vCenter Servers

```graphql
query {
  vSphereVCenterConnection {
    nodes {
      objectType
      slaAssignment
      effectiveSlaDomain {
        ... on GlobalSlaReply {
          clusterUuid
          description
          id
          isArchived
          isDefault
          isReadOnly
          isRetentionLockedSla
          name
          stateVersion
          version
        }
      }
      id
      isHotAddEnabledForOnPremVcenter
      isStandaloneHost
      isVmc
      name
      numWorkloadDescendants
      slaPauseStatus
      username
      vcenterId
    }
    pageInfo {
      endCursor
      hasNextPage
      hasPreviousPage
      startCursor
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery vSphereVCenterConnection
$query.invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { vSphereVCenterConnection { nodes { objectType slaAssignment effectiveSlaDomain { ... on GlobalSlaReply { clusterUuid description id isArchived isDefault isReadOnly isRetentionLockedSla name stateVersion version } } id isHotAddEnabledForOnPremVcenter isStandaloneHost isVmc name numWorkloadDescendants slaPauseStatus username vcenterId } pageInfo { endCursor hasNextPage hasPreviousPage startCursor } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Description

Tasks such as on-demand backups and recoveries are asynchronous requests and return an AsynRequestStatus which can be monitored for progress and completion.

To monitor the asynchronous request status for VMware vSphere, provide the ID of the cluster and the ID of the job. You can query the request status periodically until a terminal state (`SUCCEEDED`, `FAILED`, `CANCELLED`) is set given in the status field.

## Code Samples

```graphql
query {
  vSphereVMAsyncRequestStatus(
    id: "d4822e3d-c6e3-4bbe-950e-3e63c4770a78"
    clusterUuid: "e4e7d2a2-c58b-4bc2-b11e-d6f9102e6fc8"
  ) {
    id
    status
    startTime
    progress
    endTime
    error {
      message
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery vSphereVMAsyncRequestStatus
$query.var.id = $request.Id
$query.var.clusterUuid = $vm.cluster.Id
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { vSphereVMAsyncRequestStatus( id: \\\"d4822e3d-c6e3-4bbe-950e-3e63c4770a78\\\" clusterUuid: \\\"e4e7d2a2-c58b-4bc2-b11e-d6f9102e6fc8\\\" ) { id status startTime progress endTime error { message } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## VMware VM On-Demand Backup

To Perform an On-Demand Backup, you will need the Virtual Machine `ID` and SLA `ID`.

```graphql
mutation {
  vsphereBulkOnDemandSnapshot(
    input: {
      config: {
        vms: ["EC6A4D79-8F6F-4105-9DD6-11F4875C7A8B"]
        slaId: "def96ac0-be74-5e59-87e2-5af73b65ac1e"
        }
      }
    ) {
    responses {
      id
    }
  }
}
```

```powershell
$vm = Get-RscVmwareVm -name "example"

$query = New-Rscmutation -GqlMutation vsphereBulkOnDemandSnapshot -FieldProfile FULL
$query.var.input = Get-RscType -Name vsphereBulkOnDemandSnapshotInput -InitialProperties config
$query.var.input.config.Vms = @($vm.id)
$query.var.input.config.SlaId = $vm.EffectiveSlaDomain.Id
invoke-rsc $query
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation { vsphereBulkOnDemandSnapshot( input: { config: { vms: [\\\"EC6A4D79-8F6F-4105-9DD6-11F4875C7A8B\\\"] slaId: \\\"def96ac0-be74-5e59-87e2-5af73b65ac1e\\\" } } ) { responses { id } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

To monitor the status of the on-demand backup, see [job status](../Job-Status/)

Recoveries have many configuration options. The below examples demonstrate one way of configuring recoveries. For all possible recovery options refer to the API reference for the corresponding mutation.

## Export

Creates a new virtual machine from a snapshot

```graphql
mutation {
  vsphereVmExportSnapshotV3(
    input: {
    id: "e776b2f3-8ea6-47aa-8ea4-ad0029cbc451"
    config: {
      clusterId: "82a56e23-96b2-460d-8020-a859dd285690"
      hostId: "3bb4e1cc-fb27-426f-ad78-2d8a469c0a4a"
      storageLocationId: "b0ec695f-d97d-44ba-882a-b4a17c4274a9"
      shouldRecoverTags: true
    }
    }) {
    id
  }
}
```

```powershell
$vm = Get-RscVmwareVm -Name "example" -Relic:$false -Replica: $false
$snapshot = $vm | Get-RscSnapshot -BeforeTime "1900/01/01" -AfterTime "1900/01/01" | Select-Object -First 1
$vsphereClusterId = "00000000-0000-0000-0000-000000000000"
$vsphereDatastoreId = "00000000-0000-0000-0000-000000000000"

$query = New-RscMutation -GqlMutation vsphereVmExportSnapshotV3
$query.Var.Input = Get-RscType -Name VsphereVmExportSnapshotV3Input -InitialProperties config.requiredRecoveryParameters
$query.Var.Input.Id = $vm.id
$query.Var.Input.config.clusterId = $vsphereClusterId
$query.Var.Input.config.storageLocationId = $vsphereDatastoreId
$query.Var.Input.config.requiredRecoveryParameters.snapshotId = $snapshot.Id

$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation { vsphereVmExportSnapshotV3( input: { id: \\\"e776b2f3-8ea6-47aa-8ea4-ad0029cbc451\\\" config: { clusterId: \\\"82a56e23-96b2-460d-8020-a859dd285690\\\" hostId: \\\"3bb4e1cc-fb27-426f-ad78-2d8a469c0a4a\\\" storageLocationId: \\\"b0ec695f-d97d-44ba-882a-b4a17c4274a9\\\" shouldRecoverTags: true } }) { id } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Recover Files

Restore files and folders from a snapshot

```graphql
mutation {
  vsphereVmRecoverFilesNew(input: {
    id: "4d94175e-9fd4-5198-8c46-64c2ce3559a2"
    clusterUuid: "6a271636-9392-4cba-90c5-bdbe227854ab"
    config: {
      destObjectId: "a8fd8809-bbdb-5a03-8663-1c1feb19791c"
      shouldUseAgent: true
      restoreConfig: {
        restorePathPair: {
          path: "C:\\foo\\bar\\example.txt"
          restorePath: "C:\\foo\\bar"
        }
      }
    }
  }) {
    id
  }
}
```

```powershell
$vm = Get-RscVmwareVm -Name "example" -Relic:$false -Replica:$false
$snapshot = $vm | Get-RscSnapshot | Select-Object -First 1
$SourceFilePath = "C:\\foo\\bar.txt"
$DestinationFilePath = "C:\\restore"

# Optional
# $DestinationVm = Get-RscVmwareVm -id "123"

$query = New-RscMutation -GqlMutation vsphereVmRecoverFilesNew -FieldProfile FULL

$query.var.input = New-Object -Typename RubrikSecurityCloud.Types.VsphereVmRecoverFilesNewInput
$query.var.input.Config = New-Object RubrikSecurityCloud.Types.RestoreFilesJobConfigInput
$query.var.input.Config.RestoreConfig = New-Object -TypeName RubrikSecurityCloud.Types.VmRestorePathPairInput
$query.var.input.Config.RestoreConfig[0].RestorePathPair = New-Object RubrikSecurityCloud.Types.RestorePathPairInput

$query.var.input.id = $snapshot.id
$query.var.input.clusterUuid = $snapshot.Cluster.id

if ($DestinationVm) {
    $query.var.input.config.destinationObjectId = $DestinationVm.id
}
else {
    $query.var.input.config.destinationObjectId = $snapshot.SnappableNew.Id
}

$query.var.input.config.restoreConfig[0].RestorePathPair.path = $SourceFilePath
$query.var.input.config.restoreConfig[0].RestorePathPair.restorePath = $DestinationFilePath

$result = Invoke-Rsc -Query $query
$result
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation { vsphereVmRecoverFilesNew(input: { id: \\\"4d94175e-9fd4-5198-8c46-64c2ce3559a2\\\" clusterUuid: \\\"6a271636-9392-4cba-90c5-bdbe227854ab\\\" config: { destObjectId: \\\"a8fd8809-bbdb-5a03-8663-1c1feb19791c\\\" shouldUseAgent: true restoreConfig: { restorePathPair: { path: \\\"C:\\foo\\bar\\example.txt\\\" restorePath: \\\"C:\\foo\\bar\\\" } } } }) { id } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## In-Place Recovery

Update the source virtual machine with data from a snapshot using only changed blocks.

```graphql
mutation {
  vsphereVmInitiateInPlaceRecovery(
    input: {
      id: "d2d9ed9f-bb52-4ae8-a50e-9692e8bf8dff"
      config: {
        requiredRecoveryParameters: {
          snapshotId: "072ab1cd-ea3f-4dd2-8b63-49f24a5f87a2"
        }
      }
    }
    ) {
    id
    status
    startTime
    endTime
    progress
    error {
      message
    }
  }
}
```

```powershell
$vm = Get-RscVmwareVm -Name "example" -Relic:$false -Replica:$false
$snapshot = $vm | Get-RscSnapshot | Select-Object -First 1

$query = New-RscMutation -GqlMutation vsphereVmInitiateInPlaceRecovery -FieldProfile FULL
$query.Var.input = Get-RscType -name VsphereVmInitiateInPlaceRecoveryInput -InitialProperties config.requiredRecoveryParameters
$query.Var.input.id = $vm.Id
$query.Var.input.Config.requiredRecoveryParameters.snapshotId = $snapshot.Id
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation { vsphereVmInitiateInPlaceRecovery( input: { id: \\\"d2d9ed9f-bb52-4ae8-a50e-9692e8bf8dff\\\" config: { requiredRecoveryParameters: { snapshotId: \\\"072ab1cd-ea3f-4dd2-8b63-49f24a5f87a2\\\" } } } ) { id status startTime endTime progress error { message } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Live Mount

Create a new virtual machine from a snapshot. The recovered virtual machine uses the Rubrik cluster as its datastore.

```graphql
mutation {
  vsphereVmInitiateLiveMountV2(
    input: {
      id: "a8fd8809-bbdb-5a03-8663-1c1feb19791c"
      config: {
        clusterId: "e90741cc-4360-54b8-9ad3-84db4727c62e" 
        requiredRecoveryParameters: {
          snapshotId: "823cd454-7349-5a2c-a055-a936faf04c73" 
            }, 
        mountExportSnapshotJobCommonOptionsV2: {
          powerOn: true 
          disableNetwork: true 
          vmName: "livemountExample"
        }
      }
    }
  ) {
    id
  }
}
```

```powershell
$vm = Get-RscVmwareVm -Name "example" -Relic:$false -Replica:$false
$snapshot = $vm | Get-RscSnapshot | Select-Object -First 1

$query = New-RscMutation -GqlMutation vsphereVmInitiateLiveMountV2 -FieldProfile FULL
$query.Var.input = Get-RscType -name VsphereVmInitiateLiveMountV2Input -InitialProperties `
    config.requiredRecoveryParameters,`
    config.mountExportSnapshotJobCommonOptionsV2
$query.Var.input.id = $vm.Id
$query.Var.input.Config.preserveMoid = $true
$query.Var.input.Config.shouldRecoverTags = $true
$query.Var.input.Config.clusterId = $vm.Cluster.Id
$query.Var.input.Config.requiredRecoveryParameters.snapshotId = $snapshot.Id
$query.Var.input.Config.mountExportSnapshotJobCommonOptionsV2.powerOn = $true
$query.Var.input.Config.mountExportSnapshotJobCommonOptionsV2.keepMacAddresses = $true
$query.Var.input.Config.mountExportSnapshotJobCommonOptionsV2.disableNetwork = $false
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation { vsphereVmInitiateLiveMountV2( input: { id: \\\"a8fd8809-bbdb-5a03-8663-1c1feb19791c\\\" config: { clusterId: \\\"e90741cc-4360-54b8-9ad3-84db4727c62e\\\" requiredRecoveryParameters: { snapshotId: \\\"823cd454-7349-5a2c-a055-a936faf04c73\\\" }, mountExportSnapshotJobCommonOptionsV2: { powerOn: true disableNetwork: true vmName: \\\"livemountExample\\\" } } } ) { id } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Instant Recovery

Replace the source virtual machine with a virtual machine recovered from a snapshot. The recovered virtual machine uses the Rubrik cluster as the datastore.

```graphql
mutation {
  vsphereVmInitiateInstantRecoveryV2(
    input: {
      id: "a8fd8809-bbdb-5a03-8663-1c1feb19791c"
      config: {
        preserveMoid: true
        shouldRecoverTags: true
        clusterId: "e90741cc-4360-54b8-9ad3-84db4727c62e" 
        requiredRecoveryParameters: {
          snapshotId: "823cd454-7349-5a2c-a055-a936faf04c73" 
            }, 
        mountExportSnapshotJobCommonOptionsV2: {
          powerOn: true 
          keepMacAddresses: true
          disableNetwork: false
        }
      }
    }
  ) {
    id
  }
}
```

```powershell
$vm = Get-RscVmwareVm -Name "example" -Relic:$false -Replica:$false
$snapshot = $vm | Get-RscSnapshot | Select-Object -First 1

$query = New-RscMutation -GqlMutation vsphereVmInitiateInstantRecoveryV2 -FieldProfile FULL
$query.Var.input = Get-RscType -name VsphereVmInitiateInstantRecoveryV2Input -InitialProperties `
    config.requiredRecoveryParameters,`
    config.mountExportSnapshotJobCommonOptionsV2
$query.Var.input.id = $vm.Id
$query.Var.input.Config.preserveMoid = $true
$query.Var.input.Config.shouldRecoverTags = $true
$query.Var.input.Config.clusterId = $vm.Cluster.Id
$query.Var.input.Config.requiredRecoveryParameters.snapshotId = $snapshot.Id
$query.Var.input.Config.mountExportSnapshotJobCommonOptionsV2.powerOn = $true
$query.Var.input.Config.mountExportSnapshotJobCommonOptionsV2.keepMacAddresses = $true
$query.Var.input.Config.mountExportSnapshotJobCommonOptionsV2.disableNetwork = $false
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation { vsphereVmInitiateInstantRecoveryV2( input: { id: \\\"a8fd8809-bbdb-5a03-8663-1c1feb19791c\\\" config: { preserveMoid: true shouldRecoverTags: true clusterId: \\\"e90741cc-4360-54b8-9ad3-84db4727c62e\\\" requiredRecoveryParameters: { snapshotId: \\\"823cd454-7349-5a2c-a055-a936faf04c73\\\" }, mountExportSnapshotJobCommonOptionsV2: { powerOn: true keepMacAddresses: true disableNetwork: false } } } ) { id } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Mount Virtual Disks

Create new virtual disks from a snapshot, using the Rubrik cluster as the datastore. Mount these disks to another virtual machine.

```graphql
mutation {
  vsphereVmInitiateDiskMount(input: {
    id: "0c716834-1440-4c0e-bffd-c375b39309cb" # snapshot ID
    config: {
      targetVmId: "49ccc234-3fc5-4aab-9fec-eb8de56d29bf" 
      vmdkIds: ["b94a692e-2f07-44c6-8186-17e0075341d9"] # removing this will mount all VMDKs
    }
  }) {
    id
  }
}
```

```powershell
$vm = Get-RscVmwareVm -Name "example" -Relic:$false -Replica:$false
$snapshot = $vm | Get-RscSnapshot | Select-Object -First 1

$query = New-RscMutation -GqlMutation vsphereVmInitiateDiskMount -FieldProfile FULL
$query.Var.input = Get-RscType -name VsphereVmInitiateDiskMountInput -InitialProperties config
$query.Var.input.id = $snapshot.Id
$query.Var.input.Config.targetVmId = $vm.id
$query.Var.input.Config.vmdkIds = @("b94a692e-2f07-44c6-8186-17e0075341d9")
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation { vsphereVmInitiateDiskMount(input: { id: \\\"0c716834-1440-4c0e-bffd-c375b39309cb\\\" config: { targetVmId: \\\"49ccc234-3fc5-4aab-9fec-eb8de56d29bf\\\" vmdkIds: [\\\"b94a692e-2f07-44c6-8186-17e0075341d9\\\"] } }) { id } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```


## Retrieving Rubrik Cloud Vault Entitlements

```graphql
query {
  rcvAccountEntitlement {
    backupEntitlement {
      capacity
      bundle
      tier
      redundancy
      createdAt
      revenueType
    }
    archiveEntitlement {
      capacity
      bundle
      tier
      redundancy
      createdAt
      revenueType
    }
    entitlements {
      entitlement {
        capacity
        bundle
        tier
        redundancy
        createdAt
        revenueType
      }
      usedCapacity
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery rcvAccountEntitlement -FieldProfile FULL
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { rcvAccountEntitlement { backupEntitlement { capacity bundle tier redundancy createdAt revenueType } archiveEntitlement { capacity bundle tier redundancy createdAt revenueType } entitlements { entitlement { capacity bundle tier redundancy createdAt revenueType } usedCapacity } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Rubrik Clusters

```graphql
query {
  clusterConnection( filter : {
      # name: "example"
    }
  ) {
    nodes {
      name
      id
      type
      version
      defaultAddress
      ipmiInfo {
        isAvailable
        usesIkvm
        usesHttps
      }
      systemStatus
      status
      subStatus
      pauseStatus
      encryptionEnabled
      eosDate
      eosStatus
      registrationTime
      registeredMode
      estimatedRunway
      geoLocation {
        address
        latitude
        longitude
      }
      metric {
        totalCapacity
        availableCapacity
        usedCapacity
        snapshotCapacity
        liveMountCapacity
        miscellaneousCapacity
        pendingSnapshotCapacity
        cdpCapacity
        lastUpdateTime
        averageDailyGrowth
      }
      clusterNodeConnection {
        nodes {
          hostname
          id
          brikId
          ipAddress
          status
        }
      }
    }
  }
}
```

```powershell
Get-RscCluster
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { clusterConnection( filter : { } ) { nodes { name id type version defaultAddress ipmiInfo { isAvailable usesIkvm usesHttps } systemStatus status subStatus pauseStatus encryptionEnabled eosDate eosStatus registrationTime registeredMode estimatedRunway geoLocation { address latitude longitude } metric { totalCapacity availableCapacity usedCapacity snapshotCapacity liveMountCapacity miscellaneousCapacity pendingSnapshotCapacity cdpCapacity lastUpdateTime averageDailyGrowth } clusterNodeConnection { nodes { hostname id brikId ipAddress status } } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## What are SLA Domains?

Rubrik SLA Domains are data protection policies that define:

- The **object types** for which the policy can be applied
- The **frequency** of the backups
- The **retention** of the backups
- The **replication** destination of the backups
- The **archival** location of the backups
- **Object specific settings** based on the type (e.g. MSSQL Database)

## Retrieve All SLAs

```graphql
query {
  slaDomains {
    nodes {
      id
      name
      ... on GlobalSlaReply {
        isDefault
        description
        snapshotSchedule {
          minute {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
          }
          hourly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
          }
          daily {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
          }
          weekly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
            dayOfWeek
          }
          monthly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
            dayOfMonth
          }
          quarterly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
            dayOfQuarter
            quarterStartMonth
          }
          yearly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
            dayOfYear
            yearStartMonth
          }
        }
        archivalSpecs {
          threshold
          thresholdUnit
          storageSetting {
            id
            name
            groupType
          }
          archivalTieringSpec {
            coldStorageClass
            minAccessibleDurationInSeconds
            isInstantTieringEnabled
          }
        }
        backupWindows {
          durationInHours
          startTimeAttributes {
            hour
            minute
          }
        }
        firstFullBackupWindows {
          durationInHours
          startTimeAttributes {
            dayOfWeek {
              day
            }
            hour
            minute
          }
        }
        replicationSpecsV2 {
          replicationLocalRetentionDuration {
            duration
            unit
          }
          cascadingArchivalSpecs {
            archivalTieringSpec {
              coldStorageClass
              shouldTierExistingSnapshots
              minAccessibleDurationInSeconds
              isInstantTieringEnabled
            }
            archivalLocation {
              id
              name
              targetType
              ... on RubrikManagedAwsTarget {
                immutabilitySettings {
                  lockDurationDays
                }
              }
              ... on RubrikManagedAzureTarget {
                immutabilitySettings {
                  lockDurationDays
                }
              }
              ... on RubrikManagedNfsTarget {
                host
              }
              ... on CdmManagedAwsTarget {
                immutabilitySettings {
                  lockDurationDays
                }
              }
              ... on CdmManagedAzureTarget {
                immutabilitySettings {
                  lockDurationDays
                }
              }
            }
            frequency
            archivalThreshold {
              duration
              unit
            }
          }
          retentionDuration {
            duration
            unit
          }
          cluster {
            id
            name
          }
          targetMapping {
            id
            name
          }
          awsTarget {
            accountId
            accountName
            region
          }
          azureTarget {
            region
          }
        }
        localRetentionLimit {
          duration
          unit
        }
        objectSpecificConfigs {
          sapHanaConfig {
            incrementalFrequency {
              duration
              unit
            }
            differentialFrequency {
              duration
              unit
            }
            logRetention {
              duration
              unit
            }
          }
          awsRdsConfig {
            logRetention {
              duration
            }
          }
          vmwareVmConfig {
            logRetentionSeconds
          }
        }
        clusterToSyncStatusMap {
          clusterUuid
          slaSyncStatus
        }
        objectTypes
        upgradeInfo {
          eligibility {
            isEligible
            ineligibilityReason
          }
          latestUpgrade {
            status
            msg
          }
        }
        allOrgsHavingAccess {
          id
          name
        }
        ownerOrg {
          id
          name
        }
        isRetentionLockedSla
      }
      ... on ClusterSlaDomain {
        cdmId
        name
        cluster {
          name
          version
        }
        snapshotSchedule {
          minute {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
          }
          hourly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
          }
          daily {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
          }
          weekly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
            dayOfWeek
          }
          monthly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
            dayOfMonth
          }
          quarterly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
            dayOfQuarter
            quarterStartMonth
          }
          yearly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
            dayOfYear
            yearStartMonth
          }
        }
        backupWindows {
          durationInHours
          startTimeAttributes {
            hour
            minute
          }
        }
        firstFullBackupWindows {
          durationInHours
          startTimeAttributes {
            dayOfWeek {
              day
            }
            hour
            minute
          }
        }
        archivalSpec {
          threshold
          thresholdUnit
          archivalLocationName
          archivalLocationId
          archivalTieringSpec {
            coldStorageClass
            minAccessibleDurationInSeconds
            isInstantTieringEnabled
          }
        }
        replicationSpecsV2 {
          retentionDuration {
            duration
            unit
          }
          cluster {
            id
            name
          }
          targetMapping {
            id
            name
          }
          awsTarget {
            accountId
            accountName
            region
          }
          azureTarget {
            region
          }
        }
        localRetentionLimit {
          duration
          unit
        }
        upgradeInfo {
          eligibility {
            isEligible
            ineligibilityReason
          }
          latestUpgrade {
            status
            msg
          }
        }
        ownerOrg {
          id
          name
        }
        isRetentionLockedSla
      }
    }
    pageInfo {
      endCursor
      hasNextPage
    }
  }
}
```

```powershell
Get-RscSla
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { slaDomains { nodes { id name ... on GlobalSlaReply { isDefault description snapshotSchedule { minute { basicSchedule { frequency retention retentionUnit } } hourly { basicSchedule { frequency retention retentionUnit } } daily { basicSchedule { frequency retention retentionUnit } } weekly { basicSchedule { frequency retention retentionUnit } dayOfWeek } monthly { basicSchedule { frequency retention retentionUnit } dayOfMonth } quarterly { basicSchedule { frequency retention retentionUnit } dayOfQuarter quarterStartMonth } yearly { basicSchedule { frequency retention retentionUnit } dayOfYear yearStartMonth } } archivalSpecs { threshold thresholdUnit storageSetting { id name groupType } archivalTieringSpec { coldStorageClass minAccessibleDurationInSeconds isInstantTieringEnabled } } backupWindows { durationInHours startTimeAttributes { hour minute } } firstFullBackupWindows { durationInHours startTimeAttributes { dayOfWeek { day } hour minute } } replicationSpecsV2 { replicationLocalRetentionDuration { duration unit } cascadingArchivalSpecs { archivalTieringSpec { coldStorageClass shouldTierExistingSnapshots minAccessibleDurationInSeconds isInstantTieringEnabled } archivalLocation { id name targetType ... on RubrikManagedAwsTarget { immutabilitySettings { lockDurationDays } } ... on RubrikManagedAzureTarget { immutabilitySettings { lockDurationDays } } ... on RubrikManagedNfsTarget { host } ... on CdmManagedAwsTarget { immutabilitySettings { lockDurationDays } } ... on CdmManagedAzureTarget { immutabilitySettings { lockDurationDays } } } frequency archivalThreshold { duration unit } } retentionDuration { duration unit } cluster { id name } targetMapping { id name } awsTarget { accountId accountName region } azureTarget { region } } localRetentionLimit { duration unit } objectSpecificConfigs { sapHanaConfig { incrementalFrequency { duration unit } differentialFrequency { duration unit } logRetention { duration unit } } awsRdsConfig { logRetention { duration } } vmwareVmConfig { logRetentionSeconds } } clusterToSyncStatusMap { clusterUuid slaSyncStatus } objectTypes upgradeInfo { eligibility { isEligible ineligibilityReason } latestUpgrade { status msg } } allOrgsHavingAccess { id name } ownerOrg { id name } isRetentionLockedSla } ... on ClusterSlaDomain { cdmId name cluster { name version } snapshotSchedule { minute { basicSchedule { frequency retention retentionUnit } } hourly { basicSchedule { frequency retention retentionUnit } } daily { basicSchedule { frequency retention retentionUnit } } weekly { basicSchedule { frequency retention retentionUnit } dayOfWeek } monthly { basicSchedule { frequency retention retentionUnit } dayOfMonth } quarterly { basicSchedule { frequency retention retentionUnit } dayOfQuarter quarterStartMonth } yearly { basicSchedule { frequency retention retentionUnit } dayOfYear yearStartMonth } } backupWindows { durationInHours startTimeAttributes { hour minute } } firstFullBackupWindows { durationInHours startTimeAttributes { dayOfWeek { day } hour minute } } archivalSpec { threshold thresholdUnit archivalLocationName archivalLocationId archivalTieringSpec { coldStorageClass minAccessibleDurationInSeconds isInstantTieringEnabled } } replicationSpecsV2 { retentionDuration { duration unit } cluster { id name } targetMapping { id name } awsTarget { accountId accountName region } azureTarget { region } } localRetentionLimit { duration unit } upgradeInfo { eligibility { isEligible ineligibilityReason } latestUpgrade { status msg } } ownerOrg { id name } isRetentionLockedSla } } pageInfo { endCursor hasNextPage } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieve an SLA by Name

Generally, the name of the SLA may be known, but not the ID. The `slaDomains` query allows filtering on several fields, including `NAME`.

```graphql
query {
  slaDomains(filter: {field: NAME text: "foo"}) {
    nodes {
      id
      name
      ... on GlobalSlaReply {
        isDefault
        description
        snapshotSchedule {
          minute {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
          }
          hourly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
          }
          daily {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
          }
          weekly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
            dayOfWeek
          }
          monthly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
            dayOfMonth
          }
          quarterly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
            dayOfQuarter
            quarterStartMonth
          }
          yearly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
            dayOfYear
            yearStartMonth
          }
        }
        archivalSpecs {
          threshold
          thresholdUnit
          storageSetting {
            id
            name
            groupType
          }
          archivalTieringSpec {
            coldStorageClass
            minAccessibleDurationInSeconds
            isInstantTieringEnabled
          }
        }
        backupWindows {
          durationInHours
          startTimeAttributes {
            hour
            minute
          }
        }
        firstFullBackupWindows {
          durationInHours
          startTimeAttributes {
            dayOfWeek {
              day
            }
            hour
            minute
          }
        }
        replicationSpecsV2 {
          replicationLocalRetentionDuration {
            duration
            unit
          }
          cascadingArchivalSpecs {
            archivalTieringSpec {
              coldStorageClass
              shouldTierExistingSnapshots
              minAccessibleDurationInSeconds
              isInstantTieringEnabled
            }
            archivalLocation {
              id
              name
              targetType
              ... on RubrikManagedAwsTarget {
                immutabilitySettings {
                  lockDurationDays
                }
              }
              ... on RubrikManagedAzureTarget {
                immutabilitySettings {
                  lockDurationDays
                }
              }
              ... on RubrikManagedNfsTarget {
                host
              }
              ... on CdmManagedAwsTarget {
                immutabilitySettings {
                  lockDurationDays
                }
              }
              ... on CdmManagedAzureTarget {
                immutabilitySettings {
                  lockDurationDays
                }
              }
            }
            frequency
            archivalThreshold {
              duration
              unit
            }
          }
          retentionDuration {
            duration
            unit
          }
          cluster {
            id
            name
          }
          targetMapping {
            id
            name
          }
          awsTarget {
            accountId
            accountName
            region
          }
          azureTarget {
            region
          }
        }
        localRetentionLimit {
          duration
          unit
        }
        objectSpecificConfigs {
          sapHanaConfig {
            incrementalFrequency {
              duration
              unit
            }
            differentialFrequency {
              duration
              unit
            }
            logRetention {
              duration
              unit
            }
          }
          awsRdsConfig {
            logRetention {
              duration
            }
          }
          vmwareVmConfig {
            logRetentionSeconds
          }
        }
        clusterToSyncStatusMap {
          clusterUuid
          slaSyncStatus
        }
        objectTypes
        upgradeInfo {
          eligibility {
            isEligible
            ineligibilityReason
          }
          latestUpgrade {
            status
            msg
          }
        }
        allOrgsHavingAccess {
          id
          name
        }
        ownerOrg {
          id
          name
        }
        isRetentionLockedSla
      }
      ... on ClusterSlaDomain {
        cdmId
        name
        cluster {
          name
          version
        }
        snapshotSchedule {
          minute {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
          }
          hourly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
          }
          daily {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
          }
          weekly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
            dayOfWeek
          }
          monthly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
            dayOfMonth
          }
          quarterly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
            dayOfQuarter
            quarterStartMonth
          }
          yearly {
            basicSchedule {
              frequency
              retention
              retentionUnit
            }
            dayOfYear
            yearStartMonth
          }
        }
        backupWindows {
          durationInHours
          startTimeAttributes {
            hour
            minute
          }
        }
        firstFullBackupWindows {
          durationInHours
          startTimeAttributes {
            dayOfWeek {
              day
            }
            hour
            minute
          }
        }
        archivalSpec {
          threshold
          thresholdUnit
          archivalLocationName
          archivalLocationId
          archivalTieringSpec {
            coldStorageClass
            minAccessibleDurationInSeconds
            isInstantTieringEnabled
          }
        }
        replicationSpecsV2 {
          retentionDuration {
            duration
            unit
          }
          cluster {
            id
            name
          }
          targetMapping {
            id
            name
          }
          awsTarget {
            accountId
            accountName
            region
          }
          azureTarget {
            region
          }
        }
        localRetentionLimit {
          duration
          unit
        }
        upgradeInfo {
          eligibility {
            isEligible
            ineligibilityReason
          }
          latestUpgrade {
            status
            msg
          }
        }
        ownerOrg {
          id
          name
        }
        isRetentionLockedSla
      }
    }
    pageInfo {
      endCursor
      hasNextPage
    }
  }
}
```

```powershell
Get-RscSla -Name "Foo"
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { slaDomains(filter: {field: NAME text: \\\"foo\\\"}) { nodes { id name ... on GlobalSlaReply { isDefault description snapshotSchedule { minute { basicSchedule { frequency retention retentionUnit } } hourly { basicSchedule { frequency retention retentionUnit } } daily { basicSchedule { frequency retention retentionUnit } } weekly { basicSchedule { frequency retention retentionUnit } dayOfWeek } monthly { basicSchedule { frequency retention retentionUnit } dayOfMonth } quarterly { basicSchedule { frequency retention retentionUnit } dayOfQuarter quarterStartMonth } yearly { basicSchedule { frequency retention retentionUnit } dayOfYear yearStartMonth } } archivalSpecs { threshold thresholdUnit storageSetting { id name groupType } archivalTieringSpec { coldStorageClass minAccessibleDurationInSeconds isInstantTieringEnabled } } backupWindows { durationInHours startTimeAttributes { hour minute } } firstFullBackupWindows { durationInHours startTimeAttributes { dayOfWeek { day } hour minute } } replicationSpecsV2 { replicationLocalRetentionDuration { duration unit } cascadingArchivalSpecs { archivalTieringSpec { coldStorageClass shouldTierExistingSnapshots minAccessibleDurationInSeconds isInstantTieringEnabled } archivalLocation { id name targetType ... on RubrikManagedAwsTarget { immutabilitySettings { lockDurationDays } } ... on RubrikManagedAzureTarget { immutabilitySettings { lockDurationDays } } ... on RubrikManagedNfsTarget { host } ... on CdmManagedAwsTarget { immutabilitySettings { lockDurationDays } } ... on CdmManagedAzureTarget { immutabilitySettings { lockDurationDays } } } frequency archivalThreshold { duration unit } } retentionDuration { duration unit } cluster { id name } targetMapping { id name } awsTarget { accountId accountName region } azureTarget { region } } localRetentionLimit { duration unit } objectSpecificConfigs { sapHanaConfig { incrementalFrequency { duration unit } differentialFrequency { duration unit } logRetention { duration unit } } awsRdsConfig { logRetention { duration } } vmwareVmConfig { logRetentionSeconds } } clusterToSyncStatusMap { clusterUuid slaSyncStatus } objectTypes upgradeInfo { eligibility { isEligible ineligibilityReason } latestUpgrade { status msg } } allOrgsHavingAccess { id name } ownerOrg { id name } isRetentionLockedSla } ... on ClusterSlaDomain { cdmId name cluster { name version } snapshotSchedule { minute { basicSchedule { frequency retention retentionUnit } } hourly { basicSchedule { frequency retention retentionUnit } } daily { basicSchedule { frequency retention retentionUnit } } weekly { basicSchedule { frequency retention retentionUnit } dayOfWeek } monthly { basicSchedule { frequency retention retentionUnit } dayOfMonth } quarterly { basicSchedule { frequency retention retentionUnit } dayOfQuarter quarterStartMonth } yearly { basicSchedule { frequency retention retentionUnit } dayOfYear yearStartMonth } } backupWindows { durationInHours startTimeAttributes { hour minute } } firstFullBackupWindows { durationInHours startTimeAttributes { dayOfWeek { day } hour minute } } archivalSpec { threshold thresholdUnit archivalLocationName archivalLocationId archivalTieringSpec { coldStorageClass minAccessibleDurationInSeconds isInstantTieringEnabled } } replicationSpecsV2 { retentionDuration { duration unit } cluster { id name } targetMapping { id name } awsTarget { accountId accountName region } azureTarget { region } } localRetentionLimit { duration unit } upgradeInfo { eligibility { isEligible ineligibilityReason } latestUpgrade { status msg } } ownerOrg { id name } isRetentionLockedSla } } pageInfo { endCursor hasNextPage } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

Note

Name filtering in `slaDomains` is partial matching. If you provide the name "bronze", it will also return any other SLA domain with that name (e.g. "super-bronze").

## Retrieve an Individual SLA

```graphql
query {
  slaDomain(id: "0CC22D1B-B761-4EF3-BC5B-82706D97FB05") {
    id
    name
    ... on GlobalSlaReply {
      isDefault
      description
      snapshotSchedule {
        minute {
          basicSchedule {
            frequency
            retention
            retentionUnit
          }
        }
        hourly {
          basicSchedule {
            frequency
            retention
            retentionUnit
          }
        }
        daily {
          basicSchedule {
            frequency
            retention
            retentionUnit
          }
        }
        weekly {
          basicSchedule {
            frequency
            retention
            retentionUnit
          }
          dayOfWeek
        }
        monthly {
          basicSchedule {
            frequency
            retention
            retentionUnit
          }
          dayOfMonth
        }
        quarterly {
          basicSchedule {
            frequency
            retention
            retentionUnit
          }
          dayOfQuarter
          quarterStartMonth
        }
        yearly {
          basicSchedule {
            frequency
            retention
            retentionUnit
          }
          dayOfYear
          yearStartMonth
        }
      }
      archivalSpecs {
        threshold
        thresholdUnit
        archivalLocationToClusterMapping {
          cluster {
            id
            name
          }
          location {
            id
            name
            targetType
          }
        }
        storageSetting {
          id
          name
          groupType
        }
        archivalTieringSpec {
          coldStorageClass
          minAccessibleDurationInSeconds
          isInstantTieringEnabled
        }
        frequencies
      }
      archivalLocationsUpgradeInfo {
        locationId
        upgradeStatus
        upgradeUnsupportedReason
      }
      backupWindows {
        durationInHours
        startTimeAttributes {
          hour
          minute
        }
      }
      firstFullBackupWindows {
        durationInHours
        startTimeAttributes {
          dayOfWeek {
            day
          }
          hour
          minute
        }
      }
      replicationSpecsV2 {
        replicationPairs {
          sourceCluster {
            id
            name
          }
          targetCluster {
            id
            name
            version
            clusterInfo {
              ... on LocalClusterInfo {
                isIsolated: isAirGapped
                isConnected
              }
              ... on CrossAccountClusterInfo {
                originAccount
                isConnected
              }
            }
          }
        }
        replicationLocalRetentionDuration {
          duration
          unit
        }
        cascadingArchivalSpecs {
          archivalTieringSpec {
            coldStorageClass
            shouldTierExistingSnapshots
            minAccessibleDurationInSeconds
            isInstantTieringEnabled
          }
          archivalLocationToClusterMapping {
            cluster {
              id
              name
              version
              clusterInfo {
                ... on LocalClusterInfo {
                  isIsolated: isAirGapped
                  isConnected
                }
                ... on CrossAccountClusterInfo {
                  originAccount
                  isConnected
                }
              }
            }
            location {
              id
              name
              targetType
              ... on RubrikManagedAwsTarget {
                storageClass
                immutabilitySettings {
                  lockDurationDays
                }
              }
              ... on RubrikManagedAzureTarget {
                immutabilitySettings {
                  lockDurationDays
                }
              }
              ... on CdmManagedAwsTarget {
                storageClass
                immutabilitySettings {
                  lockDurationDays
                }
              }
              ... on CdmManagedAzureTarget {
                immutabilitySettings {
                  lockDurationDays
                }
              }
              ... on RubrikManagedRcsTarget {
                immutabilityPeriodDays
                syncStatus
                tier
              }
              ... on RubrikManagedS3CompatibleTarget {
                immutabilitySetting {
                  bucketLockDurationDays
                }
              }
            }
          }
          archivalLocation {
            id
            name
            targetType
            ... on RubrikManagedAwsTarget {
              storageClass
              immutabilitySettings {
                lockDurationDays
              }
            }
            ... on RubrikManagedAzureTarget {
              immutabilitySettings {
                lockDurationDays
              }
            }
            ... on CdmManagedAwsTarget {
              storageClass
              immutabilitySettings {
                lockDurationDays
              }
            }
            ... on CdmManagedAzureTarget {
              immutabilitySettings {
                lockDurationDays
              }
            }
            ... on RubrikManagedRcsTarget {
              immutabilityPeriodDays
              syncStatus
              tier
            }
            ... on RubrikManagedS3CompatibleTarget {
              immutabilitySetting {
                bucketLockDurationDays
              }
            }
          }
          frequency
          archivalThreshold {
            duration
            unit
          }
        }
        retentionDuration {
          duration
          unit
        }
        cluster {
          id
          name
          version
          clusterInfo {
            ... on LocalClusterInfo {
              isIsolated: isAirGapped
              isConnected
            }
            ... on CrossAccountClusterInfo {
              originAccount
              isConnected
            }
          }
        }
        targetMapping {
          id
          name
          targets {
            id
            name
            cluster {
              id
              name
            }
          }
        }
        awsTarget {
          accountId
          accountName
          region
        }
        azureTarget {
          region
        }
      }
      localRetentionLimit {
        duration
        unit
      }
      objectSpecificConfigs {
        awsRdsConfig {
          logRetention {
            duration
            unit
          }
        }
        sapHanaConfig {
          incrementalFrequency {
            duration
            unit
          }
          differentialFrequency {
            duration
            unit
          }
          logRetention {
            duration
            unit
          }
        }
        db2Config {
          incrementalFrequency {
            duration
            unit
          }
          differentialFrequency {
            duration
            unit
          }
          logRetention {
            duration
            unit
          }
        }
        mongoConfig {
          logFrequency {
            duration
            unit
          }
          logRetention {
            duration
            unit
          }
        }
        mssqlConfig {
          frequency {
            duration
            unit
          }
          logRetention {
            duration
            unit
          }
        }
        oracleConfig {
          frequency {
            duration
            unit
          }
          logRetention {
            duration
            unit
          }
          hostLogRetention {
            duration
            unit
          }
        }
        vmwareVmConfig {
          logRetentionSeconds
        }
        azureSqlDatabaseDbConfig {
          logRetentionInDays
        }
        azureSqlManagedInstanceDbConfig {
          logRetentionInDays
        }
      }
      clusterToSyncStatusMap {
        clusterUuid
        slaSyncStatus
      }
      objectTypes
      upgradeInfo {
        eligibility {
          isEligible
          ineligibilityReason
        }
        latestUpgrade {
          status
          msg
        }
      }
      allOrgsHavingAccess {
        id
        name
      }
      isRetentionLockedSla
      retentionLockMode
    }
  }
}
```

```powershell
Get-RscSla -Id "0CC22D1B-B761-4EF3-BC5B-82706D97FB05"
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { slaDomain(id: \\\"0CC22D1B-B761-4EF3-BC5B-82706D97FB05\\\") { id name ... on GlobalSlaReply { isDefault description snapshotSchedule { minute { basicSchedule { frequency retention retentionUnit } } hourly { basicSchedule { frequency retention retentionUnit } } daily { basicSchedule { frequency retention retentionUnit } } weekly { basicSchedule { frequency retention retentionUnit } dayOfWeek } monthly { basicSchedule { frequency retention retentionUnit } dayOfMonth } quarterly { basicSchedule { frequency retention retentionUnit } dayOfQuarter quarterStartMonth } yearly { basicSchedule { frequency retention retentionUnit } dayOfYear yearStartMonth } } archivalSpecs { threshold thresholdUnit archivalLocationToClusterMapping { cluster { id name } location { id name targetType } } storageSetting { id name groupType } archivalTieringSpec { coldStorageClass minAccessibleDurationInSeconds isInstantTieringEnabled } frequencies } archivalLocationsUpgradeInfo { locationId upgradeStatus upgradeUnsupportedReason } backupWindows { durationInHours startTimeAttributes { hour minute } } firstFullBackupWindows { durationInHours startTimeAttributes { dayOfWeek { day } hour minute } } replicationSpecsV2 { replicationPairs { sourceCluster { id name } targetCluster { id name version clusterInfo { ... on LocalClusterInfo { isIsolated: isAirGapped isConnected } ... on CrossAccountClusterInfo { originAccount isConnected } } } } replicationLocalRetentionDuration { duration unit } cascadingArchivalSpecs { archivalTieringSpec { coldStorageClass shouldTierExistingSnapshots minAccessibleDurationInSeconds isInstantTieringEnabled } archivalLocationToClusterMapping { cluster { id name version clusterInfo { ... on LocalClusterInfo { isIsolated: isAirGapped isConnected } ... on CrossAccountClusterInfo { originAccount isConnected } } } location { id name targetType ... on RubrikManagedAwsTarget { storageClass immutabilitySettings { lockDurationDays } } ... on RubrikManagedAzureTarget { immutabilitySettings { lockDurationDays } } ... on CdmManagedAwsTarget { storageClass immutabilitySettings { lockDurationDays } } ... on CdmManagedAzureTarget { immutabilitySettings { lockDurationDays } } ... on RubrikManagedRcsTarget { immutabilityPeriodDays syncStatus tier } ... on RubrikManagedS3CompatibleTarget { immutabilitySetting { bucketLockDurationDays } } } } archivalLocation { id name targetType ... on RubrikManagedAwsTarget { storageClass immutabilitySettings { lockDurationDays } } ... on RubrikManagedAzureTarget { immutabilitySettings { lockDurationDays } } ... on CdmManagedAwsTarget { storageClass immutabilitySettings { lockDurationDays } } ... on CdmManagedAzureTarget { immutabilitySettings { lockDurationDays } } ... on RubrikManagedRcsTarget { immutabilityPeriodDays syncStatus tier } ... on RubrikManagedS3CompatibleTarget { immutabilitySetting { bucketLockDurationDays } } } frequency archivalThreshold { duration unit } } retentionDuration { duration unit } cluster { id name version clusterInfo { ... on LocalClusterInfo { isIsolated: isAirGapped isConnected } ... on CrossAccountClusterInfo { originAccount isConnected } } } targetMapping { id name targets { id name cluster { id name } } } awsTarget { accountId accountName region } azureTarget { region } } localRetentionLimit { duration unit } objectSpecificConfigs { awsRdsConfig { logRetention { duration unit } } sapHanaConfig { incrementalFrequency { duration unit } differentialFrequency { duration unit } logRetention { duration unit } } db2Config { incrementalFrequency { duration unit } differentialFrequency { duration unit } logRetention { duration unit } } mongoConfig { logFrequency { duration unit } logRetention { duration unit } } mssqlConfig { frequency { duration unit } logRetention { duration unit } } oracleConfig { frequency { duration unit } logRetention { duration unit } hostLogRetention { duration unit } } vmwareVmConfig { logRetentionSeconds } azureSqlDatabaseDbConfig { logRetentionInDays } azureSqlManagedInstanceDbConfig { logRetentionInDays } } clusterToSyncStatusMap { clusterUuid slaSyncStatus } objectTypes upgradeInfo { eligibility { isEligible ineligibilityReason } latestUpgrade { status msg } } allOrgsHavingAccess { id name } isRetentionLockedSla retentionLockMode } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Assigning an SLA to a workload

```graphql
mutation assignSla {
  assignSla(input: {
    slaDomainAssignType: protectWithSlaId
    slaOptionalId: "CC4AFC96-A8DD-401F-A618-1C03742D21AA"
    objectIds: ["DEF42837-C14D-45E2-8F11-F1BE9ED50F4E"]
    # shouldApplyToExistingSnapshots: true # optional. if you want existing snaps applied to new SLA assignment
    # existingSnapshotRetention: RETAIN_SNAPSHOTS # optional. What do you want to do with the old snaps if you change to DONOTPROTECT?
  }) {
    success
  }
}
```

```powershell
$vm = Get-RscVmwareVm -Name "foo"
$sla = Get-RscSla -Name "Bar"
$vm | Protect-RscWorkload -Sla $sla
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation assignSla { assignSla(input: { slaDomainAssignType: protectWithSlaId slaOptionalId: \\\"CC4AFC96-A8DD-401F-A618-1C03742D21AA\\\" objectIds: [\\\"DEF42837-C14D-45E2-8F11-F1BE9ED50F4E\\\"] }) { success } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Assigning an SLA to a snapshot

```graphql
mutation AssignSlaToSnapshot {
  assignRetentionSLAToSnapshots(
    snapshotFids: ["b77f85ae-62d1-435b-9abf-2a1d97c6802f"]
    globalSlaAssignType: protectWithSlaId
    globalSlaOptionalFid: "5b6e44ca-9a0d-42e8-a6ba-952159c69bab"
  ) {
    success
  }
}
```

```powershell
$query = New-RscMutation -GqlMutation assignRetentionSLAToSnapshots
$query.Var.snapshotFids = @("124a67b6-be5a-5181-9447-fac686bc9949")
$query.Var.globalSlaAssignType = [RubrikSecurityCloud.Types.SlaAssignTypeEnum]::PROTECT_WITH_SLA_ID
$query.Var.globalSlaOptionalFid = "5b6e44ca-9a0d-42e8-a6ba-952159c69bab"
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation AssignSlaToSnapshot { assignRetentionSLAToSnapshots( snapshotFids: [\\\"b77f85ae-62d1-435b-9abf-2a1d97c6802f\\\"] globalSlaAssignType: protectWithSlaId globalSlaOptionalFid: \\\"5b6e44ca-9a0d-42e8-a6ba-952159c69bab\\\" ) { success } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Creating an SLA Domain

SLA domains can range from simple to very complex policy definitions.

```graphql
mutation createSla {
  createGlobalSla(input: {
    name: "foo"
    objectTypes: [VSPHERE_OBJECT_TYPE MSSQL_OBJECT_TYPE]
    snapshotSchedule: {
      daily: {
        basicSchedule: {
          frequency: 1
          retention: 7
          retentionUnit: DAYS
        }
      }
    }
  }) {
    name
    id
  }
}
```

```powershell
$dailySchedule = New-RscSlaSnapshotSchedule -Type daily -Frequency 1 -Retention 2 -RetentionUnit DAYS
New-RscSla -name "foo" -DailySchedule $dailySchedule -ObjectType VSPHERE_OBJECT_TYPE,MSSQL_OBJECT_TYPE
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation createSla { createGlobalSla(input: { name: \\\"foo\\\" objectTypes: [VSPHERE_OBJECT_TYPE MSSQL_OBJECT_TYPE] snapshotSchedule: { daily: { basicSchedule: { frequency: 1 retention: 7 retentionUnit: DAYS } } } }) { name id } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Modifying an SLA Domain

Modification of an SLA requires the entire SLA object to be passed in to the mutation. If every property is not passed in, the SLA update will either fail, or will be updated with only the portions of the object that were passed in to the update arguments.

```graphql
mutation createSla {
  updateGlobalSla(input: {
    id: "2794261b-0e3b-4eab-8a32-f1ce4579e8c7"
    name: "foo"
    objectTypes: [VSPHERE_OBJECT_TYPE MSSQL_OBJECT_TYPE]
    description: "This is my foo SLA Domain"
    snapshotSchedule: {
      daily: {
        basicSchedule: {
          frequency: 1
          retention: 7
          retentionUnit: DAYS
        }
      }
    }
  }) {
    name
    id
  }
}
```

```powershell
$sla = Get-RscSla "foo"
$sla | Set-RscSla -Description "This is my foo SLA"
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation createSla { updateGlobalSla(input: { id: \\\"2794261b-0e3b-4eab-8a32-f1ce4579e8c7\\\" name: \\\"foo\\\" objectTypes: [VSPHERE_OBJECT_TYPE MSSQL_OBJECT_TYPE] description: \\\"This is my foo SLA Domain\\\" snapshotSchedule: { daily: { basicSchedule: { frequency: 1 retention: 7 retentionUnit: DAYS } } } }) { name id } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

In Rubrik, snapshots are a point-in-time copy of data, coupled with metadata. Snapshots can be managed by an SLA Domain, ahearing to the policy's archival, replication, and retention rules. Snapshot's can also be unmanaged, which means they are not tied to a specific policy, and retained forever.

## Retrieving Snapshots for a Workload

When retrieving snapshots for a workload, use that workload's RSC `id`. If using `snappableConnection` to list objects, use the `fid` field from the query. In the case of MSSQL databases, you must use the `dagId` from the MSSQL database object.

```graphql
query {
  snapshotOfASnappableConnection(
    workloadId: "123e4567-e89b-12d3-a456-426614174000"
  ) {
    nodes {
      id
      date
      isIndexed
      isOnDemandSnapshot
      isQuarantined
      isAnomaly
      isExpired
      expirationDate
      ...on CdmSnapshot {
        isRetentionLocked
        legalHoldInfo {
          shouldHoldInPlace
        }
        snapshotRetentionInfo {
          localInfo {
            isSnapshotPresent
            isExpirationDateCalculated
            expirationTime
          }
          archivalInfos {
            isSnapshotPresent
            isExpirationDateCalculated
            expirationTime
          }
          replicationInfos {
            isSnapshotPresent
            isExpirationDateCalculated
            expirationTime
          }
        }
        fileCount
        consistencyLevel
      }
      ...on PolarisSnapshot {
        snapshotRetentionInfo {
          localInfo {
            isSnapshotPresent
            isExpirationDateCalculated
            expirationTime
          }
          archivalInfos {
            isSnapshotPresent
            isExpirationDateCalculated
            expirationTime
          }
          replicationInfos {
            isSnapshotPresent
            isExpirationDateCalculated
            expirationTime
          }
        }
        polarisConsistencyLevel: consistencyLevel
      }
    }
  }
}
```

```powershell
Get-RscVmwareVm -Name "example" | Get-RscSnapshot
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { snapshotOfASnappableConnection( workloadId: \\\"123e4567-e89b-12d3-a456-426614174000\\\" ) { nodes { id date isIndexed isOnDemandSnapshot isQuarantined isAnomaly isExpired expirationDate ...on CdmSnapshot { isRetentionLocked legalHoldInfo { shouldHoldInPlace } snapshotRetentionInfo { localInfo { isSnapshotPresent isExpirationDateCalculated expirationTime } archivalInfos { isSnapshotPresent isExpirationDateCalculated expirationTime } replicationInfos { isSnapshotPresent isExpirationDateCalculated expirationTime } } fileCount consistencyLevel } ...on PolarisSnapshot { snapshotRetentionInfo { localInfo { isSnapshotPresent isExpirationDateCalculated expirationTime } archivalInfos { isSnapshotPresent isExpirationDateCalculated expirationTime } replicationInfos { isSnapshotPresent isExpirationDateCalculated expirationTime } } polarisConsistencyLevel: consistencyLevel } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Assigning an SLA to a Snapshot

```graphql
mutation {
  assignRetentionSLAToSnapshots(
    snapshotFids: ["b77f85ae-62d1-435b-9abf-2a1d97c6802f"]
    globalSlaAssignType: protectWithSlaId
    globalSlaOptionalFid: "5b6e44ca-9a0d-42e8-a6ba-952159c69bab"
  ) {
    success
  }
}
```

```powershell
$query = New-RscMutation -GqlMutation assignRetentionSLAToSnapshots
$query.Var.globalSlaAssignType = [RubrikSecurityCloud.Types.SlaAssignTypeEnum]::PROTECT_WITH_SLA_ID
$query.Var.snapshotFids = @("124a67b6-be5a-5181-9447-fac686bc9949")
$query.Var.globalSlaOptionalFid = "123e4567-e89b-12d3-a456-426614174000"
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation { assignRetentionSLAToSnapshots( snapshotFids: [\\\"b77f85ae-62d1-435b-9abf-2a1d97c6802f\\\"] globalSlaAssignType: protectWithSlaId globalSlaOptionalFid: \\\"5b6e44ca-9a0d-42e8-a6ba-952159c69bab\\\" ) { success } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Placing a Snapshot on Legal Hold

```graphql
mutation {
  createLegalHold(input: {
    snapshotIds: ["123e4567-e89b-12d3-a456-426614174000"]
    holdConfig: { shouldHoldInPlace: true }
    userNote: "Example"
  }) {
    snapshotIds
  }
}
```

```powershell
$query = New-RscMutation -gqlMutation createLegalHold -AddField SnapshotIds
$query.var.input = Get-RscType -name CreateLegalHoldInput
$query.var.input.SnapshotIds = @("123e4567-e89b-12d3-a456-426614174000")
$query.var.input.HoldConfig = Get-RscType -Name HoldConfig
$query.var.input.HoldConfig.ShouldHoldInPlace = $true
$query.var.input.UserNote = "Example"
$query.invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation { createLegalHold(input: { snapshotIds: [\\\"123e4567-e89b-12d3-a456-426614174000\\\"] holdConfig: { shouldHoldInPlace: true } userNote: \\\"Example\\\" }) { snapshotIds } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Deleting Unmanaged Snapshots

Unmanaged snapshots have no policy and will be retained forever until deleted. A snapshot is an unmanaged or "forever" if `isExpirationDateCalculated` is *true* and `expirationTime` is *null*.

```graphql
mutation {
  deleteUnmanagedSnapshots(input: {
    snapshotIds: ["124a67b6-be5a-5181-9447-fac686bc9949"]
  }) {
    success
  }
}
```

```powershell
$query = New-RscMutation -GqlMutation deleteUnmanagedSnapshots
$query.var.input = Get-RscType -Name DeleteUnmanagedSnapshotsInput
$query.var.input.SnapshotIds = @("124a67b6-be5a-5181-9447-fac686bc9949")
$query.Invoke()
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="mutation { deleteUnmanagedSnapshots(input: { snapshotIds: [\\\"124a67b6-be5a-5181-9447-fac686bc9949\\\"] }) { success } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## [Events](Events/)

Events are state changes within Rubrik. Events can be as simple as a successful backup, or as serious as a ransomware anomaly detected within data protected by Rubrik. Events can be obtained through an API query, or streamed to an external system via webhooks.

## [Metrics](Metrics/)

Various metrics can be obtained on the Rubrik platform for capacity management, chargeback, compliance status, and more.

### Retrieving Events via API Query

```graphql
query {
  activitySeriesConnection(filters: {
    #lastUpdatedTimeGt: "2025-02-22T00:00:00Z"
    #orgIds: ["288970b2-16a0-4c65-a5fa-b0c86f5af337"]
    #lastActivityType: [BACKUP]
    #objectType: [VMWARE_VM,LINUX_FILESET]
    #severity: [SEVERITY_CRITICAL,SEVERITY_WARNING,SEVERITY_INFO]
    #lastActivityStatus: [SUCCESS,PARTIAL_SUCCESS,FAILURE,CANCELED]
  }) {
    nodes {
      fid
      id
      objectName
      objectType
      lastActivityType
      lastActivityMessage
      severity
      lastUpdated
      objectId
      location
      progress
      failureReason
      causeErrorCode
      causeErrorMessage
      causeErrorReason
      causeErrorRemedy
      activityConnection(first: 1) { # Gets the last activity in the activitySeries
        nodes {
          objectId
          objectType
          type
          status
          message
          errorInfo
          time
        }
      }
    }
    pageInfo {
      hasNextPage
      endCursor
    }
  }
}
```

```powershell
Get-RscEventSeries
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { activitySeriesConnection(filters: { }) { nodes { fid id objectName objectType lastActivityType lastActivityMessage severity lastUpdated objectId location progress failureReason causeErrorCode causeErrorMessage causeErrorReason causeErrorRemedy activityConnection(first: 1) { nodes { objectId objectType type status message errorInfo time } } } pageInfo { hasNextPage endCursor } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

### Pushing Events Using Webhooks

Webhooks provide a mechanism to push events via HTTP to an external system. Webhooks contain a JSON payload with details about the event.

The following is an example webhook of a Rubrik event in the default format. For more detailed information on Rubrik webhooks, see the [RSC User Guide](https://docs.rubrik.com/en-us/saas/saas/common/webhooks.html)

default webhook payload example

```json
{
   "summary":"Failed backup of vSphere VM 'sh1-EncryptMe-05-Group1'.",
   "source":"Rubrik Security Cloud",
   "severity":"critical",
   "timestamp":"2024-07-18T06:39:40.46Z",
   "class":"Backup",
   "custom_details":{
      "seriesId":"ccd7a8a5-4c58-4c88-bff9-7bdffddb6099",
      "id":"c2b47274-6323-4025-b307-afed1cfb7574",
      "type":"Event",
      "objectId":"83c4a80a-4a57-5699-b399-651089135586",
      "objectName":"sh1-EncryptMe-05-Group1",
      "objectType":"VmwareVm",
      "status":"Failure",
      "clusterId":"6a271636-9392-4cba-90c5-bdbe227854ab",
      "clusterName":"sh1-PaloAlto",
      "eventName":"Snapshot.BackupFailed",
      "errorId":"Snapshot.VmwareSnapshotError",
      "errorCode":"",
      "errorRemedy":"",
      "errorReason":"",
      "auditUserName":"",
      "auditUserId":"",
      "location":"sh1-paloalto-vcsa.rubrikdemo.com",
      "url":"",
      "customerID":"rubrik-gaia",
      "logicalSizeInBytes":"",
      "dataTransferredInBytes":"",
      "effectiveThroughput":""
   }
}
```

## anomaly

______________________________________________________________________

EncryptionNotRunAnomalyDetectedInfo

```text
Detected anomalous filesystem activity with ${confidence} confidence (File Change: ${filesCreatedCount} Added, ${filesModifiedCount} Modified, ${filesRemovedCount} Removed)
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

EncryptionNotRunAnomalyDetectedWarning

```text
Detected anomalous filesystem activity with ${confidence} confidence (File Change: ${filesCreatedCount} Added, ${filesModifiedCount} Modified, ${filesRemovedCount} Removed)
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

RansomwareStrainDetected

```text
Detected potential ransomware strain \"${strainName}\" with ${confidence} and ${encryptionLevel} levels of encryption (File Change: ${filesCreatedCount} Added, ${filesModifiedCount} Modified, ${filesRemovedCount} Removed)
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskSuccess** | **No** |

RansomwareStrainDetectedWarning

```text
Detected potential ransomware strain \"${strainName}\" with ${confidence} (File Change: ${filesCreatedCount} Added, ${filesModifiedCount} Modified, ${filesRemovedCount} Removed)
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

SnappableElevatedEncryption

```text
Detected anomalous filesystem activity with ${confidence} confidence and high levels of encryption (File Change: ${filesCreatedCount} Added, ${filesModifiedCount} Modified, ${filesRemovedCount} Removed)
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

SnappableElevatedEncryptionWithSuspiciousFilesInfo

```text
Detected anomalous filesystem activity with ${confidence} confidence and high levels of encryption (File Change: ${filesCreatedCount} Added, ${filesModifiedCount} Modified, ${filesRemovedCount} Removed, ${filesSuspiciousCount} Suspicious)
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

SnappableHighBasicEncryption

```text
Detected significant indication of encrypted files.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

SnappableLowBasicEncryption

```text
Detected little to no indication of encrypted files.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SnappableLowEncryptionInfo

```text
Detected anomalous filesystem activity with ${confidence} confidence and low levels of encryption (File Change: ${filesCreatedCount} Added, ${filesModifiedCount} Modified, ${filesRemovedCount} Removed)
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SnappableLowEncryptionWarning

```text
Detected anomalous filesystem activity with ${confidence} confidence and low levels of encryption (File Change: ${filesCreatedCount} Added, ${filesModifiedCount} Modified, ${filesRemovedCount} Removed)
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

VMHostAnomalyDetected

```text
Detected anomalous activity on ${snappableName} (${vmCount} Virtual Machines affected)
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

## testevent

______________________________________________________________________

TestMinimal

```text
This is test event.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

## authz

______________________________________________________________________

AccountOwnershipAssigned

```text
${userEmail} assigned account ownership to ${targetUser}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AccountOwnershipRevoked

```text
${userEmail} revoked account ownership from ${targetUser}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AdminRequestedPasswordChange

```text
${userName} initiated a mandatory password reset for ${userNames}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AllRolesDeassignedFromUser

```text
${userName} removed all role assignments from the user ${targetUser}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AllRolesDeassignedFromUserGroup

```text
${userEmail} revoked all roles from user group ${groupName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AuthorizedUserGroupsToOrg

```text
${userEmail} authorized user groups in organization ${orgName}: ${userGroupNames}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

HideUser

```text
${userName} updated the hidden status to ${hiddenStatus} for ${targetUserName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

OrgCreated

```text
${userEmail} created organization ${orgName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

OrgCreationFailed

```text
${userEmail} failed to create organization ${orgName}, Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

OrgDeleted

```text
${userEmail} deleted organization ${orgName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

OrgDeletionFailed

```text
${userEmail} failed to delete organization ${orgName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

OrgInviteEmailsFailedToSend

```text
Unable to send user invite emails for organization ${orgName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

OrgUpdated

```text
${userEmail} modified organization ${orgName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

OrgUpdateFailed

```text
${userEmail} modified organization ${orgName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

PasswordComplexityPolicyUpdated

```text
${userName} updated the password policy (${changedPolicies}) for the ${orgName} organization.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PasswordComplexityPolicyUpdateFailed

```text
${userName} failed to update the password policy for the ${orgName} organization.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

RoleAssignedToUser

```text
${userEmail} updated the assigned roles for ${principalType} ${principal} from ${previousRoles} to ${currentRoles}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RoleAssignedToUserGroup

```text
${userEmail} updated the assigned roles for SSO group ${principal} from ${previousRoles} to ${currentRoles}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RoleAssignmentToUserFailed

```text
${userEmail} failed to change role of ${targetUser} to ${role}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RoleAssignmentToUserGroupFailed

```text
${userEmail} failed to change role of user group ${groupName} to ${role}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

RoleCreated

```text
${userEmail} created role ${role}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RoleCreationFailed

```text
${userEmail} failed to create role ${role}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

RoleDeassignedFromUser

```text
${userEmail} revoked role ${role} from user ${targetUser}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RoleDeassignedFromUserGroup

```text
${userEmail} revoked role ${role} from user group ${groupName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RoleDeleted

```text
${userEmail} deleted sync ${syncStatus} role ${role}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RoleDeletionFailed

```text
${userEmail} failed to delete role ${role}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

RoleSyncUpdated

```text
${userEmail} modified role ${origRole}${role} and  ${updatedSyncStatus} syncing for the role to CDM clusters.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RoleUpdated

```text
${userEmail} modified role ${origRole}${role}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RoleUpdateFailed

```text
${userEmail} failed to modify role ${role}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

ServiceAccountCreated

```text
${actorSubjectName} created service account ${targetSubjectName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ServiceAccountCreationFailed

```text
${actorSubjectName} failed to create service account ${targetSubjectName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

ServiceAccountDeleted

```text
${actorSubjectName} deleted service account ${targetSubjectName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ServiceAccountDeletionFailed

```text
${actorSubjectName} failed to delete service account ${targetSubjectName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

ServiceAccountDeletionPreparationFailed

```text
${actorSubjectName} tried to start a delete request on ${count} service accounts. The preparation for the deletion failed. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

ServiceAccountSecretRotated

```text
${actorSubjectName} rotated the secret of the service account ${targetSubjectName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ServiceAccountSecretRotationFailed

```text
${actorSubjectName} failed to rotate the secret of the service account ${targetSubjectName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

ServiceAccountUpdated

```text
${actorSubjectName} udpated service account ${targetSubjectName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ServiceAccountUpdateFailed

```text
${actorSubjectName} failed to update service account ${targetSubjectName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

SSOUserCreated

```text
${userName} created SSO user, ${targetUserName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SSOUserCreationFailed

```text
${userName} failed to create SSO user, ${targetUserName}.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

SyncedRoleCreated

```text
${userEmail} created role ${role} and enabled syncing for the role to CDM clusters.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdatedUserGroupsInOrg

```text
${userEmail} updated user groups in organization ${orgName}: ${userGroupNames}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UserChangedOtherUserPassword

```text
${userName} changed the password for user ${targetUser}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UserChangeOtherUserPasswordFailed

```text
${userName} failed to change the password for user ${targetUser}.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

UserCreated

```text
User ${userEmail} was created.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UserCreationFailed

```text
User ${userEmail} failed to create.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

UserDeleted

```text
${actorUserEmail} deleted user ${targetUserEmail}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UserDeletionFailed

```text
${actorUserEmail} failed to delete user ${targetUserEmail}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

UserDeletionPreparationFailed

```text
${actorUserEmail} tried to start a delete request on ${count} users. The preparation for the deletion failed. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

UserGroupDeleted

```text
${actorUserName} deleted role group mapping ${groupName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UserGroupDeletionFailed

```text
${actorUserName} was unable to delete role group mapping ${groupName}.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

UserInvited

```text
${actorUserEmail} invited user ${targetUserEmail}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## classification_settings

______________________________________________________________________

DisabledClassificationBanner

```text
${actorUserEmail} disabled the classification banners successfully.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DisabledLoginBanner

```text
${actorUserEmail} disabled the login classification modal successfully.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EnabledClassificationBanner

```text
${actorUserEmail} enabled the classification banners successfully.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EnabledLoginBanner

```text
${actorUserEmail} enabled the login classification modal successfully.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateClassificationBanner

```text
${actorUserEmail} updated the classification banners successfully.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateLoginBanner

```text
${actorUserEmail} updated the login classification modal successfully.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## federated_access

______________________________________________________________________

SetCDMInventoryDisabledSucceeded

```text
${actorUserEmail} disabled the Display Rubrik CDM inventory in Polaris successfully.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SetCDMInventoryEnabledFailed

```text
${actorUserEmail} failed to change the Display Rubrik CDM inventory in Polaris. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

SetCDMInventoryEnabledSucceeded

```text
${actorUserEmail} enabled the Display Rubrik CDM inventory in Polaris successfully.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SetFederatedAccessDisabledSucceeded

```text
${actorUserEmail} disabled the Rubrik CDM federated access successfully.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SetFederatedAccessEnabledFailed

```text
${actorUserEmail} failed to change the Rubrik CDM federated access. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

SetFederatedAccessEnabledSucceeded

```text
${actorUserEmail} enabled the Rubrik CDM federated access successfully.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## mfa

______________________________________________________________________

MaxPasskeysChanged

```text
${username} has changed the maximum allowed passkeys from ${prevValue} to ${newValue}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

MfaRememberDisable

```text
${username} disabled Rubrik Two-Step Verification to remember device.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

MfaRememberHoursUpdate

```text
${username} updated Rubrik Two-Step Verification to remember device from ${initialHours} to ${hours} hours.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PasskeyAdded

```text
${username} has added ${type} passkey ${passkeyName} for MFA.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PasskeyDeleted

```text
${username} has deleted ${type} passkey ${passkeyName} for MFA.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PasskeysAllowed

```text
${username} has enabled passkeys for the account.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PasskeysDisallowed

```text
${username} has disabled passkeys for the account.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PasskeyTypeAllowed

```text
${username} has enabled ${passkeyType} passkeys for the account.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PasskeyTypeDisallowed

```text
${username} has disabled ${passkeyType} passkeys for the account.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PasswordlessLoginDisabled

```text
${username} has disabled passwordless login for the account.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PasswordlessLoginEnabled

```text
${username} has enabled passwordless login for the account.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TotpGlobalEnforce

```text
${username} set Rubrik Two-Step Verification enforced globally.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TotpGlobalUnenforce

```text
${username} set Rubrik Two-Step Verification not enforced globally.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Success** | **Yes** |

TotpLdapEnforce

```text
${username} set Rubrik Two-Step Verification enforced on LDAP domain ${ldapName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TotpLdapUnenforce

```text
${username} set Rubrik Two-Step Verification not enforced on LDAP domain ${ldapName}.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Success** | **Yes** |

TotpReconfigure

```text
${username} reconfigured Rubrik Two-Step Verification.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TotpReminderDisable

```text
${username} disabled Rubrik Two-Step Verification reminder.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Success** | **Yes** |

TotpReminderHoursUpdate

```text
${username} updated the Rubrik Two-Step Verification reminder frequency from every ${initialHours} hours to once every ${hours} hours.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TotpReset

```text
${username} disabled Rubrik Two-Step Verification for  ${targetUsername}.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Success** | **Yes** |

TotpSetup

```text
${username} enabled Rubrik Two-Step Verification.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TotpUserLevelEnforce

```text
${username} set Rubrik Two-Step Verification enforced for ${targetUsername}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TotpUserLevelUnenforce

```text
${username} set Rubrik Two-Step Verification not enforced for ${targetUsername}.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Success** | **Yes** |

## moat

______________________________________________________________________

AddIPWhitelistEntries

```text
${actorUserEmail} added new addresses, (${newIpCidrs}), to IP allowlist.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteIPWhitelistEntries

```text
${actorUserEmail} deleted addresses, (${deletedIpCidrs}), from IP allowlist.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Success** | **Yes** |

FailedAPICallDueToIPViolation

```text
${api_name} failed to execute as it was accessed from an  unauthorized IP address ${ip_address} for the ${user_domain} ${username}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

SetIPWhitelistSetting

```text
${actorUserEmail} updated IP allowlist settings to (enabled: ${newEnabled}, mode: ${newMode}).
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Success** | **Yes** |

SetWhitelistDisabledSucceeded

```text
${actorUserEmail} disabled the IP whitelist successfully.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SetWhitelistEnabledFailed

```text
${actorUserEmail} failed to change the IP whitelist enforcement. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

SetWhitelistEnabledSucceeded

```text
${actorUserEmail} enabled the IP whitelist successfully.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateIPWhitelistEntry

```text
${actorUserEmail} updated an entry in the IP allowlist from (ip: ${oldIpCidr}, description: ${oldDescription}) to (ip: ${newIpCidr}, description: ${newDescription}).
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateWhitelistFailed

```text
${actorUserEmail} failed to update IP whitelist. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

UpdateWhitelistSucceeded

```text
${actorUserEmail} updated IP whitelist successfully.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## userlockout

______________________________________________________________________

AutoUnlocked

```text
User account for ${username} has been auto-unlocked.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

LockedByAdmin

```text
${username} has been locked by administrator ${admin}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

LockedByBruteForce

```text
The user account for ${username} has been locked due to multiple  failed login attempts.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Success** | **Yes** |

LockedDueToInactivity

```text
${username} has been locked due to inactivity.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

LockedDueToLeakedPassword

```text
User ${email}'s account was locked because the account is at risk of being compromised.  The account credentials were found to have been compromised in another vendors security breach.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Success** | **Yes** |

LockoutConfigChanged

```text
${admin} updated the account lockout configuration, (${changedConfigs}), for the ${orgName} organization.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UnlockedByAdmin

```text
${username} has been unlocked by administrator ${admin}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UnlockedBySupport

```text
${username} has been unlocked by Rubrik Support.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## awsnative

______________________________________________________________________

AwsNativeArchiveDBSnapshotTaskFailed

```text
Failed to upload the database snapshot to the ${targetBucketName}  bucket of ${targetLocation} location. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeArchiveDBSnapshotTaskStarted

```text
Uploading the database snapshot to the ${targetBucketName} bucket of  ${targetLocation} location.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeArchiveDBSnapshotTaskSucceeded

```text
Successfully archived database snapshot taken at ${snapshotTimeDisplay} to the ${targetBucketName} bucket of ${targetLocation} location.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeArchiveSnapshotJobFailed

```text
Failed to archive ${uploadType} snapshot taken at ${snapshotTimeDisplay} of the ${snappableDisplay} to the ${targetBucketName} bucket of ${targetLocation} location. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsNativeArchiveSnapshotJobSucceeded

```text
Successfully archived ${uploadType} snapshot taken at ${snapshotTimeDisplay} of the ${snappableDisplay} to the ${targetBucketName} bucket of ${targetLocation} location. Processed ${dataTransferredFromSource} of data and uploaded  ${dataUploadedToDestination} (compressed) to Archival Location.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsNativeArchiveSnapshotTaskFailed

```text
Failed to upload the snapshot to the ${targetBucketName} bucket of ${targetLocation} location. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeArchiveSnapshotTaskStarted

```text
Uploading the snapshot to the ${targetBucketName} bucket of ${targetLocation} location.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

## azurenative

______________________________________________________________________

AzureNativeArchiveSnapshotJobFailed

```text
Failed to archive ${uploadType} snapshot taken at  ${snapshotTimeDisplay} of the ${snappableDisplay} to the  ${targetContainerName} container in ${storageAccountName} storage  account of ${targetLocation} location. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureNativeArchiveSnapshotJobSucceeded

```text
Successfully archived ${uploadType} snapshot taken at ${snapshotTimeDisplay} of the ${snappableDisplay} to the ${targetContainerName} container in ${storageAccountName}  storage account of ${targetLocation} location. Processed  ${dataTransferredFromSource} of data and uploaded  ${dataUploadedToDestination} (compressed) to Archival Location.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureNativeArchiveSnapshotTaskFailed

```text
Failed to upload the snapshot to the ${targetContainerName} container in ${storageAccountName} storage account of ${targetLocation} location. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeArchiveSnapshotTaskStarted

```text
Uploading the snapshot to the ${targetContainerName} container in ${storageAccountName} storage account of ${targetLocation} location.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

## cloudnative

______________________________________________________________________

CloudNativeArchiveSnapshotJobCanceled

```text
Canceled archival of snapshot of the ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

CloudNativeArchiveSnapshotJobCanceling

```text
Canceling archival of snapshot of the ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

CloudNativeArchiveSnapshotJobFailed

```text
Failed to archive snapshot of the ${snappableDisplay}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudNativeArchiveSnapshotJobStarted

```text
Started archival of ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeArchiveSnapshotJobSucceededNoSnapshotFound

```text
No snapshot found for ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudNativeArchiveSnapshotPrepareTaskFailed

```text
Failed to archive snapshot of the ${snappableDisplay}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeArchiveSnapshotPrepareTaskStarted

```text
Starting archival of snapshot for the ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeArchiveSnapshotPrepareTaskSucceeded

```text
Started archival of the snapshot taken at ${snapshotTimeDisplay} of the ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeArchiveSnapshotTaskSucceeded

```text
Uploaded the snapshot to archival location.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeArchiveSnapshotWaitForIndexSnapshotTaskFailed

```text
Failed to index the snapshot.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeArchiveSnapshotWaitForIndexSnapshotTaskStarted

```text
Waiting for snapshot to be indexed.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeArchiveSnapshotWaitForIndexSnapshotTaskSucceeded

```text
Snapshot has successfully been indexed.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeDeleteExportedDatabaseTaskFailed

```text
Failed to delete ${numExportedDatabases} temporary databases in region ${exportedDBRegion}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeDeleteExportedDatabaseTaskStarted

```text
Deleting ${numExportedDatabases} temporary databases in region ${exportedDBRegion}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeDeleteExportedDatabaseTaskSucceeded

```text
Successfully deleted ${numExportedDatabases} temporary databases in region ${exportedDBRegion}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeExportDatabaseTaskFailed

```text
Failed to create ${numExportedDatabases} temporary databases in region ${exportedDBRegion}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeExportDatabaseTaskStarted

```text
Creating temporary databases.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeExportDatabaseTaskSucceeded

```text
Successfully created ${numExportedDatabases} temporary databases in region ${exportedDBRegion}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeImmediatelyScheduleMaintainedJobTaskFailed

```text
Failed to trigger ${ImmediatelyScheduleMaintainedJobDisplay}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeImmediatelyScheduleMaintainedJobTaskStarted

```text
Waiting for ${ImmediatelyScheduleMaintainedJobDisplay} to be triggered.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeImmediatelyScheduleMaintainedJobTaskSucceeded

```text
Successfully triggered ${ImmediatelyScheduleMaintainedJobDisplay}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeImmediatelyScheduleMaintainedJobTaskSucceededWithError

```text
Triggered ${ImmediatelyScheduleMaintainedJobDisplay} with error ${ignoredError}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

CloudNativeLaunchEmptyDiskTaskFailed

```text
Failed to launch scratch ${diskTypeDisplay}(s).
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeLaunchEmptyDiskTaskStarted

```text
Temporarily launching scratch ${diskTypeDisplay}(s) in region ${region}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeLaunchEmptyDiskTaskSucceeded

```text
Launched scratch ${diskTypeDisplay}(s) in region ${region}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeOnDemandJobTaskFailed

```text
Failed to perform ${onDemandJobDisplay}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeOnDemandJobTaskStarted

```text
Waiting for ${onDemandJobDisplay} to complete.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeOnDemandJobTaskSucceeded

```text
Successfully completed ${onDemandJobDisplay}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeOnDemandJobTaskSucceededWithError

```text
Completed ${onDemandJobDisplay} with error ${ignoredError}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

CloudNativeOnDemandJobTaskWithoutWaitSucceeded

```text
Successfully triggered ${onDemandJobDisplay}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeOnDemandJobTaskWithoutWaitSucceededWithError

```text
Failed to trigger ${onDemandJobDisplay} with error ${ignoredError}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativePublishArchiveDBSnapshotTaskProgress

```text
Archival in progress: ${numTablePartitions} out of total ${totalTablePartitions} table partitions successfully archived.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

## gcpnative

______________________________________________________________________

GCPNativeArchiveSnapshotJobFailed

```text
Failed to archive ${uploadType} snapshot taken at ${snapshotTimeDisplay} of the ${snappableDisplay} to the ${targetBucketName} bucket of ${targetLocation} location. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

GCPNativeArchiveSnapshotJobSucceeded

```text
Successfully archived ${uploadType} snapshot taken at  ${snapshotTimeDisplay} of the ${snappableDisplay} to the  ${targetBucketName} bucket of ${targetLocation} location. Processed ${dataTransferredFromSource} of data and uploaded  ${dataUploadedToDestination} (compressed) to Archival Location.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

GCPNativeArchiveSnapshotTaskFailed

```text
Failed to upload the snapshot to the ${targetBucketName} bucket of ${targetLocation} location. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

GCPNativeArchiveSnapshotTaskStarted

```text
Uploading the snapshot to the ${targetBucketName} bucket   of ${targetLocation} location.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

## rcv

______________________________________________________________________

RCVDataDeletionSuccess

```text
Pursuant to Rubrik policy, data associated with the deleted RCV storage  location '${name}' has been successfully deleted.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## accountmanagement

______________________________________________________________________

ActiveDirectoryForestTransitionCompleted

```text
${username} transitioned from Domain view to Forest view.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

BrandLogoDeleted

```text
Brand logo was deleted.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

BrandLogoDeleteFailed

```text
Unable to delete brand logo. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

BrandLogoUpdated

```text
Brand logo or logo URL was updated.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

BrandLogoUpdateFailed

```text
Unable to update brand logo or logo URL. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DigestListEmailDeleted

```text
${userEmail} deleted custom event digest, ${digestListName}, which sent emails to ${emailAddressList}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DigestListEmailUpdated

```text
${userEmail} saved custom event digest, ${digestListName}, which sends emails to ${emailAddressList}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EulaAccepted

```text
${userEmail} accepted the EULA.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PactsafeEulaAccepted

```text
${userEmail} accepted the Rubrik End User Licence Agreement.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PactsafeEulaSnoozed

```text
${userEmail} snoozed the Rubrik End User Licence Agreement for ${numDays} days.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpgradeToRSCFailure

```text
${userEmail} has failed to upgrade the account to RSC at ${upgradeTime}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpgradeToRSCSuccess

```text
${userEmail} has upgraded the account to RSC at ${upgradeTime}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UrlChangeSuccess

```text
The RSC URL has been changed from ${oldUrl} to ${newUrl}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## cdm_rbac_migration

______________________________________________________________________

DownloadCdmRbacSummaryStarted

```text
${username} started a job to download the CDM RBAC summary from ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DownloadCdmRbacSummaryStartFailed

```text
${username} failed to start a job to download the CDM RBAC summary from ${clusterName}.  Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

FetchCDMRbacConfigStarted

```text
${username} started a job to fetch the CDM RBAC configurations from ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

FetchCDMRbacConfigStartFailed

```text
${username} failed to start a job to fetch the CDM RBAC configurations from ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

MigrateCDMRbacConfigStarted

```text
${username} started a job to migrate the CDM RBAC configurations from ${clusterName} to RSC.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

MigrateCDMRbacConfigStartFailed

```text
${username} failed to start a job to migrate the CDM RBAC configurations from ${clusterName} to  RSC. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## chatbot

______________________________________________________________________

CreatedChatbot

```text
${userEmail} created chatbot ${chatbotName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeletedChatbot

```text
${userEmail} deleted the chatbot, ${chatbotName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdatedChatbotNoNameChange

```text
${userEmail} updated chatbot. Name unchaged: ${chatbotName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdatedChatbotWithNameChange

```text
${userEmail} updated chatbot. Renamed from ${oldChatbotName} to ${newChatbotName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## cloudaccounts

______________________________________________________________________

AzureSqlServerCreateSuccessful

```text
Successfully created Azure SQL Server ${sqlServerName} in resource group ${resourceGroupName} in subscription ${subscriptionNativeID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AzureSqlServerDeleteSuccessful

```text
${userName} successfully deleted Azure SQL Server ${sqlServerName} in resource group ${resourceGroupName} in subscription ${subscriptionNativeID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AzureSqlServerUpdateSuccessful

```text
Successfully updated Azure SQL Server ${sqlServerName} in resource group ${resourceGroupName} in subscription ${subscriptionNativeID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

BYOKExocomputeClusterConnectSuccessful

```text
${userEmail} successfully generated cluster setup YAML for Exocompute cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CloudaccountsPrivilegeDeEscalationSuccessful

```text
${userEmail} dropped a privilege escalation session for Tenant ${tenantDomain} with ID ${tenantNativeID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CloudaccountsPrivilegeEscalationSuccessful

```text
${userEmail} initiated a privilege escalation session for Tenant ${tenantDomain} with ID ${tenantNativeID}, using OAuth.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## fedramp

______________________________________________________________________

FedrampBoundaryExited

```text
${userEmail} acknowledged that they are exiting the FedRAMP boundary and navigated to ${link}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## integrations

______________________________________________________________________

CreateIntegration

```text
User ${userID} added '${integrationType}' integration.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CreateIntegrationFailed

```text
User ${userID} failed to add '${integrationType}' integration.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

DeleteIntegration

```text
User ${userID} deleted '${integrationType}' integration.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteIntegrationFailed

```text
Deletion of '${integrationType}' integration by ${userID} failed.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

EnableIntegration

```text
${userID} enabled the '${integrationType}' integration.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## o365

______________________________________________________________________

M365AzureADAppAdded

```text
${userName} added a new authenticated Azure AD app with ID: ${appID} of type ${workloadType} for M365 tenant with ID: ${m365TenantID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

M365AzureADAppDeleted

```text
${userName} deleted the Azure AD app with ID: ${appID} of type ${workloadType} for M365.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

O365RestoreFailedItemsViewed

```text
${userID} viewed the restore failed items information of ${snappableType}  ${snappableName} corresponding to restore instance ID ${instanceID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SwitchWorkloadToOnboardingMode

```text
${userID} moved the ${workloadType} to onboarding mode.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## rkcli

______________________________________________________________________

RkcliCommandExec

```text
Admin executed '${command}' on the ${node} node from ${ip}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## saasapps

______________________________________________________________________

SaasAppsGetWorkloadTableRecords

```text
${userID} viewed object ${objectName} of type ${snappableType}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## sap_hana_database

______________________________________________________________________

CreateOnDemandSapHanaDataBackupFailed

```text
${username} failed to start a job to create an on-demand ${backupType} backup for SAP HANA database ${dbName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateOnDemandSapHanaDataBackupStarted

```text
${username} started a job to create an on-demand ${backupType} backup for SAP HANA database ${dbName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CrossRestoreSapHanaDatabaseToPointInTime

```text
${username} triggered a cross restore operation of SAP HANA database ${sourceDbName} restoring to the target database ${targetDbName}  at point in time ${pointInTime}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RestoreSapHanaDatabaseToFullBackup

```text
${username} triggered restore of SAP HANA database ${dbName} to full backup ${fullSnapshotId}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RestoreSapHanaDatabaseToPointInTime

```text
${username} triggered restore of SAP HANA database ${dbName} to point in time ${pointInTime}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## sap_hana_system

______________________________________________________________________

ConfigureRestoreSapHana

```text
${username} configured restore on the SAP HANA ${systemName} system. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RestoreSapHanaStorageSnapshotFailure

```text
${username} unable to trigger a disk restore using storage snapshot with ${snapshotId} ID of SAP HANA ${systemName} system. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RestoreSapHanaStorageSnapshotStarted

```text
${username} triggered a disk restore using storage snapshot with ${snapshotId} ID of SAP HANA ${systemName} system.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UnconfigureRestoreSapHana

```text
${username} reset the restore configuration on the SAP HANA ${systemName} system. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## sessionmanagement

______________________________________________________________________

CreateOrgSwitchSessionFailure

```text
${userEmail} failed to switch to organization ${orgName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateOrgSwitchSessionSuccess

```text
${userEmail} successfully switched to organization ${orgName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## snapshot

______________________________________________________________________

DeleteSnapshotsOfObject

```text
${username} deleted snapshots of snappable type '${snappableType}' with name '${objName}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteSnapshotsOfObjectFailed

```text
${username} failed to delete snapshots of snappable type '${snappableType}' with name '${objName}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## support_case

______________________________________________________________________

SupportCaseCreated

```text
${userEmail} created a support case with id: ${caseId}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SupportCaseModified

```text
${userEmail} modified the support case with id: ${caseId}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## tpr

______________________________________________________________________

TprExecuteComplete

```text
${username} completed executing Quorum Authorization request ${requestID} to ${description}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TprExecuteFail

```text
${username} was unable to execute Quorum Authorization request ${requestID} to ${description}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

TprPolicyDeleteFailed

```text
${username} was unable to delete the Quorum Authorization policy ${policyName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

TprPolicyUpdateFailed

```text
${username} was unable to update the Quorum Authorization policy ${policyName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

TprStatusChange

```text
${username} updated the status to ${status} for the Quorum Authorization request, ${requestID}, to ${description}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## trial

______________________________________________________________________

TrialActivationStarted

```text
${userEmail} has started activation of the ${trialType} trial.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TrialDismissed

```text
${userEmail} dismissed the ${trialType} trial.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TrialInvite

```text
${invitorEmail} invited ${inviteeEmail} to join the ${trialType} trial.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TrialOnboardingComplete

```text
${userEmail} completed the setup for the ${trialType} trial.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TrialRefreshReports

```text
${userEmail} scheduled the refresh of the ${trialType} trial report.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TrialReportSharedFailure

```text
${userEmail} was unable to share the ${trialType} trial report with ${recipientEmail}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

TrialReportSharedSuccess

```text
${userEmail} successfully shared the ${trialType} trial report with ${recipientEmail}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## unmanaged_objects

______________________________________________________________________

SnapshotsDeletetionOnClusterProcessed

```text
${userEmail} successfully expired unmanaged snapshots ${snapshotIdList} of object ${objectName} on cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SnapshotsDeletetionOnPolarisProcessed

```text
${userEmail} successfully expired unmanaged snapshots ${snapshotIdList} on polaris.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SnapshotsOfObjectDeletionOnClusterProcessed

```text
${userEmail} successfully queued request to expire all unprotected snapshots of unmanaged objects ${objectNameList} on cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SnapshotsOfObjectDeletionOnPolarisProcessed

```text
${userEmail} successfully expired all unprotected snapshots of unmanaged objects ${objectNameList} on polaris.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## appflows

______________________________________________________________________

BulkRecoveryCanceledSuccessfully

```text
${userName} canceled ${bulkRecoveryType} recovery for  '${bulkRecoveryName}'with instance ID '${bulkRecoveryInstanceID}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

BulkRecoveryCancelFailed

```text
${userName} was unable to cancel ${bulkRecoveryType} recovery for  '${bulkRecoveryName}' with instance ID '${bulkRecoveryInstanceID}'.  Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

BulkRecoveryStartedSuccessfully

```text
${userName} successfully started ${inplaceRestoreUIName}  ${bulkRecoveryType} recovery for '${bulkRecoveryName}' with instance ID  '${bulkRecoveryInstanceID}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

BulkRecoveryStartFailed

```text
${userName} was unable to start ${inplaceRestoreUIName}  ${bulkRecoveryType} recovery for '${bulkRecoveryName}'.  Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## bulk_recovery

______________________________________________________________________

BulkRecoveryScheduled

```text
Scheduled a job to perform ${bulkRecoveryType} recovery (${recoveryType}) of plan ${planName}, instance ${bulkRecoveryInstanceID}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

MassRecoveryCanceled

```text
Canceled ${bulkRecoveryType} recovery (${recoveryType}) of plan ${planName}, instance ${bulkRecoveryInstanceID}.  Recovered workloads: ${numSuccessObjects},  Failed workloads: ${numFailedObjects}, Canceled workloads:  ${numCanceledObjects}, Workloads without snapshots: ${objectsWithoutSnapshot}, Total workloads: ${totalObjects}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

MassRecoveryChildRestoreFailed

```text
Unable to restore ${sourceUser} ${snappableType} data to ${destinationUser} as part of ${bulkRecoveryType} recovery of plan  ${planName}, instance ${bulkRecoveryInstanceID} because ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

MassRecoveryCompleted

```text
Completed ${bulkRecoveryType} recovery (${recoveryType}) of plan  ${planName}, instance ${bulkRecoveryInstanceID}.  Recovered workloads: ${numSuccessObjects},  Failed workloads: ${numFailedObjects}, Workloads without snapshots: ${objectsWithoutSnapshot}, Total workloads: ${totalObjects}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

MassRecoveryFailed

```text
Unable to perform ${bulkRecoveryType} recovery (${recoveryType}) of plan  ${planName}, instance ${bulkRecoveryInstanceID} because ${failureReason}. Recovered workloads: ${numSuccessObjects},  Failed workloads: ${numFailedObjects},  Workloads without snapshots: ${objectsWithoutSnapshot},  Total workloads: ${totalObjects}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

MassRecoveryProgress

```text
(Step 3/4) Progress metrics for plan ${planName}, instance  ${bulkRecoveryInstanceID} is Recovered workloads: ${numSuccessObjects}, Failed workloads: ${numFailedObjects}, Workloads without snapshots: ${objectsWithoutSnapshot}, InProgress workloads:  ${numInProgressObjects}, Total workloads: ${totalObjects}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

MassRecoveryTaskFailed

```text
${taskFailedDesc} for ${bulkRecoveryType} recovery of plan ${planName}, instance  ${bulkRecoveryInstanceID}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

MassRecoveryTaskStarted

```text
${taskStartedDesc} for ${bulkRecoveryType} recovery of plan ${planName},  instance ${bulkRecoveryInstanceID}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

MassRecoveryTaskSucceeded

```text
${taskSuccessDesc} for ${bulkRecoveryType} recovery of plan ${planName}, instance  ${bulkRecoveryInstanceID}. ${progressDesc}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

## o365

______________________________________________________________________

M365BackupStorageBulkRestoreChildFailed

```text
Unable to restore ${snappableType} data for ${snappableName} as part of  the mass recovery of plan ${planName} due to ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

M365BackupStorageBulkRestoreCompleted

```text
Mass recovery of plan ${planName} is completed.  Recovered workloads: ${numSuccessObjects}, Failed workloads:  ${numFailedObjects}, Total workloads: ${totalObjects}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

M365BackupStorageBulkRestoreCSVReportGeneration

```text
Generating report for mass recovery of plan ${planName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

M365BackupStorageBulkRestoreFailed

```text
Unable to perform mass recovery of plan ${planName} due to  ${failureReason}: Recovered workloads: ${numSuccessObjects},  Failed workloads: ${numFailedObjects},  Total workloads: ${totalObjects}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

M365BackupStorageBulkRestoreProgress

```text
Progress metrics for plan ${planName} are as follows:  Recovered workloads: ${numSuccessObjects}, Failed workloads:  ${numFailedObjects}, In-progress workloads:  ${numInProgressObjects}, Total workloads: ${totalObjects}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

M365BackupStorageBulkRestoreResolveArtifactsCompleted

```text
Completed enumeration of the artifacts for mass recovery of  plan ${planName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

M365BackupStorageBulkRestoreResolveArtifactsFailed

```text
Failed to enumerate artifacts for mass recovery of plan ${planName} because ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

M365BackupStorageBulkRestoreResolveArtifactsStarted

```text
Enumerating artifacts for mass recovery of plan ${planName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

M365BackupStorageBulkRestoreStarted

```text
Started Mass Recovery of the plan ${planName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

## app_backup

______________________________________________________________________

BlueprintBackupCanceled

```text
Canceled ${maintenanceType} snapshot of the recovery plan '${name}' in the ${region} region for the ${awsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

BlueprintBackupCanceling

```text
Canceling ${maintenanceType} snapshot of the recovery plan '${name}' in the ${region} region for the ${awsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

BlueprintBackupFailed

```text
Failed ${maintenanceType} snapshot of the recovery plan '${name}' in the ${region} region for the ${awsAccountDisplayName} AWS account. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

BlueprintBackupStarted

```text
Started ${maintenanceType} snapshot of the recovery plan '${name}' in the ${region} region for the ${awsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintBackupSucceeded

```text
Successfully created ${maintenanceType} snapshot of the recovery plan '${name}' in the ${region} region for the ${awsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## awsnative

______________________________________________________________________

AwsNativeCreateCryoResourceSnapshotJobCanceled

```text
Canceled ${maintenanceType} snapshot of the ${resourceDisplayName} ${resourceType} in the ${region} region for the ${awsAccountDisplayName} AWS account. This can happen if the object became unprotected, or was deleted.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AwsNativeCreateCryoResourceSnapshotJobCanceling

```text
Canceling ${maintenanceType} snapshot of the ${resourceDisplayName} ${resourceType} in the ${region} region for the ${awsAccountDisplayName} AWS account. This can happen if the object became unprotected, or was deleted.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AwsNativeCreateCryoResourceSnapshotJobFailed

```text
Failed to create ${maintenanceType} snapshot of the ${resourceDisplayName} ${resourceType} in the ${region} region for the ${awsAccountDisplayName} AWS account. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsNativeCreateCryoResourceSnapshotJobQueued

```text
Queued ${maintenanceType} snapshot of the ${resourceDisplayName} ${resourceType} in the ${region} region for the ${awsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AwsNativeCreateCryoResourceSnapshotJobStarted

```text
${userEmail} started snapshot of ${resourceType}: ${resourceDisplayName} in the ${region} region on AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsNativeCreateCryoResourceSnapshotJobStarted

```text
Started ${maintenanceType} snapshot of the ${resourceDisplayName} ${resourceType} in the ${region} region for the ${awsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeCreateCryoResourceSnapshotJobStartFailed

```text
${userEmail} failed to start snapshot of ${resourceType}: ${resourceDisplayName} in the ${region} region on AWS account ${awsAccountDisplayName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsNativeCreateCryoResourceSnapshotJobSucceeded

```text
Successfully created ${maintenanceType} snapshot of the ${resourceDisplayName} ${resourceType} in the ${region} region for the ${awsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsNativeCreateEbsVolumeSnapshotJobCanceled

```text
Canceled ${maintenanceType} snapshot of the EBS Volume: ${volumeDisplayName} in the ${region} region for the ${awsAccountDisplayName} AWS account. This can happen if the volume became unprotected, or was deleted.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AwsNativeCreateEbsVolumeSnapshotJobFailed

```text
Failed to create ${maintenanceType} snapshot of the EBS Volume: ${volumeDisplayName} in the ${region} region for the ${awsAccountDisplayName} AWS account. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsNativeCreateEbsVolumeSnapshotJobStarted

```text
Started ${maintenanceType} snapshot of the EBS Volume: ${volumeDisplayName} in the ${region} region for the ${awsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeCreateEbsVolumeSnapshotJobSucceeded

```text
Successfully created ${maintenanceType} snapshot of the EBS Volume: ${volumeDisplayName} in the ${region} region for the ${awsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsNativeCreateEc2InstanceSnapshotJobCanceled

```text
Canceled ${maintenanceType} snapshot of the EC2 Instance: ${instanceDisplayName} in the ${region} region for the ${awsAccountDisplayName} AWS account. This can happen if the instance became unprotected, or was deleted.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AwsNativeCreateEc2InstanceSnapshotJobFailed

```text
Failed to create ${maintenanceType} snapshot of the EC2 Instance: ${instanceDisplayName} in the ${region} region for the ${awsAccountDisplayName} AWS account. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsNativeCreateEc2InstanceSnapshotJobPreempted

```text
Unable to create ${maintenanceType}, ${snapshotLevelText}, snapshot of  the ${instanceDisplayName} in the region, ${region}, for the ${awsAccountDisplayName}. Snapshot is canceled. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsNativeCreateEc2InstanceSnapshotJobQueued

```text
Queued ${maintenanceType} snapshot of the EC2 Instance: ${instanceDisplayName} in the ${region} region for the ${awsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AwsNativeCreateEc2InstanceSnapshotJobSkipped

```text
${nextSnapshotConsistencyLevelText} snapshot is taken since, ${maintenanceType},  ${snapshotLevelText} snapshot of the ${instanceDisplayName}, in the ${region},  region for the, ${awsAccountDisplayName} AWS account could not be created. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

AwsNativeCreateEc2InstanceSnapshotJobStarted

```text
${userEmail} started snapshot of the EC2 Instance ${instanceDisplayName} in the ${region} region on the AWS account ${awsAccountDisplayName}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsNativeCreateEc2InstanceSnapshotJobStarted

```text
Started ${maintenanceType} snapshot of the EC2 Instance: ${instanceDisplayName} in the ${region} region for the ${awsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeCreateEc2InstanceSnapshotJobStartFailed

```text
${userEmail} failed to start snapshot of the EC2 Instance ${instanceDisplayName} in the ${region} region on the AWS account ${awsAccountDisplayName}
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsNativeCreateEc2InstanceSnapshotJobSucceeded

```text
Successfully created ${maintenanceType} ${consistencyLevelText} snapshot of the EC2 instance: ${instanceDisplayName} in the ${region} region for the ${awsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsNativeCreateEc2InstanceSnapshotTaskFailed

```text
Unable to take ${snapshotLevelText} snapshot of the ${instanceName}, EC2 instance. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

AwsNativeCreateEc2InstanceSnapshotTaskPostScriptFailed

```text
An application-consistent snapshot of the ${instanceName} was undone because the post script,  ${postScriptPath}, failed on the EC2 instance. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeCreateEc2InstanceSnapshotTaskStarted

```text
Creating ${snapshotLevelText} snapshot of the ${instanceName}, EC2 instance.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeCreateEc2InstanceSnapshotTaskSucceeded

```text
Successfully created ${snapshotLevelText} snapshot of the ${instanceName},  EC2 instance.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeCreateEc2InstanceSnapshotTaskWarning

```text
Unable to take ${snapshotLevelText} snapshot of the ${instanceName}, EC2 instance. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

## azuread

______________________________________________________________________

AzureADBackupJobCanceled

```text
Canceled ${maintenanceType} backup for directory \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AzureADBackupJobCanceling

```text
Canceling ${maintenanceType} backup for directory \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AzureADBackupJobDeltaStageProgress

```text
Detected ${totalObjectsToUpdate} modified objects.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureADBackupJobFailed

```text
Unable to create ${maintenanceType} backup for directory  \"${adDirectory}\". Reason: ${reason}. ${remedy}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureADBackupJobFetchStageProgress

```text
Completed backup of ${numObjectsUpdated} objects out of  ${totalObjectsToUpdate} modified objects. Progress:  ${progressPercent}%%
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureADBackupJobQueued

```text
Queued ${maintenanceType} backup for directory \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AzureADBackupJobStarted

```text
Started ${maintenanceType} backup for directory \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureADBackupJobSucceeded

```text
Successfully created ${maintenanceType} backup for directory  \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureADBackupJobSucceededWithWarnings

```text
Successfully created ${maintenanceType} backup for directory  \"${adDirectory}\" with warnings. Warnings: ${warnings}.
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

AzureADBackupJobZeusEntityCompleted

```text
Completed backup of ${numOfObjects} ${entityPluralName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureADBackupJobZeusEntityProgress

```text
Running backup of ${entityPluralName}. Processed ${numOfObjects}  objects.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureADBackupPerformTaskStarted

```text
Started backup of ${types}. ${additionalInfo}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureAdFirstZeusBackup

```text
Due to an upgrade, this backup task will take a full backup of the directory. This may take longer than usual.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

## azurenative

______________________________________________________________________

AzureNativeBackupSQLDatabaseBackupTaskFailed

```text
Failed to sync backups of all databases in ${serverDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeBackupSQLDatabaseBackupTaskStarted

```text
Started syncing backups of all databases in ${serverDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeBackupSQLDatabaseBackupTaskSuccess

```text
Successfully synced backups of all databases in ${serverDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskFailure** | **No** |

AzureNativeBackupSQLDatabaseJobCanceled

```text
Canceled syncing backups and SLAs of databases in the ${serverDisplayName} ${serverTypeDisplayName} in the ${resGroupDisplayName} resource group in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AzureNativeBackupSQLDatabaseJobCanceling

```text
Canceling sync of backups and SLAs of databases in the ${serverDisplayName} ${serverTypeDisplayName} in the ${resGroupDisplayName} resource group in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AzureNativeBackupSQLDatabaseJobFailed

```text
Failed to sync backups and SLAs of databases in the ${serverDisplayName} ${serverTypeDisplayName} in the ${resGroupDisplayName} resource group in the ${subscriptionDisplayName} subscription. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureNativeBackupSQLDatabaseJobStarted

```text
Started syncing backups and SLAs of databases in the ${serverDisplayName} ${serverTypeDisplayName} in the ${resGroupDisplayName} resource group in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeBackupSQLDatabaseJobSucceeded

```text
Successfully synced backup and SLAs of databases in the ${serverDisplayName} ${serverTypeDisplayName} in the ${resGroupDisplayName} resource group in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureNativeCreateDiskSnapshotJobCanceled

```text
Canceled ${maintenanceType} snapshot of the ${diskDisplayName} disk in the ${resGroupDisplayName} resource group in the ${subscriptionDisplayName} subscription. This can happen if the disk became unprotected, or was deleted.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AzureNativeCreateDiskSnapshotJobCanceling

```text
Canceling ${maintenanceType} snapshot of the ${diskDisplayName} disk in the ${resGroupDisplayName} resource group in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AzureNativeCreateDiskSnapshotJobFailed

```text
Failed to create ${maintenanceType} snapshot of the ${diskDisplayName} disk in the ${resGroupDisplayName} resource group in the ${subscriptionDisplayName} subscription. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureNativeCreateDiskSnapshotJobStarted

```text
Started ${maintenanceType} snapshot of the ${diskDisplayName} disk in the ${resGroupDisplayName} resource group in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeCreateDiskSnapshotJobSucceeded

```text
Successfully created ${maintenanceType} snapshot of the ${diskDisplayName} disk in the ${resGroupDisplayName} resource group in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureNativeCreateVMSnapshotJobCanceled

```text
Canceled ${maintenanceType} snapshot of the ${vmDisplayName} virtual machine in the ${resGroupDisplayName} resource group in the ${subscriptionDisplayName} subscription. This can happen if the virtual machine became unprotected, or was deleted.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AzureNativeCreateVMSnapshotJobCanceling

```text
Canceling ${maintenanceType} snapshot of the ${vmDisplayName} virtual machine in the ${resGroupDisplayName} resource group in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AzureNativeCreateVMSnapshotJobFailed

```text
Failed to create ${maintenanceType} snapshot of the ${vmDisplayName} virtual machine in the ${resGroupDisplayName} resource group in the ${subscriptionDisplayName} subscription. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureNativeCreateVMSnapshotJobSnapshotSkipped

```text
Failed to create ${maintenanceType} ${snapshotLevelText} snapshot of the ${vmDisplayName} virtual machine. Snapshot is cancelled. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureNativeCreateVMSnapshotJobStarted

```text
Started ${maintenanceType} snapshot of the ${vmDisplayName} virtual machine in the ${resGroupDisplayName} resource group in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeCreateVMSnapshotJobSucceeded

```text
Successfully created ${maintenanceType} snapshot of the ${vmDisplayName} virtual machine in the ${resGroupDisplayName} resource group in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureNativeCreateVMSnapshotTaskFailed

```text
Failed to take ${snapshotLevelText} snapshot of the ${vmDisplayName} virtual machine. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

AzureNativeCreateVMSnapshotTaskPostScriptFailed

```text
An application consistent snapshot of the ${vmDisplayName} was successfully created but the post script ${postScriptPath} failed on the virtual machine. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

AzureNativeCreateVMSnapshotTaskStarted

```text
Creating ${snapshotLevelText} snapshot of the ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeCreateVMSnapshotTaskSucceeded

```text
Successfully created ${snapshotLevelText} snapshot of the ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeCreateVMSnapshotTaskWarning

```text
Failed to take ${snapshotLevelText} snapshot of the ${vmDisplayName} virtual machine. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeDBLTRSnapshotExpiryTaskFailed

```text
Failed to sync LTR backups for all databases in server ${serverDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeDBLTRSnapshotExpiryTaskStarted

```text
Started syncing LTR backups for all databases in server ${serverDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeDBLTRSnapshotExpiryTaskSucceeded

```text
Successfully synced LTR backups for all databases in server ${serverDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeGetDisksToExcludeTaskSucceeded

```text
The following disk(s) are being excluded from the snapshot of ${vmDisplayName}: ${dataDisksToExclude}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeSyncSLATaskFailed

```text
Failed to sync SLAs of all databases in server ${serverDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeSyncSLATaskStarted

```text
Started syncing SLAs of all databases in server ${serverDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeSyncSLATaskSucceeded

```text
Successfully synced SLA of databases ${databasesList} in server ${serverDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskFailure** | **No** |

AzureNativeSyncSLATaskSucceededWithBestEffortFailures

```text
Failed to sync SLA of databases ${databasesList} in server ${serverDisplayName}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeSyncSLATaskSucceededWithFailuresAndInvalidSLAErrors

```text
Failed to sync SLA of databases ${databasesList} in server ${serverDisplayName}. The databases ${dbsWithInvalidSLA} have an invalid SLA assigned.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

## backup

______________________________________________________________________

BackupFailureRemediationNow

```text
User ${username} started retry jobs for ${numberOfJobs} failed or cancelled jobs. Retry is scheduled to run immediately.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

BackupFailureRemediationSLAWindow

```text
User ${username} started retry jobs for ${numberOfJobs} failed or cancelled jobs. Retry is scheduled to run as per configured snapshot window in the effective SLA Domain protecting the objects.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## cloudnative

______________________________________________________________________

CloudNativeBackupJobCanceled

```text
Canceled ${maintenanceType} snapshot of the ${qualifiedSnappableDisplayText}. This can happen if the object became unprotected, or was deleted.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

CloudNativeBackupJobCanceling

```text
Canceling ${maintenanceType} snapshot of the ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

CloudNativeBackupJobCreateSnapshotTaskFailed

```text
Unable to create the snapshot.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeBackupJobCreateSnapshotTaskStarted

```text
Snapshot creation is in progress.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeBackupJobCreateSnapshotTaskSucceeded

```text
Snapshot created successfully.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeBackupJobFailed

```text
Failed to create ${maintenanceType} snapshot of the ${qualifiedSnappableDisplayText}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudNativeBackupJobQueued

```text
Queued ${maintenanceType} snapshot of the ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

CloudNativeBackupJobStarted

```text
${userEmail} started snapshot of the ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CloudNativeBackupJobStarted

```text
Started ${maintenanceType} snapshot of the ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeBackupJobStartFailed

```text
${userEmail} failed to start snapshot of the ${qualifiedSnappableDisplayText}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

CloudNativeBackupJobSucceeded

```text
Successfully created ${maintenanceType} snapshot of the ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudNativeBigBucketGeneratingInventoryReport

```text
The inventory report for ${qualifiedSnappableDisplayText} is currently being generated. The process typically takes up to 48 hours, depending on the size of the bucket.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudNativeBigBucketGeneratingInventoryReportFailed

```text
Failed to generate inventory report for ${qualifiedSnappableDisplayText}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudNativeBigBucketGeneratingInventoryReportSucceeded

```text
Inventory report generated for ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeBigBucketOnboardingJobFailed

```text
Failed to onboard ${qualifiedSnappableDisplayText}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudNativeBigBucketOnboardingJobStarted

```text
Big bucket onboarding job started for ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeBigBucketOnboardingJobSucceeded

```text
Successfully onboarded the ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudNativePublishObjectStoreBackupInfo

```text
Total object count: ${total}, Backed up: ${backedup}, Unchanged objects: ${unchanged}, Failed: ${failed}. Unsupported objects: ${unsupported}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudNativePublishObjectStoreBackupProgress

```text
Backup is in Progress: Total object count: ${total}, Backed up: ${backedup}, Unchanged objects: ${unchanged}, Failed: ${failed}. Unsupported objects: ${unsupported}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativePublishObjectStoreBackupWarning

```text
Backup Completed with warning: Total object count: ${total}, Backed up: ${backedup}, Unchanged objects: ${unchanged}, Failed: ${failed}, Unsupported objects: ${unsupported}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

CloudNativeSnapshotGCFailed

```text
Rubrik Security Cloud encountered an issue while attempting to clean up stale snapshots for ${snappableType} snappables. Reason: ${reportURL}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

CloudNativeSnapshotGCSucceeded

```text
Successfully deleted stale snapshots for ${snappableType} snappables.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudNativeTempDatabaseCreation

```text
Creating temporary database.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeTempDatabaseCreationFailed

```text
Failed to create temporary database.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeTempDatabaseCreationSucceeded

```text
Successfully created temporary database.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeTempDatabaseWaitingFailed

```text
Failed to wait for temporary database creation.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

## common

______________________________________________________________________

DeleteSnapshot

```text
${username} deleted snapshot ${snapshotId} of '${vmName}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteSnapshotFailed

```text
${username} failed to delete a snapshot ${snapshotId} of '${vmName}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

OnDemandBackupStarted

```text
${username} started a job to create an on-demand backup for ${snappableType} ${snappableName} in ${hierarchyRootType} ${hierarchyRootName}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

OnDemandBackupStartFailed

```text
${username} failed to start a job to create an on-demand backup for ${snappableType} ${snappableName} in ${hierarchyRootType} ${hierarchyRootName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## gcpnative

______________________________________________________________________

BackupGCPNativeInstanceJobCanceled

```text
Canceled ${maintenanceType} snapshot of the ${gcpInstanceDisplayName} GCE instance in the ${gcpProjectDisplayName} project. This can happen if the instance became unprotected, or was deleted.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

BackupGCPNativeInstanceJobCanceling

```text
Canceling ${maintenanceType} snapshot of the ${gcpInstanceDisplayName} GCE instance in the ${gcpProjectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

BackupGCPNativeInstanceJobFailed

```text
Failed to create ${maintenanceType} snapshot of the ${gcpInstanceDisplayName} GCE instance  in the ${gcpProjectDisplayName} project. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

BackupGCPNativeInstanceJobQueued

```text
Queued ${maintenanceType} snapshot of the ${gcpInstanceDisplayName} GCE instance in the ${gcpProjectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

BackupGCPNativeInstanceJobStarted

```text
Started  ${maintenanceType} snapshot of the ${gcpInstanceDisplayName} GCE instance in the ${gcpProjectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BackupGCPNativeInstanceJobSucceeded

```text
Successfully created ${maintenanceType} snapshot of the ${gcpInstanceDisplayName} GCE instance  in the ${gcpProjectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

GCPNativeBackupInstanceJobStarted

```text
${userEmail} started snapshot of GCP instance ${gcpInstanceDisplayName} in ${gcpProjectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

GCPNativeBackupInstanceJobStartFailed

```text
${userEmail} failed to start snapshot of GCP instance ${gcpInstanceDisplayName} in ${gcpProjectDisplayName} project. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

## kupr

______________________________________________________________________

KuprBackupCanceled

```text
Canceled ${maintenanceType} backup of ${user} Kubernetes Namespace ${snappable}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

KuprBackupCanceling

```text
Canceling ${maintenanceType} backup of ${user} Kubernetes Namespace ${snappable}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

KuprBackupCompleted

```text
Successfully created ${maintenanceType} snapshot of ${user} Kubernetes Namespace ${snappable}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

KuprBackupFailed

```text
${maintenanceType} backup of ${user} Kubernetes Namespace ${snappable} failed. because ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

KuprBackupStarted

```text
Started ${maintenanceType} backup of ${user} Kubernetes Namespace ${snappable}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

KuprNamespaceFilesetSnapshotTaskFailed

```text
Failed to persist PVC data for namespace ${namespaceName} with namespaceID ${namespaceID} in Kubernetes Cluster ${clusterName} for snapshotID ${snapshotID}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

KuprNamespaceFilesetSnapshotTaskStarted

```text
Started persisting PVC data for namespace ${namespaceName} with namespaceID ${namespaceID} in Kubernetes Cluster ${clusterName} for snapshotID ${snapshotID}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

KuprNamespaceFilesetSnapshotTaskSuccess

```text
Successfully persisted PVC data for namespace ${namespaceName} with namespaceID ${namespaceID} in Kubernetes Cluster ${clusterName} for snapshotID ${snapshotID}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

KuprNamespaceFilesetSnapshotTaskWarning

```text
Rubrik PersistentVolumeClaim backup failed for ${pvcName} due to ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

KuprNamespaceFilesetSnapshotTaskWarningInconsistentSnapshotMetadata

```text
Unexpected failure due to inconsistent configuration. Please contact ${customerService}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

KuprNamespaceFilesetSnapshotTaskWarningPVCCountMismatch

```text
Backup of ${missingPVCCount} PVCs failed due to unknown reason.  Identified mismatch in PVC counts.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

KuprNamespaceResourceSnapshotTaskFailed

```text
Failed to collect resource definition(s) for namespace ${namespaceName} with namespaceID ${namespaceID} in Kubernetes Cluster ${clusterName} for snapshotID ${snapshotID}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

KuprNamespaceResourceSnapshotTaskStarted

```text
Started collecting resource definition(s) for namespace ${namespaceName} with namespaceID ${namespaceID} in Kubernetes Cluster ${clusterName} for snapshotID ${snapshotID}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

KuprNamespaceResourceSnapshotTaskSuccess

```text
Successfully collected resource definition(s) for namespace ${namespaceName} with namespaceID ${namespaceID} in Kubernetes Cluster ${clusterName} for snapshotID ${snapshotID}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

KuprNamespaceSnapshotCanceled

```text
Canceled ${maintenanceType} snapshot of Kubernetes Namespace ${namespaceName} with namespaceID ${namespaceID} in Cluster ${clusterName} with clusterID ${clusterUUID}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

KuprNamespaceSnapshotCanceling

```text
Canceling ${maintenanceType} snapshot of Kubernetes Namespace ${namespaceName} with namespaceID ${namespaceID} in Cluster ${clusterName} with clusterID ${clusterUUID}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

KuprNamespaceSnapshotCompleted

```text
Successfully created ${maintenanceType} snapshot of Kubernetes Namespace ${namespaceName} with namespaceID ${namespaceID} in Cluster ${clusterName} with clusterID ${clusterUUID}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

KuprNamespaceSnapshotFailed

```text
${maintenanceType} snapshot of Kubernetes Namespace ${namespaceName} with namespaceID ${namespaceID} in Cluster ${clusterName} with clusterID ${clusterUUID} failed. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

KuprNamespaceSnapshotStarted

```text
Started ${maintenanceType} snapshot of Kubernetes Namespace ${namespaceName} with namespaceID ${namespaceID} in Cluster ${clusterName} with clusterID ${clusterUUID}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

KuprSkipPVCWarning

```text
Skipping PersistentVolumeClaim(PVC) ${pvcName}.  This PVC will be restored as an empty PVC during restore.  Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

## managed_volume

______________________________________________________________________

V1BeginManagedVolumeSnapshot

```text
${username} started the operation to change the Managed Volume '${mv}' state to writable.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

V1BeginManagedVolumeSnapshotFailure

```text
${username} failed to begin managed volume snapshot for Managed Volume '${mv}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

V1EndManagedVolumeSnapshot

```text
${username} started the operation to change the Managed Volume '${mv}' state to read only.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

V1EndManagedVolumeSnapshotFailure

```text
${username} failed to end managed volume snapshot for Managed Volume '${mv}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## mssql

______________________________________________________________________

DeleteMssqlDbMountFailed

```text
${username} was unable to delete mount '${mountedDbName}, created on MSSQL database '${dbName}', and with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteMssqlDbMountSuccess

```text
${username} successfully deleted mount '${mountedDbName}', created on MSSQL database '${dbName}', and with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

MSSQLBatchSnapshotFailed

```text
${username} failed to start a job to take an on-demand snapshot of Microsoft SQL Database '${snappableName}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

MSSQLBatchSnapshotStarted

```text
${username} started a job to take an on-demand snapshot of Microsoft SQL Database '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

OnDemandTransactionLogBackupStarted

```text
${username} started a job to create an on-demand  transaction log backup for ${snappableType} ${snappableName}  in ${hierarchyRootType} ${hierarchyRootName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

OnDemandTransactionLogBackupStartFailed

```text
${username} was unable to start a job to create an on-demand  transaction log backup for ${snappableType} ${snappableName}  in ${hierarchyRootType} ${hierarchyRootName}.  Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## mysqldb_instance

______________________________________________________________________

CreateOnDemandMysqldbInstanceSnapshotFailure

```text
${username} failed to trigger an on-demand snapshot for MySQL instance ${instanceName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateOnDemandMysqldbInstanceSnapshotStarted

```text
${username} triggered an on-demand snapshot for MySQL instance ${instanceName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## o365

______________________________________________________________________

O365AllAttachmentDownloaded

```text
All attachments are downloaded
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365BackupAttemptFailed

```text
Attempted ${maintenanceType} backup of ${user} Microsoft 365 ${snappable}, will retry automatically: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

O365BackupCanceled

```text
Canceled ${maintenanceType} backup of ${user} Microsoft 365 ${snappable}
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

O365BackupCanceling

```text
Canceling ${maintenanceType} backup of ${user} Microsoft 365 ${snappable}
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

O365BackupCannotBeInitiated

```text
Backup cannot be initiated for ${objectName} Microsoft ${snappable}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |              |        |
| ----------- | ------------ | ------ |
| **Warning** | **Canceled** | **No** |

O365BackupCompleted

```text
Successfully created ${maintenanceType} snapshot of ${user} Microsoft 365 ${snappable}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365BackupCompletedObjectArchived

```text
The ${objectType} is no longer active and has been archived.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365BackupCompletedObjectDisabled

```text
The ${objectType} has been disabled due to ${reason}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365BackupCompletedTeamArchived

```text
The team is no longer active and has been archived.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365BackupFailed

```text
${maintenanceType} backup of ${user} Microsoft 365 ${snappable} failed because ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365BackupFailedMailboxArchived

```text
Mailbox ${reason}. It is being archived.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365BackupFetchDataCompleted

```text
Successfully fetched Microsoft 365 ${snappable} data from Microsoft
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365BackupFetchDataFailed

```text
Failed to fetch Microsoft 365 ${snappable} data from Microsoft. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

O365BackupFetchDataRunning

```text
Fetching Microsoft 365 ${snappable} data from Microsoft
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

O365BackupStarted

```text
${userID} started backup of Microsoft 365 ${snappableType} of ${snappableName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

O365BackupStarted

```text
Started ${maintenanceType} backup of ${user} Microsoft 365 ${snappable}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365BackupStartFailed

```text
${userID} failed to start on demand backup of Microsoft 365 ${snappableType} of ${snappableName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

O365DeleteArtifactsStarted

```text
Started deletion of temporary snapshot state for ${user}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365DeleteArtifactsSucceeded

```text
Successfully deleted temporary snapshot state of ${user}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365ExchangeBackupCompleted

```text
Successfully created ${maintenanceType} snapshot of ${user} Microsoft 365 ${snappable}. Folders ingested: ${foldersIngested}. Emails ingested: ${emailsIngested}. Emails skipped: ${emailsSkipped}. Calendar events ingested: ${eventsIngested}. Calendar events skipped:  ${eventsSkipped}. Attachments ingested: ${attachmentsIngested}. Attachments skipped:  ${attachmentsSkipped}. Items deleted: ${itemsDeleted}. Items found in sync but not modified since last snapshot: ${unchangedItemCount}. Attachments found in sync but not modified since last snapshot: ${unchangedAttachmentCount}. Bytes ingested: ${bytesIngested}. Bytes stored: ${bytesStored}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365ExchangeBackupCompletedWithWarnings

```text
Completed backup with warnings. Created ${maintenanceType} snapshot of ${user} Microsoft 365 ${snappable}. Folders ingested: ${foldersIngested}. Emails ingested: ${emailsIngested}. Emails skipped: ${emailsSkipped}. Calendar events ingested: ${eventsIngested}. Calendar events skipped: ${eventsSkipped}. Contacts ingested: ${contactsIngested}. Attachments ingested: ${attachmentsIngested}. Attachments skipped: ${attachmentsSkipped}. Items deleted: ${itemsDeleted}. Items found in sync but not modified since last snapshot:  ${unchangedItemCount}. Attachments found in sync but not modified since last snapshot: ${unchangedAttachmentCount}. Bytes ingested: ${bytesIngested}.  Bytes stored: ${bytesStored}. ${reasonsForWarningEvent}.
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365ExchangeBackupProgress

```text
Backup job in progress. In the last ${progressInterval},  synced ${itemsSyncedInInterval} items,  which ${unchangedItemsInInterval} have not changed since last  snapshot. Ingested ${itemsIngestedInInterval} items (${bytesIngested})  in this interval, and in total,  ${itemsIngested} items (${bytesIngestedTotal}) in the current job.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

O365ExchangeBackupWithContactsCompleted

```text
Successfully created ${maintenanceType} snapshot of ${user} Microsoft 365 ${snappable}. Folders ingested: ${foldersIngested}. Emails ingested: ${emailsIngested}. Emails skipped: ${emailsSkipped}. Calendar events ingested: ${eventsIngested}. Calendar events skipped:  ${eventsSkipped}. Contacts ingested: ${contactsIngested}. Attachments ingested: ${attachmentsIngested}. Attachments skipped:  ${attachmentsSkipped}. Items deleted: ${itemsDeleted}. Bytes ingested: ${bytesIngested}. Bytes stored: ${bytesStored}. Items found in sync but not modified since last snapshot:  ${unchangedItemCount}. Attachments found in sync but not modified since last snapshot: ${unchangedAttachmentCount}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365FullBackupLogMailMetrics

```text
Stored ${numMailChanges} message(s) as a ${sizeIngested} snapshot
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365IncrementalBackupLogMailMetrics

```text
Stored ${numMailChanges} message change(s) as a ${sizeIngested} snapshot
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365LogAttachmentMetrics

```text
Downloaded ${numAttachments} attachment(s) (${numDeduped} deduplicated), for total of ${sizeIngested}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365LogAttachmentStorageMetrics

```text
Downloaded ${numAttachments} attachment(s). Stored ${numStored} (${numDeduped} deduplicated) for total of ${attachmentsStoredSize}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365LogIncrementalMailboxSize

```text
Taking incremental snapshot of mailbox, with full size of approximately ${mailboxSize} on Microsoft 365
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365LogMailboxSize

```text
Taking full snapshot of mailbox, approximately sized at ${mailboxSize} on Microsoft 365
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365LogMailMetrics

```text
Stored ${numMailChanges} mail changes, with ${sizeIngested} of mail downloaded
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365LogNoAttachments

```text
No attachments downloaded
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365LogTemporaryBackupStorage

```text
Used ${temporaryStorageSize} of temporary Azure Blob storage
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365OnedriveBackupCompleted

```text
Successfully created ${maintenanceType} snapshot of ${user} Microsoft 365 ${snappable}. Folders ingested ${folderCount}. Files ingested ${fileCount}. Files skipped ${skipCount}. Items deleted ${deletedCount}. Bytes ingested ${bytesIngested}. Bytes stored ${bytesStored}. Data reduction percent ${reductionPercent}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365OnedriveBackupCompletedWithWarnings

```text
Completed backup with warnings. Created ${maintenanceType} snapshot of ${user} Office 365 ${snappable}. Folders ingested ${folderCount}. Files ingested ${fileCount}. Items deleted ${deletedCount}. Bytes ingested ${bytesIngested}. Bytes stored ${bytesStored}. Data reduction percent ${reductionPercent}. ${skippedItemCount} files skipped during backup due to sync issues with Microsoft
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365RenamedFolders

```text
Renamed ${numFolders} folders from backup due to malformed folder name: ${renamedFolderNames}
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

O365SharePointListBackupCompleted

```text
Successfully created ${maintenanceType} snapshot of ${objectName} Microsoft 365 ${snappable}. Folders ingested ${folderCount}. Items ingested ${itemCount}. Attachments ingested ${attachmentCount}. Items skipped ${skipCount}. Items deleted ${deletedCount}. Bytes ingested ${bytesIngested}. Bytes stored ${bytesStored}. Data reduction percent ${reductionPercent}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365SharePointSiteBackupCompletedWithWarnings

```text
Completed backup with warnings, created ${maintenanceType} snapshot of ${objectName} Microsoft ${snappable}. ${objectsSkipped} out of ${totalChildObjects} object(s) under the site failed to backup. Folders ingested: ${folderCount} Items ingested: ${itemCount} Attachments ingested: ${attachmentCount} Items skipped: ${skipCount} Items deleted: ${deletedCount} Bytes ingested: ${bytesIngested} Bytes stored: ${bytesStored} Data reduction percent: ${reductionPercent}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365SkippedAttachments

```text
Unable to process ${totalNumSkipped} attachment(s): ${numSkippedFromServerBusyErr} due to Microsoft server busy error, ${numSkippedFromCannotOpenFileErr} due to Microsoft cannot open file error and ${numSkippedFromUnsupportedTypeErr} due to unsupported attachment type error - More details in CSV file: ${downloadLink}
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

O365SkippedEmails

```text
${numEmails} messages were not backed up due to a retrieval failure. We will attempt to download them on the next backup cycle. For more information on this error please visit https://support.rubrik.com/articles/How_To/000004060.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

O365SkippedFolders

```text
Skipping ${numFolders} folders from backup: ${skippedFolderNames}
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

O365StoreSnapshotCompleted

```text
Successfully stored Microsoft 365 ${snappable} data
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365StoreSnapshotFailed

```text
Failed to store Microsoft 365 ${snappable} data. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

O365StoreSnapshotRunning

```text
Storing Microsoft 365 ${snappable} data
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

O365TeamBackupCompleted

```text
Successfully created ${maintenanceType} snapshot of ${user} Microsoft 365 ${snappable}. Folders ingested ${folderCount}. Files ingested ${fileCount}. Files skipped ${skipCount}. Items deleted ${deletedCount}. Bytes ingested ${bytesIngested}. Bytes stored ${bytesStored}. Data reduction percent ${reductionPercent}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365TeamBackupWithConversationsCompleted

```text
Successfully created ${maintenanceType} snapshot of ${user} Microsoft 365 ${snappable}. Folders ingested ${folderCount}. Files ingested ${fileCount}. Files skipped ${skipCount}. Total Messages ingested ${messageCount}. Private Channel Message ingested ${pvtChannelMsgCount}. Items deleted ${deletedCount}. File bytes ingested ${fileBytesIngested}. File bytes stored ${bytesStored}. File data reduction percent ${fileReductionPercent}. Message bytes ingested ${msgBytesIngested}. Message bytes stored ${msgBytesStored}. Message data reduction percent ${msgReductionPercent}. Messages skipped ${msgSkipCount}. Message attachment references skipped ${msgAttachmentSkipCount}. Permissions backup skipped for ${channelPermissionsSkipped} channel(s). New channels discovered ${numChannelsAdded}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365TeamBackupWithConversationsCompletedWithWarning

```text
Partially completed the backups with warnings. Created ${maintenanceType} snapshot of ${user} Microsoft 365 ${workload},  but skipped backing up ${skippedDriveCount} channels' files. The backup for skipped files will be retried in the next incremental backup. Folders ingested ${folderCount}. Files ingested ${fileCount}. Files skipped ${skipCount}. Total Messages ingested ${messageCount}. Private Channel Message ingested ${pvtChannelMsgCount}. Items deleted ${deletedCount}. File bytes ingested ${fileBytesIngested}. File bytes stored ${bytesStored}. File data reduction percent ${fileReductionPercent}. Message bytes ingested ${msgBytesIngested}. Message bytes stored ${msgBytesStored}. Message data reduction percent ${msgReductionPercent}. Messages skipped ${msgSkipCount}. Message attachment references skipped ${msgAttachmentSkipCount}.  Permissions backup skipped for ${channelPermissionsSkipped} channel(s). New channels discovered ${numChannelsAdded}. Data reduction percent: ${reductionPercent}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

## postgres_db_cluster

______________________________________________________________________

CreateOnDemandPostgresDbClusterSnapshotFailure

```text
${username} failed to trigger an on-demand snapshot for PostgreSQL database cluster ${dbClusterName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateOnDemandPostgresDbClusterSnapshotStarted

```text
${username} triggered an on-demand snapshot for PostgreSQL database cluster ${dbClusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## saasapps

______________________________________________________________________

SaasAppsBackupCanceled

```text
Canceled ${maintenanceType} backup of ${displayName} ${snappableType}  belonging to ${siteName}. ${attachmentURLMessage}
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

SaasAppsBackupCompleted

```text
Successfully completed ${maintenanceType} backup of ${displayName}  ${snappableType} belonging to ${siteName}. Number of rows added:  ${rowsAdded}, number of rows modified: ${rowsModified}, number of rows deleted: ${rowsDeleted}. ${attachmentURLMessage}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SaasAppsBackupFailed

```text
Unable to take ${maintenanceType} backup of ${displayName}  ${snappableType} belonging to ${siteName} because ${reason}. ${attachmentURLMessage}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SaasAppsBackupStarted

```text
${userID} started backup of ${displayName} ${snappableType}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SaasAppsBackupStarted

```text
Started ${maintenanceType} backup of ${displayName} ${snappableType}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SaasAppsBackupStartFailed

```text
${userID} failed to start on-demand backup of ${displayName}  ${snappableType}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

SaasAppsEntityBackupFailed

```text
Unable to complete backup of '${entityName}' entity for ${displayName} ${snappableType}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskFailure** | **No** |

SaasAppsEntityBackupStarted

```text
Started backup of '${entityName}' entity for ${displayName} ${snappableType}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SaasAppsEntityBackupSucceeded

```text
Successfully completed backup of '${entityName}' entity for ${displayName} ${snappableType}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

## sap_hana_system

______________________________________________________________________

CreateOnDemandSapHanaStorageSnapshotFailure

```text
${username} failed to trigger an on-demand storage snapshot for SAP HANA system ${systemName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateOnDemandSapHanaStorageSnapshotStarted

```text
${username} triggered an on-demand storage snapshot for SAP HANA system ${systemName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## testevent

______________________________________________________________________

TestAll

```text
Everyone loves ${hobby}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskSuccess** | **No** |

TestDedupe

```text
In hindsight, making dedupe time customizable was not a well though out  decision. One day we will rethink RSC email dedupe, maybe.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

TestHasUrl

```text
This message tests parameters like ${hobby} and URL which are both in MessageVars.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

TestUrlMetadata

```text
Is this overkill for such a simple feature? Maybe. Striving for type safety is always a good thing!
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## vsphere

______________________________________________________________________

VSphereBulkSnapshotSingleFailed

```text
${username} failed to start a job to take a snapshot of Virtual Machine '${snappableName}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VSphereBulkSnapshotSingleStarted

```text
${username} started a job to take a snapshot of Virtual Machine '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## webhook

______________________________________________________________________

WebhookTest

```text
This is a test event to test if a message can be recieved by a user configured endpoint.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## classification

______________________________________________________________________

AnalyzerCreated

```text
${username} created a new custom analyzer named '${analyzerName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AnalyzerDeleted

```text
${username} deleted the custom analyzer named '${analyzerName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AnalyzerEdited

```text
${username} modified the custom analyzer named '${analyzerName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AnalyzerRiskUpdated

```text
${username} updated the analyzer risk to '${analyzerRisk}' for  ${analyzerNames}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

BulkPolicyJobFailure

```text
Failed to ${actionType} policies to workloads for clusters or hierarchy objects.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

BulkPolicyJobSuccess

```text
Successfully ${actionType} policies to workloads for clusters or hierarchy objects.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ClassficationResultsAvailable

```text
Results available in the Objects page for the workload '${objectName}' on the snapshot at ${snapshotsTimeStamp}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ClassificationCanceled

```text
Canceled classification of ${objectType} '${objectName}' on snapshot(s)  at ${snapshotsTimeStamp} with policies ${policyList}.
```

Severity | Status | Audit Event | |

|             |              |        |
| ----------- | ------------ | ------ |
| **Warning** | **Canceled** | **No** |

ClassificationFailure

```text
Failed to classify ${objectType} '${objectName}' on snapshot(s) at  ${snapshotsTimeStamp} with policies ${policyList}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ClassificationRunning

```text
Running classification of ${objectType} '${objectName}' on snapshot(s)  at ${snapshotsTimeStamp} with policies ${policyList}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ClassificationRunningNoNewSnapshot

```text
Running classification of ${objectType} '${objectName}' with policies  ${policyList}: No new snapshot to analyze.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ClassificationStarted

```text
Beginning classification of ${objectType} '${objectName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ClassificationSuccess

```text
Completed classification of ${objectType} '${objectName}' on snapshot(s) at ${snapshotsTimeStamp} with policies ${policyList}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ClassificationSuccessNoNewSnapshot

```text
Completed classification of ${objectType} '${objectName}' with policies ${policyList}: No new snapshot to analyze.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CrawlJobDeleted

```text
${username} deleted the discovery named '${crawlName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CrawlJobStarted

```text
${username} ran a discovery named '${crawlName}', which included ${policyNames}, across ${numObjects} object(s).
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DCAddObjectsToPolicyFailure

```text
Failed to add ${ObjectCount} objects to ${policyID}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskFailure** | **No** |

DCAddObjectsToPolicySuccess

```text
Added ${ObjectCount} objects to ${policyID} successfully
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

DCObjectResultsDownloaded

```text
${username} downloaded full discovery results of ${objectType} '${objectName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DCObjectResultsOnLocationDownloaded

```text
${username} downloaded full discovery results of ${objectType} '${objectName}' on '${location}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DCPathResultsDownloaded

```text
${username} downloaded discovery results of '${path}' in ${objectType} '${objectName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DCPathResultsOnLocationDownloaded

```text
${username} downloaded discovery results of '${path}' in ${objectType} '${objectName}' on '${location}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DCPolicySyncCanceled

```text
Sync canceled due to modifications to policies. A new sync will begin shortly
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

DCPolicySyncFailed

```text
Failed to sync changes on ${clusterName}. Reason: ${errorMessage}
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

DCPolicySyncFailedClusterDisconnected

```text
Unable to sync changes on ${clusterName} because the cluster is disconnected
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

DCPolicySyncRecovered

```text
Sync recovered and completed successfully on ${clusterName}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

DCPolicySyncStarting

```text
Starting to sync changes for ${policies} on ${clusterName}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

DCPolicySyncSuccess

```text
Succeeded to sync changes on ${clusterName}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ODCResultsDownloaded

```text
${username} downloaded the results of the discovery named '${crawlName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PolicyCreated

```text
${username} created a new custom policy named '${policyName}', which includes ${analyzerNames}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PolicyDeleted

```text
${username} deleted the policy named '${policyName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PolicyEdited

```text
${username} modified the policy named '${policyName}', which now includes ${analyzerNames}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PolicyObjAdded

```text
${username} added ${objectNames} to ${policyNames}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PolicyObjRemoved

```text
${username} removed ${objectNames} from ${policyNames}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PreviewerDisabled

```text
${username} disabled previewer for '${clusterName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PreviewerEnabled

```text
${username} enabled previewer for '${clusterName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

WhitelistUpdateAdd

```text
${username} updated the allowlist for '${objectName}' on path '${pathName}', adding '${analyzerNames}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

WhitelistUpdateAddRemove

```text
${username} updated the allowlist for '${objectName}' on path '${pathName}', adding '${analyzersAdded}' and removing '${analyzersRemoved}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

WhitelistUpdateRemove

```text
${username} updated the allowlist for '${objectName}' on path '${pathName}', removing '${analyzerNames}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## accountmanagement

______________________________________________________________________

AccountTagAdded

```text
${username} added the tag(s) ${tagName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AccountTagRemoved

```text
${username} removed the tag(s) ${tagName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## active_directory

______________________________________________________________________

ActiveDirectoryRefreshDomainStarted

```text
${username} started a job to refresh the Active Directory domain  ${domainName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ActiveDirectoryRefreshDomainStartFailed

```text
${username} unable to start a job to refresh the Active Directory domain  ${domainName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## appflows

______________________________________________________________________

BlueprintArchiveSucceeded

```text
${userEmail} successfully archived recovery plan '${blueprintName}' on ${clusterName}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

BlueprintCreationSucceeded

```text
${userEmail} successfully created recovery plan '${blueprintName}' on ${clusterName}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

BlueprintUpdateSucceeded

```text
${userEmail} successfully updated recovery plan '${blueprintName}' on ${clusterName}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

InstallIofilterStarted

```text
${userEmail} started a job to install iofilter on ${computeClusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

InstallIofilterStartFailed

```text
${userEmail} failed to start a job to install iofilter on  ${computeClusterName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

InstanceResourceConfigurationDeletionSucceeded

```text
${userEmail} successfully deleted resource configuration for recovery  plan '${blueprintName}' on ${clusterName} with failover Id ${failoverId}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PostScriptUpdateSucceeded

```text
${userEmail} successfully updated post script for the snappable '${snappableName}' of the recovery plan '${blueprintName}' on ${clusterName} with failover type ${failoverType}. The hashcode of the post script is ${postscriptSignature}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RecoveryPlanCreationSucceeded

```text
${userEmail} successfully created recovery plan '${planName}' on ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RecoveryPlanDeletionSucceeded

```text
${userEmail} successfully deleted recovery plan '${planName}' on ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RecoveryPlanUpdateSucceeded

```text
${userEmail} successfully updated recovery plan '${planName}' on ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ResourceConfigurationCreationSucceeded

```text
${userEmail} successfully created resource configuration for recovery plan '${planName}' on ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ResourceConfigurationDeletionSucceeded

```text
${userEmail} successfully deleted resource configuration for recovery plan '${planName}' on ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ResourceConfigurationUpdateSucceeded

```text
${userEmail} successfully updated resource configuration for recovery plan '${planName}' on ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ResourceMappingCreationSucceeded

```text
${userEmail} successfully created resource mapping for recovery plan '${blueprintName}' on ${clusterName}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ResourceMappingDeletionSucceeded

```text
${userEmail} successfully deleted resource mapping for recovery plan '${blueprintName}' on ${clusterName}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ResourceMappingModificationSucceeded

```text
${userEmail} successfully modified resource mapping for recovery plan '${blueprintName}' on ${clusterName}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UninstallIofilterStarted

```text
${userEmail} started a job to uninstall iofilter on ${computeClusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UninstallIofilterStartFailed

```text
${userEmail} failed to start a job to uninstall iofilter on  ${computeClusterName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpgradeIofilterStarted

```text
${userEmail} started a job to upgrade iofilter on ${computeClusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpgradeIofilterStartFailed

```text
${userEmail} failed to start a job to upgrade iofilter on  ${computeClusterName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## archivalgroup

______________________________________________________________________

ArchivalGroupCreationSucceeded

```text
${userEmail} successfully created ${archivalGroupType} Archival Location ${archivalGroupName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ArchivalGroupDeletionSucceeded

```text
${userEmail} successfully deleted Archival Location ${archivalGroupName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ArchivalGroupModificationSucceeded

```text
${userEmail} successfully modified Archival Location ${archivalGroupName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## archivallocation

______________________________________________________________________

ArchivalLocationCreationSucceeded

```text
${userEmail} successfully created ${archivalLocationType} archival  location ${archivalLocationName} with ${keyType} encryption key type.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ArchivalLocationCreationWithKeyVaultSucceeded

```text
${userEmail} successfully created ${archivalLocationType} archival  location ${archivalLocationName} with ${keyName} of ${keyType}  encryption key type from ${keyVaultUrl}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ArchivalLocationModificationSucceeded

```text
${userEmail} successfully modified archival location ${archivalLocationName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ArchivalLocationReaderDataSourcesRefreshTriggerFailed

```text
${userEmail} failed to trigger data source refresh for reader archival location ${archivalLocationName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ArchivalLocationReaderDataSourcesRefreshTriggerSucceeded

```text
${userEmail} successfully triggered data source refresh for reader archival location ${archivalLocationName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ArchivalLocationReaderPromotionFailed

```text
${userEmail} failed to promote reader archival location ${archivalLocationName} to read/write state from Polaris.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ArchivalLocationReaderPromotionSucceeded

```text
${userEmail} successfully promoted reader archival location ${archivalLocationName} to read/write state from Polaris.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ArchivalLocationReaderRefreshTriggerFailed

```text
${userEmail} failed to trigger refresh for reader archival location ${archivalLocationName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ArchivalLocationReaderRefreshTriggerSucceeded

```text
${userEmail} successfully triggered refresh for reader archival location ${archivalLocationName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ArchivalLocationStateChangeFailed

```text
${userEmail} failed to ${archivalLocationStatus} archival location ${archivalLocationName} from Polaris.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ArchivalLocationStateChangeSucceeded

```text
${userEmail} successfully ${archivalLocationStatus} archival location ${archivalLocationName} from Polaris.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DataCenterCloudAccountStateChange

```text
${userEmail} successfully ${cloudAccountStatus}  ${providerType} data center cloud account '${name}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ReaderArchivalLocationMasterKeyUpdateSucceeded

```text
${userEmail} successfully modified the master encryption key for the  reader archival location ${archivalLocationName} to ${keyType}  encryption key.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ReaderArchivalLocationMasterKeyWithKeyVaultUpdateSucceeded

```text
${userEmail} successfully modified the master encryption key for the  reader archival location ${archivalLocationName} to ${keyType}  encryption key. ${keyName} from ${keyVaultUrl} is being used as the  encryption key.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## awsnative

______________________________________________________________________

AwsNativeDeleteAccountJobStarted

```text
${userEmail} started to disable ${featureDisplayName} protection of AWS account ${awsAccountDisplayName}. ${featureSnapshots} from AWS will ${deleteSnapshotsMsg} be deleted.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsNativeDeleteAccountJobStartFailed

```text
${userEmail} failed to start disable of ${featureDisplayName} protection of AWS account ${awsAccountDisplayName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsNativeRefreshAccountJobStarted

```text
${userEmail} started refresh of AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsNativeRefreshAccountJobStartFailed

```text
${userEmail} failed to start refresh of AWS account ${awsAccountDisplayName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

DeleteAwsAccountArchiveSnapshotTaskFailed

```text
Failed to delete ${featureSnapshots} for ${featureDisplayName} protection in the AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

DeleteAwsAccountArchiveSnapshotTaskStarted

```text
Deleting ${featureSnapshots} for ${featureDisplayName} protection in the AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

DeleteAwsAccountArchiveSnapshotTaskSucceeded

```text
Successfully Deleted ${featureSnapshots} for ${featureDisplayName} protection in the AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

DeleteAwsNativeAccountJobFailed

```text
Failed to disable ${featureDisplayName} protection for AWS account ${awsAccountDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

DeleteAwsNativeAccountJobQueued

```text
Queued disabling ${featureDisplayName} protection of AWS account ${awsAccountDisplayName}. ${featureSnapshots} from AWS will ${deleteSnapshotsMsg} be deleted.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

DeleteAwsNativeAccountJobStarted

```text
Started a job to disable ${featureDisplayName} protection for AWS account ${awsAccountDisplayName}. ${featureSnapshots} from AWS will ${deleteSnapshotsMsg} be deleted.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

DeleteAwsNativeAccountJobSucceeded

```text
Successfully disabled ${featureDisplayName} protection for AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RefreshAwsNativeAccountJobCanceled

```text
Canceled  ${maintenanceType} refresh of AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

RefreshAwsNativeAccountJobCanceling

```text
Canceling  ${maintenanceType} refresh of AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

RefreshAwsNativeAccountJobFailed

```text
Failed to refresh AWS account ${awsAccountDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

RefreshAwsNativeAccountJobStarted

```text
Started  ${maintenanceType} refresh of AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

RefreshAwsNativeAccountJobSucceeded

```text
Successfully refreshed AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RefreshAwsNativeAccountRefreshFeaturesTaskStarted

```text
Refreshing ${awsAccountFeatures} features for ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

## azuread

______________________________________________________________________

AzureAdDeleteDirectoryFailed

```text
${userID} attempted to delete the Azure AD Directory ${directoryName},  but the operation failed.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AzureADDeleteDirectoryJobFailed

```text
Failed to delete directory \"${adDirectory}\". Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureADDeleteDirectoryJobQueued

```text
Queued deletion for directory \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AzureADDeleteDirectoryJobStarted

```text
Started deletion for directory \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureADDeleteDirectoryJobSucceeded

```text
Successfully deleted directory \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureAdDeleteDirectoryStarted

```text
${userName} started deletion of Azure AD Directory ${directoryName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AzureAdOnboardingFailed

```text
Onboarding of the Azure AD Directory ${directoryName} failed.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AzureAdOnboardingSucceeded

```text
Onboarding of the Azure AD Directory ${directoryName} Succeeded.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## azurenative

______________________________________________________________________

AzureNativeDBPrereqVerifyJobCanceled

```text
Canceled prerequisite verification of the ${serverDisplayName} -  ${serverTypeDisplayName} in the ${resGroupDisplayName} resource group of the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AzureNativeDBPrereqVerifyJobCanceling

```text
Canceling prerequisite verification of the ${serverDisplayName} -  ${serverTypeDisplayName} in the ${resGroupDisplayName} resource group of the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AzureNativeDBPrereqVerifyJobFailed

```text
Failed prerequisite verification of the ${serverDisplayName} -  ${serverTypeDisplayName} in the ${resGroupDisplayName} resource group of the ${subscriptionDisplayName} subscription. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureNativeDBPrereqVerifyJobQueued

```text
Queued prerequisite verification of the ${serverDisplayName} -  ${serverTypeDisplayName} in the ${resGroupDisplayName} resource group of the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AzureNativeDBPrereqVerifyJobStarted

```text
Started prerequisite verification of the ${serverDisplayName} -  ${serverTypeDisplayName} in the ${resGroupDisplayName} resource group of the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeDBPrereqVerifyJobSucceeded

```text
Successfully completed prerequisite verification of the ${serverDisplayName} -  ${serverTypeDisplayName} in the ${resGroupDisplayName} resource group of the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureNativeDeleteSubscriptionArchiveSnapshotTaskFailed

```text
Failed to delete snapshots in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeDeleteSubscriptionArchiveSnapshotTaskStarted

```text
Deleting snapshots in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeDeleteSubscriptionArchiveSnapshotTaskSucceeded

```text
Deleted snapshots in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeDeleteSubscriptionJobCanceled

```text
Canceled the job to disable ${featureDisplayName} protection for the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AzureNativeDeleteSubscriptionJobCanceling

```text
Canceling the job to disable ${featureDisplayName} protection for the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AzureNativeDeleteSubscriptionJobFailed

```text
${userEmail} failed to start disabling protection of the ${subscriptionDisplayName} Azure subscription. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AzureNativeDeleteSubscriptionJobFailed

```text
Failed to disable ${featureDisplayName} protection for the ${subscriptionDisplayName} subscription. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureNativeDeleteSubscriptionJobStarted

```text
${userEmail} started disabling protection of the ${subscriptionDisplayName} Azure subscription.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AzureNativeDeleteSubscriptionJobStarted

```text
Started a job to disable ${featureDisplayName} protection for the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeDeleteSubscriptionJobSucceeded

```text
Successfully disabled ${featureDisplayName} protection for the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureNativeRefreshSubscriptionCanceled

```text
Canceled ${maintenanceType} refresh of the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AzureNativeRefreshSubscriptionCanceling

```text
Canceling ${maintenanceType} refresh of the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AzureNativeRefreshSubscriptionFailed

```text
Failed ${maintenanceType} refresh of the ${subscriptionDisplayName} subscription (${statusPerFeature}). Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureNativeRefreshSubscriptionJobStarted

```text
${userEmail} started refresh of the ${subscriptionDisplayName} Azure subscription.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AzureNativeRefreshSubscriptionJobStartFailed

```text
${userEmail} failed to start refresh of the ${subscriptionDisplayName} Azure subscription. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AzureNativeRefreshSubscriptionQueued

```text
Queued ${maintenanceType} refresh of the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AzureNativeRefreshSubscriptionStarted

```text
Started ${maintenanceType} refresh of the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeRefreshSubscriptionSucceeded

```text
Successfully finished ${maintenanceType} refresh of the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## blobstore

______________________________________________________________________

CyberEventLockdownUpdateFailed

```text
${userName} failed to ${action} Cyber Event Lockdown for ${clusterName} (${clusterUuid}). ${supportMessage}
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

CyberEventLockdownUpdateSucceeded

```text
${userName} has ${action}d Cyber Event Lockdown for ${clusterName} (${clusterUuid}). ${supportMessage}
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Success** | **Yes** |

## cassandra_source

______________________________________________________________________

AddCassandraSourceFailure

```text
${username} failed to add the Cassandra source '${sourceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

AddCassandraSourceStarted

```text
${username} started adding the Cassandra source '${sourceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteCassandraSourceFailure

```text
${username} failed to delete the Cassandra source '${sourceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteCassandraSourceStarted

```text
${username} started deleting the Cassandra source '${sourceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EditCassandraSourceFailure

```text
${username} failed to modify the Cassandra source '${sourceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

EditCassandraSourceStarted

```text
${username} modified the Cassandra source '${sourceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## ccprovision

______________________________________________________________________

ClusterCreateFailed

```text
${userEmail} was unable to create Rubrik Cloud Cluster ${clusterName}, ${clusterUuid}, ${errorMessage}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ClusterCreateRunning

```text
${userEmail} started the creation of Rubrik Cloud Cluster ${clusterName}, ${clusterUuid}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ClusterCreateSuccess

```text
${userEmail} successfully created Rubrik Cloud Cluster ${clusterName}, ${clusterUuid}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ClusterCreateWarning

```text
${userEmail} is creating Rubrik Cloud Cluster ${clusterName}, ${clusterUuid}, with a warning message, ${warning}.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Success** | **Yes** |

ClusterRecoveryFailed

```text
${userEmail} was unable to recover Rubrik Cloud Cluster ${clusterName}, ${clusterUuid}, ${errorMessage}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ClusterRecoveryRunning

```text
${userEmail} started the recovery of Rubrik Cloud Cluster ${clusterName}, ${clusterUuid}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ClusterRecoverySuccess

```text
${userEmail} successfully recovered Rubrik Cloud Cluster ${clusterName}, ${clusterUuid}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## cdm_rbac_migration

______________________________________________________________________

FetchCDMRBACConfigJobFailed

```text
Failed to fetch the Rubrik CDM RBAC configuration from ${clusterName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

FetchCDMRBACConfigJobStarted

```text
Started the job to fetch the Rubrik CDM RBAC configuration from ${clusterName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

FetchCDMRBACConfigJobSucceeded

```text
Successfully fetched the Rubrik CDM RBAC configuration from ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

GenerateCDMRBACMigrationSummaryJobFailed

```text
Failed to generate the Rubrik CDM RBAC migration summary from ${clusterName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

GenerateCDMRBACMigrationSummaryJobStarted

```text
Started the job to generate the Rubrik CDM RBAC migration summary from ${clusterName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

GenerateCDMRBACMigrationSummaryJobSucceeded

```text
Successfully generated the Rubrik CDM RBAC migration summary from ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

MigrateCDMRBACConfigJobFailed

```text
Failed to migrate the Rubrik CDM RBAC configuration from ${clusterName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

MigrateCDMRBACConfigJobStarted

```text
Started the job to migrate the Rubrik CDM RBAC configuration from ${clusterName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

MigrateCDMRBACConfigJobSucceeded

```text
Successfully migrated the Rubrik CDM RBAC configuration from ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## cdm_remove_cluster

______________________________________________________________________

ClusterDeleteCompleted

```text
Cluster data delete completed for cluster with uuid ${clusterUUID}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ClusterDeleteQueued

```text
Cluster disconnect succeeded. Cluster delete queued for cluster with uuid ${clusterUUID}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ClusterDeleteStarted

```text
Cluster data delete started for cluster with uuid ${clusterUUID}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

ClusterDisconnectFailed

```text
Cluster disconnect failed for cluster with uuid ${clusterUUID}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ClusterDisconnectStarted

```text
Cluster disconnect started for cluster with uuid ${clusterUUID}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

## certificate_expiry

______________________________________________________________________

CertificateExpiringSoonInUse

```text
Certificate '${certificateName}' is expiring within the next ${dayCount} day(s).  This certificate is currently being used for the following service providers: ${serviceProviders}. Import a new certificate and reconfigure each service to use your new certificate.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

CertificateExpiringSoonNotInUse

```text
Certificate '${certificateName}' is expiring within the next ${dayCount} day(s).
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

CertificateExpiringTodayInUse

```text
Certificate '${certificateName}' is expiring today.  This certificate is currently being used for the following service providers: ${serviceProviders}. Import a new certificate and reconfigure each service to use your new certificate.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

CertificateExpiringTodayNotInUse

```text
Certificate '${certificateName}' is expiring today. Connections to service providers using this certificate will fail.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

## certificate_management

______________________________________________________________________

DeleteCdmCertificateFailure

```text
${ActorSubjectName} was unable to delete the certificate '${certName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteCdmCertificateSuccess

```text
${ActorSubjectName} deleted the certificate '${certName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteCertificate

```text
${ActorSubjectName} deleted the certificate '${certName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ImportCdmCertificateFailure

```text
${ActorSubjectName} was unable to import the certificate '${certName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ImportCdmCertificateSuccess

```text
${ActorSubjectName} imported the certificate '${certName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ImportCdmCertificateWithTrustSuccess

```text
${ActorSubjectName} imported the certificate '${certName}' to the cluster trust store.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ImportCertificate

```text
${ActorSubjectName} imported the certificate '${certName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ImportCSR

```text
${ActorSubjectName} created the CSR '${csrName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateCdmCertificateFailure

```text
${ActorSubjectName} was unable to update the certificate '${certName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateCdmCertificateSuccess

```text
${ActorSubjectName} updated the certificate '${certName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateCertificate

```text
${ActorSubjectName} updated the certificate '${certName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## cloudaccounts

______________________________________________________________________

AwsAccountAdditionFailed

```text
${userEmail} was unable to initiate the addition of ${feature} for ${iamRoleMsg}AWS Account, ${accountName}${orgMsg}, with ID ${nativeId}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsAccountAdditionSucceeded

```text
${userEmail} initiated addition of ${feature} for ${iamRoleMsg}AWS Account, ${accountName}${orgMsg}, with ID ${nativeId}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsAccountDeletionFailed

```text
${userEmail} was unable to initiate the deletion of ${feature} for ${iamRoleMsg}AWS Account ${accountName}${orgMsg} with ID ${nativeId}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsAccountDeletionSucceeded

```text
${userEmail} initiated the deletion of ${feature} for ${iamRoleMsg}AWS Account ${accountName}${orgMsg} with ID ${nativeId}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsAccountForceDeletionFailed

```text
${userEmail} failed to initiate deletion of ${feature} for AWS Account ${accountName} with ID ${nativeId}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsAccountForceDeletionSucceeded

```text
${userEmail} initiated deletion of ${feature} for AWS Account ${accountName} with ID ${nativeId}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Success** | **Yes** |

AwsAccountMigrationFailed

```text
${userEmail} failed to initiate migration of account, ${accountName}, with ID, ${nativeId}, to AWS organization ${orgName}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsAccountMigrationSucceeded

```text
${userEmail} initiated migration of account, ${accountName}, with ID, ${nativeId}, to AWS organization ${orgName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsAccountRoleChainingMappingInitiateFailed

```text
${userEmail} failed to initiate mapping of AWS Account ${accountName} with ID ${nativeId} to role chaining account ${roleChainingAccountName} with ID ${roleChainingAccountNativeId}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsAccountRoleChainingMappingInitiateSucceeded

```text
${userEmail} initiated mapping of AWS Account ${accountName} with ID ${nativeId} to role chaining account ${roleChainingAccountName} with ID ${roleChainingAccountNativeId}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsAccountRoleChainingUnMappingInitiateFailed

```text
${userEmail} failed to initiate unmapping of AWS Account ${accountName} with ID ${nativeId} from role chaining account ${roleChainingAccountName} with ID ${roleChainingAccountNativeId}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsAccountRoleChainingUnMappingInitiateSucceeded

```text
${userEmail} initiated unmapping of AWS Account ${accountName} with ID ${nativeId} from role chaining account ${roleChainingAccountName} with ID ${roleChainingAccountNativeId}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsAccountUpdateFailed

```text
${userEmail} failed to update the ${iamRoleMsg}AWS account ${accountName} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsAccountUpdateSucceeded

```text
${userEmail} updated the ${iamRoleMsg}AWS account ${accountName} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsAccountUpgradeFailed

```text
${userEmail} was unable to intitate an upgrade of ${iamRoleMsg}AWS account ${accountName}${orgMsg}  with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsAccountUpgradeSucceeded

```text
${userEmail} initiated an upgrade of ${iamRoleMsg}AWS Account ${accountName}${orgMsg} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsCloudAccountAdditionFailed

```text
Unable to add the ${iamRoleMsg}AWS cloud account, ${accountName} (${nativeId})${orgMsg}, for feature ${feature}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsCloudAccountAdditionSucceeded

```text
Successfully added the ${iamRoleMsg}AWS cloud account ${accountName} (${nativeId}) for feature ${feature}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsCloudAccountDeletionFailed

```text
Unable to delete the ${iamRoleMsg}AWS cloud account ${accountName} (${nativeId})${orgMsg} for feature ${feature}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsCloudAccountDeletionSucceeded

```text
Successfully deleted the ${iamRoleMsg}AWS cloud account ${accountName} (${nativeId})${orgMsg} for feature ${feature}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsCloudAccountDisableFeatureJobFailed

```text
Failed to disable ${feature} of AWS account ${awsAccountDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsCloudAccountDisableFeatureJobForProtectionStarted

```text
Started to disable ${feature} of AWS account ${awsAccountDisplayName}. Snapshots from AWS will ${deleteSnapshotsMsg}be deleted.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsCloudAccountDisableFeatureJobSucceeded

```text
Successfully disabled ${feature} of AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsCloudAccountDisconnect

```text
Disconnected AWS cloud account ${accountName} (${nativeId})${orgMsg} for feature ${feature}. Reason: The CloudFormation stack for the cross-account role has been deleted.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

AwsCloudAccountMigrationFailed

```text
Failed to migrate AWS account, ${accountName} (${nativeId}), for  feature, ${feature}, to AWS organization, ${orgName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsCloudAccountMigrationSucceeded

```text
Successfully migrated AWS account, ${accountName} (${nativeId}), for  feature, ${feature}, to AWS organization, ${orgName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsCloudAccountMissingPermissions

```text
The Account ${name} (${nativeId}) requires additional permissions for a recent enhancement with ${feature}. Navigate to AWS accounts under Remote Settings and upgrade permissions to reconnect account.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

AwsCloudAccountUpdateFailed

```text
Failed to ${action} the ${iamRoleMsg}AWS cloud account, ${accountName} (${nativeId})${orgMsg}, for feature ${feature}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsCloudAccountUpdateSucceeded

```text
Successfully ${action} the ${iamRoleMsg}AWS cloud account ${accountName} (${nativeId})${orgMsg} for feature ${feature}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsOrgCloudAccountMissingPermissions

```text
The Account ${name} (${nativeId}) of organization ${orgName} requires  additional permissions for a recent enhancement with ${feature}. Navigate to AWS accounts under Settings Menu and upgrade permissions to reconnect account.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

AwsOutpostAccountAdditionFailed

```text
${userEmail} failed to initiate the addition of Laminar AWS Outpost Account with ID ${nativeId}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsOutpostAccountAdditionFailed

```text
Failed to add the AWS Outpost account (${nativeId}) for Laminar. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsOutpostAccountAdditionSucceeded

```text
${userEmail} initiated the addition of Laminar AWS Outpost Account with ID ${nativeId}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsOutpostAccountAdditionSucceeded

```text
Successfully added the Laminar AWS Outpost account (${nativeId}).
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsOutpostAccountUpdateFailed

```text
${userEmail} failed to update the AWS Outpost account with ID ${nativeId} for Laminar.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsOutpostAccountUpdateFailed

```text
Failed to update the AWS Outpost account (${nativeId}) for Laminar. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsOutpostAccountUpdateSucceeded

```text
${userEmail} updated AWS Outpost account with ID ${nativeId} for Laminar.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsOutpostAccountUpdateSucceeded

```text
Successfully updated the AWS Outpost account (${nativeId}) for Laminar.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureCloudAccountAdditionFailed

```text
Failed to add Azure Subscription ${subscriptionName} with ID ${nativeId} for feature ${feature}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureCloudAccountAdditionSucceeded

```text
Successfully added Azure Subscription ${subscriptionName} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureCloudAccountDeleteTaskFailed

```text
Failed to delete ${feature} of ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureCloudAccountDeleteTaskStarted

```text
Started to delete ${feature} of ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureCloudAccountDeleteTaskSucceeded

```text
Successfully deleted ${feature} of ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureCloudAccountDeletionFailed

```text
Failed to delete permissions of the Azure Subscription ${subscriptionName} with ID ${nativeId} for feature ${feature}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureCloudAccountDeletionSucceeded

```text
Successfully deleted permissions of the Azure Subscription ${subscriptionName} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureCloudAccountDisconnected

```text
The Subscription ${subscriptionName} (${nativeId}) was disconnected because the Azure Active Directory application created for Rubrik was deleted. Under Remote Settings, open Azure Subscriptions and upgrade permissions to reconnect Subscription.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureCloudAccountMissingPermissions

```text
The Subscription ${subscriptionName} (${nativeId}) requires additional permissions for a recent enhancement with ${feature}. Navigate to Azure Subscriptions under Remote Settings and upgrade permissions to reconnect Subscription.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

AzureCloudAccountUpdateNameFailed

```text
Failed to update name of the Azure Subscription with ID ${nativeId} to ${name}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureCloudAccountUpdateNameSucceeded

```text
Successfully updated name of the Azure Subscription with ID ${nativeId} to ${name}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureCloudAccountUpdateRegionsFailed

```text
Failed to update regions in the Azure Subscription ${subscriptionName} with ID ${nativeId} for feature ${feature}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureCloudAccountUpdateRegionsSucceeded

```text
Successfully updated regions in the Azure Subscription ${subscriptionName} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureCloudAccountUpgradeFailed

```text
Failed to update permissions of the Azure Subscription ${subscriptionName} with ID ${nativeId} for feature ${feature}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureCloudAccountUpgradeSucceeded

```text
Successfully updated permissions of the Azure Subscription ${subscriptionName} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureEntraIDGroupCreationFailed

```text
${userEmail} unable to create Azure Entra ID group '${groupName}' in Azure tenant ${tenantDomain} with member '${servicePrincipalName}' (ID ${servicePrincipalId}). Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AzureEntraIDGroupCreationSucceeded

```text
${userEmail} successfully created Azure Entra ID group '${groupName}' (ID ${groupId}) in Azure tenant ${tenantDomain} with member '${servicePrincipalName}' (ID ${servicePrincipalId}).
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AzureEntraIDGroupDeletionFailed

```text
${userEmail} unable to delete Azure Entra ID group '${groupName}' (ID ${groupId}) from Azure tenant ${tenantDomain}.  Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AzureEntraIDGroupDeletionSucceeded

```text
${userEmail} successfully deleted Azure Entra ID group '${groupName}' (ID ${groupId}) from Azure tenant ${tenantDomain}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AzureEntraIDGroupMemberAdditionFailed

```text
${userEmail} unable to add member '${servicePrincipalName}' (ID ${servicePrincipalId}) to Azure Entra ID group '${groupName}' (ID ${groupId}) in Azure tenant ${tenantDomain}.  Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AzureEntraIDGroupMemberAdditionSucceeded

```text
${userEmail} successfully added member '${servicePrincipalName}' (ID ${servicePrincipalId}) to Azure Entra ID group '${groupName}' (ID ${groupId}) in Azure tenant ${tenantDomain}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AzureSubscriptionAdditionFailed

```text
${userEmail} failed to add Azure Subscription ${subscriptionName} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AzureSubscriptionAdditionSucceeded

```text
${userEmail} added Azure Subscription ${subscriptionName} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AzureSubscriptionDeletionFailed

```text
${userEmail} failed to delete Azure Subscription ${subscriptionName} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AzureSubscriptionDeletionSucceeded

```text
${userEmail} deleted Azure Subscription ${subscriptionName} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AzureSubscriptionUpdateFailed

```text
${userEmail} failed to update Azure Subscription ${subscriptionName} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AzureSubscriptionUpdateSucceeded

```text
${userEmail} updated Azure Subscription ${subscriptionName} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AzureSubscriptionUpgradeFailed

```text
${userEmail} failed to upgrade Azure Subscription ${subscriptionName} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AzureSubscriptionUpgradeSucceeded

```text
${userEmail} upgraded Azure Subscription ${subscriptionName} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CloudAccountDeleteFeatureTaskFailed

```text
Failed to delete ${feature} of ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudAccountDeleteFeatureTaskStarted

```text
Started to delete ${feature} of ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudAccountDeleteFeatureTaskSucceeded

```text
Successfully deleted ${feature} of ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudAccountDisableFeatureJobFailed

```text
Failed to disable ${feature} of ${cloudProvider}  ${accountTerminology} ${cloudAccountDisplayName}${awsOrgMsg}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudAccountDisableFeatureJobForProtectionStarted

```text
Started to disable ${feature} of ${cloudProvider}  ${accountTerminology} ${cloudAccountDisplayName}${awsOrgMsg}. ${deleteSnapshotsMsg}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudAccountDisableFeatureJobSucceeded

```text
Successfully disabled ${feature} of ${cloudProvider}  ${accountTerminology} ${cloudAccountDisplayName}${awsOrgMsg}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudAccountDisableFeatureTaskFailed

```text
Failed to disable ${feature} of ${cloudProvider}  ${accountTerminology} ${cloudAccountDisplayName}${awsOrgMsg}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudAccountDisableFeatureTaskStarted

```text
Started to disable ${feature} of ${cloudProvider}  ${accountTerminology} ${cloudAccountDisplayName}${awsOrgMsg}. ${deleteSnapshotsMsg}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudAccountDisableFeatureTaskSucceeded

```text
Successfully disabled ${feature} of ${cloudProvider}  ${accountTerminology} ${cloudAccountDisplayName}${awsOrgMsg}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudAccountElevatedPrivilegesAdded

```text
${userEmail} initiated a privilege elevation session for tenant - ${tenantDomain}, using OAuth.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudAccountElevatedPrivilegesRemoved

```text
Elevated privileges for user ${userEmail} to ${tenantDomain} revoked.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudAccountRoleChainingMappingFailed

```text
Failed to map AWS cloud account ${accountName} (${nativeId}) to role chaining account ${roleChainingAccountName} (${roleChainingAccountNativeId}). Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudAccountRoleChainingMappingSucceeded

```text
Successfully mapped AWS cloud account ${accountName} (${nativeId}) to role chaining account ${roleChainingAccountName} (${roleChainingAccountNativeId}).
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudAccountRoleChainingUnMappingFailed

```text
Failed to unmap AWS cloud account ${accountName} (${nativeId}) from role chaining account ${roleChainingAccountName} (${roleChainingAccountNativeId}). Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudAccountRoleChainingUnMappingSucceeded

```text
Successfully unmapped AWS cloud account ${accountName} (${nativeId}) from role chaining account ${roleChainingAccountName} (${roleChainingAccountNativeId}).
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudaccountsAwsExocomputeConfigAddFailed

```text
${userEmail} failed to add Exocompute settings for the ${region} region of the ${accountName} AWS account.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

CloudaccountsAwsExocomputeConfigAddSucceeded

```text
${userEmail} successfully added Exocompute settings for the ${region} region of the ${accountName} AWS account.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CloudaccountsAwsExocomputeConfigDeleteFailed

```text
${userEmail} failed to delete Exocompute settings for the ${region} region for the ${accountName} AWS account.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

CloudaccountsAwsExocomputeConfigDeleteSucceeded

```text
${userEmail} successfully deleted Exocompute settings for the ${region} region of the ${accountName} AWS account.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CloudaccountsAzureExocomputeConfigAddFailed

```text
${userEmail} failed to add Exocompute settings for the ${region} region of the Azure Subscription ${subscriptionName} with ID ${nativeID}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

CloudaccountsAzureExocomputeConfigAddSucceeded

```text
${userEmail} successfully added Exocompute settings for the ${region} region of the Azure Subscription ${subscriptionName} with ID ${nativeID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CloudaccountsAzureExocomputeConfigDeleteFailed

```text
${userEmail} failed to delete Exocompute settings for the ${region} region for the Azure Subscription ${subscriptionName} with ID ${nativeID}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

CloudaccountsAzureExocomputeConfigDeleteSucceeded

```text
${userEmail} successfully deleted Exocompute settings for the ${region} region of the Azure Subscription ${subscriptionName} with ID ${nativeID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CloudaccountsDisableFeatureJobFailed

```text
${userEmail} was unable to initialize disabling ${feature} of  ${cloudProvider} ${accountTerminology}  ${cloudAccountDisplayName}${awsOrgMsg}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

CloudaccountsDisableFeatureJobForAwsProtectionStarted

```text
${userEmail} started to disable ${feature} of AWS account ${awsAccountDisplayName}. ${featureSnapshots} from AWS will ${deleteSnapshotsMsg} be deleted.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CloudaccountsDisableFeatureJobForAwsStartFailed

```text
${userEmail} failed to start disable of ${feature} of AWS account ${awsAccountDisplayName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

CloudaccountsDisableFeatureJobStarted

```text
${userEmail} started to disable ${feature} of ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}${awsOrgMsg}. ${deleteSnapshotsMsg}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

GcpCloudAccountAdditionFailed

```text
Failed to add GCP Project ${name} with ID ${nativeId} for feature ${feature}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

GcpCloudAccountAdditionSucceeded

```text
Successfully added GCP Project ${name} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

GcpCloudAccountDeletionFailed

```text
Failed to delete permissions of the GCP Project ${name} with ID ${nativeId} for feature ${feature}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

GcpCloudAccountDeletionSucceeded

```text
Successfully deleted permissions of the GCP Project ${name} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

GcpCloudAccountMissingPermissions

```text
The Project ${name} (${nativeId}) requires additional permissions for a recent enhancement with ${feature}. Navigate to GCP Projects under Remote Settings and upgrade permissions to reconnect Project.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

GcpCloudAccountUpgradeFailed

```text
Failed to update permissions of the GCP Project ${name} with ID ${nativeId} for feature ${feature}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

GcpCloudAccountUpgradeSucceeded

```text
Successfully updated permissions of the GCP Project ${name} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

GcpProjectOperationFailed

```text
${userEmail} failed to ${operation} GCP Project ${name} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

GcpProjectOperationSucceeded

```text
${userEmail} ${operation} GCP Project ${name} with ID ${nativeId} for feature ${feature}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## cloudnative

______________________________________________________________________

CentralExocomputeShareSnapshotsFailed

```text
Failed to share snapshots with the mapped Exocompute account ${exocomputeAccountName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

CentralExocomputeShareSnapshotsStarted

```text
Sharing snapshots with the mapped Exocompute account ${exocomputeAccountName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CentralExocomputeShareSnapshotsSucceeded

```text
Successfully shared snapshots with the mapped Exocompute account ${exocomputeAccountName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CentralExocomputeUnShareSnapshotsFailed

```text
Failed to unshare snapshots from the mapped Exocompute account ${exocomputeAccountName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

CentralExocomputeUnShareSnapshotsStarted

```text
Unsharing snapshots from the mapped Exocompute account ${exocomputeAccountName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CentralExocomputeUnShareSnapshotsSucceeded

```text
Successfully unshared snapshots from the mapped Exocompute account ${exocomputeAccountName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeCheckInstanceConnectivityFailed

```text
Failed to validate connectivity to the RDS servers from Exocompute nodes. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

CloudNativeCheckInstanceConnectivityStarted

```text
Validating connectivity to the RDS servers from Exocompute nodes.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeCheckInstanceConnectivitySucceeded

```text
Successfully validated the connectivity to the exported RDS servers.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeDBPrereqSetupJobCanceled

```text
Canceled database backup set up on ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

CloudNativeDBPrereqSetupJobCanceling

```text
Canceling database backup set up on ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

CloudNativeDBPrereqSetupJobFailed

```text
Could not set up database backup on ${qualifiedSnappableDisplayText}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudNativeDBPrereqSetupJobQueued

```text
Queued database backup set up on ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

CloudNativeDBPrereqSetupJobSetupTaskFailed

```text
Failed to prepare ${qualifiedSnappableDisplayText} for persistent database backup. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeDBPrereqSetupJobSetupTaskStarted

```text
Started preparation for persistent database backup on ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeDBPrereqSetupJobSetupTaskSucceeded

```text
Successfully prepared ${qualifiedSnappableDisplayText} for persistent database backup.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeDBPrereqSetupJobStarted

```text
${userEmail} started database backup set up on ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CloudNativeDBPrereqSetupJobStarted

```text
Started database backup set up on ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeDBPrereqSetupJobStartFailed

```text
${userEmail} failed to start database backup set up on ${qualifiedSnappableDisplayText}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

CloudNativeDBPrereqSetupJobSucceeded

```text
Successfully set up database backup on ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudNativeRBAConnectivityJobCanceled

```text
Canceled the connectivity check to the Rubrik Backup Service on ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

CloudNativeRBAConnectivityJobCanceling

```text
Canceling the connectivity check to the Rubrik Backup Service on ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

CloudNativeRBAConnectivityJobFailed

```text
Could not check the connection to the Rubrik Backup Service on ${qualifiedSnappableDisplayText}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudNativeRBAConnectivityJobQueued

```text
Queued the check for the connection to the Rubrik Backup Service on ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

CloudNativeRBAConnectivityJobStarted

```text
Checking the connection to the Rubrik Backup Service on ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeRBAConnectivityJobStarted

```text
For ${userEmail}, checking the connection to the Rubrik Backup Service on ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CloudNativeRBAConnectivityJobStartFailed

```text
For user ${userEmail}, unable to initiate the check for the connection to the Rubrik Backup Service on ${qualifiedSnappableDisplayText}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

CloudNativeRBAConnectivityJobSucceeded

```text
Successfully connected to the Rubrik Backup Service on ${qualifiedSnappableDisplayText}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudNativeRequestClusterTaskFailed

```text
Failed to get an Exocompute cluster.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeRequestClusterTaskStarted

```text
Waiting for an Exocompute cluster to be ready.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeRequestClusterTaskSucceeded

```text
Using the Exocompute cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeRequestHostedClusterTaskFailed

```text
Failed to get a Rubrik-hosted compute cluster.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeRequestHostedClusterTaskStarted

```text
Waiting for a Rubrik-hosted compute cluster to be ready.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeRequestHostedClusterTaskSucceeded

```text
Using the Rubrik-hosted compute cluster.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

DeleteArchivalGroupsTaskFailed

```text
Failed to delete archival locations for ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName} Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

DeleteArchivalGroupsTaskStarted

```text
Deleting archival locations for ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Running** | **No** |

DeleteArchivalGroupsTaskSucceeded

```text
Successfully deleted archival locations for ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskSuccess** | **No** |

DeleteCloudAccountsTaskFailed

```text
Failed to delete features ${commaSeparatedFeatureList} for ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

DeleteCloudAccountsTaskStarted

```text
Deleting features ${commaSeparatedFeatureList} for ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Running** | **No** |

DeleteCloudAccountsTaskSucceeded

```text
Successfully deleted features ${commaSeparatedFeatureList} for ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskSuccess** | **No** |

DeleteExocomputeConfigsTaskFailed

```text
Failed to delete exocompute configurations for ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

DeleteExocomputeConfigsTaskStarted

```text
Deleting exocompute configurations for ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Running** | **No** |

DeleteExocomputeConfigsTaskSucceeded

```text
Successfully deleted exocompute configurations for ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskSuccess** | **No** |

ForceDeleteCloudAccountJobFailed

```text
Failed to delete ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ForceDeleteCloudAccountJobSucceeded

```text
Successfully deleted ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

ForceDeleteCloudAccountJobWithDeleteSnapshotsStarted

```text
Started to delete ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}. Snapshots from ${cloudProvider} will be deleted.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

ForceDeleteCloudAccountJobWithoutDeleteSnapshotsStarted

```text
Started to delete ${cloudProvider} ${accountTerminology} ${cloudAccountDisplayName}. Snapshots from ${cloudProvider} will not be deleted.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

FoundLeakedResources

```text
Rubrik Security Cloud encountered an issue while attempting to clean up your resources. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

PCRExoBundleCompatibilityCheckFailed

```text
RSC failed to validate your exo bundle version. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

TagRuleCreationFailed

```text
${userEmail} failed to create tag-rule ${ruleName} for ${objectType}, Failure reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

TagRuleCreationSucceeded

```text
${userEmail} successfully created tag-rule ${ruleName} for ${objectType}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TagRuleDeletionFailed

```text
${userEmail} failed to delete tag-rule ${ruleName} for ${objectType}, Failure reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

TagRuleDeletionSucceeded

```text
${userEmail} successfully deleted tag-rule ${ruleName} for ${objectType}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TagRuleModificationFailed

```text
${userEmail} failed to modify tag-rule ${ruleName} for ${objectType}, Failure reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

TagRuleModificationSucceeded

```text
${userEmail} successfully modified tag-rule ${ruleName} for ${objectType}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## cluster

______________________________________________________________________

AddClusterNodes

```text
${userName} started an add-node job for ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AddClusterNodesFailed

```text
${userName} failed to start an add-node job for ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

AddClusterRoute

```text
${userName} added route ${routeConfig} for Rubrik cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AddClusterRouteFailed

```text
${userName} was unable to add route ${routeConfig} for Rubrik cluster ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

AddSyslogExportRule

```text
${userName} added a Syslog export rule on ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AddSyslogExportRuleFailed

```text
${userName} was unable to add a Syslog export rule on ${clusterName}.  Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

BulkSupportTunnel

```text
${userName} started bulk ${action} support tunnel operation on ${clusterCount} clusters: ${clusterUuids}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ChangeSyslogConfiguration

```text
${userName} triggered a Syslog configuration change on ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ChangeSyslogConfigurationFailed

```text
${userName} failed to update Syslog configuration on ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

ConfigureVlan

```text
${userName} added VLAN with ID ${vlanId} to ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ConfigureVlanFailed

```text
${userName} failed to add VLAN with ID ${vlanId} to ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteClusterRoute

```text
${userName} deleted route, [${routeConfig}], for Rubrik cluster, ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteClusterRouteFailed

```text
${userName} was unable to delete a route, [${routeConfig}], for Rubrik cluster, ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteProxyConfig

```text
${userName} deleted the proxy settings for ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteProxyConfigFailed

```text
${userName} failed to delete the proxy settings for ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteSyslogConfiguration

```text
${userName} triggered a Syslog configuration deletion on ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteSyslogConfigurationFailed

```text
${userName} was unable to delete a Syslog configuration on ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

DeleteTerminatedClusterOpsData

```text
${userName} tried deleting the message for a terminated cluster-operation job on ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteVlans

```text
${userName} deleted VLAN(s) with ID ${vlanIds} for ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteVlansFailed

```text
${userName} failed to delete VLAN(s) with ID ${vlanIds} for ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

FindBadDisk

```text
${userName} successfully ran find bad disk on ${nodeId} for ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

FindBadDiskFailed

```text
${userName} failed to find bad disk on ${nodeId} for ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

GenerateClusterRegistrationToken

```text
${userName} generated registration token for cluster ${clusterUUID} with nodes ${nodeIDs} and managed by polaris set to ${managedByPolaris}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

GenerateClusterRegistrationTokenFailure

```text
${userName} failed to generate registration token for cluster ${clusterUUID} with nodes ${nodeIDs} and managed by polaris set to ${managedByPolaris}, reason ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

MigrateCloudClusterDisks

```text
${userName} started a disk migration job for the ${clusterName} cluster.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ModifyIpmi

```text
${userName} successfully modified IPMI settings for ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ModifyIpmiFailed

```text
${userName} failed to modify IPMI settings for ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

PauseClusterAlerts

```text
${userName} paused alerts for Rubrik cluster ${clusterName}, UUID: ${clusterUUID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RemoveCDMClusterStarted

```text
${userName} started removal of Rubrik Cluster ${clusterUUID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RemoveClusterNodes

```text
${userName} triggered removal of nodes: ${nodeIDs} on ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RemoveDisk

```text
${userName} successfully removed disk ${diskId} for ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RemoveDiskFailed

```text
${userName} failed to remove disk ${diskId} for ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RemoveNodeForReplacement

```text
${userName} triggered removal of node: ${nodeID} for replacement, on ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ReplaceClusterNode

```text
${userName} triggered replacement of node: ${nodeID} on ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ResizeDisk

```text
${userName} successfully resized disk ${diskId} for ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ResizeDiskFailed

```text
${userName} failed to resize disk ${diskId} for ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

SetClusterDnsAndSearchDomains

```text
${userName} updated the DNS servers and search domains for ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SetClusterDnsAndSearchDomainsFailed

```text
${userName} failed to update the DNS server or search domains for ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

SetupDisk

```text
${userName} successfully set up disk ${diskId} for ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SetupDiskFailed

```text
${userName} failed to set up disk ${diskId} for ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

SupportTunnelDisableFailed

```text
Support Tunnel for cluster '${clusterName}' failed to close. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SupportTunnelDisableNoTunnels

```text
No support tunnels were enabled on cluster '${clusterName}', nothing to disable
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

SupportTunnelDisableStarted

```text
Started to disable support tunnel on cluster '${clusterName}'
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SupportTunnelDisableSucceeded

```text
Support Tunnel for cluster '${clusterName}' was successfully closed
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SupportTunnelEnableFailed

```text
Support Tunnel for cluster '${clusterName}' failed to open. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SupportTunnelEnableStarted

```text
Started to enable support tunnel on cluster '${clusterName}'
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SupportTunnelEnableSucceeded

```text
Support Tunnel for cluster '${clusterName}' was successfully opened
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SupportTunnelNodeDisableFailed

```text
Cluster '${clusterName}: Support Tunnel for node '${nodeID}' failed to close. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

SupportTunnelNodeDisableSucceeded

```text
Cluster '${clusterName}: Support Tunnel for node '${nodeID}' was successfully closed
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SupportTunnelNodeEnableFailed

```text
Cluster '${clusterName}: Support Tunnel for node '${nodeID}' failed to open. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

SupportTunnelNodeEnableSucceeded

```text
Cluster '${clusterName}: Support Tunnel for node '${nodeID}' was successfully opened
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

UnpauseClusterAlerts

```text
${userName} resumed alerts for Rubrik cluster ${clusterName}, UUID: ${clusterUUID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateAirGapStatusFailed

```text
${userName} failed to modify the air-gap status for ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateAirGapStatusSucceeded

```text
${userName} modified the air-gap status for ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateClusterIps

```text
${userName} updated the floating IPs for ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateClusterIpsFailed

```text
${userName} failed to update the floating IPs for ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateClusterNtpServers

```text
${userName} updated the NTP servers for ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateClusterNtpServersFailed

```text
${userName} failed to update the NTP servers for ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateClusterSettings

```text
${userName} successfully updated cluster settings for ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateClusterSettingsFailed

```text
${userName} failed to update cluster settings for ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateProxyConfig

```text
${userName} updated the proxy settings for ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateProxyConfigFailed

```text
${userName} failed to update the proxy settings for ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateRegisteredMode

```text
${userName} successfully updated the RSC managed mode for ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateRegisteredModeFailed

```text
${userName} was unable to update the RSC managed mode for ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateVlan

```text
${userName} updated VLAN with ID ${vlanId} for Rubrik cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateVlanFailed

```text
${userName} was unable to update VLAN with ID ${vlanId} for Rubrik cluster ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## cluster_pause_resume

______________________________________________________________________

ClusterPauseResumeFailed

```text
${userEmail} unable to ${action} protection on clusters:  ${clusterList}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

ClusterPauseResumeFailed

```text
Unable to ${action} protection on clusters: ${clusterList}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ClusterPauseResumeSucceeded

```text
${userEmail} has successfully ${action} protection on clusters:  ${clusterList}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ClusterPauseResumeSucceeded

```text
Successfully ${action} protection on clusters: ${clusterList}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## common

______________________________________________________________________

FirmwareUpdateStarted

```text
${username} started firmware update on Rubrik cluster '${clusterName}' with ID '${clusterUuid}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PatchVmFailed

```text
${username} failed to patch '${objType}' VM named '${vmName}' with ID '${vmID}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

PatchVmStarted

```text
${username} started patching '${objType}' VM named '${vmName}' with ID '${vmID}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VmRegisterAgentFailed

```text
${username} failed to register agent on '${objType}' VM named '${vmName}' with ID '${vmID}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VmRegisterAgentStarted

```text
${username} started registering agent on '${objType}' VM named '${vmName}' with ID '${vmID}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## cross_account

______________________________________________________________________

CrossAccountMetadataSyncFailed

```text
Failed to sync metadata from cross-account ${accountName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

## crossaccount

______________________________________________________________________

CrossAccountPairCreation

```text
${username} initiated connection of cross-account ${crossAccountFqdn}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CrossAccountPairDeletion

```text
${username} initiated deletion of cross-account connection  for ${crossAccountFqdn}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CrossAccountPairRefresh

```text
${username} initiated refresh of cross-account connection  for ${crossAccountFqdn}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## database

______________________________________________________________________

ConfigureLogReportingProperties

```text
${username} updated database log reporting properties on  cluster '${clusterName}' with ID '${clusterId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ConfigureLogReportingPropertiesFailure

```text
${username} failed to update database log reporting properties on  cluster '${clusterName}' with ID '${clusterId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## db2

______________________________________________________________________

AddDb2InstanceFailure

```text
${username} failed to add Db2 instance '${instanceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

AddDb2InstanceStarted

```text
${username} started adding Db2 instance '${instanceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ConfigureDb2RestoreFailure

```text
${username} failed to configure host IDs ${hostIds} for cross-host restore of Db2 database '${databaseName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ConfigureDb2RestoreStarted

```text
${username} started configuring host IDs ${hostIds} for cross-host restore of Db2 database '${databaseName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteDb2DatabaseFailure

```text
${username} failed to delete Db2 database '${databaseName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteDb2DatabaseStarted

```text
${username} started deleting Db2 database '${databaseName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteDb2InstanceFailure

```text
${username} failed to delete Db2 instance '${instanceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteDb2InstanceStarted

```text
${username} started deleting Db2 instance '${instanceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DiscoverDb2InstanceFailure

```text
${username} failed to refresh metadata for Db2 instance '${instanceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DiscoverDb2InstanceStarted

```text
${username} started refreshing metadata for Db2 instance '${instanceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EditDb2InstanceFailure

```text
${username} failed to modify Db2 instance '${instanceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

EditDb2InstanceStarted

```text
${username} modified Db2 instance '${instanceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PatchDb2DatabaseFailure

```text
${username} failed to patch metadata for Db2 database '${databaseName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

PatchDb2DatabaseStarted

```text
${username} started patching metadata for Db2 database '${databaseName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RefreshDb2DatabaseFailure

```text
${username} failed to refresh metadata for Db2 database '${databaseName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RefreshDb2DatabaseStarted

```text
${username} started refreshing metadata for Db2 database '${databaseName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## encryption_keys

______________________________________________________________________

ArchivalKeyRotationFailure

```text
Key rotation on archival location ${locationName} has failed.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ArchivalKeyRotationInitiated

```text
Key rotation on archival location ${locationName} is initiated.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ArchivalKeyRotationSuccess

```text
Key rotation on archival location ${locationName} has succeeded.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ArchivalRekeyFailure

```text
Rekey of ${rekeyJobType} on archival location ${locationName} has failed. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ArchivalRekeyInitiated

```text
Rekey of ${rekeyJobType} on archival location ${locationName} is initiated.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ArchivalRekeySucceeded

```text
The rekey of ${rekeyJobType} on archival location ${locationName} has been successfully completed.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ArchivalRekeySuccessOnCdm

```text
Rekey of ${rekeyJobType} on archival location ${locationName} has succeeded on the CDM cluster.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ArchivalRekeyTaskFailure

```text
Rekey of ${rekeyJobType} on archival location ${locationName} has failed. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

## exchange

______________________________________________________________________

UpdateExchangeDag

```text
${username} updated Exchange Dag '${dagName}' with ID '${dagId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateExchangeDagFailed

```text
${username} failed to update Exchange Dag '${dagName}' with ID '${dagId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## exocompute

______________________________________________________________________

BYOKExocomputeClusterDeregistrationSucceeded

```text
${userEmail} successfully deregistered Exocompute cluster with ID ${clusterID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PCRBundleApprovalSucceeded

```text
${userName} successfully ${approvedOrRejected} bundle version ${bundleVersion}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PCRDeregisterSucceeded

```text
${userEmail} successfully deregistered Private Container Registry for Exocompute cloud account ID ${exocomputeCloudAccountID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PCROnboardingSucceeded

```text
${userEmail} successfully onboarded Private Container Registry ${registryURL} for Exocompute cloud account ID ${exocomputeCloudAccountID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## failover_cluster

______________________________________________________________________

AddFailoverClusterFailure

```text
${username} failed to add Host Failover Cluster '${failoverClusterName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

AddFailoverClusterStarted

```text
${username} started adding Host Failover Cluster '${failoverClusterName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteFailoverClusterFailure

```text
${username} failed to delete Host Failover Cluster '${failoverClusterName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteFailoverClusterStarted

```text
${username} started deleting Host Failover Cluster '${failoverClusterName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateFailoverClusterFailure

```text
${username} failed to update Host Failover Cluster '${failoverClusterName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateFailoverClusterStarted

```text
${username} updateed Host Failover Cluster '${failoverClusterName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## failover_cluster_app

______________________________________________________________________

AddFailoverClusterAppFailure

```text
${username} failed to add Host Failover Cluster App '${failoverClusterAppName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

AddFailoverClusterAppStarted

```text
${username} started adding Host Failover Cluster App '${failoverClusterAppName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteFailoverClusterAppFailure

```text
${username} failed to delete Host Failover Cluster App '${failoverClusterAppName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteFailoverClusterAppStarted

```text
${username} started deleting Host Failover Cluster App '${failoverClusterAppName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateFailoverClusterAppFailure

```text
${username} failed to update Host Failover Cluster App '${failoverClusterAppName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateFailoverClusterAppStarted

```text
${username} updateed Host Failover Cluster App '${failoverClusterAppName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## fileset

______________________________________________________________________

CreateFileset

```text
${username} created fileset '${filesetName} on ${parentObjectType} '${parentName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CreateFilesetFailure

```text
${username} failed to create fileset '${filesetName}' on ${parentObjectType} '${parentName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateFilesetTemplate

```text
${username} created fileset '${filesetName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CreateFilesetTemplateFailed

```text
${username} failed to create fileset '${filesetName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteFileset

```text
${username} deleted fileset '${filesetName}' on ${parentObjectType} '${parentName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteFilesetFailure

```text
${username} failed to delete fileset '${filesetName}' on ${parentObjectType} '${parentName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteFilesetTemplate

```text
${username} deleted fileset '${filesetName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteFilesetTemplateFailed

```text
${username} failed to delete fileset '${filesetName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateFilesetLevelCdmConfigs

```text
${username} modified backup throttles for fileset '${filesetName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateFilesetLevelCdmConfigsFailure

```text
${username} failed to modify backup throttles for fileset  '${filesetName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateFilesetTemplate

```text
${username} modified fileset '${filesetName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateFilesetTemplateFailed

```text
${username} failed to modify fileset '${filesetName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## gcpnative

______________________________________________________________________

DisableGCPNativeProjectArchiveSnapshotTaskFailed

```text
Failed to delete snapshots in the ${projectDisplayName} project.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

DisableGCPNativeProjectArchiveSnapshotTaskStarted

```text
Deleting snapshots in the ${projectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

DisableGCPNativeProjectArchiveSnapshotTaskSucceeded

```text
Deleted snapshots in the ${projectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

DisableGCPNativeProjectJobCanceled

```text
Canceled disable protection of the ${projectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

DisableGCPNativeProjectJobCanceling

```text
Canceling disable protection of the ${projectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

DisableGCPNativeProjectJobFailed

```text
Failed to disable protection of the ${projectDisplayName} project. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

DisableGCPNativeProjectJobStarted

```text
Started to disable protection of the ${projectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

DisableGCPNativeProjectJobSucceeded

```text
Successfully disabled protection of the ${projectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

GCPNativeDisableProjectJobStarted

```text
${userEmail} started disabling protection of the ${projectDisplayName} GCP project.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

GCPNativeDisableProjectJobStartFailed

```text
${userEmail} failed to start disabling protection of the ${projectDisplayName} GCP project. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

GCPNativeRefreshProjectJobStarted

```text
${userEmail} started refresh of GCP project ${gcpProjectDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

GCPNativeRefreshProjectJobStartFailed

```text
${userEmail} failed to start refresh of GCP project ${gcpProjectDisplayName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

RefreshGCPNativeProjectJobCanceled

```text
Canceled ${maintenanceType} refresh of the project ${gcpProjectDisplayName}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

RefreshGCPNativeProjectJobCanceling

```text
Canceling ${maintenanceType} refresh of the project ${gcpProjectDisplayName}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

RefreshGCPNativeProjectJobFailed

```text
Failed to refresh GCP project ${gcpProjectDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

RefreshGCPNativeProjectJobQueued

```text
Queued ${maintenanceType} refresh of GCP project ${gcpProjectDisplayName}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

RefreshGCPNativeProjectJobStarted

```text
Started  ${maintenanceType} refresh of GCP project ${gcpProjectDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

RefreshGCPNativeProjectJobSucceeded

```text
Successfully refreshed GCP project ${gcpProjectDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## health_monitor

______________________________________________________________________

RunPolicies

```text
${userName} successfully ran health monitor policies [${policyIds}] on nodes [${nodeIds}] for ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RunPoliciesFailed

```text
${userName} failed to run health monitor policies [${policyIds}] on nodes [${nodeIds}] for ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## host

______________________________________________________________________

ChangeVFDOnHostFailure

```text
${username} failed to ${operation} VFD on host '${hostName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ChangeVFDOnHostStarted

```text
${username} started ${operation} VFD on host '${hostName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteHostFailure

```text
${username} failed to delete host '${hostName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteHostStarted

```text
${username} started deleting host '${hostName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

MakePrimaryHostFailed

```text
${username} failed to configure cluster '${clusterName}' as primary for host '${hostName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

MakePrimaryHostStarted

```text
${username} started configuring cluster '${clusterName}' as primary for host '${hostName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RefreshHostMetadataFailed

```text
${username} failed to refresh metadata for host '${host}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RefreshHostMetadataStarted

```text
${username} started refreshing metadata for host '${host}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RegisteredHostSuccessfully

```text
${username} registered host '${hostName}' successfully.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RegisterHostFailure

```text
${username} failed to register host '${hostName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateHost

```text
${username} modified host '${hostName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateHostCertificate

```text
${username} modified certificate for host '${hostName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateHostCertificateFailed

```text
${username} failed to modify certificate for host '${hostName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateHostFailed

```text
${username} failed to modify host '${hostName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateRbaCredentialsFailure

```text
${username} failed to update RBS credentials for host '${hostName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateRbaCredentialsSuccess

```text
${username} updated RBS credentials for host '${hostName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## hyperv

______________________________________________________________________

AddHypervScvmmFailed

```text
${username} failed to create Hyperv Scvmm '${hostName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

AddHypervScvmmStarted

```text
${username} started creating Hyperv Scvmm '${hostName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteHypervScvmmFailed

```text
${username} failed to delete Hyperv Scvmm '${hypervScvmm}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteHypervScvmmStarted

```text
${username} started deleting Hyperv Scvmm '${hypervScvmm}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EditHypervScvmmFailed

```text
${username} failed to patch Hyperv Scvmm '${hypervScvmm}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

EditHypervScvmmStarted

```text
${username} started patching Hyperv Scvmm '${hypervScvmm}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RefreshHypervScvmmFailed

```text
${username} failed to refresh Hyperv Scvmm '${hypervScvmm}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RefreshHypervScvmmStarted

```text
${username} started refreshing Hyperv Scvmm '${hypervScvmm}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## k8s

______________________________________________________________________

K8sAddKubernetesClusterFailure

```text
${userName} was unable to add the Kubernetes cluster, ${kubernetesCluster}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

K8sAddKubernetesClusterSuccess

```text
${userName} added the Kubernetes cluster, ${kubernetesCluster}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

K8sCreateProtectionSetFailure

```text
${userName} was unable to create the Kubernetes protection set, ${kubernetesProtectionSet}, on Kubernetes cluster, ${kubernetesCluster}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

K8sCreateProtectionSetSuccess

```text
${userName} created the Kubernetes protection set, ${kubernetesProtectionSet}, on Kubernetes cluster, ${kubernetesCluster}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

K8sDeleteKubernetesClusterFailure

```text
${userName} was unable to initiate the deletion of Kubernetes cluster, ${kubernetesCluster}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

K8sDeleteKubernetesClusterSuccess

```text
${userName} initiated the deletion of Kubernetes cluster, ${kubernetesCluster}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

K8sDeleteProtectionSetFailure

```text
${userName} was unable to delete the Kubernetes protection set, ${kubernetesProtectionSet}, on Kubernetes cluster, ${kubernetesCluster}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

K8sDeleteProtectionSetSuccess

```text
${userName} initiated the deletion of Kubernetes protection set, ${kubernetesProtectionSet}, on Kubernetes cluster, ${kubernetesCluster}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

K8sGenerateManifestFailed

```text
${userName} failed to generate a Kubernetes manifest for cluster ${k8sClusterName}
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

K8sGenerateManifestSuccess

```text
${userName} generated a Kubernetes manifest for cluster ${k8sClusterName}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

K8sGetObjectConfigFailed

```text
${userName} was unable to retrieve the configuration for the Kubernetes object ${apigroup}/${resources}::${name} in ${scope} scope
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

K8sGetObjectConfigSuccess

```text
${userName} retrieved the configuration for the Kubernetes object ${apigroup}/${resources}::${name} in ${scope} scope
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

K8sRegenerateManifestFailed

```text
${userName} failed to regenerate Kubernetes manifest for cluster ${k8sClusterName}
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

K8sRegenerateManifestSuccess

```text
${userName} regenerated Kubernetes manifest for cluster ${k8sClusterName}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

K8sUpdateKubernetesClusterFailure

```text
${userName} was unable to modify the ${updatedFields} of the Kubernetes cluster, ${kubernetesCluster}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

K8sUpdateKubernetesClusterSuccess

```text
${userName} modified the ${updatedFields} of the Kubernetes cluster, ${kubernetesCluster}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

K8sUpdateProtectionSetFailure

```text
${userName} was unable to modify the Kubernetes protection set, ${kubernetesProtectionSet}, on Kubernetes cluster, ${kubernetesCluster}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

K8sUpdateProtectionSetSuccess

```text
${userName} modified the Kubernetes protection set, ${kubernetesProtectionSet}, on Kubernetes cluster, ${kubernetesCluster}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## kms_key_vault

______________________________________________________________________

AddKMSKeyVault

```text
${username} added KMS Key Vault ${keyVaultName} of type ${keyVaultType}${authConfigurationDetails}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteKMSKeyVault

```text
${username} deleted KMS Key Vault ${keyVaultName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EditAzureKmsKeyVaultFailure

```text
Failed to update the credentials for the KMS key vault ${kmsName}  on the Rubrik cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

EditAzureKmsKeyVaultInitiated

```text
Initiating the process to update the credentials for the KMS key vault ${kmsName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

EditAzureKmsKeyVaultSuccess

```text
Successfully updated credentials for the KMS key vault ${kmsName}  on the Rubrik cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

EditKmsKeyVaultFailure

```text
Failed to update the credentials for the KMS ${kmsName} of type ${kmsType} for archival location ${locationName} on the Rubrik cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

EditKmsKeyVaultInitiated

```text
Initiating the process to update the credentials for the KMS ${kmsName} of type ${kmsType} for archival location ${locationName} on the Rubrik cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

EditKmsKeyVaultSuccess

```text
Successfully updated credentials for the KMS ${kmsName} of type ${kmsType} for archival location ${locationName} on the Rubrik cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

UpdateKMSKeyVault

```text
${username} updated KMS Key Vault name from '${oldKeyVaultName}' to '${newKeyVaultName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateKMSKeyVaultCredentials

```text
${username} updated KMS Key Vault ${keyVaultName} credentials.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateKMSKeyVaultDescription

```text
${username} updated KMS Key Vault ${keyVaultName} description.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateKMSKeyVaultFailure

```text
Failed to update KMS key vault ${kmsName} of type ${kmsType}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

UpdateKMSKeyVaultSuccess

```text
Successfully updated KMS key vault ${kmsName} of type ${kmsType}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## kupr

______________________________________________________________________

KuprClusterRefreshCanceled

```text
Canceled refreshing Kubernetes Cluster ${clusterName} with clusterID ${clusterUUID}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

KuprClusterRefreshCanceling

```text
Canceling refreshing Kubernetes Cluster ${clusterName} with clusterID ${clusterUUID}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

KuprClusterRefreshCompleted

```text
Successfully refreshed Kubernetes Cluster ${clusterName} with clusterID ${clusterUUID}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

KuprClusterRefreshFailed

```text
Refreshing Kubernetes Cluster ${clusterName} with clusterID ${clusterUUID} failed. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

KuprClusterRefreshStarted

```text
Started refreshing Kubernetes Cluster ${clusterName} with clusterID ${clusterUUID}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

KuprDeletingClusterStarted

```text
${userName} deleted Kubernetes Cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

KuprDeletingClusterStarted

```text
${userName} deleted Kubernetes Cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

KuprOnBoardingStarted

```text
${userName} onboarded Kubernetes Cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

KuprOnboardingStarted

```text
${userName} onboarded Kubernetes Cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## legalhold

______________________________________________________________________

ApplyLegalHoldFailure

```text
${userEmail} on the Rubrik cluster named ${clusterName} unsuccessfully attempted to place a Legal Hold on the ${snapshotTimeDisplay} UTC snapshot of ${snappableName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ApplyLegalHoldSuccess

```text
${userEmail} has successfully placed a Legal Hold on the ${snapshotTimeDisplay} UTC snapshot of ${snappableName} on the Rubrik cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DissolveLegalHoldFailure

```text
${userEmail} on the Rubrik cluster named ${clusterName} unsuccessfully attempted to remove a Legal Hold from the ${snapshotTimeDisplay} UTC snapshot of ${snappableName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DissolveLegalHoldSuccess

```text
${userEmail} has successfully removed the Legal Hold from the ${snapshotTimeDisplay} UTC snapshot of ${snappableName} on the Rubrik cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## link_unlink

______________________________________________________________________

ObjectLinkingCanceled

```text
Canceled job to link ${objectNames} on Rubrik clusters  ${clusterNames}, and assign SLA Domain ${slaName} to these objects.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

ObjectLinkingCanceling

```text
Canceling a job to link ${objectNames} on Rubrik clusters  ${clusterNames}, and assign SLA Domain ${slaName} to these objects.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

ObjectLinkingFailed

```text
Job failed to link ${objectNames} on Rubrik clusters ${clusterNames},  and did not assign SLA Domain ${slaName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

ObjectLinkingStarted

```text
Started a job to link ${objectNames} on Rubrik clusters ${clusterNames},  and assign SLA Domain ${slaName} to these objects.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ObjectLinkingSuccess

```text
Successfully linked ${objectNames} on Rubrik clusters  ${clusterNames}, and assigned SLA Domain ${slaName} to these objects.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ObjectSLAAssignmentCanceled

```text
Canceled job to update the SLA Domain of ${objectNames} on  Rubrik clusters ${clusterNames} to ${newSLANames}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

ObjectSLAAssignmentCanceling

```text
Canceling a job to update the SLA Domain of ${objectNames} on  Rubrik clusters ${clusterNames} to ${newSLANames}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

ObjectSLAAssignmentFailed

```text
Job failed to update the SLA Domain of ${objectNames} on  Rubrik clusters ${clusterNames} to ${newSLANames}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

ObjectSLAAssignmentStarted

```text
Started a job to update the SLA Domain of ${objectNames} on  Rubrik clusters ${clusterNames} to ${newSLANames}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ObjectSLAAssignmentSuccess

```text
Successfully updated the SLA Domain of ${objectNames} on  Rubrik clusters ${clusterNames} to ${newSLANames}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ObjectUnlinkingCanceled

```text
Canceled job to unlink and unprotect ${objectNames} on  Rubrik clusters ${clusterNames}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

ObjectUnlinkingCanceling

```text
Canceling a job to unlink and unprotect ${objectNames} on  Rubrik clusters ${clusterNames}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

ObjectUnlinkingFailed

```text
Job failed to unlink and unprotect ${objectNames} on  Rubrik clusters ${clusterNames}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

ObjectUnlinkingStarted

```text
Started a job to unlink and unprotect ${objectNames} on  Rubrik clusters ${clusterNames}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ObjectUnlinkingSuccess

```text
Successfully unlinked and unprotected ${objectNames} on  Rubrik clusters ${clusterNames}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## managed_volume

______________________________________________________________________

ConfigureManagedVolumeLogExportFailure

```text
${username} failed to create a log export for Managed Volume: '${mvName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ConfigureManagedVolumeLogExportSuccess

```text
${username} started the operation to create a log export for Managed Volume: '${mvName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

InternalResizeManagedVolume

```text
${username} started the operation to resize managed volume for '${mv}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

InternalResizeManagedVolumeFailure

```text
${username} failed to resize managed volume for '${mv}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

InternalUpdateManagedVolume

```text
${username} updated the Managed Volume '${mv}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

InternalUpdateManagedVolumeFailure

```text
${username} failed to update the Managed Volume '${mv}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

TakeManagedVolumeOnDemandSnapshot

```text
${username} started the operation to create on demand snapshot for Managed Volume: '${mvName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TakeManagedVolumeOnDemandSnapshotFailed

```text
${username} failed to create on demand snapshot for Managed Volume: '${mvName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

V1CreateManagedVolume

```text
${username} started the operation to create the Managed Volume '${mv}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

V1CreateManagedVolumeFailure

```text
${username} failed to create the Managed Volume '${mv}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

V1DeleteManagedVolume

```text
${username} started the operation to delete the Managed Volume '${mv}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

V1DeleteManagedVolumeFailure

```text
${username} failed to delete the Managed Volume '${mv}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## mongo

______________________________________________________________________

AddCdmMongoSourceFailure

```text
${username} unable to add MongoDB source '${sourceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

AddCdmMongoSourceStarted

```text
${username} started adding MongoDB source '${sourceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteCdmMongoSourceFailure

```text
${username} unable to delete MongoDB source '${sourceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteCdmMongoSourceStarted

```text
${username} started deleting MongoDB source '${sourceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DiscoverCdmMongoSourceFailure

```text
${username} unable to refresh metadata for MongoDB source '${sourceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DiscoverCdmMongoSourceStarted

```text
${username} started refreshing metadata for MongoDB source '${sourceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EditCdmMongoSourceFailure

```text
${username} unable to edit MongoDB source '${sourceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

EditCdmMongoSourceStarted

```text
${username} modified MongoDB source '${sourceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RecoverCdmMongoDatabasesAndCollectionsFailure

```text
${username} unable to recover databases and collections to MongoDB source '${sourceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RecoverCdmMongoDatabasesAndCollectionsStarted

```text
${username} started recovering databases and collections to MongoDB source '${sourceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## mongo_source

______________________________________________________________________

AddMongoSourceFailure

```text
${username} failed to add the MongoDB source '${sourceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

AddMongoSourceStarted

```text
${username} started adding the MongoDB source '${sourceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteMongoSourceFailure

```text
${username} failed to delete the MongoDB source '${sourceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteMongoSourceStarted

```text
${username} started deleting the MongoDB source '${sourceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EditMongoSourceFailure

```text
${username} failed to modify the MongoDB source '${sourceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

EditMongoSourceStarted

```text
${username} modified the MongoDB source '${sourceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## mosaic_store

______________________________________________________________________

AddMosaicStoreFailure

```text
${username} failed to add the NoSQL store '${storeName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

AddMosaicStoreStarted

```text
${username} started the operation to add the NoSQL store '${storeName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteMosaicStoreFailure

```text
${username} failed to delete the NoSQL store '${storeName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteMosaicStoreStarted

```text
${username} started the operation to delete the NoSQL store '${storeName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EditMosaicStoreeStarted

```text
${username} modified the NoSQL store '${storeName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EditMosaicStoreFailure

```text
${username} failed to modify the NoSQL store '${storeName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## mssql

______________________________________________________________________

UpdateDefaultDbPropertiesFailed

```text
${username} failed to update default database properties for cluster '${clusterUuid}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateDefaultDbPropertiesSuccess

```text
${username} successfully updated default database properties for cluster '${clusterUuid}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateMssqlAvailabilityGroup

```text
${username} updated Microsoft SQL Server availability group '${availabilityGroupName}' with ID '${availabilityGroupId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateMssqlAvailabilityGroupFailed

```text
${username} failed to update Microsoft SQL Server availability group '${availabilityGroupName}' with ID '${availabilityGroupId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateMssqlDatabase

```text
${username} updated Mssql database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateMssqlDatabaseFailed

```text
${username} failed to update Mssql database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateMssqlHost

```text
${username} updated Microsoft SQL Server host '${hostName}' with ID '${hostId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateMssqlHostFailed

```text
${username} failed to update Microsoft SQL Server host '${hostName}' with ID '${hostId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateMssqlInstance

```text
${username} updated Microsoft SQL Server instance'${instanceName}' with ID '${instanceId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateMssqlInstanceFailed

```text
${username} failed to update Microsoft SQL Server instance '${instanceName}' with ID '${instanceId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateMssqlLogShippingConfiguration

```text
${username} updated log shipping configuration '${configId}' of Mssql database '${dbName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateMssqlLogShippingConfigurationFailed

```text
${username} failed to update log shipping configuration '${configId}' of Mssql database '${dbName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateMssqlLogShippingConfigurationFailedV1

```text
${username} failed to modify the log shipping configuration '${configId}'  for the Mssql database '${dbName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateMssqlLogShippingConfigurationV1

```text
${username} modified the log shipping configuration '${configId}'  for the Mssql database '${dbName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateMssqlWindowsCluster

```text
${username} updated Windows Cluster '${windowsClusterName}' with ID '${windowsClusterId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateMssqlWindowsClusterFailed

```text
${username} failed to update Windows Cluster '${windowsClusterName}' with ID '${windowsClusterId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## mysqldb_instance

______________________________________________________________________

AddMysqldbInstanceFailure

```text
${username} failed to add MySQL instance '${instanceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

AddMysqldbInstanceStarted

```text
${username} started adding MySQL instance '${instanceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteMysqldbInstanceFailure

```text
${username} failed to delete MySQL instance '${instanceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteMysqldbInstanceStarted

```text
${username} started deleting MySQL instance '${instanceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EditMysqldbInstanceFailure

```text
${username} failed to modify MySQL instance '${instanceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

EditMysqldbInstanceStarted

```text
${username} modified MySQL instance '${instanceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RefreshMysqldbInstanceMetadataFailed

```text
${username} failed to refresh metadata for MySQL instance '${instanceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RefreshMysqldbInstanceMetadataStarted

```text
${username} started refreshing metadata for MySQL instance '${instanceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RestoreMysqldbInstanceFailure

```text
${username} unable to complete a restore of MySQL instance '${instanceName} using snapshot with ID ${snapshotId}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RestoreMysqldbInstanceStarted

```text
${username} initiated a restore using the snapshot with ID ${snapshotId} for the MySQL instance '${instanceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## nas

______________________________________________________________________

BulkCopyAutomigratableNasHosts

```text
${username} Created RSC NAS System(s) from CDM NAS host(s). Migration modified the following objects Filesets    ${FilesetNames} Host Shares ${SharePaths} NAS Hosts   ${HostNames}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

BulkCopyAutomigratableNasHostsFailed

```text
${username} Failed to create RSC NAS System(s) from CDM NAS host(s). Reason: ${reason}. Migration may have modified the following objects Filesets:    ${FilesetNames} Host Shares: ${SharePaths} NAS Hosts:   ${HostNames}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

BulkMigrateRelicShareFilesets

```text
${username} Migrated relic CDM Share Fileset(s) to RSC NAS. Migration modified the following objects Filesets    ${FilesetNames} Host Shares ${SharePaths} NAS Hosts   ${HostNames}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

BulkMigrateRelicShareFilesetsFailed

```text
${username} Failed to migrate relic CDM Share Fileset(s) to RSC NAS. Reason: ${reason}. Migration may have modified the following objects Filesets:    ${FilesetNames} Host Shares: ${SharePaths} NAS Hosts:   ${HostNames}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

MigrateLegacyNasHostFilesets

```text
${username} Migrated CDM Share Fileset(s) to RSC NAS. Migration modified the following objects Filesets    ${FilesetNames} Host Shares ${SharePaths} NAS Hosts   ${HostNames}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

MigrateLegacyNasHostFilesetsFailed

```text
${username} Failed to migrate CDM Share Fileset(s) to RSC NAS. Reason: ${reason}. Migration may have modified the following objects Filesets:    ${FilesetNames} Host Shares: ${SharePaths} NAS Hosts:   ${HostNames}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## ncd

______________________________________________________________________

SetWanThrottle

```text
${username} successfully set WAN throttle.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SetWanThrottleFailed

```text
${username} was unable to set WAN throttle. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

## networkthrottle

______________________________________________________________________

DisableNetworkThrottleFailed

```text
${username} failed to disable ${resourceType} network throttle on cluster: ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DisableNetworkThrottleSucceeded

```text
${username} disabled ${resourceType} network throttle on cluster: ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EnableNetworkThrottleFailed

```text
${username} enabled ${resourceType} network throttle on cluster: ${clusterName} for interface '${interfaceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

EnableNetworkThrottleSucceeded

```text
${username} enabled ${resourceType} network throttle on cluster: ${clusterName} for interface '${interfaceName}' with default throttle limit set to ${defaultThrottleLimit} Mbps.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## networkthrottlebypass

______________________________________________________________________

DisableNetworkThrottleBypassFailed

```text
${username} failed to disable replication network throttle bypass on cluster: ${clusterName}  for target cluster: ${targetClusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DisableNetworkThrottleBypassSucceeded

```text
${username} disabled replication network throttle bypass on cluster: ${clusterName}  for target cluster: ${targetClusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EnableNetworkThrottleBypassFailed

```text
${username} failed to enable replication network throttle bypass on cluster: ${clusterName} for target cluster: ${targetClusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

EnableNetworkThrottleBypassSucceeded

```text
${username} enabled replication network throttle bypass on cluster: ${clusterName} for target cluster: ${targetClusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## newdevicelogin

______________________________________________________________________

NewDeviceLogin

```text
A login on a new device using ${browser} on ${os} detected for user ${userName} with IP ${ipAddress} and location ${location}.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Success** | **Yes** |

UserDeviceDelete

```text
User ${userName} deleted login device ${browser} on ${os} with IP ${ipAddress} and location ${location}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UserDeviceNameEdit

```text
User ${userName} renamed the login device from ${oldName} to ${newName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## nutanix

______________________________________________________________________

CreateNutanixClusterFailed

```text
${username} failed to create Nutanix cluster '${hostName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateNutanixClusterStarted

```text
${username} started creating Nutanix cluster '${hostName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CreateNutanixExportFailed

```text
${username} failed to export snapshot '${snapshotID}' of snappable '${snappableName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateNutanixExportStarted

```text
${username} started exporting snapshot '${snapshotID}' of snappable '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CreateNutanixInplaceExportFailed

```text
${username} failed to in-place export snapshot '${snapshotID}' of workload '${snappableName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateNutanixInplaceExportStarted

```text
${username} started in-place exporting snapshot '${snapshotID}' of workload '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CreateNutanixPrismCentralFailed

```text
${username} failed to create Nutanix Prism Central '${hostName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateNutanixPrismCentralStarted

```text
${username} started creating Nutanix Prism Central '${hostName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteNutanixClusterFailed

```text
${username} failed to delete Nutanix cluster '${nutanixCluster}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteNutanixClusterStarted

```text
${username} started deleting Nutanix cluster '${nutanixCluster}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteNutanixPrismCentralFailed

```text
${username} failed to delete Nutanix Prism Central '${nutanixPrismCentral}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteNutanixPrismCentralStarted

```text
${username} started deleting Nutanix Prism Central '${nutanixPrismCentral}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PatchNutanixClusterFailed

```text
${username} failed to patch Nutanix cluster '${nutanixCluster}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

PatchNutanixClusterStarted

```text
${username} started patching Nutanix cluster '${nutanixCluster}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PatchNutanixPrismCentralFailed

```text
${username} failed to patch Nutanix Prism Central '${nutanixPrismCentral}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

PatchNutanixPrismCentralStarted

```text
${username} started patching Nutanix Prism Central '${nutanixPrismCentral}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RefreshNutanixClusterFailed

```text
${username} failed to refresh Nutanix cluster '${nutanixCluster}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RefreshNutanixClusterStarted

```text
${username} started refreshing Nutanix cluster '${nutanixCluster}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RefreshNutanixPrismCentralFailed

```text
${username} failed to refresh Nutanix Prism Central '${nutanixPrismCentral}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RefreshNutanixPrismCentralStarted

```text
${username} started refreshing Nutanix Prism Central '${nutanixPrismCentral}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## o365

______________________________________________________________________

ExocomputeDeleteCanceled

```text
Canceled deleting Azure resources in ${exocomputeName}
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

ExocomputeDeleteCanceling

```text
Canceling deleting Azure resources in ${exocomputeName}
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

ExocomputeDeleteFailed

```text
Failed to delete Azure resources in ${exocomputeName}. For more information on this error please visit https://support.rubrik.com/articles/How_To/000002821
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ExocomputeDeleteStarted

```text
Started deleting Azure resources in ${exocomputeName}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ExocomputeDeleteSucceeded

```text
Successfully deleted Azure resources in ${exocomputeName}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ExocomputeScaleSucceeded

```text
Successfully scaled Azure AKS from ${oldCount} to ${newCount} nodes
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ExocomputeUpdateCanceled

```text
Canceled updating Azure resources in ${exocomputeName}
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

ExocomputeUpdateCanceling

```text
Canceling updating Azure resources in ${exocomputeName}
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

ExocomputeUpdateFailed

```text
Failed to update Azure resources in ${exocomputeName}. For more information on this error please visit https://support.rubrik.com/articles/How_To/000002821
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ExocomputeUpdateStarted

```text
Updating Azure resources in ${exocomputeName}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ExocomputeUpdateSucceeded

```text
Successfully updated Azure resources in ${exocomputeName}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

M365BackupStorageSetupSuccess

```text
${userEmail} successfully onboarded Microsoft 365 Backup Storage for Org ${orgName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

M365ConfiguredGroupCreated

```text
${userID} created a SharePoint/Teams Group '${name}' with wildcard  pattern '${wildcard}' and PDLs ${pdls}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

M365ConfiguredGroupDeleted

```text
${userID} removed SharePoint/Teams Group '${name}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

M365ConfiguredGroupModified

```text
${userID} modified SharePoint/Teams Group '${name}' with wildcard  pattern '${wildcard}' and PDLs ${pdls} into SharePoint/Teams Group '${newName}' with wildcard pattern '${newWildcard}' and PDLs ${newPdls}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

M365GroupDeleted

```text
${userID} removed ${groupType} '${name}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

M365GroupModified

```text
${userID} modified ${groupType} '${name}' with spec ${spec} into ${groupType} '${newName}' with spec ${newSpec}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

M36GroupCreated

```text
${userID} created a ${groupType} '${name}' with spec  '${spec}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

O365DeleteOrgFailed

```text
${userID} requested deletion of Microsoft 365 Subscription ${orgName}, but failed. Failure reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

O365DeleteOrgStarted

```text
${userID} started deletion of Microsoft 365 Subscription ${orgName}. (Taskchain ID is ${taskchainID})
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## openstack

______________________________________________________________________

AddOpenstackEnvironmentFailed

```text
${username} failed to start a job to add OpenStack environment '${environmentAddress}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AddOpenstackEnvironmentStarted

```text
${username} started a job to add OpenStack environment '${environmentAddress}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteOpenstackEnvironmentStarted

```text
${username} started a job to delete Openstack Environment '${environmentAddress}' on Rubrik cluster '${clusterUuid}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteOpenstackEnvironmentStartFailed

```text
${username} failed to start a job to delete Openstack Environment '${environmentAddress}' on Rubrik cluster '${clusterUuid}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RefreshOpenstackEnvironmentStarted

```text
${username} started a job to refresh OpenStack environment  '${environmentAddress}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RefreshOpenstackEnvironmentStartFailed

```text
${username} failed to start a job to refresh OpenStack environment  '${environmentAddress}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateOpenstackEnvironmentFailed

```text
${username} was unable to modify the OpenStack environment, '${environmentAddress}', on Rubrik cluster, '${clusterUuid}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

UpdateOpenstackEnvironmentSucceeded

```text
${username} modified the OpenStack environment, '${environmentAddress}', on Rubrik cluster, '${clusterUuid}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateOpenstackProxyVmSettingFailed

```text
${username} was unable to modify the proxy VM settings for OpenStack environment, '${environmentAddress}', on Rubrik cluster, '${clusterUuid}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

UpdateOpenstackProxyVmSettingSucceeded

```text
${username} modified the proxy VM settings for OpenStack environment, '${environmentAddress}', on Rubrik cluster, '${clusterUuid}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## oracle

______________________________________________________________________

DeleteAllOracleDatabaseSnapshots

```text
${username} deleted all snapshots for Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteAllOracleDatabaseSnapshotsFailed

```text
${username} failed to delete all snapshots for Oracle database  '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DownloadArchivedOracleSnapshot

```text
${username} downloaded archived snapshot '${snapshotId}' of Oracle database '${dbName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DownloadArchivedOracleSnapshotFailed

```text
${username} failed to download archived snapshot '${snapshotId}' of Oracle database '${dbName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ExportOracleDatabase

```text
${username} exported Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ExportOracleDatabaseFailed

```text
Failed to export Oracle database '${dbName}' with ID '${dbId}', initiated by ${username}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ExportOracleTablespace

```text
${username} exported tablespace ${tablespaceName} of Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ExportOracleTablespaceFailed

```text
${username} failed to export tablespace ${tablespaceName} of Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

InstantRecoverOracleSnapshot

```text
${username} instant recovered Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

InstantRecoverOracleSnapshotFailed

```text
${username} failed to instant recover Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

MountOracleDatabase

```text
${username} live mounted Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

MountOracleDatabaseFailed

```text
${username} failed to live mount Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

OraclePdbRestore

```text
${username} restored the PDBs '${pdbNames}' to Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

OraclePdbRestoreFailed

```text
${username} failed to restore the PDBs '${pdbNames}' to Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

OracleUnmount

```text
${username} removed Oracle mount with ID '${mountId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

OracleUnmountFailed

```text
${username} failed to remove Oracle mount with ID '${mountId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RefreshOracleDatabase

```text
${username} refreshed Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RefreshOracleDatabaseFailed

```text
${username} failed to refresh Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RestoreOracleLogs

```text
${username} restored logs of Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RestoreOracleLogsFailed

```text
${username} failed to restore logs of Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

TakeOnDemandOracleDatabaseSnapshot

```text
${username} took an on-demand snapshot of Oracle  database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TakeOnDemandOracleDatabaseSnapshotFailed

```text
${username} failed to take an on-demand snapshot of Oracle  database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

TakeOnDemandOracleLogSnapshot

```text
${username} took an on-demand log snapshot of Oracle database  '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TakeOnDemandOracleLogSnapshotFailed

```text
${username} failed to take an on-demand log snapshot of Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateOracleDatabase

```text
${username} updated Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateOracleDatabaseFailed

```text
${username} failed to update Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateOracleDataGuardGroup

```text
${username} updated Oracle Data Guard group '${dbName}' with ID  '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateOracleDataGuardGroupFailed

```text
${username} failed to refresh Oracle Data Guard group '${dbName}'  with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateOracleHost

```text
${username} updated Oracle host '${hostName}' with ID '${hostId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateOracleHostFailed

```text
${username} failed to update Oracle host '${hostName}' with ID '${hostId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateOracleRac

```text
${username} updated Oracle RAC '${racName}' with ID '${racId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateOracleRacFailed

```text
${username} failed to update Oracle RAC '${racName}' with ID '${racId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ValidateOracleDatabaseBackups

```text
${username} validated backups of Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ValidateOracleDatabaseBackupsFailed

```text
${username} failed to validate backups of Oracle database '${dbName}' with ID '${dbId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## org_config

______________________________________________________________________

EnforceStricterPolicy

```text
${admin} has enforced a stricter policy for tenant organizations.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

OrgFqdnUpdated

```text
${userEmail} has modified the FQDN for organization ${orgName} to ${currentFqdn}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

OrgQuotaCreated

```text
${userEmail} has created a ${quotaType} quota for organization ${orgName} on cluster ${clusterName}. The defined quota limits are  (soft limit: ${currentSoftLimit}, hard limit: ${currentHardLimit}).
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

OrgQuotaDeleted

```text
${userEmail} has deleted the ${quotaType} quota for organization ${orgName}  on cluster ${clusterName}. Previously, the quota limits were  (soft limit: ${previousSoftLimit}, hard limit: ${previousHardLimit}).
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

OrgQuotaUpdated

```text
${userEmail} has updated the ${quotaType} quota for organization ${orgName} on cluster ${clusterName} from  (soft limit: ${previousSoftLimit}, hard limit: ${previousHardLimit}) to (soft limit: ${currentSoftLimit}, hard limit: ${currentHardLimit}).
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UnenforceStricterPolicy

```text
${admin} has relaxed the policy for tenant organizations.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## org_network

______________________________________________________________________

CreateOrgNetwork

```text
${userName} created org network ${orgNetworkName} in org ${orgName} for cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CreateOrgNetworkFailed

```text
${userName} failed to create org network ${orgNetworkName} in org ${orgName} for cluster ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

DeleteEnvoyNgs

```text
${userName} removed Envoy Ngs: [${envoyIds}] from org network: ${orgNetworkName} in organization ${orgName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteOrgNetwork

```text
${userName} deleted org network ${orgNetworkName} in org ${orgName} for cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteOrgNetworkFailed

```text
${userName} failed to delete org network ${orgNetworkName} in org ${orgName} for cluster ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

MigrateHostsToOrgNetwork

```text
${userName} migrated ${total} hosts in the organization ${orgName}, RSC org network ${orgNetworkName}  for Rubrik cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

MigrateHostsToOrgNetworkFailed

```text
${userName} was unable to migrate hosts [${failedObjects}] in the organization ${orgName},    RSC org network ${orgNetworkName} for Rubrik cluster ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

MigrateVcentersToOrgNetwork

```text
${userName} migrated ${total} vCenters in organization ${orgName}, org network ${orgNetworkName}   for Rubrik cluster ${clusterName}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

MigrateVcentersToOrgNetworkFailed

```text
${userName} was unable to migrate vCenters [${failedObjects}] in organization ${orgName},  org network ${orgNetworkName} for Rubrik cluster ${clusterName} Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

SetLiveMountIps

```text
${userName} assigned Live Mount IPs: [${liveMountIps}] to org network: ${orgNetworkName} in organization ${orgName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateOrgNetwork

```text
${userName} updated organization network ${orgNetworkName} in organization ${orgName} for cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateOrgNetworkFailed

```text
${userName} failed to update organization network ${orgNetworkName} in organization ${orgName} for cluster ${clusterName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

## postgres_db_cluster

______________________________________________________________________

AddPostgresDbClusterFailure

```text
${username} failed to add PostgreSQL database cluster '${dbClusterName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

AddPostgresDbClusterStarted

```text
${username} started adding PostgreSQL database cluster '${dbClusterName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeletePostgresDbClusterFailure

```text
${username} failed to delete PostgreSQL database cluster '${dbClusterName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeletePostgresDbClusterStarted

```text
${username} started deleting PostgreSQL database cluster '${dbClusterName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EditPostgresDbClusterFailure

```text
${username} failed to modify PostgreSQL database cluster '${dbClusterName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

EditPostgresDbClusterStarted

```text
${username} modified PostgreSQL database cluster '${dbClusterName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RefreshPostgresDbClusterMetadataFailed

```text
${username} failed to refresh metadata for PostgreSQL database cluster '${dbClusterName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RefreshPostgresDbClusterMetadataStarted

```text
${username} started refreshing metadata for PostgreSQL database cluster '${dbClusterName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RestorePostgresDbClusterFailure

```text
${username} unable to complete a restore of PostgreSQL database cluster '${dbClusterName} using snapshot with ID ${snapshotId}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RestorePostgresDbClusterStarted

```text
${username} initiated a restore using the snapshot with ID ${snapshotId} for the PostgreSQL database cluster '${dbClusterName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## radar

______________________________________________________________________

RadarEventsDisabled

```text
Radar events have been disabled by ${user}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Success** | **Yes** |

RadarEventsDisabledForCluster

```text
Radar events have been disabled for cluster ${clusterName} by ${user}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Success** | **Yes** |

RadarEventsDisabledForSnappable

```text
Radar events have been disabled for protected object ${snappableName} on cluster ${clusterName} by ${user}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Success** | **Yes** |

RadarEventsDisabledForSubscription

```text
Radar events have been disabled for subscription ${subscriptionName} on cluster ${clusterName} by ${user}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RadarEventsEnabled

```text
Radar events have been enabled by ${user}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RadarEventsEnabledForCluster

```text
Radar events have been enabled for cluster ${clusterName} by ${user}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RadarEventsEnabledForSnappable

```text
Radar events have been enabled for protected object ${snappableName} on cluster ${clusterName} by ${user}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RadarEventsEnabledForSubscription

```text
Radar events have been enabled for subscription ${subscriptionName} on cluster ${clusterName} by ${user}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## rcv

______________________________________________________________________

RCVPEConnectionApprovalRequestApproved

```text
${userEmail} successfully approved connection approval request for private  endpoint ${pe_id} to RCV archival location '${name}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RCVPEConnectionApprovalRequestApproved

```text
Pursuant to Rubrik policy, a connection approval request for private  endpoint '${pe_id}' to RCV archival location '${name}' has been  successfully approved.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RCVPEConnectionApprovalRequestCreated

```text
${userEmail} successfully created connection approval request for private  endpoint ${pe_id} to RCV archival location '${name}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RCVPEConnectionApprovalRequestCreated

```text
Pursuant to Rubrik policy, a connection approval request for private  endpoint '${pe_id}' to RCV archival location '${name}' has been  successfully created.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RCVPEConnectionApprovalRequestExpired

```text
Pursuant to Rubrik policy, a connection approval request for private  endpoint '${pe_id}' to RCV archival location '${name}' has been expired.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RCVPEConnectionApprovalRequestRejected

```text
${userEmail} successfully rejected connection approval request for private  endpoint ${pe_id} to RCV archival location '${name}'.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

RCVPEConnectionApprovalRequestRejected

```text
Pursuant to Rubrik policy, a connection approval request for private  endpoint '${pe_id}' to RCV archival location '${name}' has been rejected.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

RCVPEConnectionApprovalRequestRemoved

```text
${userEmail} successfully removed connection approval request for private  endpoint ${pe_id} to RCV archival location '${name}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RCVPEConnectionApprovalRequestRemoved

```text
Pursuant to Rubrik policy, a connection approval request for private  endpoint '${pe_id}' to RCV archival location '${name}' has been removed.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RCVPrivateEndpointApprovalFailed

```text
Approval for Private Endpoint '${peId}' failed because of '${errMsg}'.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

RCVPublicAccessDisabled

```text
${userEmail} successfully disabled public access for RCV archival location '${name}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RCVPublicAccessDisabled

```text
Pursuant to Rubrik policy, public access to RCV archival location  '${name}' has been successfully disabled.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## rekey

______________________________________________________________________

RekeyMasterKey

```text
${username} has initiated the rekeying of the master key for the archival location ${locationName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RekeyRootKey

```text
${username} has initiated the rekeying of the root Key Encryption Key (KEK) for the archival location ${locationName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## replication

______________________________________________________________________

ReplicationLocationCancelImmediatelyPauseEnableSucceeded

```text
${userEmail} successfully paused replication from cluster: ${sourceClusterName} to cluster: ${targetClusterName}. Replication from the specified cluster will be canceled immediately.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ReplicationLocationPauseDisableFailed

```text
${userEmail} failed to resume replication from cluster: ${sourceClusterName} to cluster: ${targetClusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ReplicationLocationPauseDisableSucceeded

```text
${userEmail} successfully resumed replication from cluster: ${sourceClusterName} to cluster: ${targetClusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ReplicationLocationPauseEnableFailed

```text
${userEmail} failed to pause replication from cluster: ${sourceClusterName} to cluster: ${targetClusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ReplicationLocationPauseEnableSucceeded

```text
${userEmail} successfully paused replication from cluster: ${sourceClusterName} to cluster: ${targetClusterName}. Replication from the specified cluster will be canceled after any currently running jobs finish.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ReplicationLocationSkipSnapshotsPauseDisableSucceeded

```text
${userEmail} successfully resumed replication from cluster: ${sourceClusterName} to cluster: ${targetClusterName}. Replication will not include snapshots taken before and during the pause.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ReplicationPairCreationSucceeded

```text
${userEmail} added Rubrik cluster: ${targetClusterName} as replication target to Rubrik cluster: ${sourceClusterName} using ${setupType} configuration.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ReplicationPairDeletionSucceeded

```text
${userEmail} removed Rubrik cluster: ${targetClusterName} as replication target to Rubrik cluster: ${sourceClusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ReplicationTargetEditFailed

```text
${userEmail} failed to modify replication target: ${targetClusterName} spec on source cluster: ${sourceClusterName} using ${setupType} configuration.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ReplicationTargetEditSucceeded

```text
${userEmail} modified replication target: ${targetClusterName} spec on source cluster: ${sourceClusterName} using ${setupType} configuration.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## reports

______________________________________________________________________

ClusterReportMigrationOnDemandJobCanceled

```text
Canceled migration of custom reports from ${clusterName} into RSC.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

ClusterReportMigrationOnDemandJobCanceling

```text
Canceling migration of custom reports from ${clusterName} into RSC.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

ClusterReportMigrationOnDemandJobFailed

```text
Failed to migrate all the custom reports from ${clusterName} into RSC.  Refer to the migration dashboard for report-level breakdown. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ClusterReportMigrationOnDemandJobQueued

```text
Queued migration of custom reports from ${clusterName} into RSC.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

ClusterReportMigrationOnDemandJobStarted

```text
Started migration of custom reports from ${clusterName} into RSC.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ClusterReportMigrationOnDemandJobSucceeded

```text
Successfully migrated custom reports from ${clusterName} into RSC. Refer  to the migration dashboard for details of the migration.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

MigrateClusterReportsJobStarted

```text
${userEmail} successfully started migration of custom reports of ${clusterName} into RSC.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

MigrateClusterReportsJobStartFailed

```text
${userEmail} failed to start migration of custom reports of ${clusterName} into RSC. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## rsc_tag

______________________________________________________________________

RscTagCreated

```text
${username} created an RSC tag ${rscTagName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RscTagDeleted

```text
${username} deleted the RSC tag, ${rscTagName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RscTagUpdated

```text
${username} updated the RSC tag, ${rscTagName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## saasapps

______________________________________________________________________

SaasAppsDeleteOrgFailed

```text
${userID} requested the deletion of SaaS organization ${orgName}, but it failed. Failure reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

SaasAppsDeleteOrgStarted

```text
${userID} started deletion of SaaS organization ${orgName}. (Taskchain ID is ${taskchainID})
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SaasAppsOrgAuthenticated

```text
${userID} authenticated ${orgURL} with user ${orgUser}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SaasAppsOrgRenamed

```text
${userEmail} renamed ${oldOrgName} ${saasAppType} org to ${newOrgName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SaasAppsPendingAuthentication

```text
Service is offline. Pending authentication for ${orgName} (${orgURL}) to resume protection.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SaasAppsSeedingTemplateDeleted

```text
${userID} deleted the seeding template ${templateName} with ID  ${templateID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## sap_hana_system

______________________________________________________________________

AddSapHanaSystemFailure

```text
${username} failed to add SAP HANA system '${systemName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

AddSapHanaSystemStarted

```text
${username} started adding SAP HANA system '${systemName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteSapHanaSystemFailure

```text
${username} failed to delete SAP HANA system '${systemName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteSapHanaSystemStarted

```text
${username} started deleting SAP HANA system '${systemName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EditSapHanaSystemFailure

```text
${username} failed to modify SAP HANA system '${systemName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

EditSapHanaSystemStarted

```text
${username} modified SAP HANA system '${systemName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RefreshSapHanaSystemMetadataFailed

```text
${username} failed to refresh metadata for SAP HANA system '${systemName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RefreshSapHanaSystemMetadataStarted

```text
${username} started refreshing metadata for SAP HANA system '${systemName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## sessionmanagement

______________________________________________________________________

ConcurrentSessionLimitExceeded

```text
The session associated with ${userEmail} has been invalidated, as a new  login from ${source} for the same user, exceeded the maximum number of concurrent sessions allowed.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Success** | **Yes** |

SessionManagementSetConfiguration

```text
${userEmail} updated ${config} from ${fromValue} to ${toValue}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## sla

______________________________________________________________________

DoNotProtectSLADomainAssignmentRollbackFailed

```text
Failed to re-assign the existing SLA Domain ${slaName} to ${objectType}  ${objectName} on Rubrik cluster ${clusterUUID} while rolling back the Manage Protection operation. Retry the operation and SLA Domain assignment or re-assign the old SLA Domain.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SLAAssignmentonRSCNativeObjectsFailed

```text
Failed to assign SLA Domain: ${slaName} to objects: ${objects} on RSC. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SLAAssignmentOnRSCNativeObjectsSucceed

```text
Successfully assigned SLA Domain: ${slaName} to objects: ${objects} on RSC.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SLADirectAssignmentForRetentionLockProcessed

```text
Unable to apply the new SLA Domain because you  can only apply SLA Domains with settings that  are stricter than the current SLA Domain settings  to a Retention-locked object. Instead, the object  ${object} is now directly assigned the same SLA  Domain ${currentEffectiveSla}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SLAMigrationArchivalLocation

```text
SLA Domain has been configured with the archival location ${archivalLocationName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SLAMigrationFailed

```text
Failed to switch SLA Domain for ${slaName}. Error: ${errMsg}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SLAMigrationNoObjectTypes

```text
SLA Domain has been configured without any object types. Edit the SLA Domain manually to add object-specific configuration before using the SLA Domain to protect objects.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SLAMigrationObjectTypes

```text
SLA Domain has been configured with the following object types ${objectTypesStr}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SLAMigrationRename

```text
SLA Domain has been renamed to ${slaNewName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SLAMigrationStarted

```text
Started switching the SLA Domain ${slaName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SLAMigrationStuck

```text
Switching of SLA Domain ${slaName} is stuck. Error: ${errMsg}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SLAMigrationSucceeded

```text
Successfully switched the SLA Domain.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## smb_domain

______________________________________________________________________

AddSmbDomainFailure

```text
${username} failed to add SMB domain '${smbDomainName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

AddSmbDomainSuccess

```text
${username} successfully added SMB domain '${smbDomainName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AuthenticateSmbDomainFailure

```text
${username} failed to authenticate SMB domain '${smbDomainName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

AuthenticateSmbDomainSuccess

```text
${username} successfully authenticate SMB domain '${smbDomainName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ChangeSmbSecurityConfigurationFailure

```text
${username} failed to change SMB domain configuration of cluster '${clusterName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ChangeSmbSecurityConfigurationSuccess

```text
${username} successfully changed SMB domain configuration of cluster '${clusterName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteSmbDomainFailure

```text
${username} failed to delete SMB domain '${smbDomainName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteSmbDomainSuccess

```text
${username} successfully deleted SMB domain '${smbDomainName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## snappables

______________________________________________________________________

LinkObjectsFailed

```text
Unable to run steps to link objects.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

LinkObjectsSucceeded

```text
Finished running steps to link objects.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

LinkRollbackFailed

```text
Unable to rollback the metadata updates to link  ${objectType} ${objectNameList} on Rubrik cluster ${clusterUUID}. The Rubrik cluster will not reassign the existing SLA Domain, ${slaNameList}, to the objects. Contact Rubrik Support to rollback the metadata updates and then retry the operation.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

LinkTaskStarted

```text
Started running steps to link objects.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

UnlinkObjectsFailed

```text
Unable to run steps to unlink objects.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

UnlinkObjectsSucceeded

```text
Finished running steps to unlink objects.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

UnlinkRollbackFailed

```text
Unable to rollback the metadata updates to unlink  ${objectType} ${objectNameList} on Rubrik cluster ${clusterUUID}. The Rubrik cluster will not reassign the existing SLA Domain, ${slaNameList}, to the objects. Contact Rubrik Support to rollback the metadata updates and then retry the operation.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

UnlinkTaskStarted

```text
Started running steps to unlink objects.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

UnprotectObjectsTaskFailed

```text
Failed to unprotect objects ${objectNames} as part of ${operation} operation. Any linking, unlinking or SLA Domain reassignment did not  occur due to this failure.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

UnprotectObjectsTaskStarted

```text
Started unprotection of objects ${objectNames} as part of ${operation} operation.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

UnprotectObjectsTaskSucceeded

```text
Successfully unprotected objects ${objectNames}. If the objects are still linked, you can either unlink them or assign a new SLA Domain through the \"Manage Protection\" workflow.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

## sso

______________________________________________________________________

AddNewSSOIdentityProvider

```text
${userName} successfully added a new SSO identity provider, ${name}, with entity ID, ${entityID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RemoveIdentityProvider

```text
${userName} successfully removed the SSO identity provider, ${name}, with entity ID, ${entityID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SSOAddConfiguration

```text
${userEmail} configured SSO with Identity Provider ${entityID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SSOLoginFailure

```text
SSO login failed. Reason: ${err_msg}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

SSORemoveConfiguration

```text
${userEmail} disabled SSO through Identity Provider ${entityID}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SSOUpdateSPCertificate

```text
${userEmail} updated the SSO Service Provider ${certType} certificate with certificate named ${certName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SuccessfulSSOLoginWithNotification

```text
${userName} successfully logged in via SSO using identity provider, ${name}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SuccessfulSSOLoginWithoutNotification

```text
${userName} successfully logged in via SSO using identity provider, ${name}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateSSOIdentityProvider

```text
${userName} successfully modified the SSO identity provider, ${name}, with entity ID, ${entityID}. The changed attributes are ${changedAttributes}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## support_tunnel

______________________________________________________________________

SupportTunnelClosed

```text
${username} closed a support tunnel for cluster '${cluster}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SupportTunnelCloseFailed

```text
${username} failed to close the support tunnel for cluster '${cluster}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

SupportTunnelOpened

```text
${username} opened a support tunnel for cluster '${cluster}' and set the timeout window to ${timeoutWindow} hours.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SupportTunnelOpenFailed

```text
${username} failed to open a support tunnel for cluster '${cluster}' for ${timeoutWindow} hours. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## ticketingservice

______________________________________________________________________

TicketingPlatformConfigured

```text
${userEmail} configured ${platformType} instance ${instanceURL}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TicketingPlatformDisconnected

```text
${userEmail} disconnected ${platformType} instance ${instanceURL}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## tpr

______________________________________________________________________

TprConfigEnable

```text
${username} enabled Quorum Authorization.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TprConfigUpdate

```text
${username} updated the Quorum Authorization configuration to Execution Timeout Hours: ${executionTimeoutHours}, Request Timeout Hours: ${requestTimeoutHours}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TprPolicyCreated

```text
${username} created the Quorum Authorization policy ${policyName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TprPolicyDeleted

```text
${username} deleted the Quorum Authorization policy ${policyName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TprPolicyUpdated

```text
${username} updated the Quorum Authorization policy ${policyName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## vcd

______________________________________________________________________

AddVcdStarted

```text
${username} started a job to add VCD '${vcdAddress}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AddVcdStartFailed

```text
${username} failed to start a job to add vCenter '${vcdAddress}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteVcdStarted

```text
${username} started a job to delete VCD '${vcdAddress}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteVcdStartFailed

```text
${username} failed to start a job to delete VCD '${vcdAddress}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RefreshVcdStarted

```text
${username} started a job to refresh VCD '${vcdAddress}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RefreshVcdStartFailed

```text
${username} failed to start a job to refresh VCD '${vcdAddress}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateVcdStarted

```text
${username} started a job to update VCD '${vcdAddress}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateVcdStartFailed

```text
${username} failed to start a job to update VCD '${vcdAddress}' Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VappSnapshotInstantRecoveryStarted

```text
${username} started a job to instant recover snapshot '${snapshotId}' from ${snappableType} '${vcdVapp}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VappSnapshotInstantRecoveryStartFailed

```text
${username} failed to instant recover snapshot '${snapshotId}'  from ${snappableType} '${vcdVapp}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VcdVappOndemandSnapshotStarted

```text
${username} started a job to take on demand snapshot for ${snappableType} '${vcdVapp}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VcdVappOndemandSnapshotStartFailed

```text
${username} failed to take on demand snapshot for ${snappableType}  '${vcdVapp}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VcdVappSnapshotDeleteStarted

```text
${username} started a job to delete snapshot '${snapshotId}' from ${snappableType} '${vcdVapp}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VcdVappSnapshotDeleteStartFailed

```text
${username} failed to delete snapshot '${snapshotId}' from ${snappableType} '${vcdVapp}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VcdVappSnapshotExportStarted

```text
${username} started a job to export snapshot '${snapshotId}' from ${snappableType} '${vcdVapp}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VcdVappSnapshotExportStartFailed

```text
${username} failed to export snapshot '${snapshotId}' from ${snappableType} '${vcdVapp}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VcdVappUpdateStarted

```text
${username} started a job to update ${snappableType} '${vcdVapp}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VcdVappUpdateStartFailed

```text
${username} failed to update ${snappableType} '${vcdVapp}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## volume_group

______________________________________________________________________

UpdateVolumeGroup

```text
${username} updated volume group for host ${hostName}. Volumes included are :${volumes}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateVolumeGroupFailed

```text
${username} failed to update volume group for host ${hostName}. Reason : ${reason}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## vsphere

______________________________________________________________________

AddVcenterStarted

```text
${username} started a job to add ${sourceType} '${vcenterAddress}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AddVcenterStartFailed

```text
${username} failed to start a job to add ${sourceType}  '${vcenterAddress}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateGuestCredential

```text
${username} created a guest credential with name '${guestCredentialName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CreateGuestCredentialFailed

```text
${username} failed to create a guest credential with name '${guestCredentialName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateVSphereAdvancedTag

```text
${username} created an advanced tag with name '${advancedTagName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CreateVSphereAdvancedTagFailed

```text
${username} failed to create an advanced tag with name '${advancedTagName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteGuestCredential

```text
${username} deleted a guest credential.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteGuestCredentialFailed

```text
${username} failed to delete a guest credential.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteVcenterStarted

```text
${username} started a job to delete ${sourceType} '${vcenterAddress}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteVcenterStartFailed

```text
${username} failed to start a job to delete ${sourceType} '${vcenterAddress}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteVSphereAdvancedTag

```text
${username} deleted an advanced tag'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteVSphereAdvancedTagFailed

```text
${username} failed to delete an advanced tag'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DisabledStorageArrayIntegration

```text
${username} disabled storage array integration in VM ${vmName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EnabledStorageArrayIntegration

```text
${username} enabled storage array integration in VM ${vmName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RefreshVcenterStarted

```text
${username} started a job to refresh ${sourceType} '${vcenterAddress}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RefreshVcenterStartFailed

```text
${username} failed to start a job to refresh ${sourceType} '${vcenterAddress}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateGuestCredential

```text
${username} updated a guest credential with name '${guestCredentialName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateGuestCredentialFailed

```text
${username} failed to update a guest credential with name '${guestCredentialName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateSnapshotConsistencyFailed

```text
${username} failed to update snapshot consistency for ${objectNames}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateSnapshotConsistencySucceeded

```text
${username} successfully updated snapshot consistency for ${objectNames}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateVmwareAgentDeploymentSettingFailed

```text
${username} failed to update vmware agent deployment setting on cluster '${clusterUuid}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateVmwareAgentDeploymentSettingSucceeded

```text
${username} updated vmware agent deployment setting on cluster '${clusterUuid}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateVmwareDiskFailed

```text
${username} failed to update a Vmware Virtual Disk '${diskName}' of vSphere VM '${vmName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateVmwareDiskSucceeded

```text
${username} updated protection of disk with name '${diskName}' on  VM '${vmName}' to exclusion status '${status}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateVmwareVcenterSettingFailed

```text
${username} was unable to modify the VMware ${sourceType} '${vcenterAddress}' on Rubrik cluster '${clusterUuid}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UpdateVmwareVcenterSettingSucceeded

```text
${username} modified the VMware ${sourceType} '${vcenterAddress}' on Rubrik cluster '${clusterUuid}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateVSphereAdvancedTag

```text
${username} updated an advanced tag with name '${advancedTagName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UpdateVSphereAdvancedTagFailed

```text
${username} failed to update an advanced tag with name '${advancedTagName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VSphereLiveMountPoweredOffFailed

```text
${username} failed to power off '${vmName}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VSphereLiveMountPoweredOffStarted

```text
${username} started powering off '${vmName}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VSphereLiveMountPoweredOnFailed

```text
${username} failed to power on '${vmName}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VSphereLiveMountPoweredOnStarted

```text
${username} started powering on '${vmName}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VSphereRegisterAgent

```text
${username} registered agent on virtual machine '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VSphereRegisterAgentFailed

```text
${username} failed to register agent on virtual machine '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VSphereUpdateVM

```text
${username} updated virtual machine '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VSphereUpdateVMFailed

```text
${username} unable to update virtual machine '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VSphereUpdateVmUnmountTimeFailed

```text
${username} failed to update unmount time for vm mount '${mountId}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VSphereUpdateVmUnmountTimeSucceeded

```text
${username} successfully updated unmount time for vm mount '${mountId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## webhook

______________________________________________________________________

PolarisWebhookAutoDisabled

```text
Webhook endpoint failed to receive messages after multiple retries.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

## webhooks

______________________________________________________________________

WebhookCreated

```text
${actorSubjectName} successfully created the webhook ${targetSubjectName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

WebhookDeleted

```text
${actorSubjectName} successfully deleted the webhook ${targetSubjectName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

WebhookDisabled

```text
${actorSubjectName} successfully disabled the webhook ${targetSubjectName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

WebhookEnabled

```text
${actorSubjectName} successfully enabled webhook ${targetSubjectName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

WebhookUpdated

```text
${actorSubjectName} successfully updated the webhook ${targetSubjectName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## active_directory

______________________________________________________________________

ActiveDirectoryIrRemediationFailed

```text
${username} unable to start remediation ${remediationType} for risks identified on the Active Directory domain controller '${dcName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ActiveDirectoryIrRemediationStarted

```text
${username} triggered remediation ${remediationType} for risks identified on the Active Directory domain controller '${dcName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## data_risks

______________________________________________________________________

DataRisksPolicyCreated

```text
${userEmail} created a new policy named '${policyName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DataRisksPolicyDeleted

```text
${userEmail} deleted the policy '${policyName}', closing  '${violationsCount}' violations.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DataRisksPolicyUpdated

```text
${userEmail} modified the definitions for the policy '${policyName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EntraIDRemediationFailure

```text
${userEmail} failed to remediate violation with '${violationName}' with '${remediationType}' on '${objectName}'. Error: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

EntraIDRemediationSuccess

```text
'${userEmail}' successfully remediated violation '${violationName}'  with '${remediationType}' on '${objectName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ExportActionsLogRemediation

```text
'${userEmail}' downloaded actions log for object '${resourceName} in '${tenantName}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ExportPermissionsRemediation

```text
'${userEmail}' downloaded data access permissions for object '${resourceName}' in '${tenantName}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

MipLabelRemediationFailure

```text
Error while assigning the label '${labelName}' to ${failedDocumentCount}  documents detected in violation by user ${userEmail} for  violation '${policyName}' on object '${objectName}'. ${skippedCount} documents were skipped due to unsupported file types.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

MipLabelRemediationSuccess

```text
User ${userEmail} successfully assigned the label '${labelName}' to ${documentCount} documents detected in violation '${policyName}' on  object '${objectName}'. ${skippedCount} documents were skipped due to unsupported file types.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

OverExposureRevokeAccessRemediationFailure

```text
'${userEmail}' failed to revoke '${accessType}' access from  '${documentCount}' files in object '${resourceName}'
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

OverExposureRevokeAccessRemediationSuccess

```text
'${userEmail}' revoked '${accessType}' access from '${documentCount}' files in object '${resourceName}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PolicyViolationStatusUpdated

```text
${userEmail} changed the status of the violations '${policyName}' on  object '${objectName}' from '${oldStatus}' to '${newStatus}' .
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RemediationTriggered

```text
${userEmail} triggered remediation action '${actionName}' on  violation '${policyName}' on object '${objectName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TicketCreated

```text
${userEmail} created a ticket for violation through  '${ticketPlatform}' for '${policyName}' on object '${objectName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## account

______________________________________________________________________

AccountExpired

```text
Your trial ended on ${ExpiryDate} and your account will be on hold for ${NumHoldDays} days from that date.  During the hold period, all backup jobs will be paused and no further changes can be made.  Your POC data will be deleted after ${HoldEndDate}.  To continue using the product, contact your Account Executive to purchase a license.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

AccountExpiryWarning

```text
Hello, We want to remind you that your account is expiring in ${noOfDaysBeforeHold} days and that your existing data will not be available after that time. Act now to extend your features or buy additional features! Retain your existing data and continue to enjoy all the benefits of Rubrik data protection. For information, please contact our friendly sales professionals at sales@rubrik.com. Thank you, Rubrik
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

AccountMoveCompleted

```text
RSC account move to the new region has been completed. No more downtime should be observed.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

AccountMoveInitiated

```text
Rubrik started an account move operation, which will take a few hours to complete.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

## app_failover

______________________________________________________________________

RefreshAwsNetResourcesConnectToEc2ClientFailed

```text
Failed to connect to ec2 client: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

RefreshAwsNetResourcesEc2ClientFailed

```text
Failed to sync AWS networking resources in '${cloudAccount}(${region})': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

RefreshAwsNetResourcesFailoverCanceled

```text
Canceled sync AWS networking resources in '${account}'.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

RefreshAwsNetResourcesFailoverCanceling

```text
Canceling sync AWS networking resources in '${account}'.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

RefreshAwsNetResourcesFailoverFailed

```text
Failed to sync AWS networking resources in '${account}': ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

RefreshAwsNetResourcesFailoverStarted

```text
Started to sync AWS networking resources in '${account}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

RefreshAwsNetResourcesFailoverSuccess

```text
Synced AWS networking resources in '${account}': processed '${totalNum}' cloud locations.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RefreshAwsNetResourcesGetCloudAccountFailed

```text
Failed to get cloud account ${name} in '${account}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

RefreshAwsNetResourcesQueryArchivalLocationFailed

```text
Failed to query cloud locations in '${account}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

ValidateAppBlueprintResourceMappingFailed

```text
Failed to validate recovery spec for Recovery Plan '${name}' in '${account}': ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ValidateResourceMappingCanceled

```text
Canceled validate recovery specs for Recovery Plans in '${account}'.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

ValidateResourceMappingCanceling

```text
Canceling validate recovery specs for Recovery Plans in '${account}'.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

ValidateResourceMappingFailed

```text
Failed to validate recovery specs for Recovery Plans in '${account}': ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ValidateResourceMappingQueryAppBlueprintsFailed

```text
Failed to query Recovery Plans in '${account}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

ValidateResourceMappingStarted

```text
Started validating recovery specs for Recovery Plans in '${account}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ValidateResourceMappingSuccess

```text
Validated recovery specs for Recovery Plans in '${account}': processed '${totalNum}' and found recovery specs are invalid for '${invalidNum}' Recovery Plans.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## awsnative

______________________________________________________________________

AwsSnapshotsMissing

```text
One or more rubrik managed snapshots are missing from AWS account ${awsAccountDisplayName}. Total ${missingEc2SnapshotCount} AMIs and ${missingEbsSnapshotCount} volume snapshots are missing. ${optionalMailSentMsg}
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

## azurenative

______________________________________________________________________

AzureNativeArchiveSnapshotTaskCleanupFailed

```text
An error occurred while cleaning up a failed attempt to archive the snapshot taken at ${snapshotTimeDisplay} of the ${snappableDisplay}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

AzureSnapshotsMissing

```text
One or more rubrik managed snapshots are missing from Azure subscription ${azureSubscriptionDisplayName}. Total ${missingVMSnapshotCount} VM snapshots, ${missingVMRepSnapshotCount} VM replicated snapshots, ${missingDiskSnapshotCount} disk snapshots and ${missingDiskRepSnapshotCount} disk replicated snapshots are missing.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureSqlDatabaseServerDeleted

```text
One or more Rubrik managed Azure SQL Servers are missing from Azure subscription ${azureSubscriptionDisplayName}. Missing Azure SQL Servers: ${missingSqlDatabaseServersList}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureSqlManagedInstanceServerDeleted

```text
One or more Rubrik managed Azure SQL Managed Instances are missing from Azure subscription ${azureSubscriptionDisplayName}. Missing Azure SQL Managed Instances: ${missingSqlManagedInstanceServersList}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureSqlSnapshotsMissing

```text
One or more Rubrik managed snapshots are missing from Azure subscription ${azureSubscriptionDisplayName}. Total ${missingSqlDatabaseDbSnapshotCount} Azure Sql Database and ${missingSqlManagedInstanceDbSnapshotCount} Azure Sql Managed Database snapshots are missing.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

## ccprovision

______________________________________________________________________

ClusterCreateFailed

```text
${message}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ClusterCreateRunning

```text
${message}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ClusterCreateSuccess

```text
${message}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ClusterCreateWarning

```text
${message}
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

## cloudnative

______________________________________________________________________

AwsRdsManualSnapshotQuotaBreach

```text
One or more regions from the AWS account, ${awsAccountDisplayName}, protected by Rubrik, may have the following issues: manual snapshot quota limit is about to be breached, or you have used 75%% of the quota. Usages in affected regions are: ${quotaUsage}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

AwsRdsSnapshotsMissing

```text
One or more RDS databases from the AWS account ${awsAccountDisplayName} protected by Rubrik may have the following issues: Number of missing RDS snapshots: ${missingRdsInstanceSnapshotCount}. Number of RDS databases with modified log retention values: ${missingRdsInstancePitrCount}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudNativeIndexSnapshotsDebugModeJobCanceled

```text
Canceled debug-mode index run of the snapshot taken on ${snapshotTimeDisplay} of the ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

CloudNativeIndexSnapshotsDebugModeJobCanceling

```text
Canceling debug-mode index run of the snapshot taken on ${snapshotTimeDisplay} of the ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

CloudNativeIndexSnapshotsDebugModeJobFailed

```text
Failed in debug-mode index run of the snapshot taken on ${snapshotTimeDisplay} of the ${snappableDisplay}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

CloudNativeIndexSnapshotsDebugModeJobQueued

```text
Queued debug-mode index run of the snapshot taken on ${snapshotTimeDisplay} of the ${snappableDisplay}. The job will not index the snapshot.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

CloudNativeIndexSnapshotsDebugModeJobStarted

```text
Started debug-mode index run of the snapshot taken on ${snapshotTimeDisplay} of the ${snappableDisplay}. The job will not index the snapshot.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudNativeIndexSnapshotsDebugModeJobSucceeded

```text
Successfully completed debug-mode index run of the snapshot taken on ${snapshotTimeDisplay} of the ${snappableDisplay}. The snapshot was not indexed, since the job was run in the debug mode.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudNativeIndexSnapshotsDebugModeJobSucceededNoop

```text
No snapshot available to index for ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

GcpSnapshotsMissing

```text
One or more rubrik managed snapshots are missing from GCP project ${gcpProjectDisplayName}. Total ${missingInstanceSnapshotCount} instance snapshots and ${missingDiskSnapshotCount} disk snapshots are missing.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

## cluster

______________________________________________________________________

ClusterSyncJobsDelayed

```text
Cluster ${clusterName} is experiencing the following delays in syncing data with Rubrik Cloud: \n\n${delayedJobsMessage}\n\nPlease open a support tunnel to the cluster and contact Rubrik Support for further assistance.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ClusterUnreachable

```text
Cluster ${clusterName} is unreachable
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

## exocompute

______________________________________________________________________

ClusterVerificationTaskFailed

```text
Verification failed for the customer managed cluster ${clusterDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

ClusterVerificationTaskStarted

```text
Verifying the customer managed cluster ${clusterDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

ClusterVerificationTaskSucceeded

```text
Successfully verified the customer managed cluster ${clusterDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ConfigurePrivateEKSTaskFailed

```text
Failed to configure private EKS cluster ${eksClusterDisplayName}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

ConfigurePrivateEKSTaskStarted

```text
Configuring private EKS cluster ${eksClusterDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

ConfigurePrivateEKSTaskSucceeded

```text
Successfully configured private EKS cluster ${eksClusterDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ExoclusterReachingAzureQuotaLimit

```text
${eventMsg}
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

ExoclusterReachingAzureSubnetLimit

```text
The size of the subnet ${subnet} is limiting the scaling of the AKS. Recommended minimum subnet size: ${requiredBandwidth}
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

ExoclusterUpgradeCanceled

```text
Canceled upgrade ${exoclusterType} cluster ${exoclusterName}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

ExoclusterUpgradeCanceling

```text
Canceling upgrade of ${exoclusterType} cluster ${exoclusterName}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

ExoclusterUpgradeFailed

```text
Failed to upgrade ${exoclusterType} cluster ${exoclusterName} to version ${version}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ExoclusterUpgradeNotEnoughResource

```text
Not enough resources to upgrade ${exoclusterType} cluster ${exoclusterName} to version ${version}: ${quotaMsg}. More info on https://docs.microsoft.com/en-us/azure/aks/upgrade-cluster.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ExoclusterUpgradeStarted

```text
Upgrading ${exoclusterType} cluster ${exoclusterName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

ExoclusterUpgradeSucceeded

```text
Successfully upgraded ${exoclusterType} cluster ${exoclusterName} to version ${version}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ExocomputeAwsSetupJobCanceled

```text
Canceled setup of the EKS cluster in the ${awsAccountDisplayName} AWS account in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

ExocomputeAwsSetupJobCanceling

```text
Canceling setup of the EKS cluster in the ${awsAccountDisplayName} AWS account in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

ExocomputeAwsSetupJobFailed

```text
Failed to setup EKS cluster in the ${awsAccountDisplayName} AWS account in the ${regionDisplayName} region. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ExocomputeAwsSetupJobStarted

```text
Started setup of the EKS cluster in the ${awsAccountDisplayName} AWS account in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ExocomputeAwsSetupJobSucceeded

```text
Successfully setup EKS cluster in the ${awsAccountDisplayName} AWS account in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ExocomputeAwsTeardownJobCanceled

```text
Canceled termination of the ${eksClusterDisplayName} EKS cluster in the ${awsAccountDisplayName} AWS account in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

ExocomputeAwsTeardownJobCanceling

```text
Canceling termination of the ${eksClusterDisplayName} EKS cluster in the ${awsAccountDisplayName} AWS account in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

ExocomputeAwsTeardownJobFailed

```text
Failed to terminate the ${eksClusterDisplayName} EKS cluster in the ${awsAccountDisplayName} AWS account in the ${regionDisplayName} region. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ExocomputeAwsTeardownJobStarted

```text
Terminating the ${eksClusterDisplayName} EKS cluster in the ${awsAccountDisplayName} AWS account in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ExocomputeAwsTeardownJobSucceeded

```text
Successfully terminated the ${eksClusterDisplayName} EKS cluster in the ${awsAccountDisplayName} AWS account in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ExocomputeAzureSetupJobCanceled

```text
Canceled set up of the Azure Kubernetes Cluster in the resource group ${resourceGroupName} in the region ${azureRegionDisplayName} of the Azure subscription ${subscriptionDisplayName}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

ExocomputeAzureSetupJobCanceling

```text
Canceling set up of the Azure Kubernetes Cluster in the resource group ${resourceGroupName} in the region ${azureRegionDisplayName} of the Azure subscription ${subscriptionDisplayName}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

ExocomputeAzureSetupJobFailed

```text
Failed to set up the Azure Kubernetes Cluster in the resource group ${resourceGroupName} in the region ${azureRegionDisplayName} of the Azure subscription ${subscriptionDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ExocomputeAzureSetupJobStarted

```text
Started set up of the Azure Kubernetes Cluster in the resource group ${resourceGroupName} in the region ${azureRegionDisplayName} of the Azure subscription ${subscriptionDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ExocomputeAzureSetupJobSucceeded

```text
Successfully set up the Azure Kubernetes Cluster ${aksClusterDisplayName} in the resource group ${resourceGroupName} in the region ${azureRegionDisplayName} of the Azure subscription ${subscriptionDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ExocomputeAzureTeardownJobCanceled

```text
Canceled termination of the Azure Kubernetes Cluster ${aksClusterDisplayName} in the resource group ${resourceGroupName} in the region ${regionName} of the Azure subscription ${subscriptionName}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

ExocomputeAzureTeardownJobCanceling

```text
Canceling termination of the Azure Kubernetes Cluster ${aksClusterDisplayName} in the resource group ${resourceGroupName} in the region ${regionName} of the Azure subscription ${subscriptionName}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

ExocomputeAzureTeardownJobFailed

```text
Failed to terminate the Azure Kubernetes Cluster ${aksClusterDisplayName} in the resource group ${resourceGroupName} in the region ${regionName} of the Azure subscription ${subscriptionName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ExocomputeAzureTeardownJobStarted

```text
Terminating the Azure Kubernetes Cluster ${aksClusterDisplayName} in the resource group ${resourceGroupName} in the region ${regionName} of the Azure subscription ${subscriptionName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ExocomputeAzureTeardownJobSucceeded

```text
Successfully terminated the Azure Kubernetes Cluster ${aksClusterDisplayName} in the resource group ${resourceGroupName} in the region ${regionName} of the Azure subscription ${subscriptionName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ExocomputeCloudNativeReconcilerJobCanceled

```text
Canceled verification and configuration of the customer managed cluster ${clusterDisplayName} in the ${cloudAccountDisplayName} ${cloudTypeDisplayName} account in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

ExocomputeCloudNativeReconcilerJobCanceling

```text
Canceling verification and configuration of the customer managed cluster ${clusterDisplayName} in the ${cloudAccountDisplayName} ${cloudTypeDisplayName} account in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

ExocomputeCloudNativeReconcilerJobFailed

```text
Failed to verify and configure the customer managed cluster ${clusterDisplayName} in the ${cloudAccountDisplayName} ${cloudTypeDisplayName} account in the ${regionDisplayName} region. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ExocomputeCloudNativeReconcilerJobStarted

```text
Started verification and configuration of the customer managed cluster  ${clusterDisplayName} in the ${cloudAccountDisplayName} ${cloudTypeDisplayName} account in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ExocomputeCloudNativeReconcilerJobSucceeded

```text
Successfully verified and configured customer managed cluster  ${clusterDisplayName} in the ${cloudAccountDisplayName}  ${cloudTypeDisplayName} account in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ExocomputeCustomerKMSSaved

```text
User ${userEmail} entered customer KMS details for organization (${orgId}). Validated and persisted for key ${keyName} in vault ${vaultName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ExocomputeGCPSetupJobCanceled

```text
Canceled setup of the GKE cluster in the ${gcpProjectDisplayName} GCP project in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

ExocomputeGCPSetupJobCanceling

```text
Canceling setup of the GKE cluster in the ${gcpProjectDisplayName} GCP project in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

ExocomputeGCPSetupJobFailed

```text
Failed to setup GKE cluster in the ${gcpProjectDisplayName} GCP project in the ${regionDisplayName} region. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ExocomputeGCPSetupJobStarted

```text
Started setup of the GKE cluster in the ${gcpProjectDisplayName} GCP project in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ExocomputeGCPSetupJobSucceeded

```text
Successfully set up GKE cluster in the ${gcpProjectDisplayName} GCP project in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ExocomputeGCPTeardownJobCanceled

```text
Canceled termination of the ${gkeClusterDisplayName} GKE cluster in the  ${gcpProjectDisplayName} GCP project in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

ExocomputeGCPTeardownJobCanceling

```text
Canceling termination of the ${gkeClusterDisplayName} GKE cluster in the ${gcpProjectDisplayName} GCP project in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

ExocomputeGCPTeardownJobFailed

```text
Failed to terminate the ${gkeClusterDisplayName} GKE cluster in the  ${gcpProjectDisplayName} GCP project in the ${regionDisplayName} region. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ExocomputeGCPTeardownJobStarted

```text
Terminating the ${gkeClusterDisplayName} GKE cluster in the ${gcpProjectDisplayName} GCP project in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ExocomputeGCPTeardownJobSucceeded

```text
Successfully terminated the ${gkeClusterDisplayName} GKE cluster in the  ${gcpProjectDisplayName} GCP account in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ExocomputeResourceProvideRegistrationCompleted

```text
Completed registration of Azure Resource Providers for subscription ${subscriptionID}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ExocomputeResourceProvideRegistrationFailed

```text
Failed during registration of Azure Resource Providers for subscription ${subscriptionID}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

ExocomputeResourceProvideRegistrationStarted

```text
Started registration of Azure Resource Providers for subscription ${subscriptionID}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

HealthCheckTaskFailed

```text
Failed health check for the Kubernetes cluster. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

HealthCheckTaskFailedForPoweredOffCluster

```text
The powered-off AKS cluster, ${clusterName}, in resource group, ${rgName},  within Azure subscription, ${subscriptionID} failed the health check.  You can either start the AKS cluster to avoid data protection compliance  issues or delete the M365 subscription if you want to power down the  AKS cluster permanently.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

HealthCheckTaskStarted

```text
Checking health of the Kubernetes Cluster.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

HealthCheckTaskSucceeded

```text
Successfully completed health check for the Kubernetes Cluster.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

HealthCheckTaskWarning

```text
${error}
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

LaunchAKSClusterTaskFailed

```text
Failed to launch the Azure Kubernetes Cluster in the resource group ${resourceGroupDisplayName} in the region ${azureRegionDisplayName} of the Azure subscription ${subscriptionDisplayName}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

LaunchAKSClusterTaskStarted

```text
Launching the Azure Kubernetes Cluster in the resource group ${resourceGroupDisplayName} in the region ${azureRegionDisplayName} of the Azure subscription ${subscriptionDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

LaunchAKSClusterTaskSucceeded

```text
Successfully launched the Azure Kubernetes Cluster ${aksClusterDisplayName} in the resource group ${resourceGroupDisplayName} in the region ${azureRegionDisplayName} of the Azure subscription ${subscriptionDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

LaunchEKSClusterTaskFailed

```text
Failed to launch the ${eksClusterDisplayName} EKS cluster.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

LaunchEKSClusterTaskStarted

```text
Launching the ${eksClusterDisplayName} EKS cluster.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

LaunchEKSClusterTaskSucceeded

```text
Successfully launched the ${eksClusterDisplayName} EKS cluster.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

LaunchGKEClusterTaskFailed

```text
Failed to launch the ${gkeClusterDisplayName} GKE cluster in the  ${gcpProjectDisplayName} GCP project in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

LaunchGKEClusterTaskStarted

```text
Launching the ${gkeClusterDisplayName} GKE cluster in the  ${gcpProjectDisplayName} GCP project in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

LaunchGKEClusterTaskSucceeded

```text
Successfully launched the ${gkeClusterDisplayName} GKE cluster in the  ${gcpProjectDisplayName} GCP project in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

LaunchWorkerNodesTaskFailed

```text
Failed to launch worker nodes in the ${eksClusterDisplayName} EKS cluster.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

LaunchWorkerNodesTaskStarted

```text
Launching worker nodes in the ${eksClusterDisplayName} EKS cluster.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

LaunchWorkerNodesTaskSucceeded

```text
Launched worker nodes in the ${eksClusterDisplayName} EKS cluster.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365CleanStaleResources

```text
Please delete following stale resource from Azure Portal: ${resources}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

O365SetupExocomputeFailed

```text
${userID} failed to deploy Rubrik Office 365 protection software in ${exocomputeName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

O365SetupExocomputeFailed

```text
Failed to deploy Rubrik Office 365 protection software in ${exocomputeName}: ${reason} (Error ID: ${errorID})
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365SetupExocomputeStarted

```text
${userID} started deploying Rubrik Office 365 protection software in ${exocomputeName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

O365SetupExocomputeStarted

```text
Deploying Rubrik Office 365 protection software in ${exocomputeName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

O365SetupExocomputeSucceeded

```text
Successfully deployed Rubrik Office 365 protection software in ${exocomputeName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365SetupResourceStarted

```text
Setting up ${resource} in ${exocomputeName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

O365SetupResourceSucceeded

```text
Successfully set up ${resource} in ${exocomputeName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SetupClusterTaskFailed

```text
Failed to configure the customer managed cluster ${clusterDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

SetupClusterTaskStarted

```text
Configuring the customer managed cluster ${clusterDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

SetupClusterTaskSucceeded

```text
Successfully configured the customer managed cluster ${clusterDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SetupEKSClusterTaskFailed

```text
Failed to configure the ${eksClusterDisplayName} EKS cluster.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

SetupEKSClusterTaskStarted

```text
Configuring the ${eksClusterDisplayName} EKS cluster.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

SetupEKSClusterTaskSucceeded

```text
Successfully configured the ${eksClusterDisplayName} EKS cluster.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SetupNetworkingTaskFailed

```text
Failed to configure the networking resources for GKE cluster in the  ${gcpProjectDisplayName} GCP project in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

SetupNetworkingTaskStarted

```text
Configuring the networking resources for GKE cluster in the  ${gcpProjectDisplayName} GCP project in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

SetupNetworkingTaskSucceeded

```text
Successfully configured the networking resources for GKE cluster in the  ${gcpProjectDisplayName} GCP project in the ${regionDisplayName} region.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

## kms_key_vault

______________________________________________________________________

KmsKeyVaultHealthCheckFailure

```text
Connectivity health check failed for KMS ${kmsName} of type ${kmsType}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

## korg

______________________________________________________________________

CanaryFailed

```text
Canary job failed for object ${object}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

CanaryFinished

```text
Canary job finished for object ${object}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CanaryStarted

```text
Canary job started for object ${object}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

JobCanceled

```text
Job instance ${jobInstanceID} canceled.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

JobCancellationIssued

```text
Cancellation request issued for job instance ${jobInstanceID}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

JobCancellationIssuedByUser

```text
Cancellation request received for job instance ${jobInstanceID} by user ${user}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

NonTerminalSeriesFailureRetry

```text
The failed job will be retried automatically.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

## o365

______________________________________________________________________

InsufficientO365AppsOfType

```text
The number of ${snappableType} apps (${appCount}) authenticated for ${orgName} is not sufficient to meet the configured SLAs. We recommend increasing the number of apps to ${recommendedAppCount}. Add ${snappableType} apps via the Manage Enterprise Apps button on the Microsoft 365 inventory page.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

M365BackupStorageSyncCanceled

```text
Canceled backup storage sync for Microsoft 365 subscription ${orgName}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

M365BackupStorageSyncFailed

```text
Failed to complete backup storage sync for Microsoft 365 subscription  ${orgName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

M365BackupStorageSyncStarted

```text
Started backup storage sync for Microsoft 365 subscription ${orgName}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

M365BackupStorageSyncStateTransitionStats

```text
${count} object(s) state changed from ${fromState} to ${toState}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

M365BackupStorageSyncSucceeded

```text
Completed backup storage sync for Microsoft 365 subscription ${orgName}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365DeleteOrgFailed

```text
Failed to delete Microsoft 365 Subscription ${orgName}: ${reason} (Error ID: ${errorID}). For more information on this error please visit https://support.rubrik.com/articles/How_To/000002821
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365DeleteOrgStarted

```text
Started deletion of O365 Subscription ${orgName}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

O365DeleteOrgSucceeded

```text
Successfully deleted Microsoft 365 Subscription ${orgName}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365DeleteOrgTaskFailed

```text
Failed to delete Microsoft 365 Subscription ${orgName}. Retrying. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

O365RefreshOrgAddedDocLibStats

```text
Discovered ${numAdded} new document libraries
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RefreshOrgAddedSharePointListStats

```text
Discovered ${numAdded} new sharepoint lists
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RefreshOrgAddedSiteCollectionStats

```text
Discovered ${numAdded} new site collections(s)
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RefreshOrgAddedSiteStats

```text
Discovered ${numAdded} new site(s)
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RefreshOrgAddedTeamAndChannelStats

```text
Discovered ${numTeamsAdded} new team(s) and ${numChannelsAdded} new channel(s)
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RefreshOrgAddedUserStats

```text
Discovered ${numAdded} new user(s)
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RefreshOrgArchivedTeamAndChannelStats

```text
Archived ${numTeamsArchived} team(s) and ${numChannelsArchived} channel(s)
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RefreshOrgCanceled

```text
Canceled ${maintenanceType} metadata refresh for subscription ${orgName}
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

O365RefreshOrgNewRegionsStats

```text
Added new M365 regions (${newRegions}) to (${existingRegions}).
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RefreshOrgRemovedSharePointObjectStats

```text
Removed ${numRemoved} SharePoint object(s).
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RefreshOrgRemovedUserStats

```text
Removed ${numRemoved} user(s): ${removedUserList}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RefreshOrgSkippedLockedSiteCollectionStats

```text
Skipped ${numSkipped} locked site collections
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RefreshOrgStarted

```text
Started ${maintenanceType} metadata refresh for subscription ${orgName}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RefreshOrgSucceeded

```text
Completed ${maintenanceType} metadata refresh for subscription ${orgName}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365RefreshOrgUnverifiedUserStats

```text
Unable to verify mailbox access for ${numUnverified} user(s): ${unverifiedUserList}
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

O365RefreshOrgUpdatedDocLibStats

```text
Updated metadata for ${numUpdated} document libraries
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RefreshOrgUpdatedSharePointListStats

```text
Updated metadata for ${numUpdated} sharepoint lists
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RefreshOrgUpdatedSiteCollectionStats

```text
Updated metadata for ${numUpdated} siteCollections(s)
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RefreshOrgUpdatedSiteStats

```text
Updated metadata for ${numUpdated} site(s)
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RefreshOrgUpdatedTeamAndChannelStats

```text
Updated metadata for ${numTeamsUpdated} team(s) and ${numChannelsUpdated} channel(s)
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RefreshOrgUpdatedUserStats

```text
Updated metadata for ${numUpdated} user(s)
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ProtectedMailboxLimitBreach

```text
We're glad that our protection is helping! We're now protecting more mailboxes than your current licenses allow. We are protecting ${total_protected_licensed_mailbox} licensed mailboxes but the number allowed by your current licenses is ${allowed_protected_licensed_mailbox_limit}. We are protecting ${total_protected_unlicensed_mailbox} shared mailboxes but the number allowed by your current licenses is ${allowed_protected_unlicensed_mailbox_limit}. No need to worry though, we'll keep protecting the excess mailboxes for the next 30 days. During that time please reach out to the Rubrik Sales team to purchase additional licenses, or please remove ${overage_count} mailboxes. Please refer to ${learn_more_link} for more details. Thanks for being a great customer!
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

ProtectedOneDriveLimitBreach

```text
We're glad that our protection is helping! We're now protecting more OneDrives than your current licenses allow. We are protecting ${total_protected_onedrive} OneDrives but the number allowed by your current licenses is ${allowed_protected_onedrive_limit}. No need to worry though, we'll keep protecting the excess OneDrives for the next 30 days. During that time please reach out to the Rubrik Sales team to purchase additional licenses, or please remove ${overage} mailboxes. Please refer to ${learn_more_link} for more details. Thanks for being a great customer!
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

RefreshO365OrgFailed

```text
Failed ${maintenanceType} metadata refresh of subscription ${orgName}: ${reason} (Error ID: ${errorID}). For more information on this error please visit https://support.rubrik.com/articles/How_To/000002821
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

## polaris_disaster_recovery

______________________________________________________________________

PolarisComponentRecoveryFailure

```text
Recovery of ${component} failed.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

PolarisComponentRecoveryStarted

```text
Recovery of ${component} has begun.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

PolarisComponentRecoverySuccess

```text
Recovery of ${component} has completed successfully.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

PolarisDisasterRecoveryFailure

```text
Disaster recovery failed.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

PolarisDisasterRecoveryStarted

```text
Beginning disaster recovery.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

PolarisDisasterRecoverySuccess

```text
Disaster recovery has completed successfully.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

PolarisServiceStartBeginning

```text
Returning services to running state.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

PolarisServiceStartFailure

```text
Failed to bring up services. Please run `cluster disaster_recovery revert` from the Admin CLI.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

PolarisServiceStartSuccess

```text
Services successfully returned to running state.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## rcv

______________________________________________________________________

RcvAccessRemovedNotification

```text
Access to your Rubrik Cloud Vault (RCV) locations for the ${tier}  tier in ${bundle} with ${redundancy} redundancy was removed on  ${removeAccessDate}. If you don't renew your license, all backups in  these locations will be deleted on ${deleteDataDate}.  To renew your RCV license  and prevent the deletion of your backups, contact your Rubrik account  representative or email sales@rubrik.com.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

RcvConsumptionNotification

```text
Your Rubrik Cloud Vault (RCV) locations for the  ${tier} tier in ${bundle} with ${redundancy} redundancy have been  paused. As a result, no new backups can be uploaded. However, you can  still access previously uploaded backups in these locations. Uploaded  backups will expire based on the retention period defined in their  SLA Domains.  To purchase additional RCV capacity, contact  your Rubrik account representative or email sales@rubrik.com.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

RcvDataDeletionNotification

```text
Your backups in Rubrik Cloud Vault (RCV) locations for the ${tier}  tier in ${bundle} with ${redundancy} redundancy were deleted on  ${deleteDataDate}.  Your RCV Locations using RCV  ${tier} tier in ${bundle} regions have been deleted.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

RcvExpirationNotification

```text
Your Rubrik Cloud Vault (RCV) locations for the  ${tier} tier in ${bundle} with ${redundancy} redundancy were paused. As  a result, no new backups will be uploaded. However, you can still  access previously uploaded backups in these locations. Uploaded backups  will expire based on the retention period defined in their SLA  Domains. If you do not renew your license, your access to these  locations will be removed on ${removeAccessDate}, and all backups  in these locations will be deleted on ${deleteDataDate}.  To renew your RCV  license and prevent the deletion of your backups, contact your Rubrik  account representative or email sales@rubrik.com.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

RcvForecastedConsumptionNotification

```text
Based on your past and current consumption of  Rubrik Cloud Vault (RCV) ${tier} tier in ${bundle} regions,  we have forecasted that your consumption will exceed your  purchased entitlement on ${forecastCapacityExceedDate}.  When you exceed your license, no new backups will be uploaded  to RCV locations in ${tier} tier for ${bundle} regions  but you’ll still be able to access previously uploaded backups  in these locations. Uploaded backups will expire according to the  retention period defined in their SLA Domains.  To purchase additional Rubrik Cloud Vault (RCV) capacity, contact  your Rubrik account representative or email sales@rubrik.com.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

RCVPartialExpiryNotification

```text
Capacity Expiring: ${expiredSize} TB  Expiration Date: ${expiryDate}  Capacity Not Expiring: ${remainingSize} TB  If you exceed your remaining license of ${remainingSize} TB, the  Rubrik Cloud Vault locations for ${tier} tier in regions that belong to  ${bundle} storage bundle with ${redundancy} redundancy will be paused.  As a result, no new backups can be uploaded but you will still be able  to access previously uploaded backups in these locations. Uploaded  backups will expire according to the retention period defined in their  SLA Domains. To prevent your backups from being paused, contact your  Rubrik account representative or email sales@rubrik.com to purchase  additional Rubrik Cloud Vault capacity.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

RcvPercentageConsumptionNotification

```text
You have used ${percentage} percent of your Rubrik Cloud Vault (RCV) license. Once you have used 100 percent of your licensed capacity, the  Rubrik Cloud Vault (RCV) locations for ${tier} tier in ${bundle} with  ${redundancy} redundancy will be paused. As a result, no new backups  can be uploaded. However, you can still access previously  uploaded backups in these locations. Uploaded backups will expire  based on retention period defined in their SLA Domains.  To prevent your backups from being paused, contact your Rubrik account  representative or email sales@rubrik.com to purchase additional  RCV capacity.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

RcvPreliminaryExpirationNotification

```text
Your Rubrik Cloud Vault (RCV) locations for the  ${tier} tier in ${bundle}  with ${redundancy} redundancy will be paused on ${expiryDate}. As a  result, no new backups will be uploaded. However, you can still  access previously uploaded backups in these locations. Uploaded backups  will expire based on the retention period defined in their SLA  Domains. If you do not renew your license, your access to these  locations will be removed on ${removeAccessDate}, and all backups  in these locations will be deleted on ${deleteDataDate}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

## saasapps

______________________________________________________________________

SaasAppsDeleteOrgFailed

```text
Failed to delete SaaS organization ${orgName}: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SaasAppsDeleteOrgStarted

```text
Started the deletion of SaaS organization ${orgName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SaasAppsDeleteOrgSucceeded

```text
Successfully deleted SaaS organization ${orgName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## snapshot

______________________________________________________________________

SnapshotOutOfCompliance

```text
The following snappable is out of SLA compliance due to missed local snapshot(s): ${snappableName}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

## support_user_access

______________________________________________________________________

SupportUserAccessDisabled

```text
${accessRevokerName} revoked read-only access to view RSC account as ${impersonatedUserName} from Rubrik support staff.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SupportUserAccessDisabled

```text
${accessRevokerName} revoked read-only access to view RSC account as ${impersonatedUserName} from Rubrik support staff.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SupportUserAccessEnabled

```text
${accessProviderName} granted read-only access to view RSC account as ${impersonatedUserName} to Rubrik support staff.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SupportUserAccessEnabled

```text
${accessProviderUserName} granted read-only access to Rubrik support staff for support ticket ${ticketId}.  Rubrik support staff will have read-only view as ${impersonatedUserName} from ${startTime} till ${endTime}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SupportUserAccessExpired

```text
Access provided to Rubrik Support staff by ${accessProviderUserName} to impersonate ${impersonatedUserName} has expired.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SupportUserAccessModified

```text
${accessModifierName} updated Rubrik support staff’s read-only access timings to RSC account  as ${impersonatedUserName} from ${previousDuration} hours to ${newDuration} hours.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SupportUserAccessModified

```text
${accessModifierName} updated Rubrik support staff’s read-only access timings to RSC account  as ${impersonatedUserName} from ${previousDuration} hours to ${newDuration} hours.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SupportUserLoggedIn

```text
Rubrik support staff logged in as ${impersonatedUserName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SupportUserLoggedOut

```text
Rubrik support staff viewing RSC account as ${impersonatedUserName} logged out.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## trident

______________________________________________________________________

CPUUtilizationWarning

```text
CPU Utilization Warning. Reasons: ${reasons}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

DiskUtilizationWarning

```text
Disk Utilization Warning. Reasons: ${reasons}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

MemoryUtilizationWarning

```text
Memory Utilization Warning. Reasons: ${reasons}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

PolarisHealthDegraded

```text
Rubrik deployment status is ${node_status}. Reasons: ${reasons}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

PolarisHealthOk

```text
Rubrik deployment status is ${node_status}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## appflows

______________________________________________________________________

RecoveryReportDownloadTriggered

```text
${userEmail} triggered a job to download report for recovery '${recoveryName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## download

______________________________________________________________________

DownloadReportCSV

```text
${username} downloaded report ${reportName} as a CSV.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DownloadReportPDF

```text
${username} downloaded report ${reportName} as a PDF.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ReportDownloadGenerateFailure

```text
Failure to create a download link for ${reportName} taken at ${timestamp}. ${failureReason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ReportDownloadGenerateInProgress

```text
${reportName} is under preparation. Visit the Download Center for more information.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

ReportDownloadGenerateSuccess

```text
Successfully completed preparation of ${reportName} taken at ${timestamp}. Visit the Download Center to obtain the link to download the report
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ReportEmailGenerateFailure

```text
Failed to immediately schedule report for ${reportName} requested at ${timestamp}. ${failureReason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ReportEmailGenerateInProgress

```text
${reportName} is under preparation. Visit the Download Center for more information.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

ReportEmailGenerateSuccess

```text
Successfully sent the immediately scheduled report for ${reportName} requested at ${timestamp}. Visit the Download Center for more information.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SendImmediateReportEmail

```text
${username} performed an immediate schedule for ${reportName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## fileset

______________________________________________________________________

FilesetBackupReport

```text
${username} started a backup report job for fileset '${filesetName}' and snapshot taken on '${snapshotDate}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

FilesetBackupReportFailure

```text
${username} failed to start backup report job for fileset '${filesetName}' and snapshot taken on '${snapshotDate}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## managed_volume

______________________________________________________________________

DownloadManagedVolumeFromLocationFailure

```text
${username} failed to download the snapshot: '${snapshotId}' from location: '${locationId}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DownloadManagedVolumeFromLocationSuccess

```text
${username} started the operation to download the snapshot: '${snapshotId}' from location: '${locationId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## rest_api_precheck

______________________________________________________________________

DownloadCSV

```text
${username} downloaded a CDM Rest API metrics CSV file.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## cdm_encryption

______________________________________________________________________

AddKmipServerFailure

```text
${ActorSubjectName} failed to add a KMIP server with the address '${address}.'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

AddKmipServerSuccess

```text
${ActorSubjectName} added a KMIP server with the address '${address}.'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AsyncEditKmipServerFailure

```text
${ActorSubjectName} was unable to schedule an edit of the KMIP server with the address '${address}.'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

AsyncEditKmipServerSuccess

```text
${ActorSubjectName} scheduled an edit of the KMIP server with the address '${address}.'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

BulkAddKmipServerFailure

```text
${ActorSubjectName} was unable to schedule the addition of a KMIP server with the address '${address}.'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

BulkAddKmipServerSuccess

```text
${ActorSubjectName} scheduled the addition of a KMIP server with the address '${address}.'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

BulkDeleteKmipServerFailure

```text
${ActorSubjectName} was unable to schedule the removal of the KMIP server with the address '${address}.'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

BulkDeleteKmipServerSuccess

```text
${ActorSubjectName} scheduled the removal of the KMIP server with the address '${address}.'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DeleteKmipServerFailure

```text
${ActorSubjectName} failed to delete the KMIP server with the address '${address}.'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteKmipServerSuccess

```text
${ActorSubjectName} deleted the KMIP server with the address '${address}.'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ScheduleRotateKeysJobFailure

```text
${ActorSubjectName} was unable to schedule a job to trigger a one-time data-at-rest  encryption key rotation.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ScheduleRotateKeysJobSuccess

```text
${ActorSubjectName} scheduled a job to trigger a one-time data-at-rest  encryption key rotation with the key type '${keyType}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SetKmipClientBothSuccess

```text
${ActorSubjectName} configured the KMIP client credentials with KMIP user '${username}' and both password and certificate-based authentication.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SetKmipClientCertificateSuccess

```text
${ActorSubjectName} configured the KMIP client credentials with KMIP user '${username}' and certificate-based authentication.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SetKmipClientFailure

```text
${ActorSubjectName} failed to configure the KMIP client credentials.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SetKmipClientPasswordSuccess

```text
${ActorSubjectName} configured the KMIP client credentials with KMIP user '${username}' and password-based authentication.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SyncRotateKeysFailure

```text
${ActorSubjectName} was unable to trigger a one-time data-at-rest encryption key rotation.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

SyncRotateKeysSuccess

```text
${ActorSubjectName} triggered a one-time data-at-rest encryption  key rotation with the key type '${keyType}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## colossus

______________________________________________________________________

M365KeyRekeyingCompleted

```text
Successfully rekeyed encryption keys for ${exocomputeName} in  Subscription ${orgName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

M365KeyRekeyingFailed

```text
Failed to rekey encryption keys for ${exocomputeName} in Subscription  ${orgName}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

M365KeyRekeyingStarted

```text
Rekeying encryption keys for ${exocomputeName} in Subscription  ${orgName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

M365KeyRotationCompleted

```text
Successfully rotated encryption keys for ${exocomputeName} in  Subscription ${orgName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

M365KeyRotationFailed

```text
Failed to rotate encryption keys for ${exocomputeName} in Subscription  ${orgName}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

M365KeyRotationStarted

```text
Rotating encryption keys for ${exocomputeName} in Subscription  ${orgName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## encryption

______________________________________________________________________

BulkKmipServerAddCertificateImportFailure

```text
Failed to add the KMIP server certificate '${certName}'  to cluster '${cluster}.'
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

BulkKmipServerAddCertificateImportSuccess

```text
Successfully added the KMIP server certificate '${certName}'  to cluster '${cluster}.'
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

BulkKmipServerAddFailure

```text
Failed to add the KMIP Server '${address}:${port}' to cluster  '${cluster}.'
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

BulkKmipServerAddStarting

```text
Attempting to add a KMIP Server '${address}:${port}' with server  certificate '${certName}' to cluster '${cluster}.'
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

BulkKmipServerAddSuccess

```text
Successfully added the KMIP Server '${address}:${port}' to cluster  '${cluster}.'
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

BulkKmipServerDeleteFailure

```text
Unable to delete the KMIP server '${address}' from the  Rubrik cluster '${cluster}.'
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

BulkKmipServerDeleteStarting

```text
Attempting to delete the KMIP server '${address}' from the  Rubrik cluster '${cluster}.'
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

BulkKmipServerDeleteSuccess

```text
Successfully deleted the KMIP server '${address}' from the  Rubrik cluster '${cluster}.'
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

BulkKmipServerEditFailure

```text
Unable to edit the KMIP Server with address '${address}` to use  certificate '${certName}' and port ${port} on Rubrik cluster '${cluster}.'
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

BulkKmipServerEditStarting

```text
Attempting to edit the KMIP Server with address '${address}` to use  certificate '${certName}' and port ${port} on Rubrik cluster '${cluster}.'
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

BulkKmipServerEditSuccess

```text
Successfully edited the KMIP Server with address '${address}` to use  certificate '${certName}' and port ${port} on Rubrik cluster '${cluster}.'
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

EncryptionKeyRotationTriggerClusterUnreachable

```text
Failed to trigger a one-time data at rest encryption key rotation for cluster '${cluster}' because the cluster is disconnected.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

EncryptionKeyRotationTriggerMalformedRequest

```text
Failed to trigger a one-time data at rest encryption key rotation for cluster '${cluster}' due to an invalid request.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

EncryptionKeyRotationTriggerSuccess

```text
Successfully triggered a one-time data at rest encryption key rotation for cluster '${cluster}' using key type ${keyType}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## o365

______________________________________________________________________

MetadataBackupStorageAccountSetupFailure

```text
Failed to set up storage account ${storage_account_name} for backup of  encryption keys
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

MetadataBackupStorageAccountSetupStarted

```text
Setting up storage account ${storage_account_name} for backup of  encryption keys
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

MetadataBackupStorageAccountSetupSuccess

```text
Successfully completed set up of storage account ${storage_account_name} for backup of encryption keys
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## filedownloads

______________________________________________________________________

FileDownloadCreated

```text
${username} created a file of type ${type} named ${name}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

FileDownloadStarted

```text
${username} is downloading a file named ${name}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## app_failover

______________________________________________________________________

BlueprintFailoverCanceled

```text
Canceled failover Recovery Plan '${name}' to '${location}'.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

BlueprintFailoverCanceling

```text
Canceling failover for Recovery Plan '${name}' to '${location}'.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

BlueprintFailoverDataIngestionFailed

```text
'${dataIngestionOperation}' process failed for Recovery Plan '${name}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

BlueprintFailoverDataIngestionStarted

```text
Starting the '${dataIngestionOperation}' process for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverDataIngestionSucceed

```text
'${dataIngestionOperation}' process succeeded for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverFailed

```text
Failed to failover Recovery Plan '${name}' to '${location}': ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

BlueprintFailoverFinalizeFailed

```text
Final failover tasks failed for failover of Recovery Plan '${name}': ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

BlueprintFailoverFinalizeStarted

```text
Starting the final failover tasks for failover of Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverFinalizeSucceed

```text
Final failover tasks succeeded for failover of Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

BlueprintFailoverIncrementalDataTransferFailed

```text
Incremental data transfer process failed for Recovery Plan '${name}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

BlueprintFailoverIncrementalDataTransferStarted

```text
Starting the incremental data transfer process for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverIncrementalDataTransferSucceed

```text
Incremental data transfer process succeeded for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverPrepareDataFailed

```text
Failover initialization process failed for Recovery Plan '${name}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

BlueprintFailoverPrepareDataStarted

```text
Starting the failover initialization process for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverPrepareDataSucceed

```text
Failover initialization process succeeded for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverPrepareResourceFailed

```text
Failover resource validation and initialization process failed for Recovery Plan '${name}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

BlueprintFailoverPrepareResourceStarted

```text
Starting the failover resource validation and initialization process for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverPrepareResourceSucceed

```text
Failover resource validation and initialization process succeeded for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverProvisionFailed

```text
Unable to set up the target Rubrik cluster '${targetClusterName}' for failover of Recovery Plan '${name}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

BlueprintFailoverProvisionStarted

```text
Setting up the target Rubrik cluster '${targetClusterName}' for failover of Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverProvisionSucceed

```text
Reconfiguration of virtual machines on target Rubrik cluster '${targetClusterName}' succeeded for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverProvisionSucceedWithNetworkReconfigureFailure

```text
Reconfiguration of virtual machines on target Rubrik cluster '${targetClusterName}' failed for Recovery Plan '${name}'. Ignoring and continuing.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

BlueprintFailoverScheduled

```text
Scheduled job to failover Recovery Plan '${name}' to '${location}'.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

BlueprintFailoverStarted

```text
Starting failover for Recovery Plan '${name}' to '${location}'. Failover error handling option is set to ${errorHandling}. Skipping network reconfiguration errors is ${skipNetworkError}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverSuccess

```text
Successfully completed the failover for Recovery Plan '${name}' to '${location}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

BlueprintTakeOnDemandSnapshotFailed

```text
On demand snapshot for Recovery Plan '${blueprintName}' failed.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

BlueprintTakeOnDemandSnapshotStarted

```text
Starting on demand snapshot for Recovery Plan '${blueprintName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintTakeOnDemandSnapshotSucceed

```text
On demand snapshot for Recovery Plan '${blueprintName}' successfully completed.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

BlueprintWaitOnDemandSnapshotFailed

```text
Waiting on demand snapshot for Recovery Plan '${blueprintName}' failed.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

BlueprintWaitOnDemandSnapshotStarted

```text
Waiting for on demand snapshot for Recovery Plan '${blueprintName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintWaitOnDemandSnapshotSucceed

```text
Waiting on demand snapshot for Recovery Plan '${blueprintName}' succeeded.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CleanupFailoverCanceled

```text
Canceled the failover cleanup for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

CleanupFailoverCanceling

```text
Canceling the failover cleanup for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

CleanupFailoverFailed

```text
Failed to cleanup failover for Recovery Plan '${name}' with ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CleanupFailoverStarted

```text
Started failover cleanup for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CleanupFailoverSuccess

```text
Successfully completed the failover cleanup for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

CleanupFailoverTaskFailed

```text
Failed to cleanup Recovery Plan ${name}: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

CleanupFailoverTaskFailedWithUserComment

```text
Failed to cleanup Recovery Plan '${name}'. ${comment} : ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

CleanupFailoverTaskStarted

```text
Started cleanup for Recovery Plan ${name}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CleanupFailoverTaskSucceed

```text
Successfully completed the cleanup for Recovery Plan ${name}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CleanupFailoverTaskSucceedWithUserComment

```text
Successfully completed the cleanup for Recovery Plan '${name}'. ${comment}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

FailbackCloudMachineShutdownFailed

```text
Failed to shut down ${instanceType} ${instanceName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskFailure** | **No** |

FailbackCloudMachineShutdownSucceed

```text
Shut down ${instanceType} ${instanceName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

FailbackCloudMachineShutdownTaskFailed

```text
During failover, system was unable to shutdown the child ${instanceType} of Recovery Plan '${blueprintName}': ${reason}. Please shutdown the child ${instanceType} manually to avoid potential resource conflicts with the child ${instanceType} spun up during failover. Resource conflicts, such as IP address collisions, may result in failures, including failure to boot during failover.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

FailbackCloudMachineShutdownTaskStarted

```text
Started the shutdown process for Recovery Plan child ${instanceType}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

FailbackCloudMachineShutdownTaskSucceed

```text
Shut down all Recovery Plan child ${instanceType}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

FailbackCreateOnDemandBlueprintSnapshotTaskFailed

```text
Failed to create a snapshot for the current state of the Recovery Plan '${blueprintName}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

FailbackCreateOnDemandBlueprintSnapshotTaskStarted

```text
Started taking a snapshot for the current state of the Recovery Plan '${blueprintName}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

FailbackCreateOnDemandBlueprintSnapshotTaskSucceed

```text
Created a snapshot for the current state of the Recovery Plan '${blueprintName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

FailbackDeprecatePrimaryAppTaskFailed

```text
Failed to deprecate the primary Recovery Plan '${blueprintName}': ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

FailbackReprotectTaskFailed

```text
Failed to reprotect the Recovery Plan '${blueprintName}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

FailbackReprotectTaskStarted

```text
Reprotecting the Recovery Plan '${blueprintName}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

FailbackReprotectTaskSucceeded

```text
Reprotected the Recovery Plan '${blueprintName}' with SLA '${slaName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

FailbackSyncRecoverySpecTaskFailed

```text
The Recovery Plan '${blueprintName}' at the target cluster could not be synchronized with the source due to a communication issue. This could be a result of network issues between the source and target clusters or an incorrect replication configuration. Please resolve the issue to make sure the replication has been setup correctly between the source cluster and the target cluster, then retry the failover job.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

FailbackSyncRecoverySpecTaskStarted

```text
Started syncing the latest recovery spec to the target cluster.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

FailbackSyncRecoverySpecTaskSucceed

```text
Successfully synced the latest recovery spec to the target cluster.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

FailoverAssignClonedSLAFailed

```text
Failed to assign the cloned SLA to the newly created Recovery Plan: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

FailoverAssignSLAFailed

```text
Failed to assign the SLA '${slaName}' to the newly created Recovery Plan: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

FailoverDeprecatePrimaryAppTaskFailed

```text
Failed to deprecate the primary Recovery Plan '${blueprintName}': ${reason}, the ${instanceType} should be shutdown manually.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

FailoverDeprecatePrimaryAppTaskStarted

```text
Started to deprecate the primary Recovery Plan '${blueprintName}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

FailoverDeprecatePrimaryAppTaskSucceed

```text
Successfully deprecated the primary Recovery Plan '${blueprintName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

FailoverSLANotFound

```text
SLA not found when assigning SLA to the newly created Recovery Plan.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

RecoveryPlanFailoverPartialSuccess

```text
The failover for Recovery Plan, '${name}', to '${location}' was partially successful. ${partialFailureInfo}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SyncFailbackTaskFailed

```text
Failover failed on cluster '${clusterName}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

SyncFailbackTaskSucceed

```text
Failover succeeded on cluster '${clusterName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

TriggerFailbackTaskFailed

```text
Failed to trigger failover job for Recovery Plan to the point in time: ${recoveryPoint} on cluster '${clusterName}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

TriggerFailbackTaskFailedWithTimeRange

```text
Failed to trigger failover job for Recovery Plan to the point in time: range from ${startTime} to ${endTime} on cluster '${clusterName}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

TriggerFailbackTaskStarted

```text
Failover job for Recovery Plan to the point in time: ${recoveryPoint} triggered on cluster '${clusterName}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

TriggerFailbackTaskStartedWithTimeRange

```text
Failover job for Recovery Plan to the point in time: range from ${startTime} to ${endTime} triggered on cluster '${clusterName}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

TriggerFailbackTaskSucceed

```text
Triggered a failover job for Recovery Plan to the point in time: ${recoveryPoint} on cluster '${clusterName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

TriggerFailbackTaskSucceedWithTimeRange

```text
Triggered a failover job for Recovery Plan to the point in time: range from ${startTime} to ${endTime}, on cluster '${clusterName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ValidateRecoverySpecTaskFailed

```text
Failed to validate the recovery spec of Recovery Plan '${blueprintName}' on cluster '${clusterName}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

ValidateRecoverySpecTaskStarted

```text
The recovery spec of Recovery Plan '${blueprintName}' is being validated on cluster '${clusterName}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

ValidateRecoverySpecTaskSucceed

```text
Validated the recovery spec of Recovery Plan '${blueprintName}' on cluster '${clusterName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

## appflows

______________________________________________________________________

BlueprintFailoverCleanupStart

```text
${userEmail} triggered cleanup job for recovery plan '${blueprintName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

BlueprintFailoverStart

```text
${userEmail} triggered failover for recovery plan '${blueprintName}' to ${targetSite}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

BlueprintTestFailoverStart

```text
${userEmail} triggered test failover for recovery plan '${blueprintName}' to ${targetSite}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## rcv

______________________________________________________________________

RCVGRSFailoverReestablishmentPending

```text
Rubrik Cloud Vault location '${locName}' has been successfully  failed over to '${regionType}' region, '${currentRegionName}'  with LRS redundancy. Rubrik is now attempting to re-establish  GRS redundancy in the ${pairedRegionName} region.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RCVGRSPrimaryFailoverReestablishmentSuccess

```text
The Rubrik Cloud Vault '${locName}' has failed back to the former  primary region '${primaryRegionName}' and Rubrik has successfully  re-established the GRS redundancy. You can now enable '${locName}'  to resume archival.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RCVGRSSecondaryFailoverReestablishmentSuccess

```text
Successfully re-established GRS redundancy for Rubrik Cloud Vault  location '${locName}' between the primary region ${primaryRegionName}  and the secondary region ${secondaryRegionName}. You may initiate a  failback to the former primary region ${primaryRegionName} at any time  to resume archival to '${locName}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## identity_alerts

______________________________________________________________________

CriticalSeverityIdentityAlertClosed

```text
${alertMessage} on ${source} was closed automatically
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskSuccess** | **No** |

CriticalSeverityIdentityAlertDetected

```text
${alertMessage} detected on ${source}
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskSuccess** | **No** |

CriticalSeverityIdentityAlertDismissed

```text
${alertMessage} on ${source} was dismissed
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskSuccess** | **No** |

CriticalSeverityIdentityAlertInProgress

```text
${alertMessage} on ${source} changed status to in progress
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskSuccess** | **No** |

CriticalSeverityIdentityAlertRemediated

```text
${alertMessage} on ${source} was remediated
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskSuccess** | **No** |

CriticalSeverityIdentityAlertReOpened

```text
${alertMessage} on ${source} changed status to open
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskSuccess** | **No** |

HighSeverityIdentityAlertClosed

```text
${alertMessage} on ${source} was closed automatically
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

HighSeverityIdentityAlertDetected

```text
${alertMessage} detected on ${source}
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

HighSeverityIdentityAlertDismissed

```text
${alertMessage} on ${source} was dismissed
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

HighSeverityIdentityAlertInProgress

```text
${alertMessage} on ${source} changed status to in progress
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

HighSeverityIdentityAlertRemediated

```text
${alertMessage} on ${source} was remediated
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

HighSeverityIdentityAlertReOpened

```text
${alertMessage} on ${source} changed status to open
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

LowOrMediumSeverityIdentityAlertClosed

```text
${alertMessage} on ${source} was closed automatically
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

LowOrMediumSeverityIdentityAlertDetected

```text
${alertMessage} detected on ${source}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

LowOrMediumSeverityIdentityAlertDismissed

```text
${alertMessage} on ${source} was dismissed
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

LowOrMediumSeverityIdentityAlertInProgress

```text
${alertMessage} on ${source} changed status to in progress
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

LowOrMediumSeverityIdentityAlertRemediated

```text
${alertMessage} on ${source} was remediated
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

LowOrMediumSeverityIdentityAlertReOpened

```text
${alertMessage} on ${source} changed status to open
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

## app_failover

______________________________________________________________________

CleanupIsolatedRecoveryFailed

```text
Failed to complete the clean up: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CleanupIsolatedRecoveryStarted

```text
Starting cleaning up cyber recovery
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CleanupIsolatedRecoverySuccess

```text
Successfully completed the clean up
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CleanupIsolatedRecoveryTaskFailed

```text
Unable to clean up virtual machines: ${reason}
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

CleanupIsolatedRecoveryTaskStarted

```text
Starting clean up of virtual machines
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CleanupIsolatedRecoveryTaskSucceeded

```text
Successfully cleaned up virtual machines
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

IsolatedRecoveryConfigurationFailed

```text
Failed to complete configuration of virtual machines: ${reason}
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

IsolatedRecoveryConfigurationStarted

```text
Starting configuration of virtual machines
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

IsolatedRecoveryConfigurationSucceeded

```text
Successfully completed configuration of virtual machines
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

IsolatedRecoveryDeployEnvironmentFailed

```text
Failed to deploy recovery environment for cyber recovery of Recovery Plan '${planName}', recovery name: '${recoveryName}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

IsolatedRecoveryDeployEnvironmentStarted

```text
Starting deployment of recovery environment for cyber recovery of Recovery Plan '${planName}', recovery name: '${recoveryName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

IsolatedRecoveryDeployEnvironmentSucceeded

```text
Successfully completed deployment of recovery environment for cyber recovery of Recovery Plan '${planName}', recovery name: '${recoveryName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

IsolatedRecoveryFailed

```text
Failed to complete cyber recovery: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

IsolatedRecoveryFinalizeFailed

```text
Failed to complete final tasks of releasing resources for cyber recovery: ${reason}
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

IsolatedRecoveryFinalizeStarted

```text
Starting final tasks of releasing resources for cyber recovery
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

IsolatedRecoveryFinalizeSucceeded

```text
Successfully completed final tasks of releasing resources for cyber recovery
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

IsolatedRecoveryNetworkConfigurationFailed

```text
Error occurred during network configuration of virtual machines
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

IsolatedRecoveryNetworkConfigurationStarted

```text
Starting to execute network configuration
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

IsolatedRecoveryNetworkConfigurationSucceeded

```text
Successfully completed network configuration of virtual machines
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

IsolatedRecoveryPostScriptFailed

```text
Error occured during validation of post-recovery scripts
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

IsolatedRecoveryPostScriptStarted

```text
Starting to execute post-recovery scripts
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

IsolatedRecoveryPostScriptSucceeded

```text
Successfully completed validation of post-recovery scripts
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

IsolatedRecoveryPrepareDataFailed

```text
Failed to complete initialization process for cyber recovery: ${reason}
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

IsolatedRecoveryPrepareDataStarted

```text
Starting initialization process for cyber recovery
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

IsolatedRecoveryPrepareDataSucceeded

```text
Successfully completed initialization process for cyber recovery
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

IsolatedRecoveryPrepareResourceFailed

```text
Failed to complete resource validation and initialization: ${reason}
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

IsolatedRecoveryPrepareResourceStarted

```text
Starting resource validation and initialization
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

IsolatedRecoveryPrepareResourceSucceeded

```text
Successfully completed resource validation and initialization
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

IsolatedRecoveryRecoverObjectsFailed

```text
Failed to complete recovery of virtual machines: ${reason}
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

IsolatedRecoveryRecoverObjectsStarted

```text
Starting recovery of virtual machines
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

IsolatedRecoveryRecoverObjectsSucceeded

```text
Successfully completed recovery of virtual machines
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

IsolatedRecoveryScheduled

```text
Scheduled a job to execute cyber recovery
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

IsolatedRecoveryStarted

```text
Starting cyber recovery via ${dataTransferType}. Use the ${undoOnFailure} setting to abort and cleanup the recovery.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

IsolatedRecoverySucceeded

```text
Successfully completed cyber recovery
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## appflows

______________________________________________________________________

IsolatedRecoveryCleanupTriggered

```text
${userEmail} triggered a cyber recovery cleanup job for recovery '${recoveryName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

IsolatedRecoveryLocked

```text
${userEmail} locked cyber recovery '${recoveryName}' for recovery plan '${planName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

IsolatedRecoveryTriggered

```text
${userEmail} triggered a cyber recovery '${recoveryName}' to ${targetSite}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## azuread

______________________________________________________________________

AzureADIndexJobCanceled

```text
Canceled snapshot indexing for directory \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AzureADIndexJobCanceling

```text
Canceling snapshot indexing for directory \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AzureADIndexJobFailed

```text
Unable to index snapshot for directory \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureADIndexJobQueued

```text
Queued snapshot indexing for directory \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AzureADIndexJobStarted

```text
Started snapshot indexing for directory \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureADIndexJobSucceeded

```text
Successfully completed snapshot indexing for directory  \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## cloudnative

______________________________________________________________________

CloudNativeDeleteEmptyDiskTaskFailed

```text
Failed to delete scratch ${diskTypeDisplay}(s) in region ${region}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeDeleteEmptyDiskTaskStarted

```text
Deleting scratch ${diskTypeDisplay}(s) in region ${region}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeDeleteEmptyDiskTaskSucceeded

```text
Deleted scratch ${diskTypeDisplay}(s) in region ${region}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeIndexSnapshotBegin

```text
Started indexing of snapshot taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeIndexSnapshotFailedRetryable

```text
Failed to index snapshot taken at ${snapshotTimeDisplay} in the ${indexingAttempt} attempt. Reason: ${reason}. It will be retried automatically.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

CloudNativeIndexSnapshotFailedUnindexable

```text
Failed to index snapshot taken at ${snapshotTimeDisplay} in the ${indexingAttempt} attempt. Reason: ${reason}. Skipping indexing of this snapshot.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

CloudNativeIndexSnapshotsDeleteDisksTaskFailed

```text
Failed to delete ${diskTypeDisplay}(s) for ${numSnapshots} snapshot(s).
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeIndexSnapshotsDeleteDisksTaskStarted

```text
Deleting ${diskTypeDisplay}(s) for ${numSnapshots} snapshot(s).
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeIndexSnapshotsDeleteDisksTaskSucceeded

```text
Deleted ${diskTypeDisplay}(s) for ${numSnapshots} snapshot(s).
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeIndexSnapshotsJobCanceled

```text
Canceled indexing of the snapshots of the ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

CloudNativeIndexSnapshotsJobCanceling

```text
Canceling indexing of the snapshots of the ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

CloudNativeIndexSnapshotsJobFailed

```text
Failed to index snapshots of the ${snappableDisplay}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudNativeIndexSnapshotsJobStarted

```text
${userEmail} started indexing of the snapshot taken at ${snapshotTimeDisplay} of the ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CloudNativeIndexSnapshotsJobStarted

```text
Started indexing of the snapshots of the ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeIndexSnapshotsJobStartFailed

```text
${userEmail} failed to start indexing of the snapshot taken at ${snapshotTimeDisplay} of the ${snappableDisplay}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

CloudNativeIndexSnapshotsJobSucceeded

```text
Successfully indexed ${numSnapshots} snapshot(s) of the ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudNativeIndexSnapshotsJobSucceededNoop

```text
No snapshot available to index for ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudNativeIndexSnapshotsLaunchDisksTaskFailed

```text
Failed to launch ${diskTypeDisplay}(s) for ${numSnapshots} snapshot(s).
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeIndexSnapshotsLaunchDisksTaskStarted

```text
Launching ${diskTypeDisplay}(s) for ${numSnapshots} snapshot(s).
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeIndexSnapshotsLaunchDisksTaskSucceeded

```text
Launched ${diskTypeDisplay}(s) for ${numSnapshots} snapshot(s).
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeIndexSnapshotsOnDemandJobCanceled

```text
Canceled indexing of the snapshot taken at ${snapshotTimeDisplay} of the ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

CloudNativeIndexSnapshotsOnDemandJobCanceling

```text
Canceling indexing of the snapshot taken at ${snapshotTimeDisplay} of the ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

CloudNativeIndexSnapshotsOnDemandJobFailed

```text
Failed to index snapshot taken at ${snapshotTimeDisplay} of the ${snappableDisplay}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudNativeIndexSnapshotsOnDemandJobQueued

```text
Queued indexing of the snapshot taken at ${snapshotTimeDisplay} of the ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

CloudNativeIndexSnapshotsOnDemandJobStarted

```text
Started indexing of the snapshot taken at ${snapshotTimeDisplay} of the ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeIndexSnapshotsOnDemandJobSucceeded

```text
Successfully indexed snapshot taken at ${snapshotTimeDisplay} of the ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudNativeIndexSnapshotsPrepareTaskTerminated

```text
Some files may not be available for download because we couldn't index them. Reason:  ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

CloudNativeIndexSnapshotSucceeded

```text
Successfully indexed snapshot taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudNativeIndexSnapshotsWaitForSnappableIndexTaskFailed

```text
Failed to make ${numSnapshots} snapshot(s) available for file recovery.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeIndexSnapshotsWaitForSnappableIndexTaskStarted

```text
Waiting for ${numSnapshots} snapshot(s) to be available for file recovery.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeIndexSnapshotsWaitForSnappableIndexTaskSucceeded

```text
${numSnapshots} snapshot(s) are available for file recovery.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

## o365

______________________________________________________________________

O365IndexTaskFailed

```text
Failed to index ${user} Microsoft 365 ${snappable}. We will retry automatically. Reason: ${reason}. (Error ID: ${errorID}). For more information on this error please visit https://support.rubrik.com/articles/How_To/000002821
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365IndexTaskFailedWarning

```text
Unable to index ${user} Microsoft 365 ${snappable}. Rubrik will automatically retry indexing this user. Reason: ${reason}. (Error ID: ${errorID}). For more information on this error, see https://support.rubrik.com/articles/How_To/000002821
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

O365IndexTaskSucceededWithSkip

```text
Index completed. ${skipCount} ${itemType} were skipped because ${reason}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

## radar_hawkeye_indexing

______________________________________________________________________

RadarHawkeyeBuildIndexFailed

```text
Failed to prepare Data Threat Analytics investigation view for snapshot taken on ${snapshotDate} for workload ${snappableName}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

RadarHawkeyeBuildIndexQueued

```text
Preparing Data Threat Analytics investigation view for snapshot taken on ${snapshotDate} for workload ${snappableName}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

RadarHawkeyeBuildIndexStarted

```text
Started preparing Data Threat Analytics investigation view for snapshot taken on ${snapshotDate} for workload ${snappableName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

RadarHawkeyeBuildIndexSucceeded

```text
Successfully prepared Data Threat Analytics investigation view for snapshot taken on ${snapshotDate} for workload ${snappableName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## app_failover

______________________________________________________________________

BlueprintLocalRecoveryCanceled

```text
In-place recovery canceled for the Recovery Plan '${name}' on '${location}'.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

BlueprintLocalRecoveryCanceling

```text
Canceling in-place recovery for the Recovery Plan '${name}' on '${location}'.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

BlueprintLocalRecoveryDataIngestionFailed

```text
'${dataIngestionOperation}' recovery failed for the Recovery Plan '${name}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

BlueprintLocalRecoveryDataIngestionStarted

```text
Starting the '${dataIngestionOperation}' process for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintLocalRecoveryDataIngestionSucceed

```text
'${dataIngestionOperation}' process for in-place recovery succeeded for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintLocalRecoveryFailed

```text
In-place recovery failed for the Recovery Plan '${name}' on '${location}': ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

BlueprintLocalRecoveryFinalizeFailed

```text
Final in-place recovery tasks failed for Recovery Plan '${name}': ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

BlueprintLocalRecoveryFinalizeStarted

```text
Starting the final in-place recovery tasks for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintLocalRecoveryFinalizeSucceed

```text
Final in-place recovery tasks succeeded for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

BlueprintLocalRecoveryPostScriptOptFailed

```text
Unable to execute post scripts on the in-place recovered cluster '${sourceClusterName}' for the Recovery Plan '${name}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

BlueprintLocalRecoveryPostScriptOptStarted

```text
Starting to execute post scripts on the in-place recovered cluster '${sourceClusterName}' for the Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintLocalRecoveryPostScriptOptSucceed

```text
The in-place recovery cluster '${sourceClusterName}' post scripts setup succeeded for the Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintLocalRecoveryPrepareDataFailed

```text
In-place recovery initialization process failed for Recovery Plan '${name}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

BlueprintLocalRecoveryPrepareDataStarted

```text
Starting the in-place recovery initialization process for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintLocalRecoveryPrepareDataSucceed

```text
In-place recovery initialization process succeeded for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintLocalRecoveryPrepareResourceFailed

```text
The in-place recovery resource validation and initialization failed for Recovery Plan '${name}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

BlueprintLocalRecoveryPrepareResourceStarted

```text
Starting the in-place recovery resource validation and initialization process for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintLocalRecoveryPrepareResourceSucceed

```text
The in-place recovery resource validation and initialization succeeded for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintLocalRecoveryProvisionFailed

```text
Unable to set up Rubrik cluster '${targetClusterName}' for in-place recovery of Recovery Plan '${name}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

BlueprintLocalRecoveryProvisionStarted

```text
Setting up Rubrik cluster '${targetClusterName}' for in-place recovery of Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintLocalRecoveryProvisionSucceed

```text
Reconfiguration of virtual machines on Rubrik cluster '${targetClusterName}' succeeded for in-place recovery of Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintLocalRecoveryProvisionSucceedWithNetworkReconfigureFailureEvent

```text
Reconfiguration of virtual machines on target Rubrik cluster '${targetClusterName}' failed for Recovery Plan '${name}'. Ignoring and continuing.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

BlueprintLocalRecoveryScheduled

```text
Scheduled in-place recovery job for Recovery Plan '${name}' on '${location}'.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

BlueprintLocalRecoveryStarted

```text
Starting in-place recovery for Recovery Plan '${name}' to '${location}'. Abort and cleanup setting is ${undoOnFailure}. Skipping network reconfiguration errors is ${skipNetworkError}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintLocalRecoverySuccess

```text
Successfully completed in-place recovery for the Recovery Plan '${name}' on '${location}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## appflows

______________________________________________________________________

BlueprintLocalRecoveryStart

```text
${userEmail} triggered local recovery for recovery plan '${blueprintName}' to ${targetSite}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## snappables

______________________________________________________________________

SnapshotImmutabilityJobFailed

```text
Failed to lock snapshots for ${snappableDisplay}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SnapshotImmutabilityJobLockSnapshotsTaskMoreFailuresThanThreshold

```text
Polaris failed to lock ${failureCountBeyondThreshold} more snapshot(s) of the ${snappableDisplay}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SnapshotImmutabilityJobLockSnapshotsTaskPartiallyFailed

```text
Polaris failed to lock snapshot taken at ${snapshotTimeDisplay} of the ${snappableDisplay}. Reason: ${errorMessageDisplay}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SnapshotImmutabilityJobSucceeded

```text
Successfully locked snapshots for ${workloadDisplay}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## authz

______________________________________________________________________

ClientAuthenticationFailed

```text
${clientName} unable to authenticate with invalid secret.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

ClientIdInvalid

```text
Unable to authenticate with invalid service account ID, ${clientId}.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

LoginBlockedIP

```text
Login by ${actorUserEmail} from ${ip} blocked because the request came from outside of the IP whitelist.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

LoginFailedDueToAccountLock

```text
Login failed for ${userName} because the user is locked.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

LoginFailedInsufficientPermissions

```text
Login by ${userName} (${domain}) from ${ipAddress} failed because the  user does not have any assigned roles.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

LoginFailedSSOUnauthorizedForGroups

```text
Login by ${userEmail}(SSO) failed.  User does not belong to any of the SSO groups authorized in RSC.  User's SSO groups: (${groups})
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

LoginSucceeded

```text
${userName} logged in.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

LoginSucceededWithNotification

```text
${userName} logged in.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

LogoutSucceeded

```text
${userName} was logged out ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PasskeyLoginFailed

```text
${username} failed to login with passkey.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

PasswordLoginFailedKnownUser

```text
Known user, ${username}, was unable to login with an invalid password.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

PasswordLoginFailedUnknownUser

```text
Login failed. User ${username} does not exist.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

ResetPasswordMailSent

```text
Password reset email sent for ${userName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TotpLoginFailed

```text
${username} failed to login with Rubrik Two-Step Verification.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

UpdateUserPasswordFailed

```text
${userName} was unable to update their password. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

UpdateUserPasswordSucceeded

```text
${userName} succeeded to update their password.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## rkcli

______________________________________________________________________

RkcliLogin

```text
Admin user logged in to rkcli on the ${node} node from ${ip}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## rbac

______________________________________________________________________

AccountOwnerAdded

```text
Polaris account ownership assigned to ${user} by ${invokingUser}. Current owners are ${owners}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

AccountOwnerRemoved

```text
Polaris account ownership revoked from ${user} by ${invokingUser}. Current owners are ${owners}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

## quarantine

______________________________________________________________________

QuarantineCompleted

```text
${user} quarantined ${count} files on object ${snappableName}. These  files cannot be downloaded or recovered.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ReleaseQuarantineCompleted

```text
${user} removed ${count} files on object ${snappableName} from  quarantine. These files can now be downloaded and recovered.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## radar

______________________________________________________________________

RadarQuarantineSnapshotCompleted

```text
${user} quarantined ${count} path(s) in a backup of ${snappableName} taken on ${snapshotDate}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RadarReleaseSnapshotsFromQuarantineCompleted

```text
${user} released ${count} path(s) from quarantine in a backup of ${snappableName} taken on ${snapshotDate}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## appflows

______________________________________________________________________

RecoveryScheduleCreationSucceeded

```text
${userEmail} successfully created recovery schedule for  recovery plan '${planName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RecoveryScheduleDeletionSucceeded

```text
${userEmail} successfully deleted recovery schedule for recovery plan '${planName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RecoveryScheduleUpdateSucceeded

```text
${userEmail} successfully updated recovery schedule for recovery plan '${planName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## ruby_ai

______________________________________________________________________

DisabledRuby

```text
${userEmail} successfully turned off the usage of Ruby.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

EnabledRuby

```text
${userEmail} successfully enabled the usage of Ruby.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RubyConfirmation

```text
${userEmail} confirmed Ruby ${action}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RubyDenied

```text
${userEmail} did not confirm Ruby ${action}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## anomaly

______________________________________________________________________

DetailedEncryptionAnalysisFinished

```text
Finished detailed encryption analysis for snapshot taken on ${snapshotDate} of ${snappableType} '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

DetailedEncryptionAnalysisStarted

```text
Started detailed encryption analysis for snapshot taken on ${snapshotDate} of ${snappableType} '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

RadarAnalysisFinished

```text
Finished Anomaly Detection analysis for snapshot taken on ${snapshotDate} of ${snappableType} '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RadarAnalysisStarted

```text
Started Anomaly Detection analysis for snapshot taken on ${snapshotDate} of ${snappableType} '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

RansomwareDetectionJobFailed

```text
Ransomware detection job for snapshot taken on ${snapshotDate} of ${snappableType} '${snappableName}' failed: ${failureReason}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

RansomwareDetectionJobScheduleFailed

```text
Unable to schedule ransomware detection job on cluster ${clusterName} due to ${failureReason}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

RansomwareDetectionJobStarted

```text
Starting ransomware detection job on cluster ${clusterName} for snapshot taken on ${snapshotDate} of ${snappableType} '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

## active_directory

______________________________________________________________________

ActiveDirectoryForestOtherDcsPhaseFailed

```text
${phaseName} failed for Active Directory forest domain controllers other than root domain controller due to critical error ${reason}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

ActiveDirectoryForestOtherDcsPhaseStarted

```text
${phaseName} started for Active Directory forest domain controllers other than root domain controller.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ActiveDirectoryForestOtherDcsPhaseSuccess

```text
${phaseName} succeeded for Active Directory forest domain controllers other than root domain controller.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ActiveDirectoryForestRestoreCanceled

```text
Canceled Active Directory forest restore for forest ${forestName}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

ActiveDirectoryForestRestoreFailed

```text
Active Directory forest restore failed for forest ${forestName} due to critical error ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ActiveDirectoryForestRestoreStarted

```text
Active Directory forest restore started for forest ${forestName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

ActiveDirectoryForestRestoreSuccess

```text
Active Directory forest restore succeeded for forest ${forestName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ActiveDirectoryForestRootDcPhaseFailed

```text
${phaseName} failed for Active Directory forest root domain controller due to critical error ${reason}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

ActiveDirectoryForestRootDcPhaseStarted

```text
${phaseName} started for Active Directory forest root domain controller.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ActiveDirectoryForestRootDcPhaseSuccess

```text
${phaseName} succeeded for Active Directory forest root domain controller.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ActiveDirectoryGpoRollbackFailure

```text
${username} unable to roll back GPO ${gpoId} in domain ${domainSid} on the Active Directory domain controller '${domainControllerName}' using snapshot ${snapshotId}. Reason: ${errorMessage}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ActiveDirectoryGpoRollbackSuccess

```text
${username} successfully rolled back GPO ${gpoId} in domain ${domainSid} on the Active Directory domain controller '${domainControllerName}' using snapshot ${snapshotId}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ActiveDirectoryLiveMountStarted

```text
${username} started a job to mount the snapshot ${snapshotFid} of the  Active Directory domain controller ${dcName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ActiveDirectoryLiveMountStartFailed

```text
${username} unable to start a job to mount the snapshot ${snapshotFid}  of the Active Directory domain controller ${dcName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ActiveDirectoryModifyLiveMountStarted

```text
${username} updated the snapshot mount of volume export  ${volumeExportFid} of the Active Directory domain controller ${dcName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ActiveDirectoryModifyLiveMountStartFailed

```text
${username} unable to update the snapshot mount of volume export  ${volumeExportFid} of the Active Directory domain controller ${dcName}.  Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ActiveDirectoryObjectsRestoreStarted

```text
${username} started a job to ${restoreOperation} on the Active Directory domain controller '${dcName}' using the snapshot ${snapshotFid}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ActiveDirectoryObjectsRestoreStartFailed

```text
${username} unable to start a job to ${restoreOperation} on the Active Directory domain controller '${dcName}' using the snapshot ${snapshotFid}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ActiveDirectoryRestoreToDCJobStarted

```text
${username} started a job to restore the Active Directory domain controller ${dcName} using the snapshot ${snapshotFid}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ActiveDirectoryRestoreToDCJobStartFailed

```text
${username} unable to start a job to restore the Active Directory domain controller ${dcName} using the snapshot ${snapshotFid}. Reason:  ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ActiveDirectoryRestoreToHostJobStarted

```text
${username} started a job to restore the Active Directory domain controller ${dcName} to the host ${hostName} using the snapshot ${snapshotFid}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ActiveDirectoryRestoreToHostJobStartFailed

```text
${username} unable to start a job to restore the Active Directory domain controller ${dcName} to the host ${hostName} using the snapshot ${snapshotFid}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ActiveDirectoryUnmountStarted

```text
${username} started a job to unmount the snapshot mount of volume  export ${volumeExportFid} of the Active Directory domain controller  ${dcName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ActiveDirectoryUnmountStartFailed

```text
${username} unable to start a job to unmount the snapshot mount of  volume export ${volumeExportFid} of the  Active Directory domain  controller ${dcName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## awsnative

______________________________________________________________________

AwsNativeExportEbsFromArchivedSnapshotJobQueued

```text
Queued the export of the ${snapshotType} snapshot of EBS Volume  ${volumeDisplayName} taken on ${snapshotCreationTime} in  archival location ${archivalLocation} from region ${sourceRegion}  in AWS account ${sourceAwsAccountDisplayName} to availability zone  ${availabilityZone} in region ${destinationRegion} in  AWS account ${targetAwsAccountDisplayName} .
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AwsNativeExportEbsFromArchivedSnapshotJobStarted

```text
Started the export of the ${snapshotType} snapshot of EBS Volume  ${volumeDisplayName} taken on ${snapshotCreationTime} in  archival location ${archivalLocation} from region ${sourceRegion}  in AWS account ${sourceAwsAccountDisplayName} to  availability zone ${availabilityZone} in region ${destinationRegion}  in AWS account ${targetAwsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportEbsSnapshotAttachVolumeTaskFailed

```text
Failed to attach the ${volumeDisplayName} EBS Volume to the ${instanceDisplayName} EC2 Instance at ${devicePath} device path.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeExportEbsSnapshotAttachVolumeTaskStarted

```text
Attaching the ${volumeDisplayName} EBS Volume to the ${instanceDisplayName} EC2 Instance at ${devicePath} device path.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeExportEbsSnapshotAttachVolumeTaskSucceeded

```text
Successfully attached the ${volumeDisplayName} EBS Volume to the ${instanceDisplayName} EC2 Instance at ${devicePath} device path.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportEbsSnapshotCopySnapshotTaskFailed

```text
Failed to copy the ${snapshotType} snapshot to the ${destinationRegion} region on the ${awsAccount} AWS account.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeExportEbsSnapshotCopySnapshotTaskStarted

```text
Copying the ${snapshotType} snapshot to the ${destinationRegion} region on the ${awsAccount} AWS account.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeExportEbsSnapshotCopySnapshotTaskSucceeded

```text
Successfully copied the ${snapshotType} snapshot to the ${destinationRegion} region on the ${awsAccount} AWS account.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportEbsSnapshotCreateVolumeTaskFailed

```text
Failed to create EBS Volume from the ${snapshotType} snapshot in the ${availabilityZone} availability zone.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeExportEbsSnapshotCreateVolumeTaskStarted

```text
Creating EBS Volume from the ${snapshotType} snapshot in the ${availabilityZone} availability zone.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeExportEbsSnapshotCreateVolumeTaskSucceeded

```text
Successfully created the ${volumeDisplayName} EBS Volume from the ${snapshotType} snapshot in the ${availabilityZone} availability zone.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportEbsSnapshotDetachVolumeTaskFailed

```text
Failed to detach the ${volumeDisplayName} EBS Volume from the ${instanceDisplayName} EC2 Instance attached at ${devicePath} device path.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeExportEbsSnapshotDetachVolumeTaskStarted

```text
Detaching the ${volumeDisplayName} EBS Volume from the ${instanceDisplayName} EC2 Instance attached at ${devicePath} device path.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeExportEbsSnapshotDetachVolumeTaskSucceeded

```text
Successfully detached the ${volumeDisplayName} EBS Volume from the ${instanceDisplayName} EC2 Instance attached at ${devicePath} device path.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportEbsSnapshotJobCanceled

```text
Canceled the export the ${snapshotType} snapshot of the ${volumeDisplayName} EBS Volume taken on ${snapshotCreationTime} from the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account to the ${availabilityZone} availability zone in the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AwsNativeExportEbsSnapshotJobFailed

```text
Failed to export the ${snapshotType} snapshot of the ${volumeDisplayName} EBS Volume taken on ${snapshotCreationTime} from the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account to the ${availabilityZone} availability zone in the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsNativeExportEbsSnapshotJobQueued

```text
Queued the export of the ${snapshotType} snapshot of the ${volumeDisplayName} EBS Volume taken on ${snapshotCreationTime} from the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account to the ${availabilityZone} availability zone in the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AwsNativeExportEbsSnapshotJobStarted

```text
Started the export of the ${snapshotType} snapshot of the ${volumeDisplayName} EBS Volume taken on ${snapshotCreationTime} from the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account to the ${availabilityZone} availability zone in the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportEbsSnapshotJobSucceeded

```text
Successfully exported the ${snapshotType} snapshot of the ${volumeDisplayName} EBS Volume taken on ${snapshotCreationTime} from the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account to the  ${launchedVolumeDisplayName} EBS Volume in the ${availabilityZone} availability zone in the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsNativeExportEbsSnapshotSkipRestoreTasks

```text
Skipped replacing original volume: ${skipReason}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportEbsSnapshotStartInstanceTaskFailed

```text
Failed to start the ${instanceDisplayName} EC2 Instance.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeExportEbsSnapshotStartInstanceTaskStarted

```text
Starting the ${instanceDisplayName} EC2 Instance.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeExportEbsSnapshotStartInstanceTaskSucceeded

```text
Successfully started the ${instanceDisplayName} EC2 Instance.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportEbsSnapshotStopInstanceTaskFailed

```text
Failed to stop the ${instanceDisplayName} EC2 Instance in the ${availabilityZone} availability zone in the ${region} region.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeExportEbsSnapshotStopInstanceTaskStarted

```text
Stopping the ${instanceDisplayName} EC2 Instance in the ${availabilityZone} availability zone in the ${region} region.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeExportEbsSnapshotStopInstanceTaskSucceeded

```text
Successfully stopped the ${instanceDisplayName} EC2 Instance in the ${availabilityZone} availability zone in the ${region} region.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportEbsSnapshotStopInstanceTaskSucceededAlreadyStopped

```text
The ${instanceDisplayName} EC2 Instance in the ${availabilityZone} availability zone in the ${region} region was already stopped.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportEbsVolumeSnapshotJobStarted

```text
${userEmail} started the export of the ${snapshotType} snapshot of the ${volumeDisplayName} EBS Volume taken on ${snapshotCreationTime} from the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account to the ${availabilityZone} availability zone in the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsNativeExportEbsVolumeSnapshotJobStartFailed

```text
${userEmail} failed to start the export of the ${snapshotType} snapshot of the ${volumeDisplayName} EBS Volume taken on ${snapshotCreationTime} from the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account to the ${availabilityZone} availability zone in the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsNativeExportEc2InstanceCopySnapshotTaskFailed

```text
Failed to copy the ${snapshotType} snapshot from the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account to the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeExportEc2InstanceCopySnapshotTaskStarted

```text
Copying the ${snapshotType} snapshot from the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account to the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeExportEc2InstanceCopySnapshotTaskSucceeded

```text
Successfully copied the ${snapshotType} snapshot from the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account to the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportEc2InstanceFromArchivedSnapshotJobQueued

```text
Queued export of the ${instanceDisplayName} EC2 instance from the archived snapshot taken on ${snapshotCreationTime} in the ${sourceRegion} region in the ${archivalLocation} archival location  on the ${sourceAwsAccountDisplayName} AWS account to the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AwsNativeExportEc2InstanceFromArchivedSnapshotJobStarted

```text
Started export of the ${instanceDisplayName} EC2 instance from the  archived snapshot taken on ${snapshotCreationTime} in the ${sourceRegion}  region in the ${archivalLocation} archival location on the ${sourceAwsAccountDisplayName} AWS account to the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportEc2InstanceJobCanceled

```text
Canceled the export of the ${instanceDisplayName} EC2 instance from the ${snapshotType} snapshot taken on ${snapshotCreationTime} in the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account to the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AwsNativeExportEc2InstanceJobCanceling

```text
Canceling the export of the ${instanceDisplayName} EC2 instance from the ${snapshotType} snapshot taken on ${snapshotCreationTime} in the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account to the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AwsNativeExportEc2InstanceJobFailed

```text
Failed to export the ${instanceDisplayName} EC2 instance from the ${snapshotType} snapshot taken on ${snapshotCreationTime} in the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account to the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsNativeExportEc2InstanceJobQueued

```text
Queued the export of the ${instanceDisplayName} EC2 instance from the ${snapshotType} snapshot taken on ${snapshotCreationTime} in the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account to the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AwsNativeExportEC2InstanceJobStarted

```text
${userEmail} started the export of EC2 instance ${instanceDisplayName} from the ${snapshotType} snapshot ${snapshotDisplayName} taken on ${snapshotCreationTime} in the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account to region ${destinationRegion} in the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsNativeExportEc2InstanceJobStarted

```text
Started the export of the ${instanceDisplayName} EC2 instance from the ${snapshotType} snapshot taken on ${snapshotCreationTime} in the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account to the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportEC2InstanceJobStartFailed

```text
${userEmail} failed to start the export of EC2 instance from the ${snapshotType} snapshot ${snapshotDisplayName} taken on ${snapshotCreationTime} in the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account to region ${destinationRegion} in the ${targetAwsAccountDisplayName} AWS account. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsNativeExportEc2InstanceJobSucceeded

```text
Exported the ${instanceDisplayName} EC2 instance from the ${snapshotType} snapshot taken on ${snapshotCreationTime} in the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account to the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsNativeExportEc2InstanceLaunchInstanceTaskFailed

```text
Failed to launch EC2 instance in the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account from the ${snapshotType} snapshot taken on ${snapshotCreationTime} in the ${sourceRegion} region on the ${sourceAwsAccountDisplayName} AWS account. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeExportEc2InstanceLaunchInstanceTaskStarted

```text
Launching EC2 instance in the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account from the ${snapshotType} snapshot taken on ${snapshotCreationTime} in the ${sourceRegion} on the ${sourceAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeExportEc2InstanceLaunchInstanceTaskSucceeded

```text
Successfully launched EC2 instance ${launchedInstanceDisplayName} in the ${destinationRegion} region in the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportRdsInstanceCopySnapshotTaskFailed

```text
Failed to copy snapshot. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeExportRdsInstanceCopySnapshotTaskStarted

```text
Copying ${snapshotName} snapshot.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeExportRdsInstanceCopySnapshotTaskSucceeded

```text
Successfully copied the ${snapshotName} snapshot in the ${destinationRegion} region from the ${sourceRegion} region.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportRdsInstanceCreateDependenciesTaskFailed

```text
Failed to create ${dependencies} in the ${region} region. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeExportRdsInstanceCreateDependenciesTaskStarted

```text
Creating ${dependencies} in the ${region} region.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeExportRdsInstanceCreateDependenciesTaskSucceeded

```text
Successfully created ${dependencies} in the ${region} region.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportRdsInstanceJobCanceled

```text
Canceled export of the ${instanceDisplayName} RDS database in the ${destinationRegion} region and archival location ${archivalLocation} in the ${awsAccountDisplayName} AWS account from ${snapshotType}  snapshot in the ${sourceRegion} region taken at ${snapshotCreationTime}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AwsNativeExportRdsInstanceJobCanceling

```text
Canceling export of the ${instanceDisplayName} RDS database in the ${destinationRegion} region and archival location ${archivalLocation} in the ${awsAccountDisplayName} AWS account from ${snapshotType} snapshot  in the ${sourceRegion} region taken at ${snapshotCreationTime}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AwsNativeExportRdsInstanceJobFailed

```text
Failed to export the ${instanceDisplayName} RDS database in the ${destinationRegion} region and archival location ${archivalLocation} in the ${awsAccountDisplayName} AWS account from ${snapshotType}  snapshot in the ${sourceRegion} region taken at ${snapshotCreationTime}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsNativeExportRdsInstanceJobQueued

```text
Queued the export of the ${instanceDisplayName} RDS database from the ${snapshotType} snapshot taken on ${snapshotCreationTime} in the ${sourceRegion} region and archival location ${archivalLocation} in the  ${awsAccountDisplayName} AWS account to the ${destinationRegion} region  in the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AwsNativeExportRdsInstanceJobStarted

```text
${userEmail} started export of RDS instance ${instanceDisplayName} in region ${region} on AWS account ${awsAccountDisplayName} from snapshot ${snapshotDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsNativeExportRdsInstanceJobStarted

```text
Started export of the ${instanceDisplayName} RDS database.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportRdsInstanceJobStartFailed

```text
${userEmail} failed to start export of RDS instance ${instanceDisplayName} in region ${region} on AWS account ${awsAccountDisplayName} from snapshot ${snapshotDisplayName} . Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsNativeExportRdsInstanceJobSucceeded

```text
Export of the ${instanceDisplayName} RDS database in the ${destinationRegion} region and archival location ${archivalLocation} in the ${awsAccountDisplayName} AWS account from ${snapshotType}  snapshot in the ${sourceRegion} region, taken at ${snapshotCreationTime}, succeeded.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsNativeExportRdsInstanceJobSucceededWithDisabledUsers

```text
Export of the ${instanceDisplayName} RDS database in the ${destinationRegion} region with archival location ${archivalLocation} in the ${awsAccountDisplayName} AWS account from ${snapshotType}  snapshot in the ${sourceRegion} region, taken at ${snapshotCreationTime}, succeeded. However, following users were  explicitly created as disabled users: ${disabledUsers}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

AwsNativeExportRdsInstanceLaunchClusterTaskFailed

```text
Failed to launch the ${clusterName} RDS cluster. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeExportRdsInstanceLaunchClusterTaskStarted

```text
Launching the ${clusterName} RDS cluster.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeExportRdsInstanceLaunchClusterTaskSucceeded

```text
Successfully launched the ${clusterName} RDS cluster.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportRdsInstanceLaunchInstanceTaskFailed

```text
Failed to launch the ${instanceName} RDS instance. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeExportRdsInstanceLaunchInstanceTaskStarted

```text
Launching the ${instanceName} RDS instance.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeExportRdsInstanceLaunchInstanceTaskSucceeded

```text
Successfully launched the ${instanceName} RDS instance.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportRdsInstancePitrJobCanceled

```text
Canceled point in time export of the ${instanceDisplayName} RDS  database in the ${region} region on the ${awsAccountDisplayName} AWS  account at ${exportTime}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AwsNativeExportRdsInstancePitrJobFailed

```text
Failed to export the ${instanceDisplayName} RDS database in the  ${region} region on the ${awsAccountDisplayName} AWS account with  point in time recovery operation at ${exportTime}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsNativeExportRdsInstancePitrJobQueued

```text
Queued point in time export of the ${instanceDisplayName} RDS database  in the ${region} region on the ${awsAccountDisplayName} AWS account at  ${exportTime}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AwsNativeExportRdsInstancePitrJobStarted

```text
${userEmail} started point in time export of RDS instance ${instanceDisplayName} in region ${region} on AWS account ${awsAccountDisplayName} to ${exportTime} .
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsNativeExportRdsInstancePitrJobStarted

```text
Started point in time export of the ${instanceDisplayName} RDS database.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeExportRdsInstancePitrJobStartFailed

```text
${userEmail} failed to start point in time export of RDS instance ${instanceDisplayName} in region ${region} on AWS account ${awsAccountDisplayName} to ${exportTime}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsNativeExportRdsInstancePitrJobSucceeded

```text
Export of the ${instanceDisplayName} RDS database in the ${region}  region on the ${awsAccountDisplayName} AWS account with point in time  recovery operation at ${exportTime} succeeded.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsNativeExportRdsInstanceRecoveryTaskFailed

```text
Failed to recover data from the archived snapshot taken at  ${snapshotTimeDisplay} of the ${workloadDisplay} to  ${instanceDisplayName} RDS database in the ${destinationRegion}  region of the ${targetAwsAccountDisplayName} AWS account. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

AwsNativeExportRdsInstanceRecoveryTaskStarted

```text
Recovering data from the archived snapshot taken at  ${snapshotTimeDisplay} of the ${workloadDisplay} to ${instanceDisplayName} RDS database in the ${destinationRegion}  region of the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeExportRdsInstanceRecoveryTaskSucceeded

```text
Successfully recovered data from the archived snapshot taken at  ${snapshotTimeDisplay} of the ${workloadDisplay} to  ${instanceDisplayName} RDS database in the ${destinationRegion}  region of the ${targetAwsAccountDisplayName} AWS account.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeLaunchDiskForMaterializationTaskFailed

```text
Failed to launch volume(s) in availability zone ${availabilityZone} of region ${region} of account ${targetCloudAccountName} for recovering the archived snapshot.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeLaunchDiskForMaterializationTaskStarted

```text
Launching ${numberOfVolumes} volume(s) in availability zone ${availabilityZone} of region ${region} of account ${targetCloudAccountName} for recovering the archived snapshot.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeLaunchDiskForMaterializationTaskSucceeded

```text
Successfully launched ${numberOfVolumes} volume(s) in availability zone ${availabilityZone} of region ${region} of account ${targetCloudAccountName} for recovering the archived snapshot.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeLaunchDiskFromMaterializeSnapshotTaskFailed

```text
Failed to launch volume(s) in availability zone ${availabilityZone} of region ${region} of account ${accountName} from the recovered volume snapshot(s).
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeLaunchDiskFromMaterializeSnapshotTaskStarted

```text
Launching volume(s) in availability zone ${availabilityZone} of region ${region} of account ${accountName} from the recovered volume snapshot(s).
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeLaunchDiskFromMaterializeSnapshotTaskSucceeded

```text
Successfully Launched volume(s) in availability zone ${availabilityZone} of region ${region} of account ${accountName} from the recovered volume snapshot(s).
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeMaterializeArchivedDiskTaskFailed

```text
Failed to write data from archived snapshot to volume(s) in region ${region} of account ${accountName}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeMaterializeArchivedDiskTaskStarted

```text
Writing data from archived snapshot to volume(s) in region ${region} of account ${accountName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeMaterializeArchivedDiskTaskSucceeded

```text
Successfully written data from archived snapshot to volume(s) in region ${region} of account ${accountName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativePublishExportRdsInstanceIndexRecoveryTaskProgress

```text
Index recovery in progress: ${numIndexes} dbs recovered with indexes out of ${totalIndexes} dbs.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativePublishExportRdsInstanceIndexRecoveryTaskStart

```text
Starting index recovery for ${numIndexes} dbs.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativePublishExportRdsInstanceRecoveryTaskProgress

```text
Recovery in progress: ${numTablePartitions} out of total  ${totalTablePartitions} table partitions successfully recovered.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeRecoverDynamoDBSnapshotAddTagsError

```text
An error occurred while adding tags to the recovered DynamoDB table  ${recoveredTableName}: ${reason}. Refer to the object details  page to view the tags present on the source table and add tags using  the AWS Management Console.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeRecoverDynamoDBSnapshotCreatedAndRemainingGSIsError

```text
We were not able to create all Global Secondary Indices (GSIs) on  DynamoDB table ${recoveredTableName} due to an AWS error. Created GSIs:  [${createdGSIs}]. Remaining GSIs to be created: [${remainingGSIs}].  Contact AWS support to create remaining GSIs.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeRecoverDynamoDBSnapshotCreatedAndRemainingReplicasError

```text
Failed to create replicas of DynamoDB table  ${recoveredTableName} in some regions due to an AWS  error. Created replicas in regions: [${createdReplicas}]. Remaining  replicas to be created in regions: [${remainingReplicas}]. Contact AWS support to create remaining replicas.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeRecoverDynamoDBSnapshotCreateGSIFailedAwsError

```text
Failed to create GSI ${indexName} on the recovered DynamoDB table  ${recoveredTableName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeRecoverDynamoDBSnapshotCreateGSISucceeded

```text
Successfully created GSI(s) ${indexNames} on the recovered DynamoDB  table ${recoveredTableName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeRecoverDynamoDBSnapshotCreateGSIWaitError

```text
An error occurred while waiting for AWS to create GSI ${indexName} on  the recovered DynamoDB table ${recoveredTableName}: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeRecoverDynamoDBSnapshotCreateReplicaFailedAwsError

```text
Failed to create DynamoDB replica of table ${recoveredTableName} in  region ${replicaRegion}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeRecoverDynamoDBSnapshotCreateReplicasSucceeded

```text
Successfully created replica(s) of recovered DynamoDB table  ${recoveredTableName} in region(s) ${createdReplicas}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeRecoverDynamoDBSnapshotCreatingReplica

```text
Creating replica of DynamoDB table ${recoveredTableName} in region  ${replicaRegion}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeRecoverDynamoDBSnapshotDataRecoveryCompleted

```text
Successfully completed data recovery to ${recoveredTableName}  DynamoDB table. Started configuration of table settings and creation of  replicas and Global Secondary Indices (GSIs) as per snapshot data.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeRecoverDynamoDBSnapshotJobCanceled

```text
Canceled recovery of DynamoDB table ${sourceTableName} in region ${sourceRegion} and account ${awsAccountDisplayName} to  ${recoveredTableName} DynamoDB table in region ${destinationRegion} and account ${targetAwsAccountDisplayName} from snapshot  taken at ${snapshotCreationTime}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AwsNativeRecoverDynamoDBSnapshotJobCanceling

```text
Canceling recovery of DynamoDB table ${sourceTableName} in region ${sourceRegion} and account ${awsAccountDisplayName} to  ${recoveredTableName} DynamoDB table in region ${destinationRegion} and account ${targetAwsAccountDisplayName} from snapshot  taken at ${snapshotCreationTime}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AwsNativeRecoverDynamoDBSnapshotJobFailed

```text
Failed to recover DynamoDB table ${sourceTableName} in region ${sourceRegion} and account ${awsAccountDisplayName} to  ${recoveredTableName} DynamoDB table in region ${destinationRegion} and account ${targetAwsAccountDisplayName} from snapshot  taken at ${snapshotCreationTime}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsNativeRecoverDynamoDBSnapshotJobQueued

```text
Queued recovery of DynamoDB table ${sourceTableName} in region ${sourceRegion} and account ${awsAccountDisplayName} to  ${recoveredTableName} DynamoDB table in region ${destinationRegion} and account ${targetAwsAccountDisplayName} from snapshot  taken at ${snapshotCreationTime}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AwsNativeRecoverDynamoDBSnapshotJobStarted

```text
${userEmail} started recovery of DynamoDB table ${sourceTableName} in region ${sourceRegion} and account ${awsAccountDisplayName} to  ${recoveredTableName} DynamoDB table in region ${destinationRegion} and account ${targetAwsAccountDisplayName} from snapshot  taken at ${snapshotCreationTime}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsNativeRecoverDynamoDBSnapshotJobStarted

```text
Started recovery of the ${sourceTableName} DynamoDB table.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeRecoverDynamoDBSnapshotJobStartFailed

```text
${userEmail} failed to start recovery of DynamoDB table  ${sourceTableName} in region ${sourceRegion} and account  ${awsAccountDisplayName} to ${recoveredTableName} DynamoDB table in  region ${destinationRegion} and account ${targetAwsAccountDisplayName}  from snapshot taken at ${snapshotCreationTime}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsNativeRecoverDynamoDBSnapshotJobSucceeded

```text
Successfully recovered DynamoDB table ${sourceTableName} in region ${sourceRegion} and account ${awsAccountDisplayName} to  ${recoveredTableName} DynamoDB table in region ${destinationRegion} and account ${targetAwsAccountDisplayName} from snapshot  taken at ${snapshotCreationTime}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsNativeRecoverDynamoDBSnapshotPitrJobCanceled

```text
Canceled point-in-time recovery of the ${sourceTableName} DynamoDB table in the ${sourceRegion} region to ${recoveredTableName} DynamoDB table in the ${awsAccountDisplayName} AWS account to time  ${recoveryTime} .
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AwsNativeRecoverDynamoDBSnapshotPitrJobCanceling

```text
Canceling point-in-time recovery of the ${sourceTableName} DynamoDB  table in the ${sourceRegion} region to ${recoveredTableName}  DynamoDB table in the ${awsAccountDisplayName} AWS account to time  ${recoveryTime} .
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AwsNativeRecoverDynamoDBSnapshotPitrJobFailed

```text
Failed to recover the ${sourceTableName} DynamoDB table in the ${sourceRegion} region to ${recoveredTableName} DynamoDB table  in the ${awsAccountDisplayName} AWS account with point-in-time recovery operation to time ${recoveryTime}.  Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsNativeRecoverDynamoDBSnapshotPitrJobQueued

```text
Queued point-in-time recovery of the ${sourceTableName} DynamoDB table in the ${sourceRegion} region to ${recoveredTableName} DynamoDB table  in the ${awsAccountDisplayName} AWS account to time ${recoveryTime} .
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AwsNativeRecoverDynamoDBSnapshotPitrJobStarted

```text
${userEmail} started point-in-time recovery of DynamoDB table ${sourceTableName} in region ${sourceRegion} region to  ${recoveredTableName} DynamoDB table on the AWS account  ${awsAccountDisplayName} to ${restoreTime} .
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsNativeRecoverDynamoDBSnapshotPitrJobStarted

```text
Started point-in-time recovery of the ${sourceTableName} DynamoDB table.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeRecoverDynamoDBSnapshotPitrJobStartFailed

```text
${userEmail} failed to start point-in-time recovery of DynamoDB table ${sourceTableName} in region ${sourceRegion} region to  ${recoveredTableName} DynamoDB table on the AWS account  ${awsAccountDisplayName} to ${restoreTime}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsNativeRecoverDynamoDBSnapshotPitrJobSucceeded

```text
Recovery of the ${sourceTableName} DynamoDB table in the ${sourceRegion}  region to ${recoveredTableName} DynamoDB table in the  ${awsAccountDisplayName} AWS account with point-in-time recovery  operation to time ${recoveryTime} succeeded.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsNativeRecoverDynamoDBSnapshotProgress

```text
Recovery in Progress: ${processedDataMB} MB processed.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeRecoverDynamoDBSnapshotUpdateBillingModeError

```text
An error occurred while updating the billing for the recovered DynamoDB  table ${recoveredTableName}: ${reason}. Skipping updating the billing mode to ${billingMode}
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeRecoverDynamoDBSnapshotUpdateDeletionProtectionError

```text
An error occurred while enabling deletion protection on  the recovered DynamoDB table ${recoveredTableName}: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeRecoverDynamoDBSnapshotUpdateStreamSpecificationError

```text
An error occurred while updating the stream specification for the  recovered DynamoDB table ${recoveredTableName}: ${reason}. Skipping updating the stream view type to ${streamViewType}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeRecoverDynamoDBSnapshotUpdateTableClassError

```text
An error occurred while updating the table class for the recovered  DynamoDB table ${recoveredTableName}: ${reason}. Skipping updating the  table class to ${tableClass}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeRecoverDynamoDBSnapshotUpdateTimeToLiveError

```text
An error occurred while updating the time to live settings for the  recovered DynamoDB table ${recoveredTableName}: ${reason}. Skipping enabling time to live on attribute ${attributeName}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeRecoverDynamoDBSnapshotWaitingOnCreateGSI

```text
Triggered creation of Global Secondary Index (GSI) ${indexName} on the  recovered DynamoDB table ${recoveredTableName}. Waiting for AWS to  finish creating the index.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeRecoverEC2InstanceWaitForHostAvailableTaskFailed

```text
Failed to retrieve status of AWS dedicated host ${dedicatedHostID} in region ${targetRegion} in the AWS account ${targetAwsAccountDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeRecoverEC2InstanceWaitForHostAvailableTaskStarted

```text
Waiting for AWS dedicated host ${dedicatedHostID} in region ${targetRegion} in the AWS account ${targetAwsAccountDisplayName} to become available. For more details, refer to the AWS documentation at ${awsDocURL} .
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeRecoverEC2InstanceWaitForHostAvailableTaskSucceeded

```text
AWS dedicated host ${dedicatedHostID} in region ${targetRegion} in the AWS account ${targetAwsAccountDisplayName} is now available, proceeding to power on recovered instance.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeRecoverS3BucketPitrJobQueued

```text
Queued point-in-time recovery of the ${sourceBucketName} S3 Bucket in the ${sourceRegion} region to ${destinationBucketName} S3 Bucket  in the ${awsAccountDisplayName} AWS account to time ${restoreTime} .
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AwsNativeRecoverS3BucketPitrTaskCompletedPartially

```text
Completed point-in-time recovery of the ${sourceBucketName} S3 bucket  in the ${sourceRegion} region to ${destinationBucketName} S3 bucket  in the ${awsAccountDisplayName} AWS account to time ${restoreTime}.  Successfully restored ${numRestoredSuccessful} object(s), unable to  restore ${numRestoredFailed} object(s).
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

AwsNativeRecoverS3BucketPitrTaskFailed

```text
Unable to perform point-in-time recovery of the ${sourceBucketName} S3  bucket in the ${sourceRegion} region to ${destinationBucketName} S3  bucket in the ${awsAccountDisplayName} AWS account at ${restoreTime}.  Unable to restore ${numRestoredFailed} object(s).
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsNativeRecoverS3BucketProgress

```text
Recovery is in Progress: Successfully recovered: ${processedObjects} objects. Unable to recover: ${failedObjects} objects.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeRecoverS3BucketRecoveryInfo

```text
Recovery is in Progress: Successfully recovered: ${processedObjects} objects. Unable to recover: ${failedObjects} objects.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsNativeRecoverS3BucketRecoverySummaryInfo

```text
Download recovery failures report (the link is valid for 24 hours): ${gcsUrl}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsNativeRecoverS3SnapshotJobCanceled

```text
Canceled recovery of ${sourceBucketName} S3 Bucket in the ${sourceRegion} region in the ${sourceAwsAccountDisplayName} AWS account to ${destinationBucketName} S3 Bucket in the ${destinationAwsAccountDisplayName} AWS account from snapshot taken at ${snapshotCreationTime}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AwsNativeRecoverS3SnapshotJobCanceling

```text
Canceling recovery of ${sourceBucketName} S3 Bucket in the ${sourceRegion} region in ${sourceAwsAccountDisplayName} AWS account to ${destinationBucketName} S3 Bucket in the ${destinationAwsAccountDisplayName} AWS account from snapshot taken at ${snapshotCreationTime}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AwsNativeRecoverS3SnapshotJobFailed

```text
Failed to recover ${sourceBucketName} S3 Bucket in the ${sourceRegion} region in the ${sourceAwsAccountDisplayName} AWS account to ${destinationBucketName} S3 Bucket in the ${destinationAwsAccountDisplayName} AWS account from snapshot taken at ${snapshotCreationTime}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsNativeRecoverS3SnapshotJobQueued

```text
Queued recovery of ${sourceBucketName} S3 Bucket in the ${sourceRegion} region in the ${sourceAwsAccountDisplayName} AWS account to ${destinationBucketName} S3 Bucket in the ${destinationAwsAccountDisplayName} AWS account from snapshot taken at ${snapshotCreationTime}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AwsNativeRecoverS3SnapshotJobStarted

```text
${userEmail} started recovery of ${sourceBucketName} S3 bucket in ${sourceRegion} region in ${sourceAwsAccountDisplayName} AWS account to ${destinationBucketName} S3 bucket in the ${destinationAwsAccountDisplayName} AWS account from the snapshot taken at ${snapshotCreationTime}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsNativeRecoverS3SnapshotJobStarted

```text
Started recovery of the ${sourceBucketName} S3 bucket.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeRecoverS3SnapshotJobStartFailed

```text
${userEmail} failed to start recovery of S3 bucket ${sourceBucketName} in region ${sourceRegion} in the ${sourceAwsAccountDisplayName} AWS account to ${destinationBucketName} S3 bucket on the ${destinationAwsAccountDisplayName} AWS account from snapshot taken at ${snapshotCreationTime}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsNativeRecoverS3SnapshotJobSucceeded

```text
Successfully recovered ${sourceBucketName} S3 Bucket in the ${sourceRegion} region in the ${sourceAwsAccountDisplayName} AWS account to ${destinationBucketName} S3 Bucket in the ${destinationAwsAccountDisplayName} AWS account from snapshot taken at ${snapshotCreationTime}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsNativeRecoverS3SnapshotPitrJobCanceled

```text
Canceled point-in-time recovery of the ${sourceBucketName} S3 bucket in the ${sourceRegion} region to ${destinationBucketName} S3 Bucket in the ${awsAccountDisplayName} AWS account to time  ${restoreTime} .
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AwsNativeRecoverS3SnapshotPitrJobCanceling

```text
Canceling point-in-time recovery of the ${sourceBucketName} S3  Bucket in the ${sourceRegion} region to ${destinationBucketName}  S3 Bucket in the ${awsAccountDisplayName} AWS account to time  ${restoreTime} .
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AwsNativeRecoverS3SnapshotPitrJobFailed

```text
Failed to recover the ${sourceBucketName} S3 Bucket in the ${sourceRegion} region to ${destinationBucketName} S3 Bucket  in the ${awsAccountDisplayName} AWS account with point-in-time recovery operation to time ${restoreTime}.  Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsNativeRecoverS3SnapshotPitrJobStarted

```text
${userEmail} started point-in-time recovery of S3 bucket ${sourceBucketName} in region ${sourceRegion} region to  ${destinationBucketName} S3 bucket on the AWS account  ${awsAccountDisplayName} to ${restoreTime} .
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsNativeRecoverS3SnapshotPitrJobStarted

```text
Started point-in-time recovery of the ${sourceBucketName} S3 Bucket.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeRecoverS3SnapshotPitrJobStartFailed

```text
${userEmail} failed to start point-in-time recovery of S3 bucket ${sourceBucketName} in region ${sourceRegion} region to  ${destinationBucketName} S3 bucket on the AWS account  ${awsAccountDisplayName} to ${restoreTime}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsNativeRecoverS3SnapshotPitrJobSucceeded

```text
Recovery of the ${sourceBucketName} S3 Bucket in the ${sourceRegion}  region to ${destinationBucketName} S3 Bucket in the  ${awsAccountDisplayName} AWS account with point-in-time recovery  operation to time ${restoreTime} succeeded.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsNativeRestoreEC2InstanceAttachVolumesTaskFailed

```text
Failed to attach volumes ${volumeNativeIds} to EC2 instance ${instanceDisplayName} in region ${region} on AWS account ${awsAccountDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeRestoreEC2InstanceAttachVolumesTaskStarted

```text
Attaching volumes ${volumeNativeIds} to EC2 instance ${instanceDisplayName} in region ${region} on AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeRestoreEC2InstanceAttachVolumesTaskSucceeded

```text
Attached volumes ${volumeNativeIds} to EC2 instance ${instanceDisplayName} in region ${region} on AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeRestoreEC2InstanceDetachVolumesTaskFailed

```text
Failed to detach volumes ${volumeNativeIds} from EC2 instance ${instanceDisplayName} in region ${region} on AWS account ${awsAccountDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeRestoreEC2InstanceDetachVolumesTaskStarted

```text
Detaching volumes ${volumeNativeIds} from EC2 instance ${instanceDisplayName} in region ${region} on AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeRestoreEC2InstanceDetachVolumesTaskSucceeded

```text
Detached volumes ${volumeNativeIds} from EC2 instance ${instanceDisplayName} in region ${region} on AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeRestoreEC2InstanceFromArchivedSnapshotJobQueued

```text
Queued restore of EC2 instance ${instanceDisplayName} from the snapshot taken on ${snapshotCreationTime} in region ${region} and archival location  ${archivalLocation} in AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AwsNativeRestoreEC2InstanceFromArchivedSnapshotJobStarted

```text
Started restore of EC2 instance ${instanceDisplayName} from the snapshot taken on ${snapshotCreationTime} in region ${region} and archival location  ${archivalLocation} in AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeRestoreEC2InstanceJobCanceled

```text
Canceled restore of EC2 instance ${instanceDisplayName} from the snapshot taken on ${snapshotCreationTime} in region ${region} on AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AwsNativeRestoreEC2InstanceJobCanceling

```text
Canceling restore of EC2 instance ${instanceDisplayName} from the snapshot taken on ${snapshotCreationTime} in region ${region} on AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AwsNativeRestoreEC2InstanceJobFailed

```text
Failed to restore EC2 instance ${instanceDisplayName} from the snapshot taken on ${snapshotCreationTime} in region ${region} on AWS account ${awsAccountDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AwsNativeRestoreEC2InstanceJobQueued

```text
Queued restore of EC2 instance ${instanceDisplayName} from the snapshot taken on ${snapshotCreationTime} in region ${region} on AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AwsNativeRestoreEC2InstanceJobStarted

```text
${userEmail} started restore of EC2 instance ${instanceDisplayName} from the snapshot taken on ${snapshotCreationTime} in region ${region} on AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AwsNativeRestoreEC2InstanceJobStarted

```text
Started restore of EC2 instance ${instanceDisplayName} from the snapshot taken on ${snapshotCreationTime} in region ${region} in AWS account  ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeRestoreEC2InstanceJobStartFailed

```text
${userEmail} failed to start restore EC2 instance ${instanceDisplayName} from the snapshot taken on ${snapshotCreationTime} in region ${region} on AWS account ${awsAccountDisplayName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AwsNativeRestoreEC2InstanceJobSucceeded

```text
Restore of EC2 instance ${instanceDisplayName} from the snapshot taken on ${snapshotCreationTime} in region ${region} succeeded on AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AwsNativeRestoreEC2InstanceLaunchVolumeTaskFailed

```text
Failed to launch volumes ${volumeNativeIds} in region ${region} on AWS account ${awsAccountDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeRestoreEC2InstanceLaunchVolumeTaskStarted

```text
Launching new volumes from the snapshot taken on ${snapshotCreationTime} in region ${region} on AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeRestoreEC2InstanceLaunchVolumeTaskSucceeded

```text
Launched new volumes ${volumeNativeIds} in region ${region} on AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeRestoreEC2InstanceRestoreTagsTaskFailed

```text
Failed to restore tags on EC2 instance ${instanceDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeRestoreEC2InstanceRestoreTagsTaskStarted

```text
Starting restore of tags.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeRestoreEC2InstanceRestoreTagsTaskSucceeded

```text
Successfully restored tags.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeRestoreEC2InstanceStartInstanceTaskFailed

```text
Failed to start EC2 instance ${instanceDisplayName} in region ${region} on AWS account ${awsAccountDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeRestoreEC2InstanceStartInstanceTaskStarted

```text
Starting EC2 instance ${instanceDisplayName} in region ${region} on AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeRestoreEC2InstanceStartInstanceTaskSucceeded

```text
Started EC2 instance ${instanceDisplayName} in region ${region} on AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeRestoreEC2InstanceStopInstanceTaskFailed

```text
Failed to power off EC2 instance ${instanceDisplayName} in region ${region} on AWS account ${awsAccountDisplayName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeRestoreEC2InstanceStopInstanceTaskStarted

```text
Powering off EC2 instance ${instanceDisplayName} in region ${region} on AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeRestoreEC2InstanceStopInstanceTaskSucceeded

```text
Powered off EC2 instance ${instanceDisplayName} in region ${region} on AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AwsNativeSnapshotMaterializeDiskTaskFailed

```text
Failed to create snapshot(s) of volume(s) of the archived snapshot in  region ${region} of account ${accountName}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AwsNativeSnapshotMaterializeDiskTaskStarted

```text
Creating snapshot(s) of volume(s) of the archived snapshot in region ${region} of account ${accountName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AwsNativeSnapshotMaterializeDiskTaskSucceeded

```text
Successfully created snapshot(s) of volume(s) of the archived snapshot in region ${region} of account ${accountName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

RefreshAwsNativeAccountJobQueued

```text
Queued ${maintenanceType} refresh of AWS account ${awsAccountDisplayName}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

## azuread

______________________________________________________________________

AzureAdFTRFailed

```text
Failed to complete Full Tenant Recovery for directory \"${adDirectory}\". ${reason}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

AzureADFTRProgressCompleted

```text
Completed restoring ${attributeType} for ${objectType}. Processed ${processed} out of ${total} objects.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureADFTRProgressRunning

```text
Restoring ${attributeType} for ${objectType}. Processed ${processed} out of ${total} objects.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureAdFTRStarted

```text
Started Full Tenant Recovery for directory \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureAdFTRSummary

```text
Successfully completed Full Tenant Recovery for directory \"${adDirectory}\". Download recovery details (the link is valid for 24 hours): ${gcsUrl}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureADRecoveryJobCanceled

```text
Canceled recovery for directory \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AzureADRecoveryJobCanceling

```text
Canceling recovery for directory \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AzureADRecoveryJobFailed

```text
Unable to recover directory \"${adDirectory}\".  Reason: ${reason}. ${remedy}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureADRecoveryJobQueued

```text
Queued recovery for directory \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AzureADRecoveryJobStarted

```text
Started recovery for directory \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureADRecoveryJobSucceeded

```text
Successfully recovered directory \"${adDirectory}\".
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureADRestoreFailedSummary

```text
Recovery for directory \"${adDirectory}\"\x20 has completed. Attempted to restore ${total} objects. Successfully restored ${totalRestored} objects. ${fullyDeleted} restored objects have a new UUID that is different from the original object UUID. Failed to read ${readFailed} objects from the snapshot. Failed to create ${createFailed} objects.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

AzureADRestoreSummary

```text
Recovery for directory \"${adDirectory}\"\x20 has completed. Attempted to restore ${total} objects. Successfully restored ${totalRestored} objects. ${fullyDeleted} restored objects have a new UUID that is different from the original object UUID. Download recovery details (the link is valid for 24 hours): ${gcsUrl}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## azurenative

______________________________________________________________________

AzureNativeArchiveTierRehydrationStarted

```text
Started rehydration of archived data from ${sourceContainer} container  to ${destinationContainer} container in ${storageAccount} storage account.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeArchiveTierRehydrationSucceeded

```text
Successfully rehydrated archived data from ${sourceContainer} container  to ${destinationContainer} container in ${storageAccount} storage account.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureNativeCreateNewStorageAccountTaskStarted

```text
Started creating storage account with name: ${storageAccountName} in resource group: ${resourceGroupName}, subscription:${subscriptionName},  region: ${regionName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeCreateStorageAccountTaskFailed

```text
Failed to create storage account with name: ${storageAccountName} in resource group: ${resourceGroupName}, subscription:${subscriptionName}, region: ${regionName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeCreateStorageAccountTaskSucceeded

```text
Successfully created storage account with name: ${storageAccountName} in resource group: ${resourceGroupName}, subscription:${subscriptionName}, region: ${regionName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeDatabaseCreationTaskFailed

```text
Failed creating an empty database ${databaseDisplayName} in server ${serverDisplayName} and region ${region}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

AzureNativeDatabaseCreationTaskStarted

```text
Creating an empty database ${databaseDisplayName} in server ${serverDisplayName} and region ${region}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeDatabaseCreationTaskSuceeded

```text
Successfully created an empty database ${databaseDisplayName} in server ${serverDisplayName} and region ${region}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeDatabaseRecoveryTaskFailed

```text
Failed recovery to database ${databaseDisplayName} in server ${serverDisplayName} and region ${region}. Please delete this database from Azure. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

AzureNativeDatabaseRecoveryTaskStarted

```text
Starting recovery to database ${databaseDisplayName} in server ${serverDisplayName} and region ${region}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeDatabaseRecoveryTaskSuceeded

```text
Successfully recovered to database ${databaseDisplayName} in server ${serverDisplayName} and region ${region}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeExportDatabaseCanceled

```text
Canceled ${restoreType} export of the ${sourceDatabaseName} ${databaseType} to ${destinationDatabaseName} ${databaseType} in the ${destinationServerName} ${serverType}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AzureNativeExportDatabaseCanceling

```text
Canceling ${restoreType} export of the ${sourceDatabaseName} ${databaseType} to ${destinationDatabaseName} ${databaseType} in the ${destinationServerName} ${serverType}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AzureNativeExportDatabaseFailed

```text
Failed ${restoreType} export of the ${sourceDatabaseName} ${databaseType} to ${destinationDatabaseName} ${databaseType} in the ${destinationServerName} ${serverType}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureNativeExportDatabaseQueued

```text
Queued ${restoreType} export of the ${sourceDatabaseName} ${databaseType} to ${destinationDatabaseName} ${databaseType} in the ${destinationServerName} ${serverType}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AzureNativeExportDatabaseStarted

```text
${userEmail} started ${restoreType} export of the ${databaseType} ${databaseName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AzureNativeExportDatabaseStarted

```text
Started ${restoreType} export of the ${sourceDatabaseName} ${databaseType} to ${destinationDatabaseName} ${databaseType} in the ${destinationServerName} ${serverType}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeExportDatabaseStartFailed

```text
${userEmail} failed to start ${restoreType} export of the ${databaseType} ${databaseName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AzureNativeExportDatabaseSucceeded

```text
Successfully finished ${restoreType} export of the ${sourceDatabaseName} ${databaseType} to ${destinationDatabaseName} ${databaseType} in the ${destinationServerName} ${serverType}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureNativeExportDatabaseSucceededWithDisabledUsers

```text
Successfully finished ${restoreType} export of the ${sourceDatabaseName} ${databaseType} to ${destinationDatabaseName} ${databaseType} in the ${destinationServerName} ${serverType}. However, following users were explicitly created as disabled users: ${disabledUsers}. For more information please visit https://support.rubrik.com/articles/How_To/TODO
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

AzureNativeExportDbSuccessWithLoginDeletionFailed

```text
Successfully recovered to database ${databaseDisplayName} in server ${serverDisplayName} and region ${region}. Unable to delete the temporary login user ${user} in database ${db}. Manual deletion is required.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

AzureNativeExportDiskFromArchivedSnapshotJobQueued

```text
Queued export of disk ${diskDisplayName} in region ${region} and subscription ${destSubscriptionDisplayName} from the snapshot taken at ${snapshotTimeDisplay} in  archival location ${archivalLocation}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AzureNativeExportDiskFromArchivedSnapshotJobStarted

```text
Started export of disk ${diskDisplayName} in region ${region} and subscription ${destSubscriptionDisplayName} from the snapshot taken at ${snapshotTimeDisplay} in  archival location ${archivalLocation}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeExportDiskSnapshotAttachDiskOsDiskTaskFailed

```text
Failed to swap OS disk of the ${vmDisplayName} virtual machine. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeExportDiskSnapshotAttachDiskOsDiskTaskStarted

```text
Swapping OS disk of the ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeExportDiskSnapshotAttachDiskOsDiskTaskSucceeded

```text
Swapped OS disk of the ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeExportDiskSnapshotAttachDiskTaskFailed

```text
Failed to attach disk with LUN ${lun} to the ${vmDisplayName} virtual machine. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeExportDiskSnapshotAttachDiskTaskStarted

```text
Attaching disk with LUN ${lun} to the ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeExportDiskSnapshotAttachDiskTaskSucceeded

```text
Attached disk with LUN ${lun} to the ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeExportDiskSnapshotCreateDiskTaskFailed

```text
Failed to create new disk in the ${region} region from the snapshot taken at ${snapshotTimeDisplay}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeExportDiskSnapshotCreateDiskTaskStarted

```text
Creating new disk in the ${region} region from the snapshot taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeExportDiskSnapshotCreateDiskTaskSucceeded

```text
Created new disk in the ${region} region from the snapshot taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeExportDiskSnapshotDetachDiskTaskFailed

```text
Failed to detach disks with LUN ${lun} from the ${vmDisplayName} virtual machine. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeExportDiskSnapshotDetachDiskTaskStarted

```text
Detaching disk with LUN ${lun} from the ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeExportDiskSnapshotDetachDiskTaskSucceeded

```text
Detached disk with LUN ${lun} from the ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeExportDiskSnapshotJobCanceled

```text
Canceled export of the ${diskDisplayName} disk in the ${region} region and ${destSubscriptionDisplayName} subscription from the snapshot taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AzureNativeExportDiskSnapshotJobCanceling

```text
Canceling export of the ${diskDisplayName} disk in the ${region} region and ${destSubscriptionDisplayName} subscription from the snapshot taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AzureNativeExportDiskSnapshotJobFailed

```text
Failed to export the ${diskDisplayName} disk in the ${region} region and ${destSubscriptionDisplayName} subscription from the snapshot taken at ${snapshotTimeDisplay}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureNativeExportDiskSnapshotJobQueued

```text
Queued export of the ${diskDisplayName} disk in the ${region} region and ${destSubscriptionDisplayName} subscription from the snapshot taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AzureNativeExportDiskSnapshotJobStarted

```text
${userEmail} started export of the ${diskDisplayName} Azure disk in the ${region} region and ${destSubscriptionDisplayName} subscription from the snapshot taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AzureNativeExportDiskSnapshotJobStarted

```text
Started export of the ${diskDisplayName} disk in the ${region} region and ${destSubscriptionDisplayName} subscription from the snapshot taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeExportDiskSnapshotJobStartFailed

```text
${userEmail} failed to start export of the ${diskDisplayName} Azure disk in the ${region} region and ${destSubscriptionDisplayName} subscription from the snapshot taken at ${snapshotTimeDisplay}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AzureNativeExportDiskSnapshotJobSucceeded

```text
Export of the ${diskDisplayName} disk in the ${region} region and ${destSubscriptionDisplayName} subscription from the snapshot taken at ${snapshotTimeDisplay} succeeded.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureNativeExportVMCreateSnapshotDisksTaskFailed

```text
Failed to create new disks in the ${region} region from the snapshot taken at ${snapshotTimeDisplay} for ${vmDisplayName} export. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeExportVMCreateSnapshotDisksTaskStarted

```text
Creating new disks in the ${region} region from the snapshot taken at ${snapshotTimeDisplay} for ${vmDisplayName} export.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeExportVMCreateSnapshotDisksTaskSucceeded

```text
Created new disks in the ${region} region from the snapshot taken at ${snapshotTimeDisplay} for ${vmDisplayName} export.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeExportVMCreateVMTaskFailed

```text
Failed to create the ${vmDisplayName} virtual machine in the ${region} region. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeExportVMCreateVMTaskStarted

```text
Creating the ${vmDisplayName} virtual machine in the ${region} region.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeExportVMCreateVMTaskSucceeded

```text
Created the ${vmDisplayName} virtual machine in the ${region} region.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeExportVMEnableEncryptionTaskFailed

```text
Failed to enable encryption for the ${vmDisplayName} virtual machine. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeExportVMEnableEncryptionTaskSkipped

```text
Cannot enable encryption for the ${vmDisplayName} virtual machine.  You can enable manually ADE for an exported virtual machine.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

AzureNativeExportVMEnableEncryptionTaskStarted

```text
Enabling encryption for the ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeExportVMEnableEncryptionTaskSucceeded

```text
Enabled encryption for the ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeExportVMFromArchivedSnapshotJobQueued

```text
Queued export of virtual machine ${vmDisplayName} in region ${region} and subscription ${destSubscriptionDisplayName} from the snapshot taken at ${snapshotTimeDisplay} in  archival location ${archivalLocation}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AzureNativeExportVMFromArchivedSnapshotJobStarted

```text
Started export of virtual machine ${vmDisplayName} in region ${region} and subscription ${destSubscriptionDisplayName} from the snapshot taken at ${snapshotTimeDisplay} in  archival location ${archivalLocation}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeExportVMJobCanceled

```text
Canceled export of the ${vmDisplayName} virtual machine in the ${region} region and ${destSubscriptionDisplayName} subscription from the snapshot taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AzureNativeExportVMJobCanceling

```text
Canceling export of the ${vmDisplayName} virtual machine in the ${region} region and ${destSubscriptionDisplayName} subscription from the snapshot taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AzureNativeExportVMJobFailed

```text
Failed to export the ${vmDisplayName} virtual machine in the ${region} region and ${destSubscriptionDisplayName} subscription from the snapshot taken at ${snapshotTimeDisplay}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureNativeExportVMJobQueued

```text
Queued export of the ${vmDisplayName} virtual machine in the ${region} region and ${destSubscriptionDisplayName} subscription from the snapshot taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AzureNativeExportVMJobStarted

```text
${userEmail} started export of the ${vmDisplayName} Azure virtual machine in the ${region} region and ${destSubscriptionDisplayName} subscription from the snapshot taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AzureNativeExportVMJobStarted

```text
Started export of the ${vmDisplayName} virtual machine in the ${region} region and ${destSubscriptionDisplayName} subscription from the snapshot taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeExportVMJobStartFailed

```text
${userEmail} failed to start export of the ${vmDisplayName} Azure virtual machine in the ${region} region and ${destSubscriptionDisplayName} subscription from the snapshot taken at ${snapshotTimeDisplay}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AzureNativeExportVMJobSucceeded

```text
Export of the ${vmDisplayName} virtual machine in the ${region} region and ${destSubscriptionDisplayName} subscription from the snapshot taken at ${snapshotTimeDisplay} succeeded.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureNativeMountDiskJobCanceled

```text
Canceled mounting disks on the ${vmDisplayName} virtual machine in the ${region} region from the snapshot taken at ${snapshotTimeDisplay} in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AzureNativeMountDiskJobCanceling

```text
Canceling mounting disks on the ${vmDisplayName} virtual machine in the ${region} region from the snapshot taken at ${snapshotTimeDisplay} in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AzureNativeMountDiskJobFailed

```text
Unable to mount disks on the ${vmDisplayName} virtual machine in the ${region} region from the snapshot taken at ${snapshotTimeDisplay} in the ${subscriptionDisplayName} subscription. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureNativeMountDiskJobQueued

```text
Queued mount disk on the ${vmDisplayName} virtual machine in the ${region} region from the snapshot taken at ${snapshotTimeDisplay} in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AzureNativeMountDiskJobStarted

```text
Started mounting disk on the ${vmDisplayName} virtual machine in the ${region} region from the snapshot taken at ${snapshotTimeDisplay} in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeMountDiskJobSucceeded

```text
Successfully mounted disks on the ${vmDisplayName} virtual machine in  the ${region} region from the snapshot taken at ${snapshotTimeDisplay}  in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureNativeMountDisksTaskFailed

```text
Unable to mount disks created from the snapshot taken at ${snapshotTimeDisplay} of ${sourceVmDisplayName} on ${targetVmDisplayName} virtual machine in the region ${region}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeMountDisksTaskStarted

```text
Mounting the disks created from the snapshot taken at ${snapshotTimeDisplay} of ${sourceVmDisplayName} on ${targetVmDisplayName} virtual machine in the region ${region}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeMountDisksTaskSucceeded

```text
Mounted the disks created from the snapshot taken at ${snapshotTimeDisplay} of ${sourceVmDisplayName} on ${targetVmDisplayName} virtual machine in the region ${region}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeMovingDatabaseToElasticPoolTaskFailed

```text
Failed to move database ${databaseDisplayName} to elastic pool ${elasticPoolDisplayName} in ${serverDisplayName} and  region ${region}.. Reason: ${reason}. Note that database is successfully recovered, please manually move the recovered database to the desired elastic pool.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeMovingDatabaseToElasticPoolTaskStarted

```text
Moving destination database ${databaseDisplayName} to elastic pool ${elasticPoolDisplayName} in ${serverDisplayName} and  region ${region}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeMovingDatabaseToElasticPoolTaskSucceeded

```text
Successfully moved database ${databaseDisplayName} to elastic pool ${elasticPoolDisplayName} in ${serverDisplayName} and  region ${region}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativePowerOffTaskFailed

```text
Failed to power off the ${vmDisplayName} virtual machine. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativePowerOffTaskStarted

```text
Powering off the ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativePowerOffTaskSucceeded

```text
Powered off the ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativePowerOnTaskFailed

```text
Failed to power on the ${vmDisplayName} virtual machine. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativePowerOnTaskStarted

```text
Powering on the ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativePowerOnTaskSucceeded

```text
Powered on the ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativePublishStorageAccountRecoveryInfo

```text
Recovery is in progress: Successfully processed: ${processedObjects} objects. Unable to recover: ${failedObjects} objects.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureNativePublishStorageAccountRecoveryProgress

```text
Recovery is in progress: Successfully processed: ${processedObjects} objects. Unable to recover: ${failedObjects} objects.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeRecoverStorageAccountJobCanceled

```text
Canceled recovery of ${sourceStorageAccount} storage account in the ${resGroupDisplayName} resource group from the snapshot taken at ${snapshotTimeDisplay} in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AzureNativeRecoverStorageAccountJobCanceling

```text
Canceling recovery of the ${sourceStorageAccount} storage account in the ${resGroupDisplayName} resource group from the snapshot taken at  ${snapshotTimeDisplay} in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AzureNativeRecoverStorageAccountJobFailed

```text
Unable to recover the ${sourceStorageAccount} storage account in the ${resGroupDisplayName} resource group from the snapshot taken at ${snapshotTimeDisplay} in the ${subscriptionDisplayName} subscription. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureNativeRecoverStorageAccountJobQueued

```text
Queued recovery of the ${sourceStorageAccount} storage account in the ${resGroupDisplayName} resource group from the snapshot taken at ${snapshotCreationTime} in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AzureNativeRecoverStorageAccountJobStarted

```text
Started recovery of the ${sourceStorageAccount} storage account in the ${resGroupDisplayName} resource group from the snapshot taken at ${snapshotTimeDisplay} in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeRecoverStorageAccountJobSucceeded

```text
Recovery of the ${sourceStorageAccount} storage account in the ${resGroupDisplayName} resource group from the snapshot taken at ${snapshotTimeDisplay} in the ${subscriptionDisplayName} succeeded.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureNativeRecoverStorageAccountSnapshotJobStarted

```text
${userEmail} started restore of the ${saDisplayName} Azure storage account in the ${resGroupDisplayName} resource group from the snapshot taken at ${snapshotTimeDisplay} in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AzureNativeRecoverStorageAccountSnapshotJobStartFailed

```text
${userEmail} failed to start restore of the ${saDisplayName} Azure storage account in the ${resGroupDisplayName} resource group from the snapshot taken at ${snapshotTimeDisplay} in the ${subscriptionDisplayName} subscription. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AzureNativeResizeDiskTaskFailed

```text
Failed to re-size the ${diskDisplayName} managed disk. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeResizeDiskTaskStarted

```text
Re-sizing ${diskDisplayName} managed disk.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeResizeDiskTaskSucceeded

```text
Re-sized ${diskDisplayName} managed disk.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeRestoreVMAttachDisksTaskFailed

```text
Failed to attach disks with LUNs ${luns} or restore OS disk to the ${vmDisplayName} virtual machine. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeRestoreVMAttachDisksTaskStarted

```text
Attaching disks with LUNs ${luns} and restoring OS disk to the  ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeRestoreVMAttachDisksTaskSucceeded

```text
Attached disks with LUNs ${luns} and restored OS disk to the  ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeRestoreVMCreateSnapshotDisksTaskFailed

```text
Failed to create new disks from the snapshot taken at ${snapshotTimeDisplay}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeRestoreVMCreateSnapshotDisksTaskStarted

```text
Creating new disks from the snapshot taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeRestoreVMCreateSnapshotDisksTaskSucceeded

```text
Created new disks from the snapshot taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeRestoreVMDeleteDetachedDisksTaskFailed

```text
Failed to delete detached disks. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeRestoreVMDeleteDetachedDisksTaskStarted

```text
Deleting detached disks.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeRestoreVMDeleteDetachedDisksTaskSucceeded

```text
Deleted detached disks.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeRestoreVMDetachDisksTaskFailed

```text
Failed to detach disks with LUNs ${luns} from the ${vmDisplayName} virtual machine. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeRestoreVMDetachDisksTaskStarted

```text
Detaching disks with LUNs ${luns} from the ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeRestoreVMDetachDisksTaskSucceeded

```text
Detached disks with LUNs ${luns} from the ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeRestoreVMDetachDisksTaskSucceededTagsNotUpdated

```text
Detached disks with LUNs ${luns} from the ${vmDisplayName} virtual machine. Unable to apply Rubrik metadata tags on the detached disks.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

AzureNativeRestoreVMFromArchivedSnapshotJobQueued

```text
Queued restore of virtual machine ${vmDisplayName} in resource group ${resGroupDisplayName} from the snapshot taken  at ${snapshotTimeDisplay} in archival location ${archivalLocation}  in subscription ${subscriptionDisplayName}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AzureNativeRestoreVMFromArchivedSnapshotJobStarted

```text
Started restore of virtual machine ${vmDisplayName} in resource group ${resGroupDisplayName} from the snapshot taken at ${snapshotTimeDisplay} in archival location ${archivalLocation} in  subscription ${subscriptionDisplayName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeRestoreVMJobCanceled

```text
Canceled restore of ${vmDisplayName} virtual machine in the ${resGroupDisplayName} resource group from the snapshot taken at ${snapshotTimeDisplay} in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

AzureNativeRestoreVMJobCanceling

```text
Canceling restore of the ${vmDisplayName} virtual machine in the ${resGroupDisplayName} resource group from the snapshot taken at  ${snapshotTimeDisplay} in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

AzureNativeRestoreVMJobFailed

```text
Failed to restore the ${vmDisplayName} virtual machine in the ${resGroupDisplayName} resource group from the snapshot taken at ${snapshotTimeDisplay} in the ${subscriptionDisplayName} subscription. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AzureNativeRestoreVMJobQueued

```text
Queued restore of the ${vmDisplayName} virtual machine in the ${resGroupDisplayName} resource group from the snapshot taken at ${snapshotTimeDisplay} in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

AzureNativeRestoreVMJobStarted

```text
${userEmail} started restore of the ${vmDisplayName} Azure virtual machine in the ${resGroupDisplayName} resource group from the snapshot taken at ${snapshotTimeDisplay} in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AzureNativeRestoreVMJobStarted

```text
Started restore of the ${vmDisplayName} virtual machine in the ${resGroupDisplayName} resource group from the snapshot taken at ${snapshotTimeDisplay} in the ${subscriptionDisplayName} subscription.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeRestoreVMJobStartFailed

```text
${userEmail} failed to start restore of the ${vmDisplayName} Azure virtual machine in the ${resGroupDisplayName} resource group from the snapshot taken at ${snapshotTimeDisplay} in the ${subscriptionDisplayName} subscription. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

AzureNativeRestoreVMJobSucceeded

```text
Restore of the ${vmDisplayName} virtual machine in the ${resGroupDisplayName} resource group from the snapshot taken at ${snapshotTimeDisplay} in the ${subscriptionDisplayName} succeeded.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureNativeSkippingRestoreTasks

```text
Skipped replacing original disk as it's not attached to virtual machine.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

AzureNativeStorageAccountRecoverySummaryInfo

```text
Download recovery failures report (the link is valid for 24 hours): ${gcsUrl}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

AzureNativeUpdateNicTaskFailed

```text
Failed to update ${nicName} network interface of ${vmDisplayName} virtual machine. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

AzureNativeUpdateNicTaskStarted

```text
Updating ${nicName} network interface of ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

AzureNativeUpdateNicTaskSucceeded

```text
Updated ${nicName} network interface of ${vmDisplayName} virtual machine.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AzureNativeUseExistingStorageAccountTaskStarted

```text
Using existing storage account with name: ${storageAccountName} in resource group: ${resourceGroupName}, subscription:${subscriptionName}, region: ${regionName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

## cassandra_source

______________________________________________________________________

CassandraRecoveryFailure

```text
${username} failed to start recovery of objects [${recoveryObjects}] on the Cassandra source '${sourceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CassandraRecoveryStarted

```text
${username} started recovery of objects [${recoveryObjects}] on the Cassandra source '${sourceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## cloudnative

______________________________________________________________________

CloudNativeDBSnapshotUploadJobCanceled

```text
Canceled upload for snapshot taken at ${snapshotTimeDisplay} of ${snappableDisplay} to ${bucketType} with details ${bucketDetails}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

CloudNativeDBSnapshotUploadJobCanceling

```text
Canceling upload for snapshot taken at ${snapshotTimeDisplay} of ${snappableDisplay} to ${bucketType} with details ${bucketDetails}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

CloudNativeDBSnapshotUploadJobFailed

```text
Could not upload snapshot taken at ${snapshotTimeDisplay} of ${snappableDisplay} to ${bucketType} with details ${bucketDetails}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudNativeDBSnapshotUploadJobQueued

```text
Queued upload for snapshot taken at ${snapshotTimeDisplay} of ${snappableDisplay} to ${bucketType} with details ${bucketDetails}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

CloudNativeDBSnapshotUploadJobStarted

```text
${userEmail} started upload of database backup taken at  ${snapshotTimeDisplay} of database ${snappableDisplay} to blob storage.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CloudNativeDBSnapshotUploadJobStarted

```text
Started upload for snapshot taken at ${snapshotTimeDisplay} of ${snappableDisplay} to ${bucketType} with details ${bucketDetails}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeDBSnapshotUploadJobStartFailed

```text
${userEmail} failed to upload database backup taken at  ${snapshotTimeDisplay} of database ${snappableDisplay} to blob storage. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

CloudNativeDBSnapshotUploadJobSucceeded

```text
Successfully uploaded snapshot taken at ${snapshotTimeDisplay} of ${snappableDisplay} to ${bucketType} with details ${bucketDetails}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudNativeDBSnapshotUploadJobUploadTaskFailed

```text
Failed to upload snapshot taken at ${snapshotTimeDisplay} of ${snappableDisplay} to ${bucketType} with details ${bucketDetails}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

CloudNativeDBSnapshotUploadJobUploadTaskFailedWithSnapshotUploadStarted

```text
Failed to upload snapshot taken at ${snapshotTimeDisplay} of ${snappableDisplay} to ${bucketType} with details ${bucketDetails}. Please visit ${bucketURL} to manually clean up the created ${bucketType}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

CloudNativeDBSnapshotUploadJobUploadTaskStarted

```text
Started uploading snapshot taken at ${snapshotTimeDisplay} of ${snappableDisplay} to ${bucketType} with details ${bucketDetails}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeDBSnapshotUploadJobUploadTaskSucceeded

```text
Successfully uploaded snapshot taken at ${snapshotTimeDisplay} of ${snappableDisplay} to ${bucketType} with ${bucketURL} url.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeDownloadFileCreateDownloadLocationTaskFailed

```text
Failed to create the ${downloadLocation}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeDownloadFileCreateDownloadLocationTaskStarted

```text
Creating the ${downloadLocation}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeDownloadFileCreateDownloadLocationTaskSucceeded

```text
Created the ${downloadLocation}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeDownloadFileDeleteDisksTaskFailed

```text
Failed to delete ${diskTypeDisplay}(s) launched from the snapshot.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeDownloadFileDeleteDisksTaskStarted

```text
Deleting ${diskTypeDisplay}(s) launched from the snapshot.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeDownloadFileDeleteDisksTaskSucceeded

```text
Deleted ${diskTypeDisplay}(s) launched from the snapshot.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeDownloadFileDownloadTaskFailed

```text
Failed to upload ${numFiles} file(s) to the ${downloadLocation}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeDownloadFileDownloadTaskSkippedSomeFiles

```text
Failed to upload ${numFailedFiles} of ${numFiles} files to the ${downloadLocation}.  ${errors}
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

CloudNativeDownloadFileDownloadTaskStarted

```text
Uploading ${numFiles} file(s) to the ${downloadLocation}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeDownloadFileDownloadTaskSucceeded

```text
Uploading ${numFiles} file(s) to the ${downloadLocation}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeDownloadFileJobCanceled

```text
Canceled recovery of ${numFiles} file(s) from the snapshot of the ${snappableDisplay} taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

CloudNativeDownloadFileJobCanceledAndBucketCreated

```text
Canceled recovery of ${numFiles} file(s) from the snapshot of the ${snappableDisplay} taken at ${snapshotTimeDisplay}. Please visit ${bucketURL} to manually clean up the created ${bucketType}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

CloudNativeDownloadFileJobCanceling

```text
Canceling recovery of ${numFiles} file(s) from the snapshot of the ${snappableDisplay} taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

CloudNativeDownloadFileJobFailed

```text
Failed to recover ${numFiles} file(s) from the snapshot of the ${snappableDisplay} taken at ${snapshotTimeDisplay}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudNativeDownloadFileJobFailedAndBucketCreated

```text
Failed to recover ${numFiles} file(s) from the snapshot of the ${snappableDisplay} taken at ${snapshotTimeDisplay}. Reason: ${reason}. Please visit ${bucketURL} to manually clean up the created ${bucketType}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudNativeDownloadFileJobQueued

```text
Queued recovery of ${numFiles} file(s) from the snapshot of the ${snappableDisplay} taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

CloudNativeDownloadFileJobStarted

```text
${userEmail} started download of ${numFiles} file(s) from the snapshot of the ${snappableDisplay} taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CloudNativeDownloadFileJobStarted

```text
Started recovery of ${numFiles} file(s) from the snapshot of the ${snappableDisplay} taken at ${snapshotTimeDisplay}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeDownloadFileJobStartFailed

```text
${userEmail} failed to start download of ${numFiles} file(s) from the snapshot of the ${snappableDisplay} taken at ${snapshotTimeDisplay}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

CloudNativeDownloadFileJobSucceeded

```text
Successfully uploaded ${numFiles} file(s) from the snapshot of the ${snappableDisplay} taken at ${snapshotTimeDisplay} to ${downloadLocation} url.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudNativeDownloadFileJobSucceededSkippedSomeFiles

```text
Successfully uploaded ${uploadedFiles} out of ${numFiles} file(s) from the snapshot of the ${snappableDisplay} taken at ${snapshotTimeDisplay} to ${downloadLocation} url. See details for skipped files.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudNativeDownloadFileLaunchDisksTaskFailed

```text
Failed to launch ${diskTypeDisplay}(s) from the snapshot.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeDownloadFileLaunchDisksTaskStarted

```text
Temporarily launching ${diskTypeDisplay}(s) from the snapshot in region ${region}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeDownloadFileLaunchDisksTaskSucceeded

```text
Launched ${diskTypeDisplay}(s) from the snapshot in region ${region}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeRecoverFileToVMDownloadTaskFailed

```text
Failed to recover ${numFiles} file(s) to the virtual machine ${vmName} (${vmIpAddress}) at ${restoreDirectory}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

CloudNativeRecoverFileToVMDownloadTaskStarted

```text
Recovering ${numFiles} file(s) to the virtual machine ${vmName} (${vmIpAddress}) at ${restoreDirectory}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeRecoverFileToVMDownloadTaskSucceeded

```text
Recovering ${numFiles} file(s) to the virtual machine ${vmName} (${vmIpAddress}) at ${restoreDirectory}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CloudNativeRecoverFileToVMJobSucceeded

```text
Successfully recovered ${numFiles} file(s) from the snapshot of the ${snappableDisplay} taken at ${snapshotTimeDisplay} to the virtual machine ${vmName} (${vmIpAddress}) at ${restoreDirectory}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## common

______________________________________________________________________

DownloadBackupFiles

```text
${username} started a job to download backup files of object type '${objType}' with Id '${objId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DownloadBackupFilesFailed

```text
${username} failed to start a job to download backup files of object type '${objType}' with Id '${objId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DownloadBackupFilesFromArchivalLocation

```text
${username} started a job to download backup files from archival location '${archiveLocation}' of object type '${objType}' with Id '${objId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DownloadBackupFilesFromArchivalLocationFailed

```text
${username} failed to start a job to download backup files from archival location '${archiveLocation}' of object type '${objType}' with Id '${objId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DownloadBackupFilesFromArchive

```text
${username} started a job to download backup files from archive of object type '${objType}' with Id '${objId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DownloadBackupFilesFromArchiveFailed

```text
${username} failed to start a job to download backup files from archive of object type '${objType}' with Id '${objId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DownloadFilesStarted

```text
${username} started a job to download ${numOfPaths} path(s) from a backup of '${objectName}' taken on ${date}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DownloadFilesStartFailed

```text
${username} failed to start a job to download ${numOfPaths} path(s) from a backup of '${objectName}' taken on ${date}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DownloadReplicatedSnapshotFromLocationFailed

```text
${username} failed to start a job to download replicated snapshot  from location of object type '${objType}' with Id '${objId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DownloadReplicatedSnapshotFromLocationSuccess

```text
${username} started a job to download replicated snapshot from location of object type '${objType}' with Id '${objId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DownloadSnapshotFromRemoteFailed

```text
${username} failed to start a job to download remote snapshot for  '${objName}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DownloadSnapshotFromRemoteSuccess

```text
${username} started a job to download remote snapshot for '${objName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ExportFilesStarted

```text
${username} started a job to restore ${count} file(s) from a backup of '${objectName}' taken on ${date} to '${objectDestName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ExportFilesStartFailed

```text
${username} failed to start a job to restore ${count} file(s) from a backup of '${objectName}' taken on ${date} to '${objectDestName}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ExportSnapshotStarted

```text
${username} started a job to export snapshot '${snapshotId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

ExportSnapshotStartFailed

```text
${username} failed to start a job to export snapshot '${snapshotId}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

InstantRecoverSnapshotStarted

```text
${username} started a job to instantly recover '${snappableName}' (${snappableType}) with a snapshot taken at '${snapshotDate}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

InstantRecoverSnapshotStartFailed

```text
${username} failed to start a job to instantly recover '${snappableName}' (${snappableType}) with a snapshot taken at '${snapshotDate}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

MountSnapshotStarted

```text
${username} started a job to mount '${snappableName}' (${snappableType}) with a snapshot taken at '${snapshotDate}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

MountSnapshotStartFailed

```text
${username} failed to start a job to mount '${snappableName}'  (${snappableType}) with a snapshot taken at '${snapshotDate}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RestoreFilesStarted

```text
${username} started a job to restore ${count} file(s) from a backup of '${objectName}' taken on ${date}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RestoreFilesStartFailed

```text
${username} failed to start a job to restore ${count} file(s) from a backup of '${objectName}' taken on ${date}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RestoreSnapshotFilesFromArchivalLocation

```text
${username} started a job to restore snapshot files from archival location '${archiveLocation}' of object type '${objType}' with ID '${objId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RestoreSnapshotFilesFromArchivalLocationFailed

```text
${username} failed to start a job to restore snapshot files from archival location '${archiveLocation}' of object type '${objType}' with ID '${objId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

UnmountMountStarted

```text
${username} started a job to remove ${snappableType} mount '${mountId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

UnmountMountStartFailed

```text
${username} failed to start a job to remove ${snappableType} mount '${mountId}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## fileset

______________________________________________________________________

ExportFilesetFailure

```text
Failed to export '${sourceDir}' from '${source}' to '${destination}' based on snapshot taken at '${snapshotDate}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ExportFilesetStarted

```text
Started exporting '${sourceDir}' from '${source}' to '${destination}' based on snapshot taken at '${snapshotDate}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RestoreFilesetFailure

```text
Failed to start restore job for fileset '${filesetName}' from source path '${sourceDir}' to ${hostAndShare} destination path '${destinationDir}' using snapshot ${snapshotId} taken on ${snapshotDate}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RestoreFilesetStarted

```text
${username} started a restore job for fileset '${filesetName}' from source path '${sourceDir}' to ${hostAndShare} destination path '${destinationDir}' using snapshot ${snapshotId} taken on ${snapshotDate}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## gcpnative

______________________________________________________________________

GCPNativeAttachDisksTaskFailed

```text
Failed to attach recovered disks to the instance. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

GCPNativeAttachDisksTaskStarted

```text
Attaching recovered disks to the instance.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

GCPNativeAttachDisksTaskSucceeded

```text
Successfully attached recovered disks to the instance.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

GCPNativeDetachDisksTaskFailed

```text
Failed to detach existing disks from the instance. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

GCPNativeDetachDisksTaskStarted

```text
Detaching existing disks from the instance.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

GCPNativeDetachDisksTaskSucceeded

```text
Successfully detached existing disks from the instance.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

GCPNativeExportDiskCreateDiskTaskFailed

```text
Failed to create the disk. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

GCPNativeExportDiskCreateDiskTaskStarted

```text
Creating the disk.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

GCPNativeExportDiskCreateDiskTaskSucceeded

```text
Successfully created the disk.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

GCPNativeExportDiskJobCanceled

```text
Canceled export of the ${diskDisplayName} disk in the ${locationName} ${locationScope} in ${targetProjectDisplayName} project  from the snapshot of the ${sourceDiskName} disk taken at  ${snapshotDisplayTime} in the ${sourceProjectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

GCPNativeExportDiskJobCanceling

```text
Canceling export of the ${diskDisplayName} disk in the ${locationName} ${locationScope} in ${targetProjectDisplayName} project from the snapshot of the ${sourceDiskName} disk taken  at ${snapshotDisplayTime} in the ${sourceProjectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

GCPNativeExportDiskJobFailed

```text
Failed to export the ${diskDisplayName} disk in the ${locationName} ${locationScope} in ${targetProjectDisplayName} project from the  snapshot of the ${sourceDiskName} disk taken at ${snapshotDisplayTime}  in the ${sourceProjectDisplayName} project. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

GCPNativeExportDiskJobQueued

```text
Queued export of the ${diskDisplayName} disk in the ${locationName} ${locationScope} in ${targetProjectDisplayName} project from the  snapshot of the ${sourceDiskName} disk taken at ${snapshotDisplayTime}  in the ${sourceProjectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

GCPNativeExportDiskJobStarted

```text
${userEmail} started export of the ${diskDisplayName} GCP disk from the  snapshot taken at ${snapshotDisplayTime} in the  ${sourceProjectDisplayName} GCP project to the ${locationName}  ${locationScope} in ${targetProjectDisplayName} GCP project.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

GCPNativeExportDiskJobStarted

```text
Started export of the ${diskDisplayName} disk in the ${locationName} ${locationScope} in ${targetProjectDisplayName} project from the  snapshot of the ${sourceDiskName} disk taken at ${snapshotDisplayTime}  in the ${sourceProjectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

GCPNativeExportDiskJobStartFailed

```text
${userEmail} failed to start the export of the ${diskDisplayName} GCP  disk from the snapshot taken at ${snapshotDisplayTime} in the  ${sourceProjectDisplayName} GCP project to the ${locationName}  ${locationScope} in ${targetProjectDisplayName} GCP project. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

GCPNativeExportDiskJobSucceeded

```text
Export of the ${diskDisplayName} disk in the ${locationName} ${locationScope} in ${targetProjectDisplayName} project from the  snapshot of the ${sourceDiskName} disk taken at ${snapshotDisplayTime}  in the ${sourceProjectDisplayName} project succeeded.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

GCPNativeExportInstanceCreateInstanceTaskFailed

```text
Failed to create the instance. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

GCPNativeExportInstanceCreateInstanceTaskStarted

```text
Creating the instance.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

GCPNativeExportInstanceCreateInstanceTaskSucceeded

```text
Successfully created the instance.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

GCPNativeExportInstanceJobCanceled

```text
Canceled export of the ${instanceDisplayName} GCE instance in the ${zone} zone in ${targetProjectDisplayName} project from the snapshot of  ${sourceInstanceName} GCE instance taken at ${snapshotDisplayTime} in  the ${sourceProjectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

GCPNativeExportInstanceJobCanceling

```text
Canceling export of the ${instanceDisplayName} GCE instance in the ${zone} zone in the ${targetProjectDisplayName} project from the  snapshot of ${sourceInstanceName} GCE instance taken at  ${snapshotDisplayTime} in the ${sourceProjectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

GCPNativeExportInstanceJobFailed

```text
Failed to export the ${instanceDisplayName} GCE instance in the ${zone} zone in ${targetProjectDisplayName} project from the snapshot of  ${sourceInstanceName} GCE instance taken at ${snapshotDisplayTime} in  the ${sourceProjectDisplayName} project. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

GCPNativeExportInstanceJobQueued

```text
Queued export of the ${instanceDisplayName} GCE instance in the ${zone} zone in the ${targetProjectDisplayName} project from the snapshot of  ${sourceInstanceName} GCE instance taken at ${snapshotDisplayTime} in  the ${sourceProjectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

GCPNativeExportInstanceJobStarted

```text
${userEmail} started export of the ${instanceDisplayName} GCP instance from the snapshot taken at ${snapshotDisplayTime} in the  ${sourceProjectDisplayName} GCP project to the ${zone} zone in the  ${targetProjectDisplayName} GCP project.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

GCPNativeExportInstanceJobStarted

```text
Started export of the ${instanceDisplayName} GCE instance in the ${zone} zone in the ${targetProjectDisplayName} project from the snapshot of  ${sourceInstanceName} GCE instance taken at ${snapshotDisplayTime} in  the ${sourceProjectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

GCPNativeExportInstanceJobStartFailed

```text
${userEmail} failed to start the export of the ${instanceDisplayName}  GCP instance from the snapshot taken at ${snapshotDisplayTime} in the  ${sourceProjectDisplayName} GCP project to the ${zone} zone in the  ${targetProjectDisplayName} GCP project. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

GCPNativeExportInstanceJobSucceeded

```text
Export of the ${instanceDisplayName} GCE instance in the ${zone} zone  in ${targetProjectDisplayName} project from the snapshot of  ${sourceInstanceName} GCE instance taken at ${snapshotDisplayTime} in the  ${sourceProjectDisplayName} project succeeded.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

GCPNativeRestoreInstanceCreateDisksTaskFailed

```text
Failed to create disks from the snapshot. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

GCPNativeRestoreInstanceCreateDisksTaskStarted

```text
Creating disks from the snapshot.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

GCPNativeRestoreInstanceCreateDisksTaskSucceeded

```text
Successfully created disks from the snapshot.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

GCPNativeRestoreInstanceJobCanceled

```text
Canceled restore of the ${instanceDisplayName} GCE instance in the ${zone} zone from the snapshot taken at ${snapshotDisplayTime} in the ${projectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

GCPNativeRestoreInstanceJobCanceling

```text
Canceling restore of the ${instanceDisplayName} GCE instance in the ${zone} zone from the snapshot taken at ${snapshotDisplayTime} in the ${projectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

GCPNativeRestoreInstanceJobFailed

```text
Failed to restore the ${instanceDisplayName} GCE instance in the ${zone} zone from the snapshot taken at ${snapshotDisplayTime} in the ${projectDisplayName} project. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

GCPNativeRestoreInstanceJobQueued

```text
Queued restore of the ${instanceDisplayName} GCE instance in the ${zone} zone from the snapshot taken at ${snapshotDisplayTime} in the ${projectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

GCPNativeRestoreInstanceJobStarted

```text
${userEmail} started restore of the ${instanceDisplayName} GCP GCE instance in the ${zone} zone from the snapshot taken at ${snapshotDisplayTime} in the ${projectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

GCPNativeRestoreInstanceJobStarted

```text
Started restore of the ${instanceDisplayName} GCE instance in the ${zone} zone from the snapshot taken at ${snapshotDisplayTime} in the ${projectDisplayName} project.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

GCPNativeRestoreInstanceJobStartFailed

```text
${userEmail} failed to start restore of the ${instanceDisplayName} GCP GCE instance in the ${zone} zone from the snapshot taken at ${snapshotDisplayTime} in the ${projectDisplayName} project. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

GCPNativeRestoreInstanceJobSucceeded

```text
Restore of the ${instanceDisplayName} GCE instance in the ${zone} zone from the snapshot taken at ${snapshotDisplayTime} in the ${projectDisplayName} project succeeded.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

GCPNativeRestoreInstanceRestoreInstanceLabelsTaskFailed

```text
Failed to restore instance labels from the snapshot. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

GCPNativeRestoreInstanceRestoreInstanceLabelsTaskStarted

```text
Restoring instance labels from the snapshot.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

GCPNativeRestoreInstanceRestoreInstanceLabelsTaskSucceeded

```text
Successfully restored instance labels from the snapshot.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

GCPNativeStartInstanceTaskFailed

```text
Failed to start the instance. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

GCPNativeStartInstanceTaskStarted

```text
Starting the instance.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

GCPNativeStartInstanceTaskSucceeded

```text
Successfully started the instance.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

GCPNativeStopInstanceTaskFailed

```text
Failed to stop the instance. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

GCPNativeStopInstanceTaskStarted

```text
Stopping the instance.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

GCPNativeStopInstanceTaskSucceeded

```text
Successfully stopped the instance.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

GCPNativeStopInstanceTaskSucceededNoop

```text
Ensured that the instance is stopped.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

## hyperv

______________________________________________________________________

CreateHypervDiskMountFailed

```text
${username} failed to mount disks from snapshot '${snapshotID}' of Hyper-V virtual machine '${snappableName}' to Hyper-V virtual machine '${targetSnappableName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateHypervDiskMountStarted

```text
${username} started disk mount from snapshot '${snapshotID}' of Hyper-V virtual machine '${snappableName}' to Hyper-V virtual machine '${targetSnappableName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CreateHypervExportFailed

```text
${username} failed to export snapshot '${snapshotID}' of Hyper-V virtual machine '${snappableName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateHypervExportStarted

```text
${username} started exporting snapshot '${snapshotID}' of Hyper-V virtual machine '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CreateHypervInstantRecoveryFailed

```text
${username} failed to instant recover snapshot '${snapshotID}' of Hyper-V Virtual Machine '${snappableName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateHypervInstantRecoveryStarted

```text
${username} started instant recovery of Hyper-V Virtual Machine '${snappableName}' with snapshot '${snapshotID}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CreateHypervMountFailed

```text
${username} failed to mount snapshot '${snapshotID}' of Hyper-V Virtual Machine '${snappableName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateHypervMountStarted

```text
${username} started live mount of snapshot '${snapshotID}' of Hyper-V Virtual Machine '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CreateInplaceHypervExportFailed

```text
${username} failed to in-place export snapshot '${snapshotID}' of Hyper-V virtual machine '${snappableName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateInplaceHypervExportStarted

```text
${username} started in-place exporting snapshot '${snapshotID}' of Hyper-V virtual machine '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DownloadVmLevelFilesFailed

```text
${username} failed to download virtual-machine-level files from snapshot '${snapshotID}' of Hyper-V virtual machine '${snappableName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DownloadVmLevelFilesStarted

```text
${username} started downloading virtual-machine-level files from snapshot '${snapshotID}' of Hyper-V virtual machine '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

HypervBatchExportSingleFailed

```text
${username} failed to start a job to export a snapshot of Hyper-V Virtual Machine '${vmId}'(${vmName}). Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

HypervBatchExportSingleStarted

```text
${username} started a job to export a snapshot of Hyper-V Virtual Machine '${vmId}'(${vmName}).
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

HypervBatchInstantRecoverSingleFailed

```text
${username} failed to start a job to instant recover a snapshot on Hyper-V Virtual Machine '${vmId}'(${vmName}). Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

HypervBatchInstantRecoverSingleStarted

```text
${username} started a job to instant recover a snapshot on Hyper-V Virtual Machine '${vmId}'(${vmName}).
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

HypervBatchMountSingleFailed

```text
${username} failed to start a job to mount a snapshot of Hyper-V Virtual Machine '${vmId}'(${vmName}). Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

HypervBatchMountSingleStarted

```text
${username} started a job to mount a snapshot of Hyper-V Virtual Machine '${vmId}'(${vmName}).
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## k8s

______________________________________________________________________

K8sExportSnapshotStarted

```text
${userName} started a job to export Kubernetes snapshot ${snapshotId}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

K8sExportSnapshotStartFailed

```text
${userName} failed to start a job to export Kubernetes snapshot  ${snapshotId}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

K8sRestoreSnapshotStarted

```text
${userName} started a job to restore Kubernetes snapshot ${snapshotId}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

K8sRestoreSnapshotStartFailed

```text
${userName} failed to start a job to restore Kubernetes snapshot  ${snapshotId}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

## kupr

______________________________________________________________________

KuprNamespaceExportCanceled

```text
Canceled export of namespace snapshot with snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName} with clusterID ${targetClusterUUID}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

KuprNamespaceExportCanceling

```text
Canceling export of namespace snapshot with snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName} with clusterID ${targetClusterUUID}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

KuprNamespaceExportCompleted

```text
Successfully exported namespace snapshot with snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName} with clusterID ${targetClusterUUID}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

KuprNamespaceExportFailed

```text
Export of namespace snapshot with snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName} with clusterID ${targetClusterUUID} failed. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

KuprNamespaceExportFilesetFailure

```text
Failed to export PVC data for PVC ${pvcID}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

KuprNamespaceExportFilesetSnapshotTaskFailed

```text
Failed to export PVC data from snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

KuprNamespaceExportFilesetSnapshotTaskStarted

```text
Started export of PVC data from snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

KuprNamespaceExportFilesetSnapshotTaskSuccess

```text
Successfully exported PVC data from snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

KuprNamespaceExportResourceSnapshotTaskError

```text
Errors occurred while trying to export resource definition(s) from snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in cluster ${targetClusterName}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

KuprNamespaceExportResourceSnapshotTaskFailed

```text
Failed to export resource definition(s) from snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

KuprNamespaceExportResourceSnapshotTaskStarted

```text
Started export of resource definition(s) from snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

KuprNamespaceExportResourceSnapshotTaskSuccess

```text
Successfully exported resource definition(s) from snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

KuprNamespaceExportResourceSnapshotTaskWarning

```text
Skipped exporting resource definition(s) from snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in cluster ${targetClusterName}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

KuprNamespaceExportStarted

```text
Started export of namespace snapshot with snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName} with clusterID ${targetClusterUUID}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

KuprNamespaceRestoreCanceled

```text
Canceled restore of namespace snapshot with snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName} with clusterID ${targetClusterUUID}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

KuprNamespaceRestoreCanceling

```text
Canceling restore of namespace snapshot with snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName} with clusterID ${targetClusterUUID}.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

KuprNamespaceRestoreCompleted

```text
Successfully restored namespace snapshot with snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName} with clusterID ${targetClusterUUID}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

KuprNamespaceRestoreFailed

```text
Restore of namespace snapshot with snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName} with clusterID ${targetClusterUUID} failed. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

KuprNamespaceRestoreFilesetFailure

```text
Failed to restore PVC data for PVC ${pvcID}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

KuprNamespaceRestoreFilesetSnapshotTaskFailed

```text
Failed to restore PVC data from snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

KuprNamespaceRestoreFilesetSnapshotTaskStarted

```text
Started restore of PVC data from snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

KuprNamespaceRestoreFilesetSnapshotTaskSuccess

```text
Successfully restored PVC data from snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

KuprNamespaceRestoreResourceSnapshotTaskError

```text
Errors occurred while trying to restore resource definition(s) from snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in cluster ${targetClusterName}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

KuprNamespaceRestoreResourceSnapshotTaskFailed

```text
Failed to restore resource definition(s) from snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

KuprNamespaceRestoreResourceSnapshotTaskStarted

```text
Started restore of resource definition(s) from snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

KuprNamespaceRestoreResourceSnapshotTaskSuccess

```text
Successfully restored resource definition(s) from snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

KuprNamespaceRestoreResourceSnapshotTaskWarning

```text
Skipped restoring resource definition(s) from snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in cluster ${targetClusterName}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

KuprNamespaceRestoreStarted

```text
Started restore of namespace snapshot with snapshotID ${snapshotID} to Kubernetes Namespace ${targetNamespace} in Cluster ${targetClusterName} with clusterID ${targetClusterUUID}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

KuprRecoverySkipPVCWarning

```text
Restoring PersistentVolumeClaim(PVC) ${pvcName} as an empty PVC since  its backup was skipped. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

## managed_volume

______________________________________________________________________

InternalExportSlaSnapshot

```text
${username} exported the snapshot '${snapshot}' of SLA Managed Volume '${mv}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

InternalExportSlaSnapshotFailure

```text
${username} failed to export the snapshot '${snapshot}' of SLA Managed Volume '${mv}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

InternalExportSnapshot

```text
${username} exported the snapshot '${snapshot}' of Managed Volume '${mv}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

InternalExportSnapshotFailure

```text
${username} failed to export the snapshot '${snapshot}' of Managed Volume '${mv}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

V1DeleteSnapshotExport

```text
${username} deleted the live mount '${mount}' of Managed Volume '${mv}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

V1DeleteSnapshotExportFailure

```text
${username} failed to delete the live mount '${mount}' of Managed Volume '${mv}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## mongo_source

______________________________________________________________________

MongoRecoveryFailure

```text
${username} failed to start recovery of objects [${recoveryObjects}] on the MongoDB source '${sourceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

MongoRecoveryStarted

```text
${username} started recovery of objects [${recoveryObjects}] on the MongoDB source '${sourceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## mount

______________________________________________________________________

CreateLiveMount

```text
${username} started a job to mount '${objId}' (${objName}) of type ${objType}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CreateLiveMountFailed

```text
${username} failed to start a job to mount '${objId}' (${objName}) of type ${objType}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## mssql

______________________________________________________________________

AssignMssqlSlaDomain

```text
${username} assigned SLA Domain to Mssql database '${dbName}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

AssignMssqlSlaDomainFailed

```text
${username} failed to assign SLA Domain to Mssql database '${dbName}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

BulkExportMssqlDbFailure

```text
${username} was unable to export multiple SQL Server databases to  instance '${destinationInstanceName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

BulkExportMssqlDbStarted

```text
${username} started exporting multiple SQL Server databases to instance  '${destinationInstanceName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CreateMssqlLogShippingConfiguration

```text
${username} created log shipping for '${dbName}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CreateMssqlLogShippingConfigurationFailed

```text
${username} failed to create log shipping for Mssql database '${dbName}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ExportMssqlDbFailure

```text
${username} failed exporting database '${source}' to '${destination}' Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ExportMssqlDbStarted

```text
${username} started exporting database '${source}' to '${destination}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RestoreMssqlDbFailure

```text
${username} failed to restore '${dbName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RestoreMssqlDbStarted

```text
${username} began restoring '${dbName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## mysqldb_instance

______________________________________________________________________

DeleteMysqldbInstanceLiveMountFailure

```text
${username} failed to trigger the deletion of a Live Mount for the MySQL instance ${instanceName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeleteMysqldbInstanceLiveMountStarted

```text
${username} triggered the deletion of a Live Mount for the MySQL instance ${instanceName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## ncd

______________________________________________________________________

RecoverPaths

```text
${username} successfully started recovery of paths '${paths}' from snapshot '${snapshot}' to '${share}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RecoverPathsFailed

```text
${username} was unable to start recovery of paths '${paths}' from snapshot '${snapshot}' to '${share}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

## nutanix

______________________________________________________________________

CreateNutanixDiskMountFailed

```text
${username} failed to mount disks from snapshot '${snapshotID}' of Nutanix virtual machine '${snappableName}' to Nutanix virtual machine '${targetSnappableName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateNutanixDiskMountStarted

```text
${username} started disk mount from snapshot '${snapshotID}' of Nutanix virtual machine '${snappableName}' to Nutanix virtual machine '${targetSnappableName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

CreateNutanixInstantRecoveryFailed

```text
${username} failed to instantly recover from snapshot '${snapshotID}' of workload '${snappableName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

CreateNutanixInstantRecoveryStarted

```text
${username} started a job to instantly recover from snapshot '${snapshotID}' of workload '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

DownloadNutanixVdiskFailed

```text
${username} failed to download virtual disks from snapshot '${snapshotID}' of Nutanix virtual machine '${snappableName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DownloadNutanixVdiskStarted

```text
${username} started downloading virtual disks from snapshot '${snapshotID}' of Nutanix virtual machine '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

NutanixBatchExportSingleFailed

```text
${username} failed to start a job to export a snapshot of Nutanix Virtual Machine '${vmId}'(${vmName}). Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

NutanixBatchExportSingleStarted

```text
${username} started a job to export a snapshot of Nutanix Virtual Machine '${vmId}'(${vmName}).
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

NutanixBatchMountSingleFailed

```text
${username} failed to start a job to mount a snapshot of Nutanix Virtual Machine '${vmId}'(${vmName}). Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

NutanixBatchMountSingleStarted

```text
${username} started a job to mount a snapshot of Nutanix Virtual Machine '${vmId}'(${vmName}).
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

NutanixVmMountMigrationStarted

```text
${username} started a job to migrate ${snappableType} mount '${mountId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

NutanixVmMountMigrationStartFailed

```text
${username} failed to start a job to migrate ${snappableType} mount '${mountId}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

PatchNutanixVmMountStarted

```text
${username} started a job to patch ${snappableType} mount '${mountId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

PatchNutanixVmMountStartFailed

```text
${username} failed to start a job to patch ${snappableType} mount '${mountId}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

## o365

______________________________________________________________________

M365BackupStorageNewLocationRestoreSucceeded

```text
Successfully completed restore of ${sourceObject} Microsoft  365 ${snappableType} data to ${newLocation}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

M365BackupStorageRestoreFailed

```text
Failed to perform ${restoreType} of ${sourceObject} Microsoft 365  ${snappableType} data. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

M365BackupStorageRestoreStarted

```text
Started ${restoreType} of ${sourceObject} Microsoft 365 ${snappableType} data.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

M365PublishBackupStorageInplaceRestoreSucceeded

```text
Successfully completed in-place restore of ${sourceObject} Microsoft  365 ${snappableType} data.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

M365PublishBackupStorageRestoreProgress

```text
Restore is in progress.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

O365ExchangeExportSuccess

```text
Successfully exported ${numEmails} emails and ${numExportedAttachments} attachments in ${numFolders} folders (total size: ${bytesUploaded}) from the mailbox of ${sourceUser}. Skipped data: ${numSkippedFolders} folders, ${numSkippedEmails} emails  and ${numSkippedAttachments} attachments (estimated total skipped size:  ${bytesSkipped}). The download link has been generated successfully: ${exportUrl}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365ExchangeInplaceRestoreFailure

```text
Completed ${inplaceRestoreUIName} of ${numEmails} emails,  ${numEvents} calendar events, ${numContacts} contacts, and  ${numAttachments} attachments (skipped ${skippedAttachments}  attachments) in ${numFolders} folders from ${sourceUser} Microsoft 365  Exchange to ${destinationUser}. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365ExchangeInplaceRestoreFailureWithRenamedCalendars

```text
Completed ${inplaceRestoreUIName} of ${numEmails} emails,  ${numEvents} calendar events, ${numContacts} contacts, and  ${numAttachments} attachments (skipped ${skippedAttachments} attachments)  in ${numFolders} folders from ${sourceUser} Microsoft 365 Exchange to  ${destinationUser}. (Renamed ${RenamesDueToNameConflictsCount} calendars due to naming conflict). Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365ExchangeInplaceRestorePartialSuccess

```text
Completed ${inplaceRestoreUIName} of ${numEmails} emails,  ${numEvents} calendar events, ${numContacts} contacts, and  ${numAttachments} attachments (skipped ${skippedAttachments}  attachments) in ${numFolders} folders from ${sourceUser} Microsoft 365  Exchange to ${destinationUser}. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365ExchangeInplaceRestorePartialSuccessWithRenamedCalendars

```text
Completed ${inplaceRestoreUIName} of ${numEmails} emails,  ${numEvents} calendar events, ${numContacts} contacts, and  ${numAttachments} attachments (skipped ${skippedAttachments} attachments)  in ${numFolders} folders from ${sourceUser} Microsoft 365 Exchange to  ${destinationUser}. (Renamed ${RenamesDueToNameConflictsCount} calendars due to naming conflict). Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365ExchangeInplaceRestoreSuccess

```text
Successfully completed ${inplaceRestoreUIName} of ${numEmails} emails,  ${numEvents} calendar events, ${numContacts} contacts, and  ${numAttachments} attachments (skipped ${skippedAttachments}  attachments) in ${numFolders} folders from ${sourceUser} Microsoft 365  Exchange to ${destinationUser}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365ExchangeInplaceRestoreSuccessWithRenamedCalendars

```text
Successfully completed ${inplaceRestoreUIName} of ${numEmails} emails,  ${numEvents} calendar events, ${numContacts} contacts, and  ${numAttachments} attachments (skipped ${skippedAttachments}  attachments) in ${numFolders} folders from ${sourceUser} Microsoft 365  Exchange to ${destinationUser}. (Renamed ${RenamesDueToNameConflictsCount} calendars due to naming  conflict).
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365ExchangeRestoreFailure

```text
Completed restore of ${numEmails} emails, ${numEvents} calendar events, and ${numAttachments} attachments (skipped ${skippedAttachments} attachments) in ${numFolders} folders from ${sourceUser} Microsoft 365 Exchange to ${destinationUser}. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365ExchangeRestorePartialSuccess

```text
Completed restore of ${numEmails} emails, ${numEvents} calendar events, and ${numAttachments} attachments (skipped ${skippedAttachments} attachments) in ${numFolders} folders from ${sourceUser} Microsoft 365 Exchange to ${destinationUser}. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365ExchangeRestoreSuccess

```text
Successfully restored ${numEmails} emails, ${numEvents} calendar events, and ${numAttachments} attachments (skipped ${skippedAttachments} attachments) in ${numFolders} folders from ${sourceUser} Microsoft 365 Exchange to ${destinationUser}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365ExchangeRestoreWithContactsFailure

```text
Completed restore of ${numEmails} emails, ${numEvents} calendar events, ${numContacts} contacts, and ${numAttachments} attachments (skipped ${skippedAttachments} attachments) in ${numFolders} folders from ${sourceUser} Microsoft 365 Exchange to ${destinationUser}. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365ExchangeRestoreWithContactsPartialSuccess

```text
Completed restore of ${numEmails} emails, ${numEvents} calendar events, ${numContacts} contacts, and ${numAttachments} attachments (skipped ${skippedAttachments} attachments) in ${numFolders} folders from ${sourceUser} Microsoft 365 Exchange to ${destinationUser}. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365ExchangeRestoreWithContactsSuccess

```text
Successfully restored ${numEmails} emails, ${numEvents} calendar events, ${numContacts} contacts, and ${numAttachments} attachments (skipped ${skippedAttachments} attachments) in ${numFolders} folders from ${sourceUser} Microsoft 365 Exchange to ${destinationUser}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365ExportDownloaded

```text
${userID} accessed the download link for the exported Microsoft 365 ${objectType} data of ${objectName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

O365ExportFailed

```text
${userID} failed to export ${sourceUser} Microsoft 365 ${snappableType} data${optionalDescription}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

O365ExportFailed

```text
Failed to export ${sourceUser} Microsoft 365 ${snappableType} data because ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365ExportStarted

```text
${userID} started export of ${sourceUser} Microsoft 365 ${snappableType} data${optionalDescription}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

O365ExportStarted

```text
Started export of ${sourceUser} Microsoft 365 ${snappableType} data
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365FullTeamChannelCreationCompleted

```text
Finished preparing and creating channels for recovery. Successfully prepared and created ${successfulChannels} channel(s). Failed to create ${failedChannels} channel(s).
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365FullTeamChannelCreationStart

```text
Preparing and creating channels for recovery.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

O365FullTeamChannelRestoreCompleted

```text
Successfully restored ${numRestoredMessages} message(s) across ${numChannelsRestored} channel(s). Skipped restore of ${numChannelsSkipped} channel(s). Failed to restore ${numFailedMessages} message(s).
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365FullTeamChannelRestoreSkip

```text
Skipping restore of Channel '${channelName}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

O365FullTeamChannelRestoreStart

```text
Restoring ${numRestoredMessages} message(s) across ${numChannels} channel(s).
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365FullTeamCreationCompleted

```text
Successfully created the new team for recovery.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365FullTeamCreationStart

```text
Preparing the team for recovery.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

O365FullTeamPreparationCompleted

```text
Successfully prepared the team for recovery.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365FullTeamRestoreFailure

```text
Completed ${inplaceRestoreUIName} of ${numChannelsRestored}  channel(s) and ${numSitesRestored} site(s) from Team '${sourceObject}' to ${destinationObject}. Skipped restore of ${numChannelsSkipped}  channel(s) and ${numSitesSkipped} site(s). Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365FullTeamRestorePartialSuccess

```text
Completed ${inplaceRestoreUIName} of ${numChannelsRestored}  channel(s) and ${numSitesRestored} site(s) from Team '${sourceObject}' to ${destinationObject}. Skipped restore of ${numChannelsSkipped}  channel(s) and ${numSitesSkipped} site(s). Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365FullTeamRestoreSkippedObjectsPartialSuccess

```text
Completed ${inplaceRestoreUIName} of ${numChannelsRestored}  channel(s) and ${numSitesRestored} site(s) from Team '${sourceObject}' to ${destinationObject}. Skipped restore of ${numChannelsSkipped}  channel(s) and ${numSitesSkipped} site(s).
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365FullTeamRestoreSuccess

```text
Successfully completed ${inplaceRestoreUIName} of ${numChannelsRestored}  channel(s) and ${numSitesRestored} site(s) from Team '${sourceObject}' to ${destinationObject}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365FullTeamSharepointSiteRestoreCompleted

```text
Successfully restored ${numSitesRestored} site(s). Skipped  restore of ${numSitesSkipped} site(s).
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365FullTeamSharepointSiteRestoreProgress

```text
Restored ${numSites} site(s) out of ${totalSites} site(s).
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

O365FullTeamSharepointSiteRestoreStart

```text
Restoring ${numSites} site(s).
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

O365FullTeamSharepointSiteSkip

```text
Skipping restore of Sharepoint Site ${siteUrl}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

O365InplaceRestoreCanceled

```text
Canceled ${inplaceRestoreUIName} of Microsoft 365 ${snappableType}  data for ${user}
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

O365InplaceRestoreFailed

```text
${userEmail} unable to start ${inplaceRestoreUIName} of Microsoft 365 ${snappableType} from ${sourceSnappableName} to ${destinationSnappableName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

O365InplaceRestoreFailed

```text
Failed to perform ${inplaceRestoreUIName} Microsoft 365 ${snappableType} data from ${sourceUser} to ${destinationUser} because of ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365InplaceRestoreStarted

```text
${userEmail} started ${inplaceRestoreUIName} of Microsoft 365 ${snappableType}  from '${sourceSnappableName}' to '${destinationSnappableName}'${optionalDescription}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

O365InplaceRestoreStarted

```text
Started ${inplaceRestoreUIName} of Microsoft 365 ${snappableType} data from ${sourceUser} to ${destinationUser}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365LogRestoreAttachmentTooLarge

```text
Could not restore ${numTooLargeAttachments} attachment(s) due to Microsoft API limitations. Manual recovery is possible.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

O365LogRestoreMetrics

```text
Restored ${numEmails} e-mails and ${numAttachments} attachments
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365MailBoxRestoreSuccess

```text
Successfully restored ${numEmails} email(s) and ${numAttachments} attachment(s) from ${sourceUser} Microsoft 365 ${snappableType} to ${destinationUser}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365OnedriveExportSuccess

```text
Successfully exported ${numRestoredFiles} file(s) (total uploaded size: ${bytesUploaded}) and ${numRestoredFolders} folder(s) from ${sourceUser} Microsoft 365 Onedrive. The download link has been generated successfully: ${exportUrl}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365OnedriveInplaceRestoreFailure

```text
Completed ${inplaceRestoreUIName} of ${numRestoredFiles} files (total uploaded size: ${bytesUploaded}) and ${numRestoredFolders}  folders from Microsoft 365 OneDrive ${sourceUser} to ${destinationUser}. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365OnedriveInplaceRestoreFailureWithRenamedItems

```text
Completed ${inplaceRestoreUIName} of ${numRestoredFiles} files (total uploaded size: ${bytesUploaded}) and ${numRestoredFolders} folders from Microsoft 365 OneDrive ${sourceUser} to ${destinationUser}. (Renamed ${RenamesDueToNameConflictsCount} files and folders due to naming conflict  and ${RenamesDueToItemLockedCount} files that were locked for editing  and were not available for overwriting). Failed to restore  ${failurePercent}%% of the items. For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365OnedriveInplaceRestorePartialSuccess

```text
Completed ${inplaceRestoreUIName} of ${numRestoredFiles} files (total uploaded size: ${bytesUploaded}) and ${numRestoredFolders}  folders from Microsoft 365 OneDrive ${sourceUser} to ${destinationUser}. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365OnedriveInplaceRestorePartialSuccessWithRenamedItems

```text
Completed ${inplaceRestoreUIName} of ${numRestoredFiles} files (total uploaded size: ${bytesUploaded}) and ${numRestoredFolders} folders from Microsoft 365 OneDrive ${sourceUser} to ${destinationUser}. (Renamed ${RenamesDueToNameConflictsCount} files and folders due to naming conflict  and ${RenamesDueToItemLockedCount} files that were locked for editing  and were not available for overwriting). Failed to restore  ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365OnedriveInplaceRestoreSuccess

```text
Successfully completed ${inplaceRestoreUIName} of ${numRestoredFiles} files (total uploaded size: ${bytesUploaded}) and ${numRestoredFolders} folders from Microsoft 365 OneDrive ${sourceUser} to ${destinationUser}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365OnedriveInplaceRestoreSuccessWithRenamedItems

```text
Successfully completed ${inplaceRestoreUIName} of ${numRestoredFiles} files (total uploaded size: ${bytesUploaded}) and ${numRestoredFolders} folders from Microsoft 365 OneDrive ${sourceUser} to ${destinationUser}. (Renamed ${RenamesDueToNameConflictsCount} files and folders due to naming conflict and ${RenamesDueToItemLockedCount} files that were  locked for editing and were not available for overwriting).
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365OnedriveRestoreFailure

```text
Completed restore of ${numRestoredFiles} file(s) (total uploaded size:  ${bytesUploaded}) and ${numRestoredFolders} folder(s) from ${sourceUser} Microsoft 365 OneDrive to ${destinationUser}. Failed to restore  ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365OnedriveRestorePartialSuccess

```text
Completed restore of ${numRestoredFiles} file(s) (total uploaded size:  ${bytesUploaded}) and ${numRestoredFolders} folder(s) from ${sourceUser} Microsoft 365 OneDrive to ${destinationUser}. Failed to restore  ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365OnedriveRestoreSuccess

```text
Successfully restored ${numRestoredFiles} file(s) (total uploaded size: ${bytesUploaded}) and ${numRestoredFolders} folder(s) from ${sourceUser} Microsoft 365 OneDrive to ${destinationUser}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365PublishRestoreProgress

```text
Successfully recovered ${restoredItems} out of total ${totalItems}  items (${itemsSinceLastUpdate} items in last  ${progressIntervalInMins} minutes)
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

O365PublishSharePointSiteRestoreProgress

```text
Recovered ${leafObjectsRestored} out of total ${totalLeafObjects} drives/lists. Total items recovered so far: ${totalItemsRestored}  (${itemsSinceLastUpdate} items in last ${progressIntervalInMins}  minutes). Currently recovering [${objectInProgress}], its progress so  far: ${itemsRestoredInCurrentObject} out of ${totalItemsInCurrentObject}  items
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

O365RelicRestoreStarted

```text
Restoring the relic object
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

O365RelicRestoreSucceeded

```text
Successfully restored the relic object. It will be visible on RSC once your subscription is refreshed
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RestoreCanceled

```text
Canceled restore of ${user} Microsoft 365 ${snappableType}
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

O365RestoredItems

```text
List of restored items in the CSV file: ${downloadLink}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RestoreFailed

```text
${userID} failed to start restore of O365 ${snappableType} from ${sourceSnappableName} to ${destinationSnappableName}. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

O365RestoreFailed

```text
Failed to restore ${sourceUser} Microsoft 365 ${snappableType} data to ${destinationUser} because ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365RestoreStarted

```text
${userID} started restore of Microsoft 365 ${snappableType} from '${sourceSnappableName}' to '${destinationSnappableName}'${optionalDescription}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

O365RestoreStarted

```text
Started restore of ${sourceUser} Microsoft 365 ${snappableType} data to ${destinationUser}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365RestoreSuccess

```text
Successfully restored ${sourceUser} Office 365 ${snappableType} data to ${destinationUser} account
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365SearchInProgress

```text
Preparing items for the recovery
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

O365SearchPhaseCompleted

```text
Successfully prepared ${totalItems} items for recovery
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365SharedTeamsInfo

```text
Following teams originally belonged to Channel ${sourceChannel}. Please invite them to the newly created Shared Channel to complete their membership. ${sourceTenantTeams} ${externalTeams}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365SharePointDriveExportSuccess

```text
Successfully exported ${numRestoredFiles} file(s) (total uploaded size: ${bytesUploaded}) and ${numRestoredFolders} folder(s) from ${sourceObject} Microsoft 365 ${snappableType}.The download link has been generated successfully: ${exportUrl}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365SharePointDriveRestoreSuccess

```text
Successfully restored ${numRestoredFiles} file(s) (total uploaded size: ${bytesUploaded}) and ${numRestoredFolders} folder(s) from ${sourceObject} Microsoft 365 ${snappableType} to ${destinationObject}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365SharePointListRestoreSuccess

```text
Successfully restored ${NumRestoredItems} item(s) and ${numRestoredFolders} folder(s) from ${sourceObject} Office 365 ${snappableType} to ${destinationObject}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365SharePointSiteHierarchyRestoreCompleted

```text
Successfully prepared site hierarchy, initiating recovery of the drives/lists
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

O365SharePointSiteHierarchyRestoreInProgress

```text
Preparing site hierarchy for the recovery
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

O365SharePointSiteInplaceRestoreFailure

```text
Completed ${inplaceRestoreUIName} of ${numRestoredSites} site(s),  ${numRestoredDocLibs} document libraries,  ${numRestoredLists} list(s),  ${numRestoredWebParts} page libraries, ${numRestoredFiles} file item(s),  ${numRestoredListItems} list item(s), and  ${numRestoredFolders} folder(s)  (total uploaded size: ${bytesUploaded})  from ${sourceObject}  Microsoft 365 ${snappableType} to ${destinationObject}. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365SharePointSiteInplaceRestoreFailureWithRenamedItems

```text
Completed ${inplaceRestoreUIName} of ${numRestoredSites} site(s),  ${numRestoredDocLibs} document libraries,  ${numRestoredLists} list(s),  ${numRestoredWebParts} page libraries, ${numRestoredFiles} file item(s),  ${numRestoredListItems} list item(s), and  ${numRestoredFolders} folder(s)  (total uploaded size: ${bytesUploaded})  from ${sourceObject}  Microsoft 365 ${snappableType} to ${destinationObject} (Renamed ${RenamesDueToNameConflictsCount} files and folders due to naming conflict and ${RenamesDueToItemLockedCount} files that were  locked for editing and were not available for overwriting). Failed to restore ${failurePercent}%% of the items. For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365SharePointSiteInplaceRestorePartialSuccess

```text
Completed ${inplaceRestoreUIName} of ${numRestoredSites} site(s),  ${numRestoredDocLibs} document libraries,  ${numRestoredLists} list(s),  ${numRestoredWebParts} page libraries, ${numRestoredFiles} file item(s),  ${numRestoredListItems} list item(s), and  ${numRestoredFolders} folder(s)  (total uploaded size: ${bytesUploaded})  from ${sourceObject}  Microsoft 365 ${snappableType} to ${destinationObject}. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365SharePointSiteInplaceRestorePartialSuccessWithRenamedItems

```text
Completed ${inplaceRestoreUIName} of ${numRestoredSites} site(s),  ${numRestoredDocLibs} document libraries,  ${numRestoredLists} list(s),  ${numRestoredWebParts} page libraries, ${numRestoredFiles} file item(s),  ${numRestoredListItems} list item(s), and  ${numRestoredFolders} folder(s)  (total uploaded size: ${bytesUploaded})  from ${sourceObject}  Microsoft 365 ${snappableType} to ${destinationObject} (Renamed ${RenamesDueToNameConflictsCount} files and folders due to naming conflict and ${RenamesDueToItemLockedCount} files that were  locked for editing and were not available for overwriting). Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365SharePointSiteInplaceRestoreSuccess

```text
Successfully completed ${inplaceRestoreUIName} of ${numRestoredSites} site(s),  ${numRestoredDocLibs} document libraries,  ${numRestoredLists} list(s),  ${numRestoredWebParts} page libraries, ${numRestoredFiles} file item(s),  ${numRestoredListItems} list item(s), and  ${numRestoredFolders} folder(s)  (total uploaded size: ${bytesUploaded})  from ${sourceObject}  Microsoft 365 ${snappableType} to ${destinationObject}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365SharePointSiteInplaceRestoreSuccessWithRenamedItems

```text
Successfully completed ${inplaceRestoreUIName} of ${numRestoredSites} site(s),  ${numRestoredDocLibs} document libraries,  ${numRestoredLists} list(s),  ${numRestoredWebParts} page libraries, ${numRestoredFiles} file item(s),  ${numRestoredListItems} list item(s), and  ${numRestoredFolders} folder(s)  (total uploaded size: ${bytesUploaded})  from ${sourceObject}  Microsoft 365 ${snappableType} to ${destinationObject} (Renamed ${RenamesDueToNameConflictsCount} files and folders due to naming conflict and ${RenamesDueToItemLockedCount} files that were  locked for editing and were not available for overwriting).
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365SharePointSiteRestoreFailure

```text
Completed restore of ${numRestoredSites} site(s),  ${numRestoredDocLibs} document libraries,  ${numRestoredLists} list(s),  ${numRestoredWebParts} page libraries, ${numRestoredFiles} file item(s),  ${numRestoredListItems} list item(s), and  ${numRestoredFolders} folder(s)  (total uploaded size: ${bytesUploaded})  from ${sourceObject}  Microsoft 365 ${snappableType} to ${destinationObject}. Failed to  restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365SharePointSiteRestorePartialSuccess

```text
Completed restore of ${numRestoredSites} site(s),  ${numRestoredDocLibs} document libraries,  ${numRestoredLists} list(s),  ${numRestoredWebParts} page libraries, ${numRestoredFiles} file item(s),  ${numRestoredListItems} list item(s), and  ${numRestoredFolders} folder(s)  (total uploaded size: ${bytesUploaded})  from ${sourceObject}  Microsoft 365 ${snappableType} to ${destinationObject}. Failed to  restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365SharePointSiteRestoreSuccess

```text
Successfully restored ${numRestoredSites} site(s),  ${numRestoredDocLibs} document libraries,  ${numRestoredLists} list(s),  ${numRestoredWebParts} page libraries, ${numRestoredFiles} file item(s),  ${numRestoredListItems} list item(s), and  ${numRestoredFolders} folder(s)  (total uploaded size: ${bytesUploaded})  from ${sourceObject}  Microsoft 365 ${snappableType} to ${destinationObject}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365TeamConversationsInplaceRestoreFailure

```text
Completed ${inplaceRestoreUIName} of ${numRestoredMessages} message(s) and ${numRestoredFiles} attachment(s) from Team  '${sourceObject}' (channels: ${sourceChannels}) to ${destinationObject}. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365TeamConversationsInplaceRestoreFailureWithWarning

```text
Completed ${inplaceRestoreUIName} of ${numRestoredMessages} message(s) and ${numRestoredFiles} attachment(s) from Team  '${sourceObject}' (channels: ${sourceChannels}) to ${destinationObject}. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink} .  Warning: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365TeamConversationsInplaceRestorePartialSuccess

```text
Completed ${inplaceRestoreUIName} of ${numRestoredMessages}  message(s) and ${numRestoredFiles} attachment(s) from Team  '${sourceObject}' (channels: ${sourceChannels}) to ${destinationObject}. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365TeamConversationsInplaceRestorePartialSuccessWithWarning

```text
Completed ${inplaceRestoreUIName} of ${numRestoredMessages} message(s) and ${numRestoredFiles} attachment(s) from Team  '${sourceObject}' (channels: ${sourceChannels}) to ${destinationObject}. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink} .  Warning: ${reason}.
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365TeamConversationsInplaceRestoreSuccess

```text
Successfully completed ${inplaceRestoreUIName} of ${numRestoredMessages} message(s) and ${numRestoredFiles} attachment(s) from Team  '${sourceObject}' (channels: ${sourceChannels}) to ${destinationObject}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365TeamConversationsInplaceRestoreWarning

```text
Successfully completed ${inplaceRestoreUIName} of ${numRestoredMessages}  message(s) and ${numRestoredFiles} attachment(s) from Team  '${sourceObject}' (channels: ${sourceChannels}) to ${destinationObject}. Warning: ${reason}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

O365TeamConversationsRestoreFailure

```text
Completed restore of ${numRestoredMessages} message(s) and ${numRestoredFiles} attachment(s) from Team '${sourceObject}' (channels: ${sourceChannels}) to ${destinationObject}. Failed to restore  ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365TeamConversationsRestoreFailureWithWarning

```text
Completed restore of ${numRestoredMessages} message(s) and ${numRestoredFiles} attachment(s) from Team '${sourceObject}' (channels: ${sourceChannels}) to ${destinationObject}. Failed to restore  ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink} .  Warning: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365TeamConversationsRestorePartialSuccess

```text
Completed restore of ${numRestoredMessages} message(s) and ${numRestoredFiles} attachment(s) from Team '${sourceObject}' (channels: ${sourceChannels}) to ${destinationObject}. Failed to restore  ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365TeamConversationsRestorePartialSuccessWithWarning

```text
Completed restore of ${numRestoredMessages} message(s) and ${numRestoredFiles} attachment(s) from Team '${sourceObject}' (channels: ${sourceChannels}) to ${destinationObject}. Failed to restore  ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink} .  Warning: ${reason}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365TeamConversationsRestoreSuccess

```text
Successfully restored ${numRestoredMessages} message(s) and ${numRestoredFiles} attachment(s) from Team '${sourceObject}' (channels: ${sourceChannels}) to ${destinationObject}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365TeamConversationsRestoreWarning

```text
Successfully restored ${numRestoredMessages} message(s) and ${numRestoredFiles} attachment(s) from Team '${sourceObject}' (channels: ${sourceChannels}) to ${destinationObject}. Warning: ${reason}
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

O365TeamFilesExportSuccess

```text
Successfully exported ${numRestoredFiles} file(s) (total uploaded size: ${bytesUploaded}) and ${numRestoredFolders} folder(s) from Team '${sourceObject}'. The download link has been generated successfully: ${exportUrl}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365TeamFilesInplaceRestoreFailure

```text
Completed ${inplaceRestoreUIName} of ${numRestoredFiles}  file(s) (total uploaded size: ${bytesUploaded}) and  ${numRestoredFolders} folder(s) from Team '${sourceObject}' to  ${destinationObject}. Failed to restore ${failurePercent}%% of the  items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365TeamFilesInplaceRestorePartialSuccess

```text
Completed ${inplaceRestoreUIName} of ${numRestoredFiles}  file(s) (total uploaded size: ${bytesUploaded}) and  ${numRestoredFolders} folder(s) from Team '${sourceObject}' to  ${destinationObject}. Failed to restore ${failurePercent}%% of the  items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365TeamFilesInplaceRestoreSuccess

```text
Successfully completed ${inplaceRestoreUIName} of ${numRestoredFiles}  file(s) (total uploaded size: ${bytesUploaded}) and ${numRestoredFolders} folder(s) from Team '${sourceObject}' to ${destinationObject}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365TeamFilesRestoreFailure

```text
Completed restore of ${numRestoredFiles} file(s) (total uploaded size:  ${bytesUploaded}) and ${numRestoredFolders} folder(s) from Team  '${sourceObject}' to ${destinationObject}. Failed to restore  ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365TeamFilesRestorePartialSuccess

```text
Completed restore of ${numRestoredFiles} file(s) (total uploaded size:  ${bytesUploaded}) and ${numRestoredFolders} folder(s) from Team  '${sourceObject}' to ${destinationObject}. Failed to restore  ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365TeamFilesRestoreSuccess

```text
Successfully restored ${numRestoredFiles} file(s) (total uploaded size: ${bytesUploaded}) and ${numRestoredFolders} folder(s) from Team '${sourceObject}' to ${destinationObject}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365TeamFullChannelInplaceRestoreFailure

```text
Completed ${inplaceRestoreUIName} of full channel  '${channelName}' from Team '${sourceObject}' to ${destinationObject}. ${numRestoredMessages} message(s), ${numRestoredFiles} file(s) (total  uploaded size: ${bytesUploaded}), and ${numRestoredFolders} folder(s)  were restored. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365TeamFullChannelInplaceRestoreFailureWithWarning

```text
Completed ${inplaceRestoreUIName} of full channel  '${channelName}' from Team '${sourceObject}' to ${destinationObject}. ${numRestoredMessages} message(s), ${numRestoredFiles} file(s)  (total uploaded size: ${bytesUploaded}), and ${numRestoredFolders}  folder(s) were restored. Failed to restore ${failurePercent}%% of the  items.  For more information, click here: ${failedItemsLink} Warning: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365TeamFullChannelInplaceRestorePartialSuccess

```text
Completed ${inplaceRestoreUIName} of full channel  '${channelName}' from Team '${sourceObject}' to ${destinationObject}.  ${numRestoredMessages} message(s), ${numRestoredFiles} file(s)  (total uploaded size: ${bytesUploaded}), and ${numRestoredFolders}  folder(s) were restored. Failed to restore ${failurePercent}%% of the  items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365TeamFullChannelInplaceRestorePartialSuccessWithWarning

```text
Completed ${inplaceRestoreUIName} of full channel  '${channelName}' from Team '${sourceObject}' to ${destinationObject}. ${numRestoredMessages} message(s), ${numRestoredFiles} file(s) (total  uploaded size: ${bytesUploaded}), and ${numRestoredFolders} folder(s)  were restored. Failed to restore ${failurePercent}%% of the items.  Formore information, click here: ${failedItemsLink} Warning: ${reason}.
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365TeamFullChannelInplaceRestoreSuccess

```text
Successfully completed ${inplaceRestoreUIName} of full channel  '${channelName}' from Team '${sourceObject}' to ${destinationObject}. ${numRestoredMessages} message(s), ${numRestoredFiles} file(s)  (total uploaded size: ${bytesUploaded}), and ${numRestoredFolders}  folder(s) were restored.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365TeamFullChannelInplaceRestoreWarning

```text
Successfully completed ${inplaceRestoreUIName} of full channel  '${channelName}' from Team '${sourceObject}' to ${destinationObject}. ${numRestoredMessages} message(s), ${numRestoredFiles} file(s) (total  uploaded size: ${bytesUploaded}), and ${numRestoredFolders} folder(s)  were restored. Warning: ${reason}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

O365TeamFullChannelRestoreFailure

```text
Completed restore of full channel '${channelName}' from Team  '${sourceObject}' to ${destinationObject}. ${numRestoredMessages}  message(s), ${numRestoredFiles} file(s) (total uploaded size:  ${bytesUploaded}), and ${numRestoredFolders} folder(s) were restored. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365TeamFullChannelRestoreFailureWithWarning

```text
Completed restore of full channel '${channelName}' from Team '${sourceObject}' to ${destinationObject}. ${numRestoredMessages} message(s), ${numRestoredFiles} file(s) (total uploaded size: ${bytesUploaded}), and ${numRestoredFolders} folder(s) were restored. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink} Warning: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

O365TeamFullChannelRestorePartialSuccess

```text
Completed restore of full channel '${channelName}' from Team  '${sourceObject}' to ${destinationObject}. ${numRestoredMessages}  message(s), ${numRestoredFiles} file(s) (total uploaded size:  ${bytesUploaded}), and ${numRestoredFolders} folder(s) were restored. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365TeamFullChannelRestorePartialSuccessWithWarning

```text
Completed restore of full channel '${channelName}' from Team '${sourceObject}' to ${destinationObject}. ${numRestoredMessages} message(s), ${numRestoredFiles} file(s) (total uploaded size: ${bytesUploaded}), and ${numRestoredFolders} folder(s) were restored. Failed to restore ${failurePercent}%% of the items.  For more information, click here: ${failedItemsLink} Warning:  ${reason}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

O365TeamFullChannelRestoreSuccess

```text
Successfully restored full channel '${channelName}' from Team '${sourceObject}' to ${destinationObject}. ${numRestoredMessages} message(s), ${numRestoredFiles} file(s) (total uploaded size: ${bytesUploaded}), and ${numRestoredFolders} folder(s) were restored.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

O365TeamFullChannelRestoreWarning

```text
Successfully restored full channel '${channelName}' from Team '${sourceObject}' to ${destinationObject}. ${numRestoredMessages} message(s), ${numRestoredFiles} file(s) (total uploaded size: ${bytesUploaded}), and ${numRestoredFolders} folder(s) were restored. Warning: ${reason}
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

## openstack

______________________________________________________________________

ExportOpenstackVMSnapshotFailed

```text
${username} failed to start a job to export OpenStack virtual machine '${vmName}' using snapshot '${snapshotFid}'. Failure reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |         |
| ----------- | ----------- | ------- |
| **Warning** | **Failure** | **Yes** |

ExportOpenstackVMSnapshotStarted

```text
${username} started a job to export OpenStack virtual machine '${vmName}' using snapshot '${snapshotFid}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## postgres_db_cluster

______________________________________________________________________

DeletePostgresDbClusterLiveMountFailure

```text
${username} failed to trigger the deletion of a Live Mount for the PostgreSQL database cluster ${dbClusterName}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

DeletePostgresDbClusterLiveMountStarted

```text
${username} triggered the deletion of a Live Mount for the PostgreSQL database cluster ${dbClusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## saasapps

______________________________________________________________________

SaasAppsCascadingImpactAnalysisJobFailed

```text
Unable to complete impact analysis of ${numKeys} keys ${selectedKeys}.  Contact Rubrik Support.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

SaasAppsCascadingImpactAnalysisJobStarted

```text
Started impact analysis of ${numKeys} keys ${selectedKeys}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SaasAppsCascadingImpactAnalysisJobSucceeded

```text
Successfully completed impact analysis of ${numKeys} keys ${selectedKeys}.  Check notifications to resume the restore.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SaasAppsRestoreCanceled

```text
Canceled restore of ${displayName} ${snappableType}.  ${attachmentURLMessage}
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

SaasAppsRestoreCompleted

```text
Successfully completed the restore of ${displayName} ${snappableType} with ${numKeys} keys, ${selectedKeys}. ${attachmentURLMessage}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SaasAppsRestoreCompletedWithWarnings

```text
Successfully completed the restore of ${displayName} ${snappableType} with warnings. ${warningMessage} Restored ${numKeys} keys, ${selectedKeys}. ${attachmentURLMessage}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

SaasAppsRestoreFailed

```text
Unable to restore ${displayName} ${snappableType}. Reason: ${reason}.  ${attachmentURLMessage}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SaasAppsRestoreStarted

```text
${userID} started restore of ${displayName} ${snappableType}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SaasAppsRestoreStarted

```text
Started the restore of ${displayName} ${snappableType} with ${numKeys} keys, ${selectedKeys}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SaasAppsRestoreStartFailed

```text
${userID} failed to start restore of ${displayName} ${snappableType}.  Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |         |
| ------------ | ----------- | ------- |
| **Critical** | **Failure** | **Yes** |

## testaudit

______________________________________________________________________

Test

```text
This is a test audit.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## vsphere

______________________________________________________________________

ExportSnapshotToStandaloneHostFailed

```text
${username} failed to start a job to export '${snappableName}' to standalone host '${hostName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

ExportSnapshotToStandaloneHostStarted

```text
${username} started a job to export '${snappableName}' with a snapshot to standalone host '${hostName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RelocateVsphereMountFailed

```text
${username} failed to relocate vSphere mount '${mountId}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

RelocateVsphereMountStarted

```text
${username} started a job to relocate vSphere mount '${mountId}'
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TriggerDownloadVirtualMachineFileJobFailed

```text
${username} failed to start a job to prepare Virtual Machine file  download for '${vmName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

TriggerDownloadVirtualMachineFileJobSucceeded

```text
${username} started a job to prepare Virtual Machine file download  for '${vmName}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VSphereBulkExportSingleFailed

```text
${username} failed to start a job to export a snapshot on Virtual Machine '${vmId}' (${vmName}). Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VSphereBulkExportSingleStarted

```text
${username} started a job to export a snapshot on Virtual Machine '${vmId}' (${vmName}).
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VSphereBulkInPlaceRecoverySingleFailed

```text
${username} failed to start a job to in-place recover a snapshot on Virtual Machine '${vmId}' (${vmName}). Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VSphereBulkInPlaceRecoverySingleStarted

```text
${username} started a job to in-place recover a snapshot on Virtual Machine '${vmId}' (${vmName}).
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VSphereBulkInstantRecoverySingleFailed

```text
${username} failed to start a job to instantly recover a snapshot on Virtual Machine '${vmId}' (${vmName}). Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VSphereBulkInstantRecoverySingleStarted

```text
${username} started a job to instantly recover a snapshot on Virtual Machine '${vmId}' (${vmName}).
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VSphereBulkLiveMountSingleFailed

```text
${username} failed to start a job to mount a snapshot on Virtual Machine '${vmId}' (${vmName}). Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VSphereBulkLiveMountSingleStarted

```text
${username} started a job to mount a snapshot on Virtual Machine '${vmId}' (${vmName}).
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VSphereExportFailed

```text
${username} failed to start a job to export '${snappableName}' with a snapshot taken at '${snapshotDate}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VSphereExportStarted

```text
${username} started a job to export '${snappableName}' with a snapshot taken at '${snapshotDate}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VSphereInPlaceRecoveryFailed

```text
${username} failed to start a job to in-place recover '${snappableName}' with a snapshot taken at '${snapshotDate}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VSphereInPlaceRecoveryStarted

```text
${username} started a job to in-place recover '${snappableName}' with a snapshot taken at '${snapshotDate}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VSphereInstantRecoverFailed

```text
${username} failed to instantly recover '${snappableName}' with a snapshot taken at '${snapshotDate}'. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VSphereInstantRecoverStarted

```text
${username} started a job to instantly recover '${snappableName}' with a snapshot taken at '${snapshotDate}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VSphereLatestExportFailed

```text
${username} failed to export '${snappableName}' to the latest available recovery point. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VSphereLatestExportStarted

```text
${username} started a job to export '${snappableName}' to the latest available recovery point.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VSphereLatestInPlaceRecoveryFailed

```text
${username} failed to start a job to in-place recover '${snappableName}' to the latest available recovery point. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VSphereLatestInPlaceRecoveryStarted

```text
${username} started a job to in-place recover '${snappableName}' to the latest available recovery point.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VSphereLatestInstantRecoverFailed

```text
${username} failed to instantly recover '${snappableName}' to the latest available recovery point. Failure reason: ${reason}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VSphereLatestInstantRecoverStarted

```text
${username} started a job to instantly recover '${snappableName}' to the latest available recovery point.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VSphereLatestLiveMountFailed

```text
${username} failed to mount '${snappableName}' to the latest available recovery point.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VSphereLatestLiveMountStarted

```text
${username} started a job to mount '${snappableName}' to the latest available recovery point.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

VSphereLiveMountFailed

```text
${username} failed to mount '${snappableName}' with a snapshot taken at '${snapshotDate}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

VSphereLiveMountStarted

```text
${username} started a job to mount '${snappableName}' with a snapshot taken at '${snapshotDate}'.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## app_failover

______________________________________________________________________

ReplicateBlueprintSnapshotFailed

```text
Failed to replicate the latest snapshot of Recovery Plan '${appName}' to cluster '${cluster}' in '${account}': ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ReplicateBlueprintSnapshotPrepareTaskFailed

```text
Failed to prepare replication: ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

ReplicateBlueprintSnapshotTriggerTaskFailed

```text
Failed to replicate the latest snapshot of Recovery Plan '${appName}' to cluster '${cluster}': ${reason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

## cloudnative

______________________________________________________________________

CloudNativeReplicateSnapshotsIntegrityTaskFailed

```text
Validation of a replicated snapshot taken at ${snapshotTimeDisplay} for the ${qualifiedSnappableDisplayText} to the ${region} failed.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudNativeReplicateSnapshotsReplicateTaskFailed

```text
Failed to replicate the snapshot taken at ${snapshotTimeDisplay} for the ${qualifiedSnappableDisplayText} to the ${targetLocation}. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudNativeReplicateSnapshotsReplicateTaskStarted

```text
Replicating the snapshot taken at ${snapshotTimeDisplay} for the ${qualifiedSnappableDisplayText} to the ${targetLocation}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CloudNativeReplicateSnapshotsReplicateTaskSucceeded

```text
Successfully replicated snapshot taken at ${snapshotTimeDisplay} for the ${qualifiedSnappableDisplayText} to the ${targetLocation}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudNativeReplicateSnapshotsSkipped

```text
Replication of snapshot(s) taken at ${snapshotTimesDisplay} for the ${qualifiedSnappableDisplayText} was skipped because newer snapshot(s) have already been replicated.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

## app_failover

______________________________________________________________________

ScheduleRecoveryCleanupFailed

```text
Failed to run cleanup for ${failoverType} job for ${blueprintName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

ScheduleRecoveryCleanupStarted

```text
Starting to schedule cleanup for ${failoverType} job for ${blueprintName}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ScheduleRecoveryCleanupSucceeded

```text
Successfully completed cleanup for ${failoverType} job for ${blueprintName}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ScheduleRecoveryCompleted

```text
Scheduled recovery completed for ${blueprintName}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ScheduleRecoveryFailed

```text
Scheduled recovery failed for ${blueprintName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ScheduleRecoveryNotifyFailed

```text
Failed to notify users for results of scheduled recovery for ${blueprintName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

ScheduleRecoveryNotifyStarted

```text
Starting to notify users for results of scheduled recovery for ${blueprintName}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ScheduleRecoveryNotifySucceeded

```text
Successfully notified users for results of scheduled recovery for ${blueprintName}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ScheduleRecoveryPostcheckFailed

```text
Failed to run postchecks for scheduled recovery for ${blueprintName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

ScheduleRecoveryPostcheckStarted

```text
Starting to run postchecks for scheduled recovery for ${blueprintName}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ScheduleRecoveryPostcheckSucceeded

```text
Successfully completed postchecks for scheduled recovery for ${blueprintName}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ScheduleRecoveryPrecheckFailed

```text
Failed to run prechecks for scheduled recovery for ${blueprintName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

ScheduleRecoveryPrecheckNotSatisfied

```text
Scheduled recovery for ${blueprintName} doesn't meet all precheck criteria. Skipping Recovery Plan test. Reason: ${failedPrecheckErr}
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

ScheduleRecoveryPrecheckStarted

```text
Starting to run prechecks for scheduled recovery for ${blueprintName}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ScheduleRecoveryPrecheckSucceeded

```text
Successfully completed prechecks for scheduled recovery for ${blueprintName}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ScheduleRecoveryReportGenerationFailed

```text
Failed to generate report for scheduled recovery for ${blueprintName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

ScheduleRecoveryReportGenerationStarted

```text
Starting to generate report for scheduled recovery for ${blueprintName}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ScheduleRecoveryReportGenerationSucceeded

```text
Successfully generated report for scheduled recovery for ${blueprintName}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ScheduleRecoveryStarted

```text
Starting scheduled recovery for ${blueprintName}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ScheduleRecoveryTestRecoveryFailed

```text
Failed to schedule ${failoverType} job for ${blueprintName}. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

ScheduleRecoveryTestRecoveryStarted

```text
Starting to schedule ${failoverType} job for ${blueprintName}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ScheduleRecoveryTestRecoverySucceeded

```text
Successfully completed ${failoverType} for ${blueprintName}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

## security_violation

______________________________________________________________________

AdIrRemediationFailed

```text
Failed to remediate AD IR risk '${riskName}' with '${remediationType}' on ${objectName}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AdIrRemediationStarted

```text
Initiating remediation of AD IR risk '${riskName}' with '${remediationType}' on ${objectName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AdIrRemediationSuccess

```text
Remediated AD IR risk '${riskName}' with '${remediationType}' on ${objectName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CriticalSeverityDataViolationClosed

```text
Critical severity violation of policy ${policyName} on ${objectName} was closed automatically
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

CriticalSeverityDataViolationDetected

```text
Critical severity violation of policy ${policyName} detected on  ${objectName}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

CriticalSeverityDataViolationDismissed

```text
Critical severity violation of policy ${policyName} on ${objectName} was dismissed
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

CriticalSeverityDataViolationInProgress

```text
Critical severity violation of policy ${policyName} on ${objectName}  changed status to in progress
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

CriticalSeverityDataViolationRemediated

```text
Critical severity violation of policy ${policyName} on ${objectName} was remediated
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

CriticalSeverityDataViolationReOpen

```text
Critical severity violation of policy ${policyName} on ${objectName} changed status to open
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

DataViolationExportActionsLogRemediationFailed

```text
Failed to download actions log for object '${resourceName}' in  violation of policy '${policyName}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

DataViolationExportActionsLogRemediationSuccess

```text
Actions log for object '${resourceName}' in violation  of policy '${policyName}' downloaded.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

DataViolationExportPermissionsRemediationFailed

```text
Failed to download permissions for object '${resourceName}' detected in violation of '${policyName}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

DataViolationExportPermissionsRemediationSuccess

```text
Permissions for object '${resourceName}' where downloaded and detected in violation of '${policyName}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

DataViolationMipLabelRemediationFailure

```text
Failed to assign label '${labelName}' to ${FailedDocumentCount} out of  ${documentCount} documents detected in violation '${policyName}' on  object '${objectName}'.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

DataViolationMipLabelRemediationFinished

```text
Completed assignment of label  '${labelName}' to ${documentCount} documents detected in violation '${policyName}' on  object '${objectName}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

DataViolationMipLabelRemediationSkipped

```text
Skipped assignment of label '${labelName}' to ${SkippedDocumentCount}  out of ${documentCount} documents, which were detected in violation  '${policyName}'on object '${objectName}'. This occurred either due to unsupported document types or because the downgrading of MIP labels  is not allowed.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

DataViolationMipLabelRemediationStarted

```text
Beginning assignment of label '${labelName}' to ${documentCount} documents detected in violation '${policyName}' on  object '${objectName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

DataViolationMipLabelRemediationSuccess

```text
Successfully assigned label '${labelName}' to ${SuccessfulDocumentCount} out of ${documentCount} documents detected in violation '${policyName}'  on object '${objectName}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

EntraIdIrRemediationFailed

```text
Unable to remediate Entra ID IR risk '${riskName}' with  '${remediationType}' on ${objectName}. Error: ${reason}. ${remedy}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

EntraIdIrRemediationStarted

```text
Initiating remediation of Entra ID IR risk '${riskName}' with '${remediationType}' on ${objectName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

EntraIdIrRemediationSuccess

```text
Remediated Entra ID IR risk '${riskName}' with '${remediationType}' on  ${objectName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

HighSeverityDataViolationClosed

```text
High severity violation of policy ${policyName} on ${objectName} was closed automatically
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

HighSeverityDataViolationDetected

```text
High severity violation of policy ${policyName} detected on  ${objectName}
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

HighSeverityDataViolationDismissed

```text
High severity violation of policy ${policyName} on ${objectName} was dismissed
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

HighSeverityDataViolationInProgress

```text
High severity violation of policy ${policyName} on ${objectName}  changed status to in progress
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

HighSeverityDataViolationRemediated

```text
High severity violation of policy ${policyName} on ${objectName} was remediated
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

HighSeverityDataViolationReOpen

```text
High severity violation of policy ${policyName} on ${objectName} changed status to open
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

IdentityRevokeAccessRemediationFailed

```text
Failed to revoke access for '${identityName}' to ${documentCount} files in object ${objectName}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

IdentityRevokeAccessRemediationSuccess

```text
Successfully revoked access for '${identityName}' to ${documentCount} files in object ${objectName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

LowOrMediumSeverityDataViolationClosed

```text
${severity} severity violation of policy ${policyName} on ${objectName} was closed automatically
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

LowOrMediumSeverityDataViolationDetected

```text
${severity} severity violation of policy ${policyName} detected on  ${objectName}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

LowOrMediumSeverityDataViolationDismissed

```text
${severity} severity violation of policy ${policyName} on ${objectName} was dismissed
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

LowOrMediumSeverityDataViolationInProgress

```text
${severity} severity violation of policy ${policyName} on ${objectName}  changed status to in progress
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

LowOrMediumSeverityDataViolationRemediated

```text
${severity} severity violation of policy ${policyName} on ${objectName} was remediated
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

LowOrMediumSeverityDataViolationReOpen

```text
${severity} severity violation of policy ${policyName} on ${objectName} changed status to open
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

OverExposureRevokeAccessRemediationFailed

```text
Failed to revoke '${accessType}' access from ${documentCount} files  in object ${objectName}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

OverExposureRevokeAccessRemediationPartialSuccess

```text
Partially revoked '${accessType}' access from ${documentCount} files  in object ${objectName}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

OverExposureRevokeAccessRemediationStarted

```text
Initiating revoke '${accessType}' access from ${documentCount} files in object ${objectName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

OverExposureRevokeAccessRemediationSuccess

```text
Successfully revoked '${accessType}' access from ${documentCount} files  in object ${objectName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RevokeAccessRemediationInProgressForMultipleIdentities

```text
Revoking access in progress for ${numOfViolatingIdentities} identities from ${totalAccessibleFilesAtRiskCount} files in object ${objectName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

RevokeAccessRemediationInProgressForSingleIdentity

```text
Revoking access in progress for '${identityName}' from ${totalAccessibleFilesAtRiskCount} files in object ${objectName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

## o365

______________________________________________________________________

O365Search

```text
${userID} performed the following search on ${snappableType} ${snappableName}: ${query}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## saasapps

______________________________________________________________________

SaasAppsCascadingImpactAnalysisSeedingJobFailed

```text
Unable to complete impact analysis of ${numKeys} keys ${selectedKeys}.  Contact Rubrik Support.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

SaasAppsCascadingImpactAnalysisSeedingJobStarted

```text
Started impact analysis of ${numKeys} keys ${selectedKeys}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SaasAppsCascadingImpactAnalysisSeedingJobSucceeded

```text
Successfully completed impact analysis of ${numKeys} keys ${selectedKeys}.  Check notifications to resume the seeding.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SaasAppsSeedingCanceled

```text
Canceled seeding of ${displayName} ${snappableType}. ${attachmentURLMessage}
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

SaasAppsSeedingCompleted

```text
Successfully completed the seeding of ${displayName} ${snappableType} with ${numKeys} keys, ${selectedKeys}. ${attachmentURLMessage}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SaasAppsSeedingCompletedWithWarnings

```text
Successfully completed the seeding of ${displayName} ${snappableType} with warnings. ${warningMessage} Seeded ${numKeys} keys, ${selectedKeys}. ${attachmentURLMessage}
```

Severity | Status | Audit Event | |

|             |                    |        |
| ----------- | ------------------ | ------ |
| **Warning** | **PartialSuccess** | **No** |

SaasAppsSeedingFailed

```text
Unable to seed ${displayName} ${snappableType}. Reason: ${reason}. ${attachmentURLMessage}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SaasAppsSeedingStarted

```text
Started the seeding of ${displayName} ${snappableType} with ${numKeys} keys, ${selectedKeys}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

## sla

______________________________________________________________________

RetentionSLAAssignmentOnClusterObjectsProcessed

```text
${userEmail} successfully initiated request to assign retention SLA ${slaName} to objects ${objectNameList} on cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RetentionSLAAssignmentOnClusterSnapshotsProcessed

```text
${userEmail} successfully initiated request to assign retention SLA ${slaName} to snapshots ${snapshotIdList} on cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RetentionSLAAssignmentOnPolarisObjectsProcessed

```text
${userEmail} successfully assigned retention SLA ${slaName}. to objects ${objectNameList} on RSC
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RetentionSLAAssignmentOnPolarisObjectsQueued

```text
${userEmail} successfully initiated request to assign retention SLA Domain ${slaName} to objects ${objectNameList} on RSC
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RetentionSLAAssignmentOnPolarisSnapshotsProcessed

```text
${userEmail} successfully assigned retention SLA ${slaName}. to snapshots ${snapshotIdList} on RSC
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SLAAssignmentOnClusterProcessed

```text
${userEmail} successfully initiated request to assign SLA Domain ${slaName} to ${objectList} on cluster ${clusterName}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SLAAssignmentOnPolarisProcessed

```text
${userEmail} successfully assigned SLA ${slaName} to ${objectList} on RSC
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SLAAssignmentOnPolarisQueued

```text
${userEmail} successfully initiated request to assign SLA Domain  ${slaName} to ${objectList} on RSC
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## sla

______________________________________________________________________

SLACreationSucceeded

```text
${userEmail} successfully created Global SLA ${slaName}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SLADeletionSucceeded

```text
${userEmail} successfully deleted Global SLA ${slaName}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SLAMigrationEnqueueFailure

```text
${userEmail} did not succeed in initiating request to upgrade SLA Domain ${slaName} from cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Failure** | **Yes** |

SLAMigrationEnqueueSuccess

```text
${userEmail} successfully initiated request to switch SLA ${slaName} from cluster ${clusterName}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SLAModificationSucceeded

```text
${userEmail} successfully modified Global SLA ${slaName}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

SLAPauseSucceeded

```text
${userEmail} successfully ${action} Global SLA ${slaName} on ${clusterName}
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## archival

______________________________________________________________________

ArchivalLocationKmsUpdateFailed

```text
Failed to update KMS details for Archival Location {locationName}’s on  cluster {clusterName}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ArchivalLocationKmsUpdateSucceeded

```text
Successfully updated KMS details for Archival Location {locationName}’s on cluster  {clusterName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ArchivalLocationOperationSuccess

```text
${type} location '${name}' has been successfully ${operation}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ArchivalLocationUnsyncedDeleteFailed

```text
Failed to remove the entry corresponding to the archival location, ${name}, from the UI. The location could not be synced either due to invalid parameters or unrecoverable/ fatal error. Contact Rubrik Support to remove this entry from the UI. Verify the parameters used during creation of the archival location and retry the operation with a new name.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

ArchivalLocationUnsyncedDeleteStarted

```text
Started removing the entry for archival location ${name} from the UI that could not be synced either due to invalid parameters or unrecoverable/fatal error. Error description: ${description}
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

ArchivalLocationUnsyncedDeleteSuccess

```text
Archival location ${name} entry was removed from the UI since it could not be synced either due to invalid parameters or unrecoverable/fatal error. Verify and try again. Error description: ${description}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

ArchivalLocationUpgradeFailed

```text
Unable to upgrade the CDM managed archival location '${name}' on Rubrik cluster '${cluster}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

ArchivalLocationUpgradeStarted

```text
Started the upgrade of CDM managed archival location '${name}' on Rubrik cluster '${cluster}'.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

ArchivalLocationUpgradeSuccess

```text
Successfully completed the upgrade of CDM managed archival location '${name}' on Rubrik cluster '${cluster}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ReaderArchivalLocationRefreshFailed

```text
Failed to refresh reader archival location ${name}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

## encryption

______________________________________________________________________

FederatedLoginCleanupFailure

```text
Unable to clean up federated access configuration on Rubrik cluster, '${cluster}.'
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

FederatedLoginCleanupSuccess

```text
Successfully cleaned up federated access configuration on Rubrik cluster, '${cluster}.'
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

FederatedLoginConfigurationFailure

```text
Unable to configure federated access on Rubrik cluster, '${cluster}.'
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

FederatedLoginConfigurationSuccess

```text
Successfully configured federated access on Rubrik cluster, '${cluster}.'
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

FederatedLoginGenericError

```text
Failed to toggle federated login configuration on Rubrik cluster, '${cluster}.'
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

## encryption_keys

______________________________________________________________________

ArchivalRekeyQueued

```text
Queued the rekey of ${rekeyJobType} on archival location ${locationName}.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

## oktaintegration

______________________________________________________________________

OktaIntegrationSendEventFailure

```text
RSC failed to send ${failureCount} SSF messages to Okta ITP.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

OktaIntegrationSendEventSuccess

```text
RSC succeeded to send SSF messages to Okta ITP.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## pending_action

______________________________________________________________________

AppBlueprintChangeSyncFailed

```text
Failed to ${operation} Blueprint ${data} on cluster: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

AppBlueprintChangeSyncStarted

```text
Started to ${operation} Blueprint ${data} on cluster
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

AppBlueprintChangeSyncSucceed

```text
Succeeded to ${operation} Blueprint ${data} on cluster
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ArchivalLocationJobInitiated

```text
Job to sync Archival Location was successfully initiated on cluster
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ArchivalLocationSyncFailed

```text
Failed to sync Archival Location to the cluster: Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ArchivalLocationSyncStarted

```text
Started to sync Archival Location to the cluster.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ArchivalLocationSyncSucceed

```text
Succeeded to sync Archival Location to the cluster
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudAccountUpdateFailed

```text
Failed to update cloud account '${cloudAccountName}' credentials for  ${failedCount} location(s): ${failedLocations}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CloudAccountUpdateSucceeded

```text
Successfully updated cloud account '${cloudAccountName}' credentials for  ${successfulCount} location(s): ${successfulLocations}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CloudAccountUpdateSyncStarted

```text
Started to sync cloud account '${cloudAccountName}' credentials  for ${totalLocations} location(s): ${locations}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

GlobalSLAAssignFailed

```text
Failed to assign RSC SLA Domain '${slaName}' to objects '${objectNames}' on the Rubrik cluster '${clusterName}'. Reason: '${reason}'
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

GlobalSLAAssignStarted

```text
Started to assign RSC SLA Domain '${slaName}' to objects '${objectNames}' on cluster '${clusterName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

GlobalSLAAssignSuccess

```text
RSC SLA Domain '${slaName}' is successfully assigned  to objects '${objectNames}' on the Rubrik cluster '${clusterName}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

GlobalSLAAssignSynced

```text
Sent request to Rubrik cluster '${clusterName}' to assign  RSC SLA Domain `${slaName}` to objects '${objectNames}'. Update may take a few minutes to complete.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ReplicationLocationEnableFailed

```text
Failed to add replication target: ${targetName} on the cluster. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ReplicationLocationEnableStarted

```text
Started to add replication target: ${targetName} on the cluster
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ReplicationLocationEnableSucceed

```text
Succeeded to add replication target: ${targetName} on cluster
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RetentionSLAAssignmentToObjectsFailed

```text
Failed to assign retention SLA: ${slaName} to objects: ${objects} on cluster. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

RetentionSLAAssignmentToObjectsStarted

```text
Started to assign retention SLA: ${slaName} to objects: ${objects} on cluster
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

RetentionSLAAssignmentToObjectsSucceeded

```text
Succeeded to assign retention SLA: ${slaName} to objects: ${objects} on cluster
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RetentionSLAAssignmentToSnapshotsFailed

```text
Failed to assign SLA: ${slaName} to snapshot IDs: ${snapshotIDs} on cluster. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

RetentionSLAAssignmentToSnapshotsStarted

```text
Started to assign retention SLA: ${slaName} to snapshot IDs: ${snapshotIDs} on cluster
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

RetentionSLAAssignmentToSnapshotsSucceeded

```text
Succeeded to assign SLA: ${slaName} to snapshot IDs: ${snapshotIDs} on cluster
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RetentionSLAAssignmentV2ToSnapshotsFailed

```text
Rubrik cluster '${clusterName}' could not assign SLA Domain '${slaName}' to snapshot '${snapshotNames}'. Reason: '${reason}'
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

RetentionSLAAssignmentV2ToSnapshotsStarted

```text
Started to assign retention SLA '${slaName}' to snapshot '${snapshotNames}' on cluster
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

RetentionSLAAssignmentV2ToSnapshotsSuccess

```text
Rubrik cluster '${clusterName}' successfully assigned SLA Domain '${slaName}' to snapshot '${snapshotNames}'
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RetentionSLAAssignmentV2ToSnapshotsSynced

```text
Successfully passed request to Rubrik cluster '${clusterName}' to assign SLA Domain '${slaName}' to snapshot '${snapshotNames}'. Update may take a few minutes to complete
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ServiceAccountSyncFailed

```text
Unable to ${operation} RSC service accounts: ${serviceAccountID} on the Rubrik cluster.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SLAAssignmentFailed

```text
Failed to assign SLA: ${slaName} to objects: ${objects} on cluster. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SLAAssignmentStarted

```text
Started to assign SLA: ${slaName} to objects: ${objects} on cluster
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SLAAssignmentSucceed

```text
Succeeded to assign SLA: ${slaName} to objects: ${objects} on cluster
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SLAChangeSyncFailed

```text
Failed to ${operation} SLA Domain ${name} to the cluster. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SLAChangeSyncFailedWithInvalidRetention

```text
Failed to ${operation} SLA Domain ${name} to the cluster. Reason: ${reason}. For more information about failures due to invalid retention, refer to ${articleLink}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SLAChangeSyncStarted

```text
Started to ${operation} SLA Domain ${name} on the cluster
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SLAChangeSyncSucceeded

```text
Successfully synced SLA Domain ${slaDomainName} to the cluster ${clusterName}
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SnapshotDeletionFailed

```text
Failed to delete snapshots: ${snapshotIds} of object: ${objectName} on cluster. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SnapshotDeletionStarted

```text
Started to delete snapshots: ${snapshotIds} of object: ${objectName} on cluster
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SnapshotDeletionSucceeded

```text
Succeeded to delete snapshots: ${snapshotIds} of object: ${objectName} on cluster
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SnapshotsOfObjectDeletionFailed

```text
Failed to delete all unprotected snapshots of objects: ${objectNameList} on cluster. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

SnapshotsOfObjectDeletionStarted

```text
Started to delete all unprotected snapshots of objects: ${objectNameList} on cluster
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SnapshotsOfObjectDeletionSucceeded

```text
Succeeded to delete all unprotected snapshots of objects: ${objectNameList} on cluster
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## rcv

______________________________________________________________________

RcvReaderArchivalLocationMasterKeyUpdateFailed

```text
Unable to update the master encryption key for reader Rubrik Cloud Vault location ${objectName} on cluster ${clusterName}. Unable to update reader Rubrik Cloud Vault location ${objectName}’s encryption key to the new ${keyType} key.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

RcvReaderArchivalLocationMasterKeyUpdateFailedAkv

```text
Unable to update the master encryption key for reader Rubrik Cloud Vault location ${objectName}’s on cluster ${clusterName}. Unable to update reader Rubrik Cloud Vault location ${objectName}’s encryption key to ${keyName} from ${akvName}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

RcvReaderArchivalLocationMasterKeyUpdateFailedKms

```text
Failed to update master encryption key for reader Rubrik Cloud Vault  location '${locationName}' on cluster '${clusterName}'. Unable to switch  to encryption key '${keyName}' managed by '${kmsName}' (Provider: ${kmsType}).
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

RcvReaderArchivalLocationMasterKeyUpdateSucceeded

```text
Successfully updated the master encryption key for reader Rubrik Cloud Vault location ${objectName} on cluster ${clusterName}. Reader Rubrik Cloud Vault location ${objectName}’s encryption key updated to the new ${keyType} key.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RcvReaderArchivalLocationMasterKeyUpdateSucceededAkv

```text
Successfully updated the master encryption key for reader Rubrik Cloud Vault location ${objectName} on cluster ${clusterName}. Reader Rubrik Cloud Vault location ${objectName}’s encryption key updated to ${keyName} from ${akvName}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RcvReaderArchivalLocationMasterKeyUpdateSucceededKms

```text
Successfully updated master encryption key for reader Rubrik Cloud Vault  location '${locationName}' on cluster '${clusterName}'. The location now  uses encryption key '${keyName}' managed by '${kmsName}' (Provider: ${kmsType}).
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RCVResourceCreationFailed

```text
Unable to allocate required resource '${resourceType}' for the RCV location '${name}'.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

RCVResourceCreationSuccess

```text
The required ${resourceType} resource has been allocated for the RCV location '${name}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## replication

______________________________________________________________________

ReplicationPairingFailed

```text
Failed to create a replication pair between the source cluster  '${sourceCluster}' and the target cluster '${targetCluster}'. Create a  replication pair for them. Error: ${errMsg}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

## role_sync

______________________________________________________________________

RoleSyncCreationFailed

```text
Role ${role} creation failed in cluster. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

RoleSyncCreationScheduled

```text
Scheduled a job to sync role ${role} to cluster.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

RoleSyncCreationSucceeded

```text
Role ${role} successfully created in cluster.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RoleSyncDeletionFailed

```text
Role ${role} deletion failed in cluster. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

RoleSyncDeletionScheduled

```text
Scheduled a job to delete role ${role} from cluster.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

RoleSyncDeletionSucceeded

```text
Role ${role} successfully deleted from cluster.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RoleSyncGrantAuthzFailed

```text
Failed to grant authorizations to role ${role} in cluster.  Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

RoleSyncGrantAuthzScheduled

```text
Scheduled a job to grant authorizations to ${role} in cluster.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

RoleSyncGrantAuthzSucceeded

```text
Successfully granted authorizations to role ${role} in cluster.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RoleSyncRevokeAuthzFailed

```text
Failed to revoke authorizations from role ${role} in cluster.  Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

RoleSyncRevokeAuthzScheduled

```text
Scheduled a job to revoke authorizations from ${role} in cluster.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

RoleSyncRevokeAuthzSucceeded

```text
Successfully revoked all authorizations from role ${role} in cluster.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

RoleSyncUpdateFailed

```text
Failed to update the name and description of role ${role} in the  cluster. Reason: ${reason}
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

RoleSyncUpdateScheduled

```text
Scheduled a job to update role name and description of ${role} from the cluster.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

RoleSyncUpdateSucceeded

```text
The name and description of role ${role} successfully updated  in the cluster.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## saasapps

______________________________________________________________________

SaasAppsRefreshOrgCanceled

```text
Canceled ${maintenanceType} metadata refresh for org ${orgName}.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

SaasAppsRefreshOrgCompleted

```text
Completed ${maintenanceType} metadata refresh for org ${orgName}. ${statsMsg}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

SaasAppsRefreshOrgCompletedWithWarnings

```text
Completed ${maintenanceType} metadata refresh for org ${orgName} with warnings. ${statsMsg}. ${warningMsg}
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Success** | **No** |

SaasAppsRefreshOrgFailed

```text
Failed ${maintenanceType} metadata refresh of ${siteName}: ${reason}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

SaasAppsRefreshOrgStarted

```text
Started ${maintenanceType} metadata refresh for subscription ${orgName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

## multitenancy

______________________________________________________________________

TenantOverlapDetected

```text
Tenant organization ${orgName1}'s permission on ${objectName} has a conflict with  ${conflictObjects}. As a result of this conflict, specific resources are being  assigned to multiple orgs and this is not allowed. Further, this can lead to  unexpected behavior until the conflict is resolved. To resolve this conflict, edit the organizations and reassign the appropriate rules to each org. Note that  all organizations will have access to the same objects until the conflict is resolved.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

## multitenancy

______________________________________________________________________

TenantQuotaHardLimitExceeded

```text
The organization ${orgName} has exceeded its ${hardLimit} disk hard quota on cluster ${clusterName}, curently using ${currentUsage}. Due to this overage, RSC is unable to continue taking snapshots for this organization's objects on the cluster. You should address this overage promptly to ensure continued compliance with your backup service-level agreements. Visit the organization overview page to view ${orgName}'s usage on the affected cluster over time. For questions, contact your Global Account Administrator.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

TenantQuotaHardLimitResolved

```text
The disk usage for the organization ${orgName} on cluster ${clusterName} is now within the acceptable limits. The hard quota limit issue has been  successfully resolved. Backup snapshots for objects on this cluster have been resumed and are operating normally as per your service-level agreements.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

TenantQuotaSoftLimitExceeded

```text
The organization ${orgName} has exceeded its ${softLimit} disk soft quota on cluster ${clusterName}, currently using ${currentUsage}. This organization is approaching its hard limit of ${hardLimit}. If it exceeds the hard limit of ${hardLimit}, RSC will be unable to perform snapshot backups for this organization's objects on the cluster. Reduce your disk usage to avoid future disruptions.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

TenantQuotaSoftLimitResolved

```text
The organization ${orgName} has successfully reduced its disk usage on cluster ${clusterName} to below the soft quota limit.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## orion

______________________________________________________________________

OrionThreatFeedEntryDisabled

```text
Threat feed entry for ${entryDetails} has been disabled by ${userEmail}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

OrionThreatFeedEntryEnabled

```text
Threat feed entry for ${entryDetails} has been enabled by ${userEmail}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## threat_feed

______________________________________________________________________

DownloadThreatFeedFailure

```text
Unable to download threat feed version: ${version}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

DownloadThreatFeedSuccess

```text
Successfully downloaded threat feed version: ${version}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

NewThreatIntelFailure

```text
Failed to ingest intel from ${provider} because of ${failureReason}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

NewThreatIntelSuccess

```text
New threat intel includes ${iocsAndProviders}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ThreatMonitoringHashCatalogAnalysisFailed

```text
Unable to perform full Threat Monitoring hash analysis with Threat Feed  Version ${hashTfVersion}. Found file hash matches for ${numFilesWithMatches} files.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Failure** | **No** |

ThreatMonitoringHashCatalogAnalysisMatchesFound

```text
Completed full Threat Monitoring hash analysis with Hash Threat Feed  Version ${hashTfVersion}. Found file hash matches for ${numFilesWithMatches} files.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Success** | **No** |

ThreatMonitoringHashCatalogAnalysisNoMatchesFound

```text
Completed full Threat Monitoring hash analysis with Hash Threat Feed  Version ${hashTfVersion}. No matches found.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## radar

______________________________________________________________________

RadarThreatHuntCancelled

```text
${user} canceled the threat hunt '${huntName}' started on ${huntDate}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RadarThreatHuntCsvDownload

```text
${user} started a CSV download of threat hunt '${huntName}' created on ${huntDate}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RadarThreatHuntStarted

```text
${user} started an advanced threat hunt '${huntName}' on ${huntDate}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

RadarTurboThreatHuntStarted

```text
${user} started a fast turbo-charged threat hunt '${huntName}' on ${huntDate}.
```

Severity | Status | Audit Event | |

|          |             |         |
| -------- | ----------- | ------- |
| **Info** | **Success** | **Yes** |

## threat_hunt

______________________________________________________________________

ThreatHuntAborted

```text
Threat hunt ${huntName} was aborted due to file match limit exceeded. Start a threat hunt with narrower IOCs or lower number of objects to have the file match count within the allowed limit.
```

Severity | Status | Audit Event | |

|              |              |        |
| ------------ | ------------ | ------ |
| **Critical** | **Canceled** | **No** |

ThreatHuntCanceled

```text
Threat hunt ${huntName} was canceled.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

ThreatHuntFailed

```text
Threat hunt ${huntName} failed to complete. Reason: ${reason}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ThreatHuntInProgress

```text
Started scanning the object snapshots.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

ThreatHuntPartiallySucceeded

```text
Threat hunt ${huntName} partially succeeded with ${objSucceeded}  objects successful, ${objPartiallySucceeded} objects partially  successful, and ${objFailed} objects failing. There were  ${objectMatches} object matches and ${fileMatches} file  matches.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ThreatHuntStarted

```text
${userEmail} initiated ${huntType} threat hunt: ${huntName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ThreatHuntSucceeded

```text
Threat hunt ${huntName} completed successfully for all the objects.  There were ${objectMatches} object matches and ${fileMatches} file  matches.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

## threat_monitoring

______________________________________________________________________

ThreatMonitoringAnalysisFailed

```text
Failed to run Threat Monitoring analysis of snapshot taken on ${snapshotDate} of '${snappableName}': ${failureReason}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

ThreatMonitoringAnalysisStarted

```text
Started Threat Monitoring analysis of snapshot taken on ${snapshotDate} of '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ThreatMonitoringAnalysisSucceeded

```text
Completed Threat Monitoring analysis of snapshot taken on ${snapshotDate} of '${snappableName}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ThreatMonitoringFullAnalysisFailed

```text
Failed to run a full Threat Monitoring analysis on '${snappableName}'  using Threat Feed ${threatFeedType}: ${failureReason}.
```

Severity | Status | Audit Event | |

|             |             |        |
| ----------- | ----------- | ------ |
| **Warning** | **Failure** | **No** |

ThreatMonitoringFullAnalysisStarted

```text
Started a full Threat Monitoring analysis on ${snappableName}'  using Threat Feed: ${threatFeedType}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ThreatMonitoringFullAnalysisSucceeded

```text
Completed full Threat Monitoring analysis on '${snappableName}' using Threat Feed: ${threatFeedType}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

ThreatMonitoringFullHashAnalysisMatchesFound

```text
Completed full Threat Monitoring hash analysis on '${snappableName}' using Hash Threat Feed version ${hashTfVersion}. Found ${numHashMatches} hash matches.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskSuccess** | **No** |

ThreatMonitoringFullHashAnalysisNoMatchesFound

```text
Completed full Threat Monitoring hash analysis on '${snappableName}' using Hash Threat Feed version ${hashTfVersion}. No matches found.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ThreatMonitoringFullYaraAnalysisMatchesFound

```text
Completed full Threat Monitoring YARA analysis on  '${snappableName}' using Threat Feed version ${yaraTfVersion}.  Found ${numYaraRuleMatches} YARA rule matches.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskSuccess** | **No** |

ThreatMonitoringFullYaraAnalysisNoMatchesFound

```text
Completed full Threat Monitoring YARA analysis on '${snappableName}' using YARA Threat Feed version ${yaraTfVersion}.  No matches found.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ThreatMonitoringHashMatchesFound

```text
Found file hash matches for ${numFilesWithMatches} files.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskSuccess** | **No** |

ThreatMonitoringNoHashMatchesFound

```text
Found no file hash matches.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ThreatMonitoringNoYaraMatchesFound

```text
Found no YARA rule matches.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ThreatMonitoringYaraError

```text
Error while analyzing YARA rule matches: ${failureReason}.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskFailure** | **No** |

ThreatMonitoringYaraMatchesFound

```text
Found ${numYaraRuleMatches} YARA rule matches.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskSuccess** | **No** |

## app_failover

______________________________________________________________________

BlueprintFailoverTestDataIngestionFailed

```text
'${dataIngestionOperation}' process for test failover failed for Recovery Plan '${name}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

BlueprintFailoverTestDataIngestionStarted

```text
Starting the '${dataIngestionOperation}' process for test failover for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverTestDataIngestionSucceed

```text
'${dataIngestionOperation}' process for test failover succeeded for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverTestFinalizeFailed

```text
Final failover tasks failed for test failover of Recovery Plan '${name}': ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

BlueprintFailoverTestFinalizeStarted

```text
Starting the final failover tasks for test failover of Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverTestFinalizeSucceed

```text
Failover succeeded for failover of Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

BlueprintFailoverTestIncrementalDataTransferFailed

```text
Incremental data transfer process for test failover failed for Recovery Plan '${name}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

BlueprintFailoverTestIncrementalDataTransferStarted

```text
Starting the incremental data transfer process for test failover for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverTestIncrementalDataTransferSucceed

```text
Incremental data transfer process for test failover succeeded for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverTestPrepareDataFailed

```text
Test failover initialization process failed for Recovery Plan '${name}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

BlueprintFailoverTestPrepareDataStarted

```text
Starting the test failover initialization process for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverTestPrepareDataSucceed

```text
Test failover initialization process succeeded for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverTestPrepareResourceFailed

```text
Test failover resource validation and initialization process failed for Recovery Plan '${name}'. Reason: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

BlueprintFailoverTestPrepareResourceStarted

```text
Starting the test failover resource validation and initialization process for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverTestPrepareResourceSucceed

```text
Test failover resource validation and initialization process succeeded for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverTestProvisionFailed

```text
Unable to set up the target Rubrik cluster '${targetClusterName}' for test failover of Recovery Plan '${name}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

BlueprintFailoverTestProvisionStarted

```text
Setting up the target Rubrik cluster '${targetClusterName}' for test failover of Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverTestProvisionSucceed

```text
Reconfiguration of virtual machines on target Rubrik cluster '${targetClusterName}' succeeded for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintFailoverTestProvisionSucceedWithNetworkReconfigureFailure

```text
Reconfiguration of virtual machines on target Rubrik cluster '${targetClusterName}' failed for Recovery Plan '${name}'. Ignoring and continuing.
```

Severity | Status | Audit Event | |

|             |                 |        |
| ----------- | --------------- | ------ |
| **Warning** | **TaskSuccess** | **No** |

BlueprintTestFailoverCanceled

```text
Canceled test failover Recovery Plan '${name}' to '${location}'.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

BlueprintTestFailoverCanceling

```text
Canceling test failover for Recovery Plan '${name}' to '${location}'.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

BlueprintTestFailoverFailed

```text
Failed to test failover for Recovery Plan '${name}' to '${location}': ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

BlueprintTestFailoverScheduled

```text
Scheduled job to test failover Recovery Plan '${name}' to '${location}'.
```

Severity | Status | Audit Event | |

|          |            |        |
| -------- | ---------- | ------ |
| **Info** | **Queued** | **No** |

BlueprintTestFailoverStarted

```text
Starting test failover for Recovery Plan '${name}' to '${location}'. Failover error handling option is set to ${errorHandling}. Skipping network reconfiguration errors is ${skipNetworkError}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

BlueprintTestFailoverSuccess

```text
Successfully completed the test failover for Recovery Plan '${name}' to '${location}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CleanupTestFailoverCanceled

```text
Canceled the test failover cleanup for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |              |        |
| -------- | ------------ | ------ |
| **Info** | **Canceled** | **No** |

CleanupTestFailoverCanceling

```text
Canceling the test failover cleanup for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |               |        |
| -------- | ------------- | ------ |
| **Info** | **Canceling** | **No** |

CleanupTestFailoverFailed

```text
Failed to cleanup test failover for Recovery Plan '${name}' with ${reason}.
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CleanupTestFailoverStarted

```text
Started cleanup of test failover for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CleanupTestFailoverSuccess

```text
Successfully completed the test failover cleanup for Recovery Plan '${name}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CleanupTestFailoverTaskFailed

```text
Failed to cleanup Recovery Plan ${name}: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

CleanupTestFailoverTaskFailedWithUserComment

```text
Failed to cleanup Recovery Plan ${name}. ${comment}: ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

CleanupTestFailoverTaskStarted

```text
Started the cleanup for Recovery Plan '${name}'
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

CleanupTestFailoverTaskSucceed

```text
Successfully completed the cleanup of Recovery Plan ${name}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CleanupTestFailoverTaskSucceedWithUserComment

```text
Successfully completed the cleanup of Recovery Plan '${name}'. ${comment}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

SyncTestFailbackTaskFailed

```text
Test failover failed on cluster '${clusterName}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

SyncTestFailbackTaskSucceed

```text
Test failover succeeded on cluster '${clusterName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

TriggerTestFailbackTaskFailed

```text
Failed to trigger test failover for Recovery Plan to the point in time: ${recoveryPoint} on cluster '${clusterName}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

TriggerTestFailbackTaskFailedWithTimeRange

```text
Failed to trigger test failover for Recovery Plan to the point in time: range from ${startTime} to ${endTime}, on cluster '${clusterName}': ${reason}.
```

Severity | Status | Audit Event | |

|              |                 |        |
| ------------ | --------------- | ------ |
| **Critical** | **TaskFailure** | **No** |

TriggerTestFailbackTaskStarted

```text
Test failover for Recovery Plan to the point in time: ${recoveryPoint} triggered on cluster '${clusterName}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

TriggerTestFailbackTaskStartedWithTimeRange

```text
Test failover for Recovery Plan to the point in time: range from ${startTime} to ${endTime}, triggered on cluster '${clusterName}'.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Running** | **No** |

TriggerTestFailbackTaskSucceed

```text
Triggered a test failover for Recovery Plan to the point in time: ${recoveryPoint} on cluster '${clusterName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

TriggerTestFailbackTaskSucceedWithTimeRange

```text
Triggered a test failover for Recovery Plan to the point in time: range from ${startTime} to ${endTime}, on cluster '${clusterName}'.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

## cdm_upgrade

______________________________________________________________________

CdmClusterUpgraded

```text
Rubrik cluster ${clusterName} upgraded from version ${fromVersion} to ${version}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CdmUpgradeFailed

```text
Failed to upgrade ${clusterName} from version ${fromVersion} to ${version}. Error: ${errorMessage}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CdmUpgradeInitFailed

```text
Failed to initiate cluster upgrade for ${clusterName} from version ${fromVersion} to ${version}. Error: ${errorMessage}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CdmUpgradeInitiated

```text
Initiated cluster upgrade for ${clusterName} from version ${fromVersion} to ${version}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CdmUpgradePrechecksFailed

```text
Upgrade prechecks failed for ${clusterName} from version ${fromVersion} to ${version}. Error: ${errorMessage}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CdmUpgradePrechecksSucceeded

```text
Successfully completed upgrade prechecks for ${clusterName} from version ${fromVersion} to ${version}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CdmUpgradeRollbackFailed

```text
Failed to rollback the upgrade for ${clusterName} from version ${fromVersion} to ${version}. Error: ${errorMessage}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

CdmUpgradeRollbackSucceeded

```text
Successfully rolled back the upgrade for ${clusterName} to ${version}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CdmUpgradeStatus

```text
Current state name: ${currentStateName} | Pending states: ${pendingStates} | Finished states: ${finishedStates} | Current states: ${currentTaskName} | Overall progress: ${overallProgress}%%
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CdmUpgradeSucceeded

```text
Successfully upgraded ${clusterName} from version ${fromVersion} to ${version}.
```

Severity | Status | Audit Event | |

|          |             |        |
| -------- | ----------- | ------ |
| **Info** | **Success** | **No** |

CdmUpgradeTriggered

```text
Triggered cluster upgrade for ${clusterName} with mode ${mode} from version ${fromVersion} to ${version} on node ${nodeId}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

CdmUpgradeTriggerFailed

```text
Failed to trigger cluster upgrade for ${clusterName} with mode ${mode} from version ${fromVersion} to ${version} on node ${nodeId}. Error: ${errorMessage}
```

Severity | Status | Audit Event | |

|              |             |        |
| ------------ | ----------- | ------ |
| **Critical** | **Failure** | **No** |

ResumeRollbackTriggered

```text
Triggered ${action} for upgrade on ${clusterName}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskSuccess** | **No** |

ResumeRollbackTriggerFailed

```text
Failed to trigger ${action} for upgrade on ${clusterName}. Error: ${ErrorMessage}
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskFailure** | **No** |

UpgradeAlreadyInProgress

```text
Could not trigger upgrade as an upgrade is already running for ${clusterName} with mode ${mode} using tarball ${tarball}.
```

Severity | Status | Audit Event | |

|          |                 |        |
| -------- | --------------- | ------ |
| **Info** | **TaskFailure** | **No** |

## Workload Metrics

Common workload metrics can include storage usage, compliance status, last backup time, protection status, and more.

```graphql
query {
  snappableConnection(filter: {
    #complianceStatus: IN_COMPLIANCE
    #slaTimeRange: LAST_24_HOURS
    #objectType: VmwareVirtualMachine 
    #objectState: ACTIVE
    #slaDomain: {id: "0000"}
    #protectionStatus: DoNotProtect
  }) {
    nodes {
      name
      fid
      location
      objectType
      objectState
      protectionStatus
      lastSnapshot
      latestReplicationSnapshot
      complianceStatus
      replicationComplianceStatus
      archivalComplianceStatus
      usedBytes
      localStorage
      localEffectiveStorage
      replicaStorage
      archiveStorage
      logicalBytes
      physicalBytes
      provisionedBytes
      totalSnapshots
      localSnapshots
      localOnDemandSnapshots
      localSlaSnapshots
      replicaSnapshots
      archiveSnapshots
      dataReduction
      slaDomain {
        name
        id
      }
      cluster {
        name
        id
      }
      workloadOrg {
        fullName
        id
      }
    }
  }
}
```

```powershell
Get-RscWorkload
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { snappableConnection(filter: { }) { nodes { name fid location objectType objectState protectionStatus lastSnapshot latestReplicationSnapshot complianceStatus replicationComplianceStatus archivalComplianceStatus usedBytes localStorage localEffectiveStorage replicaStorage archiveStorage logicalBytes physicalBytes provisionedBytes totalSnapshots localSnapshots localOnDemandSnapshots localSlaSnapshots replicaSnapshots archiveSnapshots dataReduction slaDomain { name id } cluster { name id } workloadOrg { fullName id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```


## Retrieving M365 Organizations

```graphql
query {
  o365Orgs {
    nodes {
      name
      id
      tenantId
      exocomputeId
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery o365Orgs
$query.invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { o365Orgs { nodes { name id tenantId exocomputeId } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving M365 Mailboxes

```graphql
query {
    o365Mailboxes(o365OrgId: "0876804E-1CB1-4F28-BCB3-B4390C15FA1F") {
    nodes {
      name
      id
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery o365Mailboxes
$query.var.o365OrgId = "0876804E-1CB1-4F28-BCB3-B4390C15FA1F"
$query.invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { o365Mailboxes(o365OrgId: \\\"0876804E-1CB1-4F28-BCB3-B4390C15FA1F\\\") { nodes { name id effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving M365 OneDrives

```graphql
query {
    o365Onedrives(o365OrgId: "0876804E-1CB1-4F28-BCB3-B4390C15FA1F") {
    nodes {
      name
      id
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery o365Onedrives
$query.var.o365OrgId = "0876804E-1CB1-4F28-BCB3-B4390C15FA1F"
$query.invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { o365Onedrives(o365OrgId: \\\"0876804E-1CB1-4F28-BCB3-B4390C15FA1F\\\") { nodes { name id effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving M365 Teams

```graphql
query {
    o365Teams(o365OrgId: "0876804E-1CB1-4F28-BCB3-B4390C15FA1F") {
    nodes {
      name
      id
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery o365Teams
$query.var.o365OrgId = "0876804E-1CB1-4F28-BCB3-B4390C15FA1F"
$query.invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { o365Teams(o365OrgId: \\\"0876804E-1CB1-4F28-BCB3-B4390C15FA1F\\\") { nodes { name id effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving M365 Sites

```graphql
query {
    o365Sites(o365OrgId: "0876804E-1CB1-4F28-BCB3-B4390C15FA1F") {
    nodes {
      name
      id
      effectiveSlaDomain {
        name
        id
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery o365Sites
$query.var.o365OrgId = "0876804E-1CB1-4F28-BCB3-B4390C15FA1F"
$query.invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { o365Sites(o365OrgId: \\\"0876804E-1CB1-4F28-BCB3-B4390C15FA1F\\\") { nodes { name id effectiveSlaDomain { name id } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Global Certificates

```graphql
query { 
    globalCertificates {
    nodes {
        status
        certificate
        certificateFid
        certificateId
        description
        expiringAt
        hasKey
        isCaSigned
        issuedBy
        issuedOn
        issuedTo
        name
        serialNumber
        sha1Fingerprint
        sha256Fingerprint
        cdmUsages {
            type
            clusterName
            clusterUuid
        }
        clusters {
            cdmCertUuid
        }
        org {
            id
            name
        }
        usages {
            type
        }
    }
    pageInfo {
        endCursor
        hasNextPage
        hasPreviousPage
        startCursor
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery globalCertificates
$query.Var.input = Get-RscType -Name GlobalCertificatesQueryInput
$query.Field.Nodes = @(Get-RscType -Name GlobalCertificate -InitialProperties `
    certificate,`
    certificateId,`
    certificateFid,`
    clusters.cdmCertUuid,cluster.clusterUuid,isTrusted,name,`
    description,`
    expiringAt,`
    hasKey,`
    isCaSigned,`
    issuedBy,`
    issuedOn,`
    issuedTo,`
    name,`
    serialNumber,`
    sha1FingerPrint,`
    sha256Fingerprint,`
    status,`
    cdmUsages.type,cdmUsages.clusterUuid,cdmUsages.clusterName,`
    usages.type,`
    org.name,org.id
)
$query.Invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { globalCertificates { nodes { status certificate certificateFid certificateId description expiringAt hasKey isCaSigned issuedBy issuedOn issuedTo name serialNumber sha1Fingerprint sha256Fingerprint cdmUsages { type clusterName clusterUuid } clusters { cdmCertUuid } org { id name } usages { type } } pageInfo { endCursor hasNextPage hasPreviousPage startCursor } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

Rubrik Threat Analytics provides services to discover and identify malware, anomalies and other potential Indicators of Compromise (IOC). Identifying threats within protected data speeds up cyber recovery by identifying restore points that are free from common malware file signatures and content that is specified via YARA rule.

## [Anomaly Detection](Anomaly-Detection/)

Anomaly Detection automatically scans snapshots for suspicious data changes based on previous snapshots. Anomaly Detection is passive and does not require any user intervention to run.

## [Threat Hunting](Threat-Hunting/)

Threat Hunting provides advanced investigation of snaphots for specific file hashes, file patterns, and YARA rules provided by the user. Threat Hunts are defined and initiated by the user.

## [Threat Monitoring](Threat-Monitoring/)

Threat Monitoring automatically scans each snapshot for file hashes that have a match in a threat feed. When enabled, Threat Monitoring is passive and does not require any user intervention to run.

## Retrieving Workload Anomalies

```graphql
query {
  workloadAnomalies(beginTime: "2025-08-15T00:00:00.000Z") {
    nodes {
      workloadName
      workloadFid
      anomalousSnapshotDate
      anomalousSnapshotFid
      previousSnapshotFid
      objectType
      anomalyType
      suspiciousFileCount
      anomalyInfo {
        strainAnalysisInfo {
          strainId
          totalAffectedFiles
        }
      }
      encryption
      severity
      resolutionStatus
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery workloadAnomalies -AddField Nodes.workloadName, `
    Nodes.workloadFid, `
    Nodes.anomalousSnapshotDate, `
    Nodes.anomalousSnapshotFid, `
    Nodes.previousSnapshotFid, `
    Nodes.objectType, `
    Nodes.anomalyType, `
    Nodes.suspiciousFileCount, `
    Nodes.anomalyInfo.strainAnalysisInfo.strainId, `
    Nodes.anomalyInfo.strainAnalysisInfo.totalAffectedFiles, `
    Nodes.encryption, `
    Nodes.severity, `
    Nodes.resolutionStatus
$query.field.Count = $null
$query.var.beginTime = "2025-08-15T00:00:00.000Z"
$query.invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { workloadAnomalies(beginTime: \\\"2025-08-15T00:00:00.000Z\\\") { nodes { workloadName workloadFid anomalousSnapshotDate anomalousSnapshotFid previousSnapshotFid objectType anomalyType suspiciousFileCount anomalyInfo { strainAnalysisInfo { strainId totalAffectedFiles } } encryption severity resolutionStatus } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Threat Hunts

```graphql
query {
  threatHunts(
    matchesFoundFilter: [NO_MATCHES,MATCHES_FOUND,UNSCANNED]
    #quarantinedMatchesFilter: [QUARANTINED_MATCHES,NO_QUARANTINED_MATCHES]
    #clusterUuidFilter: "00000000-0000-0000-0000-000000000000"
    #statusFilter: [PENDING,CANCELED,ABORTED,FAILED,IN_PROGRESS,SUCCEEDED,PARTIALLY_SUCCEEDED]
    #beginTime: "1900-01-01T00:00:00.000Z"
    #endTime: "1900-01-01T00:00:00.000Z"
  ) {
    nodes {
      name
      huntId
      createdBy {
        username
        email
      }
      huntDetails {
        startTime
        endTime
        config {
          name
          notes
          objects {
            name
            id
            objectType
          }
          requestedMatchDetails {
            requestedHashTypes
          }
          clusterUuid
          fileScanCriteria {
            fileSizeLimits {
              maximumSizeInBytes
              minimumSizeInBytes
            }
            fileTimeLimits {
              earliestCreationTime
              latestCreationTime
              earliestModificationTime
              latestModificationTime
            }
            pathFilter {
              includes
              excludes
              exceptions
            }
          }
          snapshotScanLimit {
            maxSnapshotsPerObject
            snapshotsToScanPerObject {
              id
              snapshots
            }
          }
          indicatorsOfCompromise {
            iocKind
            iocValue
            threatFamily
          }
          maxMatchesPerSnapshot
          shouldTrustFilesystemTimeInfo
        }
      }
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery threatHunts
$query.Var.beginTime = "2025-07-04T00:00:00.000Z"
$query.Var.endTime = "1900-01-01T00:00:00.000Z"
$query.Var.matchesFoundFilter = @(
    [RubrikSecurityCloud.Types.ThreatHuntMatchesFound]::MATCHES_FOUND
    [RubrikSecurityCloud.Types.ThreatHuntMatchesFound]::NO_MATCHES
    [RubrikSecurityCloud.Types.ThreatHuntMatchesFound]::UNSCANNED
)
$query.Var.quarantinedMatchesFilter = @(
    [RubrikSecurityCloud.Types.ThreatHuntQuarantinedMatchType]::QUARANTINED_MATCHES
    [RubrikSecurityCloud.Types.ThreatHuntQuarantinedMatchType]::NO_QUARANTINED_MATCHES
)
$query.Var.statusFilter = @(
    [RubrikSecurityCloud.Types.ThreatHuntStatus]::ABORTED
    [RubrikSecurityCloud.Types.ThreatHuntStatus]::CANCELED
    [RubrikSecurityCloud.Types.ThreatHuntStatus]::FAILED
    [RubrikSecurityCloud.Types.ThreatHuntStatus]::IN_PROGRESS
    [RubrikSecurityCloud.Types.ThreatHuntStatus]::PARTIALLY_SUCCEEDED
    [RubrikSecurityCloud.Types.ThreatHuntStatus]::SUCCEEDED
    [RubrikSecurityCloud.Types.ThreatHuntStatus]::PENDING
)
$query.field.nodes = @(
    Get-RscType -Name ThreatHunt -InitialProperties `
    name,`
    huntId,`
    startTime,`
    status,`
    HuntType,`
    createdBy.username, createdBy.email,`
    huntDetails.startTime,`
    huntDetails.endTime,`
    huntDetails.config.name,`
    huntDetails.config.notes,`
    huntDetails.config.requestedMatchDetails.requestedHashTypes,`
    huntDetails.config.clusterUuid,`
    huntDetails.config.maxMatchesPerSnapshot,`
    huntDetails.config.shouldTrustFilesystemTimeInfo
)

$query.invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { threatHunts( matchesFoundFilter: [NO_MATCHES,MATCHES_FOUND,UNSCANNED] ) { nodes { name huntId createdBy { username email } huntDetails { startTime endTime config { name notes objects { name id objectType } requestedMatchDetails { requestedHashTypes } clusterUuid fileScanCriteria { fileSizeLimits { maximumSizeInBytes minimumSizeInBytes } fileTimeLimits { earliestCreationTime latestCreationTime earliestModificationTime latestModificationTime } pathFilter { includes excludes exceptions } } snapshotScanLimit { maxSnapshotsPerObject snapshotsToScanPerObject { id snapshots } } indicatorsOfCompromise { iocKind iocValue threatFamily } maxMatchesPerSnapshot shouldTrustFilesystemTimeInfo } } } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```

## Retrieving Threat Monitoring Results

```graphql
query {
  threatMonitoringMatchedObjects(
    beginTime: "2025-07-01"
    # objectTypeFilter: "VmwareVirtualMachine"
    ) {
    nodes {
      objectName
      objectFid
      objectType
      filesMatched
      matchType
    }
  }
}
```

```powershell
$query = New-RscQuery -GqlQuery threatMonitoringMatchedObjects -AddField Nodes.MatchType, Nodes.FilesMatched, Nodes.LastDetection, Nodes.ObjectName
$query.field.Count = $null
$query.var.beginTime = "2025-08-15T00:00:00.000Z"
$query.invoke().nodes
```

```bash
#!/bin/bash

# RSC_TOKEN="YOUR_RSC_ACCESS_TOKEN"
query="query { threatMonitoringMatchedObjects( beginTime: \\\"2025-07-01\\\" ) { nodes { objectName objectFid objectType filesMatched matchType } } }"

# Execute the GraphQL query with curl
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $RSC_TOKEN" \
  -d "{\"query\": \"$query\"}" \
  https://example.my.rubrik.com/api/graphql
```