---
title: "runZero events"
lastmodexempt: true
---

runZero records system events for administrative actions, alert rule processing, scans, Explorers, API activity, and more. Use an event action below as the trigger for an [alert rule](rules-engine.md), or search for it in the [audit log](managing-your-team.md#audit-log).

**207** events available for alert rules.

### Inventory queries (post-task)

| Event action | Target type | Description |
|--------------|-------------|-------------|
| `asset-query-results` | asset | Run an asset inventory query against the site after analysis completes. |
| `certificate-query-results` | certificate | Run a certificate inventory query against the site after analysis completes. |
| `group-query-results` | asset | Run a group inventory query against the site after analysis completes. |
| `service-query-results` | asset | Run a service inventory query against the site after analysis completes. |
| `software-query-results` | asset | Run a software inventory query against the site after analysis completes. |
| `user-query-results` | asset | Run a user inventory query against the site after analysis completes. |
| `vulnerability-query-results` | asset | Run a vulnerability inventory query against the site after analysis completes. |
| `wireless-query-results` | asset | Run a wireless inventory query against the site after analysis completes. |

### Asset changes (post-task)

| Event action | Target type | Description |
|--------------|-------------|-------------|
| `assets-back-online` | asset | Assets back online. |
| `assets-changed` | asset | Assets changed. |
| `assets-now-offline` | asset | Assets now offline. |
| `new-assets-found` | asset | New assets found. |

### Explorer and scan events

| Event action | Target type | Description |
|--------------|-------------|-------------|
| `agent-diagnostics-updated` | agent | Explorer diagnostics are updated. |
| `agent-forget-all` | organization | All inactive explorers are deleted. |
| `agent-offline` | organization | An explorer goes offline for more than 30 minutes. This event repeats every four hours for offline explorers. |
| `agent-organization-reassigned` | agent | An explorer is reassigned to a different organization. |
| `agent-reconnected` | organization | An explorer that was offline reconnects. |
| `agent-registered` | organization | A new explorer registers with runZero. |
| `agent-removed` | agent | An explorer is removed from the account. |
| `agent-removed-all` | organization | All explorers are removed from an organization. |
| `agent-removed-multiple` | organization | Multiple explorers are removed from an organization. |
| `agent-set-tags-multiple` | agent | Explorer tags are updated. |
| `agent-settings-updated` | agent | Explorer settings are updated. |
| `agent-site-assigned-all` | organization | All explorers are automatically assigned to sites. |
| `agent-software-updated` | agent | Explorer software is updated. |
| `agent-software-updated-all` | organization | All explorer software for an organization is updated. |
| `agent-software-updated-multiple` | agent | Explorer software update is manually triggered for multiple explorers. |
| `agent-updated` | organization | An explorer has changed its network configuration. |
| `speedtest-completed` | agent | A speed test completed. |
| `speedtest-deleted` | explorer-report | A speed test report was deleted by the user. |
| `speedtest-started` | agent | A speed test was manually scheduled by the user. |
| `task-failed` | site | A scan task fails to complete. |

### Security-related events

| Event action | Target type | Description |
|--------------|-------------|-------------|
| `auth-login-link-completed` | user | A one-time login link is used successfully. |
| `auth-login-link-request` | user | A user requests a login link. |
| `auth-mfa-added` | user | Multi-factor authentication credentials are added to a user account. |
| `auth-mfa-removed` | user | Multi-factor authentication credentials are removed from a user account. |
| `auth-password-reset-completed` | user | A password reset is completed successfully. |
| `auth-password-reset-request` | user | A user requests a password reset. |
| `client-switched` | client | A user switches to a different account. |
| `credential-created` | credential | A set of credentials is created. |
| `credential-removed` | credential | A set of credentials is removed. |
| `credential-updated` | credential | A set of credentials is updated. |
| `group-created` | group | A new group is created. |
| `group-mapping-created` | group-mapping | A new group mapping is created. |
| `group-mapping-removed` | group-mapping | A group mapping is removed. |
| `group-mapping-updated` | group-mapping | A group mapping is updated. |
| `group-removed` | group | A group is removed. |
| `group-updated` | group | A group's information is updated. |
| `login` | client | A user logs in. |
| `login-failed` | client | A user fails to login. |
| `login-mfa` | client | A user logs in using multi-factor authentication. |
| `login-sso` | client | A user logs in using SSO. |
| `login-sso-begin` | client | A user begins logging in using SSO. |
| `login-sso-enroll` | client | A new user is created via SSO enrollment. |
| `role-created` | role | A custom role is created. |
| `role-deleted` | role | A custom role is deleted. |
| `role-updated` | role | A custom role's name, description or permissions are changed. |
| `sso-settings-updated` | client | The SSO settings are changed. |
| `sso-user-activated` | client | An SSO user activated with runZero. |
| `user-activated` | client | An external user activated with runZero. |
| `user-added-to-group` | group | A user is added to a group. |
| `user-demoted` | user | A user is demoted from superuser |
| `user-invite-current` | user | A user is invited to join the current organization. |
| `user-invite-external` | user | An external user is invited to join a team. |
| `user-invite-resent` | user | A user invitation is resent. |
| `user-invite-restricted` | user | A user is invited to join a team with restricted permissions. |
| `user-invite-team` | user | A user is invited to join a team. |
| `user-mfa-reset` | user | A user resets their multi-factor authentication settings. |
| `user-password-reset` | user | A user resets their password. |
| `user-promoted` | user | A user is promoted to superuser. |
| `user-registered` | client | A new user registers with runZero. |
| `user-removed` | user | A user is deleted. |
| `user-removed-from-group` | group | A user is removed from a group. |
| `users-csv-import` | user | Multiple users are imported from a CSV file. |

### Risk management events

| Event action | Target type | Description |
|--------------|-------------|-------------|
| `findings-with-instances` | finding | Findings instances found or updated (triggered when results change). |
| `rapid-response-published` | query | A Rapid Response query is published or updated. |
| `rapid-response-with-matches` | query | Rapid Response matches are found (triggered when results change). |

### API-related events

| Event action | Target type | Description |
|--------------|-------------|-------------|
| `api-client` | client | A request was made to the Account API. |
| `api-client-created` | client | An API client is created. |
| `api-client-removed` | client | An API client is removed. |
| `api-client-secret-rotated` | client | The secret for an API client is rotated. |
| `api-client-updated` | client | An API client is updated. |
| `api-export` | organization | A request was made to the Export API. |
| `api-mcp-session-active` | client | An MCP session made calls or changed address (periodic summary). |
| `api-mcp-session-ended` | client | An MCP session ended or went idle. |
| `api-mcp-session-started` | client | An MCP client connected with an API key or API client. |
| `api-organization` | organization | A request was made to the Organization API. |
| `client-api-key-created` | client | A client API key is created. |
| `client-api-key-removed` | client | A client API key is deleted. |
| `client-api-key-rotated` | client | The secret for a client API key is rotated. |
| `custom-asset-source-created` | custom-asset-source | A custom asset source is created. |
| `custom-asset-source-removed` | custom-asset-source | A custom asset source is removed. |
| `custom-asset-source-updated` | custom-asset-source | A custom asset source is updated. |
| `mcp-oauth-consent-approved` | client | A user authorized an MCP client, creating an API client. |
| `mcp-oauth-consent-denied` | client | A user refused an MCP client's request for access. |
| `organization-api-key-created` | organization | An organization API key is created. |
| `organization-api-key-removed` | organization | An organization API key is removed. |
| `organization-api-key-rotated` | organization | The secret for an organization API key is rotated. |
| `organization-download-token-reset` | organization | The download token for an organization is reset. |
| `organization-export-token-created` | organization | An export token for an organization is created. |
| `organization-export-token-removed` | organization | The export token for an organization is removed. |
| `organization-export-token-reset` | organization | The export token for an organization is reset. |

### All other events

| Event action | Target type | Description |
|--------------|-------------|-------------|
| `account-ai-settings-updated` | account | Account AI (LLM) provider configuration is updated. |
| `account-settings-updated` | account | Account settings are updated. |
| `ai-budget-exceeded` | account | An AI daily limit was reached (platform token allowance, or a per-day input/output token cap) for the account or an organization. |
| `ai-budget-warning` | account | AI usage crossed the daily-limit warning threshold (75% of the platform token allowance or a token cap) for the account or an organization. |
| `ai-report-generated` | organization | An AI report (deep analysis, organization report, or chat answer) was generated. |
| `alert-acknowledge` | organization | An alert is acknowledged (cleared). |
| `alert-acknowledge-all` | organization | All alerts are acknowledged (cleared). |
| `alert-channel-created` | organization | An alert channel is created. |
| `alert-channel-removed` | organization | An alert channel is removed. |
| `alert-channel-updated` | organization | An alert channel is updated. |
| `alert-clear-all` | organization | All alerts for an organization are cleared. |
| `alert-rule-created` | organization | An alert rule is created. |
| `alert-rule-removed` | organization | An alert rule is removed. |
| `alert-rule-updated` | organization | An alert rule is updated. |
| `alert-template-created` | organization | An alert template is created. |
| `alert-template-removed` | organization | An alert template is removed. |
| `alert-template-updated` | organization | An alert template is updated. |
| `asset-clear-tags-multiple` | organization | Tags are cleared on multiple assets at once. |
| `asset-csv-import` | organization | Asset information is exported as CSV. |
| `asset-fingerprint-submitted` | asset | An asset fingerprint is submitted to runZero, Inc. |
| `asset-merge-multiple` | organization | Multiple assets are merged into a single asset. |
| `asset-owners-removed` | asset | Asset owners are removed. |
| `asset-owners-updated` | asset | Asset owners are updated. |
| `asset-removed` | asset | An asset is deleted. |
| `asset-removed-multiple` | organization | Multiple assets are deleted from an organization. |
| `asset-set-comments` | asset | A comment is set on an asset. |
| `asset-set-comments-multiple` | organization | A comment is set on multiple assets at once. |
| `asset-set-criticality` | asset | Criticality is set on an asset. |
| `asset-set-criticality-multiple` | organization | Criticality is set on multiple assets at once. |
| `asset-set-risk-multiple` | organization | Risk is set on multiple assets at once. |
| `asset-set-tags` | asset | Tags are set on assets. |
| `asset-set-tags-multiple` | organization | Tags are set on multiple assets at once. |
| `assets-expired` | organization | One or more assets have expired and have been removed. |
| `assets-purged` | organization | All asset data is deleted from an organization. |
| `directory-group-removed-multiple` | directory-group | Directory groups are been removed from the directory groups inventory. |
| `directory-user-removed-multiple` | directory-user | Directory users are been removed from the directory users inventory. |
| `findings-suppressed` | finding | Findings were suppressed. |
| `findings-unsuppressed` | finding | Findings were unsuppressed. |
| `goal-completed` | client | A goal is completed. |
| `goal-created` | organization | A goal is created. |
| `goal-lapsed` | client | A goal is no longer completed. |
| `goal-removed` | organization | A goal is removed. |
| `goal-updated` | organization | A goal is updated. |
| `insight-clear` | insight | A computed insight result is cleared. |
| `insight-clear-all` | insight | All computed insight results are cleared. |
| `instance-registered` | client | A new self-hosted instance has been registered. |
| `issue-closed` | issue | An issue is closed. |
| `issue-opened` | issue | An issue is opened. |
| `issue-status-updated` | issue | An issue's status is updated. |
| `issues-overdue` | issue | One or more open issues are past their due date. |
| `issues-reoccurred` | issue | One or more issues have recently re-occurred. |
| `license-changed` | client | The runZero license entitlement changes. |
| `license-limit-exceeded` | client | The asset count has exceeded the runZero license limit. |
| `nessus-import` | organization | Nessus data is imported. |
| `nexpose-import` | organization | Nexpose data is imported. |
| `org-ai-settings-updated` | organization | Organization AI (LLM) provider configuration is updated. |
| `organization-created` | client | A new organization is created. |
| `organization-purged` | organization | All assets for an organization are purged. |
| `organization-removed` | client | An organization is deleted. |
| `organization-updated` | organization | An organization is modified. |
| `ownership-type-created` | client | An ownership type is created. |
| `ownership-type-removed` | client | An ownership type is removed. |
| `ownership-type-updated` | client | An ownership type is updated. |
| `packet-import` | organization | Pcap data is imported. |
| `query-created` | client | A saved query is created. |
| `query-imported` | client | A saved query is imported. |
| `query-removed` | client | A saved query is deleted. |
| `query-updated` | client | A saved query is modified. |
| `report-removed` | report | A computed insight report is removed. |
| `scan-completed` | asset | Scan completed. |
| `scan-created` | site | A new scan task is created. |
| `scan-import` | organization | Scan data is imported. |
| `scan-template-created` | client | A scan template is created. |
| `scan-template-removed` | client | A scan template is removed. |
| `scan-template-updated` | client | A scan template is updated. |
| `scan-updated` | site | A scan task is modified. |
| `service-removed-multiple` | organization | Multiple service records are deleted. |
| `site-created` | organization | A new site is created. |
| `site-imported` | organization | Site data is imported as CSV. |
| `site-removed` | organization | A site is deleted. |
| `site-updated` | site | A site is updated. |
| `software-removed-multiple` | organization | Multiple software records are deleted. |
| `task-completed` | site | A scan task completes. |
| `task-created` | task | A task is created. |
| `task-hidden` | task | A (failed) task is hidden. |
| `task-last-started-ts-cleared` | task | A task's last started at timestamp is cleared. |
| `task-paused` | task | A task is paused. |
| `task-reprocessed` | task | A completed task is queued to have its data processed again. |
| `task-started` | site | A task is started. |
| `task-stopped` | task | A task is stopped. |
| `task-stopped-all` | organization | All tasks are stopped. |
| `task-unpaused` | task | A task is unpaused. |
| `user-password-disabled` | user | A user disabled password authentication. |
| `user-settings-updated` | user | A user updates their settings. |
| `user-unlocked` | user | A user's account is unlocked. |
| `user-updated` | user | A user's information is updated. |
| `vulnerabilities-suppressed` | vulnerabilities | Vulnerabilities were suppressed. |
| `vulnerabilities-unsuppressed` | vulnerabilities | Vulnerabilities were unsuppressed. |
| `vulnerability-groups-suppressed` | vulnerability-groups | Vulnerability groups were suppressed. |
| `vulnerability-groups-unsuppressed` | vulnerability-groups | Vulnerability groups were unsuppressed. |
| `vulnerability-owners-removed` | vulnerability | Vulnerability owners are removed. |
| `vulnerability-owners-updated` | vulnerability | Vulnerability owners are updated. |
| `vulnerability-set-risk` | organization | Risk is set on a vulnerability. |
| `vulnerability-set-risk-multiple` | organization | Risk is set on multiple vulnerabilities at once. |
| `wireless-removed-multiple` | organization | Multiple discovered wireless LANs are deleted. |