> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abbyy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security event log

> Enable the security event log in the FlexiCapture database to record permission, user, and group changes in the dbo.SecurityEventLog table for audits.

The security event log records events related to adding, deleting, and changing user permissions, which helps you carry out security audits. It is compatible with all database servers supported by ABBYY FlexiCapture: Microsoft SQL Server, Azure SQL, Oracle, and PostgreSQL.

## Enable the security event log

Security event logging is disabled by default. Only the System Administrator can enable it, directly in a FlexiCapture database.

For the default tenant, add the following to the `Settings` table of the FlexiCapture database:

```text theme={null}
[db_name].[dbo].[Settings]
Name = LogSecurityEvents
Value = True
TenantId = Null
```

For custom tenants, turn on the second bit in the `Flags` field of the tenant's record in the `Tenant` table. For example, in Microsoft SQL Server, use the statement `Update Tenant set Flags = Flags | 2 where Id = NNN;`.

## Logged events

Once security event logging is enabled, events are recorded in the `dbo.SecurityEventLog` table in the ABBYY FlexiCapture database. Each event is identified by its `SecurityEventTypeId` value.

| Event                        | ID | Description                                      |
| :--------------------------- | :- | :----------------------------------------------- |
| UserCreated                  | 0  | A user was created                               |
| UserDeleted                  | 1  | A user was deleted                               |
| GroupCreated                 | 2  | A group was created                              |
| GroupDeleted                 | 3  | A group was deleted                              |
| PermissionAdded              | 4  | A permission was added                           |
| PermissionDeleted            | 5  | A permission was deleted                         |
| AddToGroup                   | 6  | A user was added to a group                      |
| RemoveFromGroup              | 7  | A user was removed from a group                  |
| UserPasswordChanged          | 8  | A user password was changed                      |
| GroupModified                | 9  | Group permissions or membership were modified    |
| UserPasswordReset            | 10 | A user password was reset                        |
| TenantCreated                | 11 | A tenant was created                             |
| TenantDeleted                | 12 | A tenant was deleted                             |
| ProjectDeleted               | 13 | A project was deleted                            |
| ProjectChanged               | 14 | A project was changed                            |
| BatchTypeCreated             | 15 | A batch type was created                         |
| BatchTypeDelete              | 16 | A batch type was deleted                         |
| BatchTypeChanged             | 17 | A batch type was changed                         |
| TemplateCreated              | 18 | A document definition was created                |
| TemplateDelete               | 19 | A document definition was deleted                |
| TemplateChanged              | 20 | A document definition was changed                |
| ProjectHotFolderEnable       | 21 | A project hot folder was enabled                 |
| ProjectHotFolderDiable       | 22 | A project hot folder was disabled                |
| ManualCleanUpStart           | 23 | A manual cleanup was started                     |
| CleanUpEnable                | 24 | Automatic cleanup was enabled                    |
| CleanUpDisable               | 25 | Automatic cleanup was disabled                   |
| AuditingConfigurationChanged | 26 | The security event log configuration was changed |

## Event attributes

Each logged event can have the following attributes:

| Attribute      | Description                                                     |
| :------------- | :-------------------------------------------------------------- |
| Date           | The date and time of the event                                  |
| Writer         | The user that made the change                                   |
| WriterTenantId | The ID of the tenant of the user that made the change           |
| Principal      | The ID of the user or group affected by the event               |
| TenantId       | The ID of the tenant that the affected user or group belongs to |
| Details        | Additional information about the event                          |
| RemoteHost     | The IP address of the computer used to make the change          |