Security
Security logs and alerts help you to keep your Workplace community safe. Find out more about security by visiting the Customer Resource Center.
Workplace Logs are a hub for all security events and data. Below is a list of all the events we currently record, alongside an explanation of the event that's occurred.
| Event Name | Note |
| Logged in | A user has successfully logged in using either password or SSO. |
| Login Failed | A user has unsuccessfully tried to log in. |
| Logged out | A user has logged out. |
| Password Changed | A user has changed their Workplace password. |
| Password Reset Succeeded | A user has reset their Workplace password by setting a new password. |
| Password Reset Code Requested | A user's Workplace password has been requested for reset through the self-service flow. |
| Password Reset Incorrect Code | The verification code required to reset a user's Workplace password has been entered incorrectly. |
| Account at Risk | We've found a user whose account is at risk. Learn more on how to identify accounts at risk. |
| Account Set To Unclaimed | An admin or integration has set a user to unclaimed. |
| Forced Logout | An admin has forced a user to log out via the admin panel. |
| Account Deactivated | A user has been deactivated through an admin or an integration. |
| Account Activated | A user has been activated through an admin or an integration. |
| Account Deleted | A user account has been deleted. |
| Forced Password Reset | An admin has forced a user's password to be reset before next login. |
| Account Created | A user account has been created by an admin. |
| Accounts Created | An admin has created user accounts with the excel import method. |
| Admin Role Changed | An admin account has had its role modified. |
| Admin Removed | A user account has had its admin role removed. |
| Admin Created | A user account has been created through the Administrators section and has been promoted to an admin role. |
| Account Promoted to Admin | An existing user has been promoted to admin. |
| Email Changed | A user's email has been edited. |
| Domain Added | A domain has been added to the verification table, but has not been verified yet. |
| Domain Verified | A domain has been verified successfully. Learn more on domain verification. |
| Domain Removed | A domain has been removed from Workplace. |
| Two-Factor Authentication Enabled | A user has self-enrolled in two-factor authentication. Learn more on how this is enabled. |
| Two-Factor Authentication Disabled | A user has disabled their two-factor authentication. |
| Phone Number Added | A user has added a phone number against their account. |
| Two-Factor Code Entry Succeeded | A user has successfully entered in their two-factor authentication code when prompted on our desktop or mobile site. |
| Two-Factor Code Entry Failed | A user has unsuccessfully entered in their two-factor authentication code when prompted on our desktop or mobile site. |
| Two-Factor Code Entry Succeeded On Mobile App | A user has successfully entered in their two-factor authentication code when prompted on either our Android or iOS app. |
| Two-Factor Code Entry Failed On Mobile App | A user has unsuccessfully entered in their two-factor authentication code when prompted on either our Android or iOS app. |
| Group File Downloaded | A file has been downloaded from a group. |
| Group File Uploaded | A file has been uploaded to a group. Learn more on how to upload a file to a group. |
| Malware Suspected in File | A file has been suspected of having malware and has been blocked from being uploaded to a group. |
| Integration Created | A custom integration has been created. |
| Integration Edited | A custom integration has been edited. |
| Integration Deleted | A custom integration has been deleted. |
| Integration Added | An app from the integration directory has been added. |
| Integration Removed | A integration directory app has been removed. |
| Multi-Company Group Created | A multi-company group has been created. |
| Joined Multi-Company Group | A user has joined a multi-company group. |
| Created users via IDP Sync | Users have been created via a connected identity provider (Azure or G Suite). |
| Created Users via Coworker Invite | Users have been created through invites initiated by other community members. |
| Invited Coworker | Users have been invited through invites initiated by other community members. They're only created once they accept the invite. |
| Compromised Credentials Found | An account was found to have compromised credentials for username/password authentication. |
| Company Marked as Resold | |
| Malware Upload Blocked | A malware found in a file upload was blocked. |
| Profile Data Download Requested | A user put in a request to download their data. |
| Report Former Employee | Persisted events from former employee reports. These are only persisted events for reports received by users of Workplace Essential. |
| Reseller Added | Enabled insights tab for non-admin user. |
| Reseller Removed | Disabled insights tab for non-admin user. |
| Reseller Invite Sent | A company has been invited to be linked |
| Reseller Invite Accepted | Invited company to be linked has accepted the invite |
| Reseller Invite Declined | Invited company to be linked has declined the invite |
| Self Invite Created | A user created their account using self-invite. |
| SSO Reauthentication | An admin requested SSO Reauthentication from their users. |
| Two-Factor Authentication Enabled | Two-factor authentication was enabled for a user. |
| Two-Factor Code Entry Failed | A two-factor authentication code entry failed upon validation. |
| Two-Factor Code Entry Failed On Mobile App | A two-factor authentication code entry failed upon validation on the mobile app. |
| Two-Factor Code Entry Succeeded | A two-factor authentication code entry succeeded upon validation. |
| Two-Factor Code Entry Succeeded On Mobile App | A two-factor authentication code entry succeeded upon validation on mobile app. |
| User Invited | A two-factor authentication code entry succeeded upon validation on the mobile app. |
| Integration Access Token Reset | An integration access token was reset. |
| Profile Data Downloaded | A user downloaded their data. |
| Two-Factor Authentication Disabled | Two-factor authentication was disabled for an user. |
| Reported Content | A user has reported a post for the admin to review. |
| Video Downloaded |
Admins can save the searches they make in the Security Log. To save a search:
- From your Admin Panel, click Security.
- Select Log.
- Type in your search criteria and select Save Search.
- Saved Searches appear on the right side of the page.
This article is only applicable to community admins on Workplace Advanced
We'll let you know if we suspect that some of the user accounts in your community may be at risk. You'll receive a notification that says a security risk has been detected, and the dashboard in your Security tab will show at risk accounts. Given that there's a small risk that an attacker could use password information to access your Workplace community, we recommend that you disable these users or force them to reset their passwords.
To see which accounts may be at risk:
- Click Admin Panel at the top-left of your home page.
- Click People.
The Security tab in your Admin Panel gathers all the information regarding your community's security into one place, making it easier to access and oversee. The tab combines a Security Log and Authentication, and the Dashboard provides you with an overview of your community's security activity and your Security Health score.
To access the Security tab:
- Click Admin Panel at the top-left of Workplace on your computer.
- Click Security.
- Click Log at the top of the page. From there, you can view all login, password, admin, file and integration activity from the past 90 days.
The Authentication tab allows you to decide how members of your community can log in (ex. by password or SSO).
The Security Health score takes into account various pieces of information about your community's security activities.
To see your Security Health score:
- From a computer, go to your Workplace homepage and then open the Admin Panel.
- Click Security.
The overall security level is based on the security events of the last 30 days and the security features you've set up as well as any security threats we've detected. We'll notify you about issues that need your attention. Learn more about what information you can find in the Security tab.
