Type

event.type enum

The type of an Event. Types coincide with Levels and Recommendations.

Configure the Event types you receive and the criteria under which they are triggered in Dashboard under Setup > Policies.

Possible values

For convenience, we have noted the Level of each type next to its value.

BAD_ACTOR CRITICAL

User's IP has been recognized as a bad actor.

BAD_DEVICE CRITICAL

User's account is being accessed from a device was previously rejected by the user.

FAILED_LOGINS_EXCEEDED CRITICAL

User has exceeded the max failed logins within a given time period.

IMPOSSIBLE_TRAVEL CRITICAL

User could not have traveled between two received locations at a realistic speed.

NEW_DEVICE WARNING

User is on a device we've never seen before.

NEW_LOCATION WARNING

User is at a location we've never seen them at before (city or region).

VPN_SWITCH WARNING

User is using a VPN provider that they haven't used before.

TOR_SWITCH WARNING

We haven't seen this user on Tor network, but now they are on it.

CARRIER_SWITCH WARNING

User is on a mobile carrier network that they haven't used before (only triggered along with NEW_DEVICE or IMPOSSIBLE_TRAVEL).

IP_MANY_IDENTITIES WARNING

Many different users have logged into your app from the same IP.

IP_SIMILARITY WARNING

User's IP address is numerically dissimilar from others they have used.

COMPROMISED_PASSWORD WARNING

User logged into an account using a known compromised password while using Chrome browser or ChromeOS (via Google Workspace integration).

NEW_IDENTITY INFO

We created a new DFend Identity for one of your users.

IDENTITY_OPTED_IN INFO

A user has opted into DFend (and added contact information for verifications).

IDENTITY_OPTED_OUT INFO

A user has opted out of DFend.

USER_INVOLVEMENT_RESPONSE INFO

User has responded to a verification request using a DFend embedded link.

USER_INVOLVEMENT_EXPIRED INFO

User didn't respond in a given time period. Take further action.