15.1 Severity and categories
Severity
Every audit record gets a severity, computed on the server from its event name. Severity tells you how quickly someone should look; category (below) tells you what kind of event it is. When an event belongs to several groups, the highest severity wins.
| Severity | Meaning | Events (summary) |
|---|---|---|
| Critical | Protection was attacked or lost — someone should look now. | Office add-in switch-off blocked or attempted
(addin_disable_blocked,
addin_disable_attempt), agent file missing
(agent_binary_missing), agent unprotected
(agent_unprotected), failed uninstall attempt
(uninstall_attempt_failed), tampering detected
(tamper_detected), screen overlay stopped
(overlay_stopped), agent authentication rejected
(agent_auth_rejected). |
| High | Policy stopped an action, a label was removed, or a console sign-in failed. | Every blocking event (save/send/print/copy/attachment/downgrade
blocked, send blocked because content must be masked),
admin_login_failed, admin_session_ip_blocked,
label_removed, file_label_unregistered,
file_label_denied. |
| Medium | Needs attention, nothing lost. | Content masked or masking pending, warning acknowledged (user
continued), label downgraded, add-in put back, agent file restored,
protection restored, uninstall token issued / authorised / completed,
server-held label reassigned, manifest download blocked by the
allow-list, stale agent request, auditor alert opt-in denied, stale
policy (agent_policy_stale). |
| Low | Normal work. | Labeling, recommendations, unlabeled-file findings, allowed sends/prints, warnings shown or cancelled. |
| Informational | Administration and system events, and any event the product does not classify. | Sign-ins, publishes, configuration changes, backups, reports, licence, health events. |
The same colours are used everywhere: the Overview severity tiles, the coloured strip on every Audit Log row, the Severity column of the Audit Log Extract and the severity chart in reports.
Top-bar critical counter. The top bar of every page shows N new critical (or No new critical). It counts critical events since you last opened the Audit Log from that chip. Clicking it opens the Audit Log filtered to Critical and resets your counter. The “seen up to” mark is stored per console user on the server.
The 12 categories
Categories are assigned by event name. They are used by the Audit Log category filter, the event-type picker, the Category column of exports and the “Records by category” table of the Audit Log Extract.
| Category (UI name) | What it contains |
|---|---|
| Labeling | A label was placed, changed, migrated, downgraded or removed:
label_applied*, label_migrated,
label_downgraded, label_removed,
agent_labeled, agent_upgraded,
file_label_registered,
file_label_unregistered, label_cancelled,
outlook_addin_installed. |
| Recommendations | An agent detected something and told the user, without forcing a
label: agent_recommendation, agent_unlabeled,
agent_prompted, content_warning_shown,
content_warning_cancelled. |
| Masking | content_masked, content_mask_pending,
mask_cancelled. |
| Printing | Allowed prints that leave a trace: print_traced,
print_logged. Print blocks stay under
Blocking. |
| Screen watermark | watermark_shown,
screen_capture_protected. |
| AI classification | ai_shadow_match (a rule in test mode matched) and the
console AI actions ai_type_created/changed/deleted,
ai_example_added/deleted,
ai_training_completed/failed,
ai_document_tested. |
| Blocking | enforce_blocked, save_blocked_*,
send_blocked_*, print_blocked_*,
copy_blocked_policy, downgrade_blocked,
content_mask_blocked. |
| Allowed activity | Actions that passed a gate and only leave a trace:
send_allowed, send_allowed_exception,
copy_justified,
content_warning_acknowledged. |
| Agent operations | agent_command_done, agent_command_failed,
scan_completed, agent_skipped_too_large,
agent_skipped_unprocessable,
agent_unlabeled_reported, agent_online,
agent_offline, foreign_label_seen. |
| Security | Tamper and access-control events (all Critical events above plus
agent_policy_stale, addin_reenabled,
agent_binary_restored,
agent_protection_restored, uninstall_*,
agent_request_stale, file_label_denied,
file_label_reassigned,
admin_session_ip_blocked,
auditor_alert_optin_denied,
manifest_ip_blocked, admin_login_failed). |
| Administration | Every event generated by the server itself (console actions,
sign-ins, publishes, backups, reports, licence, certificates, health)
that is not Security or AI. Any event whose name starts with
admin_, policy_, license_,
tls_, report_, backup_,
retention_, service_, installer_,
ad_connection_ and similar belongs here. |
| Other | Anything not matched above. |