Privacy Act of 1974; System of Records, 4964-4970 [2022-01064]
Download as PDF
4964
Federal Register / Vol. 87, No. 20 / Monday, January 31, 2022 / Notices
HISTORY:
May 10th, 2021; 86 FR 24907.
*
*
*
*
*
Joshua J. Hofer,
Attorney, Ethics and Legal Compliance.
[FR Doc. 2022–01062 Filed 1–28–22; 8:45 am]
BILLING CODE 7710–12–P
POSTAL SERVICE
Privacy Act of 1974; System of
Records
Postal ServiceTM.
Notice of a modified system of
AGENCY:
ACTION:
records.
The United States Postal
ServiceTM (USPSTM) is proposing to
modify a General Privacy Act System of
Records to support the implementation
of a suite of cloud-based workplace
productivity software.
DATES: These revisions will become
effective without further notice on
March 2, 2022, unless comments
received on or before that date result in
a contrary determination.
ADDRESSES: Comments may be
submitted via email to the Privacy and
Records Management Office, United
States Postal Service Headquarters
(privacy@usps.gov). Arrangements to
view copies of any written comments
received, to facilitate public inspection,
will be made upon request.
FOR FURTHER INFORMATION CONTACT:
Janine Castorina, Chief Privacy and
Records Management Officer, Privacy
and Records Management Office, 202–
268–3069 or privacy@usps.gov.
SUPPLEMENTARY INFORMATION: This
notice is in accordance with the Privacy
Act requirement that agencies publish
their systems of records in the Federal
Register when there is a revision,
change, or addition, or when the agency
establishes a new system of records.
khammond on DSKJM1Z7X2PROD with NOTICES
SUMMARY:
I. Background
The Postal Service is constantly
seeking methods to improve employee
productivity and efficiency. To that end,
the Postal Service will implement a
suite of cloud-based workplace
productivity applications. These
applications will expand employee
access to various programs, allowing
more employees to utilize resources to
increase productivity and team
collaboration.
II. Rationale for Changes to USPS
Privacy Act Systems of Records
The Postal Service is proposing to
modify USPS System of Records (SOR)
550.200 Commercial Information
VerDate Sep<11>2014
17:38 Jan 28, 2022
Jkt 256001
Technology Resources—Administrative
to support the implementation of a suite
of cloud-based workplace productivity
software. This system will be modified
in conjunction with USPS 550.000
Commercial Information Technology
Resources—Infrastructure and USPS
550.100 Commercial Information
Technology Resources—Applications to
reflect the full scope of application
implementation. Revisions to these
SORs will be submitted independent of
this notice. More information on
accompanying changes can be found
within those SORs.
This system specifically reflects data
elements created from a user or
application’s interactions with other
applications. Revisions to the existing
SOR to support this implementation are
documented as additions to existing
category of records Video Platform
Activities beginning with ‘‘Video
Platform Event Date,’’ and further as
new categories of records 80 through
102.
III. Description of the Modified System
of Records
Pursuant to 5 U.S.C. 552a(e)(11),
interested persons are invited to submit
written data, views, or arguments on
this proposal. A report of the proposed
revisions has been sent to Congress and
to the Office of Management and Budget
for their evaluations. The Postal Service
does not expect this amended system of
records to have any adverse effect on
individual privacy rights. The notice for
550.200 Commercial Information
Technology Resources—Administrative,
provided below in its entirety, is as
follows:
SYSTEM NAME AND NUMBER:
550.200 Commercial Information
Technology Resources—Administrative.
SECURITY CLASSIFICATION:
None.
SYSTEM LOCATION:
All USPS facilities and contractor
sites.
SYSTEM MANAGER(S):
For records of computer access
authorizations: Chief Information
Officer and Executive Vice President,
United States Postal Service, 475
L’Enfant Plaza SW, Washington, DC
20260.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
39 U.S.C. 401, 403, and 404.
PURPOSE(S) OF THE SYSTEM:
1. To provide active and passive
monitoring and review of information
system applications and user activities.
PO 00000
Frm 00133
Fmt 4703
Sfmt 4703
2. To generate logs and reports of
information system application and user
activities.
3. To provide a means of auditing
commercial information system
activities across applications and users.
CATEGORIES OF INDIVIDUALS COVERED BY THE
SYSTEM:
1. Individuals with authorized access
to USPS computers, information
resources, and facilities, including
employees, contractors, business
partners, suppliers, and third parties.
2. Individuals participating in webbased meetings, web-based video
conferencing, web-based
communication applications, and webbased collaboration applications.
CATEGORIES OF RECORDS IN THE SYSTEM:
1. General Audit Log activities:
DateTime, IP Address, User Activity,
User Item Accessed, Activity Detail,
Object ID, Record Type, Client IP
Address, CorrelationID, CreationTime,
EventData, EventSource, ItemType,
OrganizationID, UserAgent, USerKEy,
UserType, Version, Workload.
2. File and page activities: Accessed
file, Change retention label for a file,
Deleted file marked as a record,
Checked in file, Changed record status
to locked, Changed record status to
unlocked, Checked out file, Copied file,
Discarded file checkout, Deleted file,
Deleted file from recycle bin, Deleted
file from second-stage recycle bin,
Detected document sensitivity
mismatch, Detected malware in file,
Deleted file marked as a record,
Downloaded file, Modified file, Moved
file, Recycled all minor versions of file,
Recycled all versions of file, Recycled
version of file, Renamed file, Restored
file, Uploaded file, Viewed page, View
signaled by client, Performed search
query.
3. Folder activities: Copied folder,
Created folder, Deleted folder, Deleted
folder from recycle bin, Deleted folder
from second-stage recycle bin, Modified
folder, Moved folder, Renamed folder,
Restored folder.
4. Cloud-based Enterprise Storage
activities: Created list, Created list
column, Created list content type,
Created list item, Created site column,
Created site content type, Deleted list,
Deleted list column, Deleted list content
type, Deleted list item, Deleted site
column, Deleted site content type,
Recycled list item, Restored list,
Restored list item, Updated list,
Updated list column, Updated list
content type, Updated list item,
Updated site column, Updated site
content type.
5. Sharing and access request
activities: Added permission level to
E:\FR\FM\31JAN1.SGM
31JAN1
khammond on DSKJM1Z7X2PROD with NOTICES
Federal Register / Vol. 87, No. 20 / Monday, January 31, 2022 / Notices
site collection, Accepted access request,
Accepted sharing invitation, Blocked
sharing invitation, Created access
request, Created a company shareable
link, Created an anonymous link,
Created secure link, Deleted secure link,
Created sharing invitation, Denied
access request, Removed a company
shareable link, Removed an anonymous
link, Shared filer, folder, or site,
Unshared file folder or site, Updated
access request, Updated an anonymous
link, Updated sharing invitation, Used a
company shareable link, Used an
anonymous link, Used secure link, User
added to secure link, User removed
from secure link, Withdrew sharing
invitation.
6. Synchronization activities: Allowed
computer to sync files, Blocked
computer from syncing files,
Downloaded files to computer,
Downloaded file changes to computer,
Uploaded files to document library,
Uploaded file changes to document
library.
7. Site permissions activities: Added
site collection admin, Added user of
group to Cloud-based Enterprise Storage
group, Broke permission level
inheritance, Broke sharing inheritance,
Created group, Deleted group, Modified
access request setting, Modified
‘‘Members Can Share’’ setting, Modified
permission level on site collection,
Modified site permissions, Removed site
collection admin, Removed permission
level from site collection, Removed user
or group from Cloud-based Enterprise
Storage group, Requested site admin
permissions, Restored sharing
inheritance, Updated group.
8. Site administration activities:
Added allowed data location, Added
exempt user agent, Added geo location
admin, Allowed user to create groups,
Cancelled site geo move, Changed a
sharing policy, Changed deice access
policy, Changed exempt user agents,
Changed network access policy,
Completed site geo move, Created Sent
To connection, Created site collection,
Deleted orphaned hub site, Deleted Sent
To connection, Deleted site, Enabled
document preview, Enabled legacy
workflow, Enabled Office on Demand,
Enabled result source for People
Searched, Enabled RSS feeds, Failed site
swap, Joined site to hub site, Registered
hub site, Removed allowed data
location, Removed geo location admin,
Renamed site, Scheduled site rename,
Scheduled site swap, Scheduled site geo
move, Set host site, Set storage quota for
geo location, Swapped site, Unjoined
site from hub site, Unregistered hub site.
9. Cloud-based Email Server mailbox
activities: Created mailbox item, Copied
messages to another folder, User signed
VerDate Sep<11>2014
17:38 Jan 28, 2022
Jkt 256001
in to mailbox, Accessed mailbox items,
Sent message using Send On Behalf
permissions, Purged messages from
mailbox, Moved messages to Deleted
Items folder, Moved messages to another
folder, Sent message using Send As
permissions, Sent message, Updated
message, Deleted messages from Deleted
Items folder, New-Inbox Rule CreateInbox Rule from email web application,
Set-Inbox Rule Modify inbox rule from
email web application, Update inbox
rules from email web application,
Added delegate mailbox permissions,
Removed delegate mailbox permissions,
Added permissions to folder, Modified
permissions of folder, Removed
permissions from folder, Added or
removed user with delegate access to
calendar folder, Labeled message as a
record.
10. Retention policy and retention
level activities: Created retention label,
Created retention policy, Configured
settings for a retention policy, Deleted
retention label, Deleted retention policy,
Deleted settings from a retention policy,
Updated retention label, Updated
retention policy, Updated settings for a
retention policy, Enabled regulatory
record option for retention labels.
11. User administration activities:
Added user, Deleted user, Set license
properties, Reset user password,
Changed user password, Changed user
license, Updated user, Set property that
forces user to change password.
12. Enterprise User Administration
group administration activities: Added
group, Updated group, Deleted group,
Added member to group, Removed
member from group.
13. Application administration
activities: Added service principal,
Removed a service principal from the
directory, Set delegation entry,
Removed credentials from a service
principal, Added delegation entry,
Added credentials to a service principal,
Removed delegation entry.
14. Role administration activities:
Added member to Role, Removed a user
from a directory role, Set company
contact information.
15. Directory administration
activities: Added a partner to the
directory, Removed a partner from the
directory, Added domain to company,
Removed domain from company,
Updated domain, Set domain
authentication, Verified domain,
Updated the federation settings for a
domain, Verified email verified domain,
Turned on Enterprise Information
Technology Account Administration
sync, Set password policy, Set company
information.
16. eDiscovery activities: Created
content search, Deleted content search,
PO 00000
Frm 00134
Fmt 4703
Sfmt 4703
4965
Changed content search, Started content
search, Stopped content search, Started
export of content search, Started export
report, Previewed results of content
search, Purged results of content search,
Started analysis of content search,
Removed export of content search,
Removed preview results of content
search, Removed purse action
performed on content search, Removed
analysis of content search, Removed
search report, Content search preview
item listed, Content search preview item
viewed, Content search preview item
downloaded, Downloaded export of
content search, Created search
permissions filter, Deleted search
permissions filter, Changed search
permissions filter, Created hold in
eDiscovery case, Deleted hold in
eDiscovery case, Changed hold in
eDiscovery case, Created eDiscovery
case, Deleted hold in eDiscovery case,
Changed hold in eDiscovery case,
Created eDiscovery case, Deleted
eDiscovery data, Changed hold in
eDiscovery case, Added member to
eDiscovery case, Removed member from
eDiscovery case, Changed eDiscovery
case membership, Created eDiscovery
administrator, Deleted eDiscovery
administrator, Changed eDiscovery
administrator membership, Remediation
action created, Item deleted using
Remediation, Created workingset
search, Updated workingset search,
Deleted workingset search, Previewed
workingset search, Document viewed,
Document annotated, Document
downloaded, Tag created, Tag edited,
Tag deleted, Tag files, Tag job, Created
review set, Added Cloud-based
productivity software data, Added nonoffice data, Added data to another
workingset, Added remediated data,
Run algo job, Run export job, Run burn
job, Run error remediation job, Run load
comparison job, Updated case settings.
17. eDiscovery system command
activities: Created content search,
Deleted content search, Changed
content search, Started content search,
Stopped content search, created content
search action, Deleted content search
action, Created search permissions
filter, Deleted search permissions filter,
Changed search permissions filter,
Created hold in eDiscovery case,
Deleted hold in eDiscovery case,
Changed hold in eDiscovery case,
Created search query for eDiscovery
case hold, Deleted search query for
eDiscovery case hold, Changed search
query for eDiscovery case hold, Created
eDiscovery case, Deleted eDiscovery
case, Changed eDiscovery case, Added
member to eDiscovery case, Removed
member from eDiscovery case, Changed
E:\FR\FM\31JAN1.SGM
31JAN1
khammond on DSKJM1Z7X2PROD with NOTICES
4966
Federal Register / Vol. 87, No. 20 / Monday, January 31, 2022 / Notices
eDiscovery case membership, Created
eDiscovery administrator, Deleted
eDiscovery administrator, Changed
eDiscovery administrator membership.
18. Data Analysis application
activities: Viewed program dashboard,
Created program dashboard, Edited
program dashboard, Deleted program
dashboard, Shared program dashboard,
Printed program dashboard, Copied
program dashboard, Viewed program
tile, Exported program tile data, Viewed
program report, Deleted program report,
Printed program report page, Created
program report, Edited program report,
Copied program report, Exported
program artifact to another file format,
Export program activity events, Updated
program workspace access, Restored
program workspace, Updated program
workspace, Viewed program metadata,
Created program dataset, Deleted
program dataset, Created program
group, Deleted program group, Added
program group members, Retrieved
program groups, Retrieved program
dashboard, Retrieved data sources from
program dataset, Retrieved upstream
data flows from program dataflow,
Retrieved data sources from program
dataflow, Removed program group
members, Retrieved links between
datasets and dataflows, Created
organizational program content pack,
Created program app, Installed program
app, Updated program app, Updated
organization’s program settings, Started
program trial, Started program extended
trial, Analyzed program dataset, Created
program gateway, Deleted program
gateway, Added data source to program
gateway, Removed data source from
program gateway, Changed program
gateway admins, Changed program
gateway data source users, Set
scheduled refresh on program dataset,
Unpublished program app, Deleted
organizational program content pack,
Renamed program dashboard, Edited
program dataset, Updated capacity
display name, Changed capacity state,
Updated capacity admin, Changed
capacity user assignment, Migrated
workspace to a capacity, Removed
workspace from a capacity, Retrieved
program workspaces, Shared program
report, Generated program Embed
Token, Discover program dataset data
sources, Updated program dataset data
sources, Requested program dataset
refresh, Binded program dataset to
gateway, Changed program dataset data
sources, Requested program dataset
refresh, Binded program dataset to
gateway, Changed program dataset
connections, Took over program dataset,
Updated program gateway data source
credentials, Imported file to program,
VerDate Sep<11>2014
17:38 Jan 28, 2022
Jkt 256001
Updated program dataset parameters,
Generated program dataflow SAS token,
Created program dataflow, Updated
program dataflow, Deleted program
dataflow, Viewed program dataflow,
Exported program dataflow, Set
scheduled refresh on program dataflow,
Requested program dataflow refresh,
Received program dataflow secret from
Key Vault, Attached dataflow storage
account, Migrated dataflow storage
location, Updated dataflow storage
assignment permissions, Set dataflow
storage location for workspace, Took
ownership of program dataflow,
Canceled program dataflow refresh,
Created program email subscription,
Updated program email subscription,
Deleted program email subscription,
Created program folder, Deleted
program folder, Updated program
folder, Added program folder access,
Deleted program folder access, Updated
program folder access, Posted program
comment, Deleted program comment,
Analyzed program report, Viewed
program usage metrics, Edited program
dataset endorsement, Edited program
dataflow endorsement, Edited program
report endorsement, Edited program app
endorsement, Retrieved list of modified
workspaces in program tenant, Sent a
scan request in program tenant, Retrieve
scan result in program tenant, Inserted
snapshot for user in program tenant,
Updated snapshot for user in program
tenant, Deleted snapshot for user in
program tenant, Inserted snapshot for
user in program tenant, Updated
snapshot for user in program tenant,
Deleted snapshot for user in program
tenant, Retrieved snapshots for user in
program tenant, Edited program
certification permission, Took over a
program data source, Updated capacity
custom settings, Created workspace for
program template app, Deleted
workspace for program template app,
Updated settings for program template
app, Updated testing permissions for
program template app, Created program
template app, Deleted program template
app, Promoted program template app,
Installed program template app,
Updated parameters for installed
program template app, Created install
ticker for installing program template
app, Updated an organizational custom
visual, Created an organizational custom
visual, Deleted an organizational custom
visual, Custom visual requested
Enterprise Information Technology
Account Administration access token,
Customer visual requested Cloud-based
productivity software access token,
Connected to program dataset from
external app, Created program dataset
from external app, Deleted program
PO 00000
Frm 00135
Fmt 4703
Sfmt 4703
dataset from external app, Edited
program dataset from external app,
Requested program dataset refresh from
external app, Requested SAS token for
program storage, Requested account key
for program storage, Assigned a
workspace to a deployment pipeline,
Removed a workspace from a
deployment pipeline, Deleted
deployment pipeline, Created
deployment pipeline, Deployed to a
pipeline stage, Updated deployment
pipeline configuration, Updated
deployment pipeline access, Added
external resource, Added link to
external resource, Deleted link to
external resource, Updated featured
tables, Applied sensitivity label to
program artifact, Changed sensitivity
label for program artifact, Deleted
sensitivity label from program artifact.
19. Productivity Analysis activities:
Updated privacy setting, Updated data
access setting, Uploaded organization
data, Created meeting exclusion,
Updated preferred meeting exclusion,
Execute query, Canceled query, Deleted
result, Downloaded report, Accessed
Odata link, Viewed query visualization,
Viewed explore, Created partition,
Updated partition, Deleted partition,
User logged in, User logged out.
20. Briefing email activities: Updated
user privacy settings, Updated
organization privacy settings.
21. Cloud-based Collaboration
Application activities: Created team,
Deleted team, Added channel, Deleted
channel, Changed organization setting,
Changed team setting, Changed channel
setting, User signed in to Cloud-based
Collaboration Application, Added
members, Changed role of members,
Removed members, Added bot to team,
Removed bot from team, Added tab,
Removed tab, Updated tab, Added
connector, Removed connector,
Updated connector, Downloaded
analytics report, Upgraded Cloud-based
Collaboration Application device,
Blocked Cloud-based Collaboration
Application device, Unblocked Cloudbased Collaboration Application device,
Changed configuration of Cloud-based
Collaboration Application device,
Enrolled Cloud-based Collaboration
Application device, Installed app,
Upgraded app, Uninstalled app,
Published app, Updated app, Deleted
app, Deleted all organization apps,
Performed action on card, Added
scheduling group, Edited scheduling
group, Deleted scheduling group, Added
shift, Edited shift, Deleted shift, Added
time off, Edited time off, Deleted time
off, Added open shift, Edited open shift,
Deleted open shift, Shared schedule,
Clocked in using Time clock, Clocked
out using Time clock, Started break
E:\FR\FM\31JAN1.SGM
31JAN1
khammond on DSKJM1Z7X2PROD with NOTICES
Federal Register / Vol. 87, No. 20 / Monday, January 31, 2022 / Notices
using Time clock, Ended break using
Time clock, Added Time clock entry,
Edited Time clock entry, Deleted Time
clock entry, Added shift request,
Responded to shift request, Canceled
shift request, Changed schedule setting,
Added workforce integration, Accepted
off shift message.
22. Cloud-based Collaboration
Application approvals activities:
Created new approval request, Viewed
approval request details, Approved
approval request, Rejected approval
request, Canceled approval request,
Shared approval request, File attached
to approval request, Reassigned
approval request, Added e-signature to
approval request.
23. Enterprise Social Network
activities: Changed data retention
policy, Changed network configuration,
Changed network profile settings,
Changed private content mode, Changed
security configuration, Created file,
Created group, Deleted group, Deleted
message, Downloaded file, Exported
data, Shared file, Suspended network
user, Suspended user, Updated file
description, Updated file name, Viewed
file.
24. Enterprise Customer Relationship
Management activities: Accessed out-ofbox entity (deprecated), Accessed
custom entity (deprecated), Accessed
admin entity (deprecated), Performed
bulk actions (deprecated), All Enterprise
Customer Relationship Management
activities, Accessed Enterprise Customer
Relationship Management admin center
(deprecated), Accessed internal
management tool (deprecated), Signed
in or out (deprecated), Activated process
or plug-in (deprecated).
25. Information Systems
Infrastructure Automation activities:
Created flow, Edited flow, Deleted flow,
Edited flow permissions, Deleted flow
permissions, Started a Flow paid trial,
Renewed a Flow paid trial.
26. Application authoring program
activities: Created app, Edited app,
Deleted app, Launched app, Published
app, Marked app as Hero, Marked app
as Featured, Edited app permission,
Restored app version.
27. Enterprise Automation DLP
activities: Created DLP Policy, Updated
DLP Policy, Deleted DLP Policy.
28. Video platform activities: Created
video, Edited video, Deleted video,
Uploaded video, Downloaded video,
Edited video permission, Viewed video,
Shared video, Liked video, Unliked
video, Commented on video, Deleted
video comment, Uploaded video text
track, Deleted video text track,
Uploaded video thumbnail, Deleted
video thumbnail, Replaced video
permissions and channel links, Marked
VerDate Sep<11>2014
17:38 Jan 28, 2022
Jkt 256001
video public, Marked video private,
Created Video platform group, Edited
Video platform group, Deleted Video
platform group, Edited Video platform
group memberships, Created Video
platform channel, Edited Video platform
channel, Deleted a Video platform
channel, Replaced Video platform
channel thumbnails, Edited Video
platform user settings, Edited tenant
settings, Edited global role members,
Deleted Video platform user, Deleted
Video platform user’s data report,
Edited Video platform user, Exported
Video platform user’s data report,
Downloaded Video platform user’s data
report, Video Platform Event Date,
Video Platform Event Name, Video
Platform Event Description, Video
Platform Meeting Code, Video Platform
Participant Identifiers.
29. Content explorer activities:
Accessed item.
30. Quarantine activities: Previewed
Quarantine message, Deleted
Quarantine message, Released
Quarantine message, Exported
Quarantine message, Viewed
Quarantine Message’s header.
31. Customer Key Service Encryption
activities: Fallback to Availability Key
32. Form application activities:
Created form, Edited form, Moved form,
Deleted form, Viewed form, Previewed
form, Exported form, Allowed share
form for copy, Added form co-author,
Removed form co-author, Viewed
response page, Created response,
Updated response, Deleted all
responses, Deleted response, Viewed
responses, Viewed response, Created
summary link, Deleted summary link,
Updated from phishing status, Updated
user phishing status, Sent premium
form product invitation, Updated form
setting, Updated user setting, Listed
forms.
33. Sensitivity label activities:
Applied sensitivity label to site,
Removed sensitivity label from site,
Applied sensitivity label to file,
Changed sensitivity label applied to file,
Removed sensitivity label from file.
34. Local machine communications
platform system command activities: Set
tenant federation.
35. Search activities: Performed email
search, Performed Cloud-based
Enterprise Storage search.
36. Security analytics activities:
Attempted to compromise accounts.
37. Device activities: Printed file,
Deleted file, Renamed file, Created file,
Modified file, Read file, Captured
screen, Copied file to removable media,
Copied file to network share, Copied file
to clipboard, Uploaded file to cloud,
File accessed by an unallowed
application.
PO 00000
Frm 00136
Fmt 4703
Sfmt 4703
4967
38. Information barrier activities:
Removed segment from site, Changed
segment of site, Applied segment to site.
39. On-premises DLP scanning
activities: Matched DLP rule, Enforced
DLP rule.
40. Individual Productivity Analytics
activities: Updated user settings,
Updated organization settings.
41. Exact Data Match (EDM) activities:
Created EDM schema, Modified EDM
schema, Removed EDM scheme,
Completed EDM data upload, Failed
EDM data upload.
42. Enterprise Information System
Information Protection activities:
Accessed file, Discovered file, Applied
sensitivity label, Updated sensitivity
label, Removed sensitivity label,
Removed file, Applied protection,
Changed protection, Removed
protection, Received AIP heartbeat.
43. Data Repository Team Discussion
Post Actions: Team Discussion Post
Updated, Team Discussion Post
Destroyed.
44. Data Repository Team Discussion
Post Reply Actions: Team Discussion
Post Reply Updated, Team Discussion
Post Reply Destroyed.
45. Data Repository Enterprise
Actions: Self-Hosted Runner Removed,
Self-Hosted Runner Registered, SelfHosted Runner Group Created, SelfHosted Runner Group Removed, SelfHosted Runner Removed From Group,
Self-Hosted Runner Added To Group,
Self-Hosted Runner Group Member List
Updated, Self-Hosted Runner Group
Configuration Changed, Self-Hosted
Runner Updated.
46. Data Repository Hook Actions:
Hook Created, Hook Configuration
Changed, Hook Destroyed, Hook Events
Altered.
47. Data Repository Integration
Installation Request Actions: Integration
Installation Request Created, Integration
Installation Request Closed.
48. Data Repository Issue Action:
Issue Destroyed.
49. Data Repository Org Actions:
Secret Action Created, Member Creation
Disabled, Two Factor Authentication
Requirement Disabled, Member Creation
Enabled, Two Factor Authentication
Enabled, Member Invited, Self-Hosted
Runner Registered, Secret Action
Removed, Member Removed, Outside
Collaborator Removed, Self-Hosted
Runner Removed, Self-Hosted Runner
Group Created, Self-Hosted Runner
Group Removed, Self-Hosted Runner
Group Updated, Secret Action Updated,
Repository Default Branch Named
Updated, Default Repository Permission
Updated, Member Role Updated,
Member Repository Creation Permission
Updated.
E:\FR\FM\31JAN1.SGM
31JAN1
khammond on DSKJM1Z7X2PROD with NOTICES
4968
Federal Register / Vol. 87, No. 20 / Monday, January 31, 2022 / Notices
50. Data Repository Organization
Label Actions: Default Label Created,
Default Label Updated, Default Label
Destroyed.
51. Data Repository Oauth
Application Actions: Oauth Application
Created, Oauth Application Destroyed,
Oauth Application Secret Restet, Oauth
Application Token Revoked, Oauth
Application Transferred.
52. Data Repository Profile Picture
Actions: Organization Profile Picture
Updated.
53. Data Repository Project Actions:
Project Board Created, Project Board
Linked, Project Board Renamed, Project
Board Updated, Project Board Deleted,
Project Board Unlinked, Project Board
Permissions Updated, Project Board
Team Permissions Updated, Project
Board User Permission Updated.
54. Data Repository Protected Branch
Actions: Branch Protection Enabled,
Branch Protection Destroyed, Branch
Protection Enforced For Administrators,
Branch Enforcement Of Required Code
Owner Enforced, Stale Pull Request
Dismissal Enforced, Branch Commit
Signing Updated, Pull Request Review
Updated, Required Status Check
Updated, Requirement For Branch To
Be Up To Date Before Merging Changed,
Branch Update Attempt Rejected,
Branch Protection Requirement
Overridden, Force Push Enabled, Force
Push Disabled, Branch Deletion
Enabled, Branch Deletion Disabled,
Linear Commit History Enabled, Linear
Commit History Disabled.
55. Data Repository Repo Actions:
User Visibility Changed, Actions
Enabled For Repository, Collaboration
Member Added, Topic Added To
Repository, Repository Archived,
Anonymous Git Read Access Disabled,
Anonymous Git Read Access Enabled,
Anonymous Git Read Access Setting
Locked, Anonymous Git Read Access
Setting Unlocked, New Repository
Created, Secret Created For Repository,
Repository Deleted, Repository Enabled,
Secret Removed, User Removed, SelfHosted Runner Registered, Topic
Removed From Repository, Repository
Renamed, Self-Hosted Runner Updated,
Repository Transferred, Repository
Transfer Started, Repository
Unarchived, Secret Action Updated.
56. Data Repository Dependency
Graph Actions: Dependency Graph
Disabled, Dependency Graph Disabled
For New Repository, Dependency Graph
Enabled, Dependency Graph Enabled
For New Repository.
57. Data Repository Secret Scanning
Actions: Secret Scanning Disabled For
Individual Repository, Secret Scanning
Disabled For All Repositories, Secret
Scanning Disabled For New
VerDate Sep<11>2014
17:38 Jan 28, 2022
Jkt 256001
Repositories, Secret Scanning Enabled
For Individual Repository, Secret
Scanning Enabled For All Repositories,
Secret Scanning Enabled For New
Repositories.
58. Data Repository Vulnerability
Alert Actions: Vulnerable Dependency
Alert Created, Vulnerable Dependency
Alert Dismissed, Vulnerable
Dependency Alert Resolved.
59. Data Repository Team Actions:
Member Added To Team, Repository
Added To Team, Team Parent Changed,
Team Privacy Level Changed, Team
Created, Member Demoted In Team,
Team Destroyed, Member Promoted In
Team, Member Removed From Team,
Repository Removed From Team.
60. Data Repository Team Discussion
Actions: Team Discussion Disabled,
Team Discussion Enabled.
61. Data Repository Workflow
Actions: Workflow Run Cancelled,
Workflow Run Completed, Workflow
Run Created, Workflow Run Deleted,
Workflow Run Rerun, Workflow Job
Prepared.
62. Data Repository Account Actions:
Billing Plan Change, Plan Change,
Pending Plan Change, Pending
Subscription Change.
63. Data Repository Advisory Credit
Actions: Accept Credit, Create Credit,
Decline Credit, Destroy Credit.
64. Data Repository Billing Actions:
Change Billing Type, Change Email.
65. Data Repository Bot Alerts
Actions: Disable Bot, Enable Bot.
66. Data Repository Bot Alerts for
New Repository Actions: Disable Alerts,
Enable Alerts.
67. Data Repository Bot Security
Alerts for Update Actions: Disable
Security Update Alerts, Enable Security
Update Alerts.
68. Data Repository Bot Security
Alerts for New Repository Actions:
Disable New Repository Security Alerts,
Enable New Repository Security Alerts.
69. Data Repository Environment
Actions: Create Actions Secret, Delete,
Remove Actions Secret, Update Actions
Secret.
70. Data Repository Git Actions:
Clone, Fetch, Push.
71. Data Repository Marketplace
Agreement Signature Actions: Create.
72. Data Repository Marketplace
Listing Actions: Approve, Create, Delist,
Redraft, Reject.
73. Data Repository Members Can
Create Pages Actions: Enable, Disable.
74. Data Repository Organization
Credential Authorization Actions:
Security Assertion Markup Language
Single-Sign On Authorized, Security
Assertion Markup Language Single-Sign
On Deauthorized, Authorized
Credentials Revoked.
PO 00000
Frm 00137
Fmt 4703
Sfmt 4703
75. Data Repository Package Actions:
Package Version Published, Package
Version Deleted, Package Deleted,
Package Version Restored, Package
Restored.
76. Data Repository Payment Method
Actions: Payment Method Cleared,
Payment Method Created, Payment
Method Updated.
77. Data Repository Advisory Actions:
Security Advisory Closed, Common
Vulnerabilities And Exposures Advisory
Requested, Data Repository Security
Advisory Made Public, Data Repository
Security Advisory Withdrawn, Security
Advisory Opened, Security Advisory
Published, Security Advisory Reopened,
Security Advisory Updated.
78. Data Repository Content Analysis:
Data Use Settings Enabled, Data Use
Settings Disabled.
79. Data Repository Sponsors Actions:
Repo Funding Link Button Toggle, Repo
Funding Links File Action, Sponsor
Sponsorship Cancelled, Sponsor
Sponsorship Created, Sponsor
Sponsorship Preference Changed,
Sponsor Sponsorship Tier Changed,
Sponsored Developer Approved,
Sponsored Developer Created,
Sponsored Developer Profile Updated,
Sponsored Developer Request
Submitted For Approval, Sponsored
Developer Tier Description Updated,
Sponsored Developer Newsletter Sent,
Sponsored Developer Invited From
Waitlist, Sponsored Developer Joined
From Waitlist.
80. Administrator audit log events:
Admin privileges grant, Group events,
Marketplace login audit change, Auto
provisioning automatically disabled.
81. Group enterprise audit log events:
Add service account permission,
Remove service account permission,
Add user, Add user role, Remove user,
Request to join, Approve join request,
Reject join request, Invite user, Accept
invitation, Reject invitation, Revoke
invitation, Join, Ban user including with
moderation, Unban user, Add all users
in domain, Create group, Delete group,
Create namespace, Delete namespace,
Change info setting, Add info setting,
Remove info setting, Add member role,
Remove user role, Membership
expiration added, Membership
expiration removed, Membership
expiration updated.
82. Software vendor employee
interaction events: Event date, Software
product name, Software vendor
employee email, Software vendor
employee home office location,
Software vendor employee access
justification, Justification tickets, Log
ID, Software product resource accessed
name.
E:\FR\FM\31JAN1.SGM
31JAN1
khammond on DSKJM1Z7X2PROD with NOTICES
Federal Register / Vol. 87, No. 20 / Monday, January 31, 2022 / Notices
83. Login events: Two-step
verification enabled, Two-step
verification disabled, Account password
change, Account recovery email change,
Account recovery phone change,
Account recovery secret question
change, Account recovery secret answer
change, Advanced Protection enroll,
Advanced Protection unenroll, Failed
login, Government-backed attack
attempt, Leaked password detected,
Login challenged, Login verification,
Logout, Out of domain email forwarding
enabled, Successful login, Suspicious
Login, Suspicious login blocked,
Suspicious login from less secure app
blocked, Suspicious programmatic login
locked, User suspended, User
suspended through spam relay, User
suspended through spam, User
suspended through suspicious activity.
84. OAuth Token audit log events:
OAuth event description, OAuth event
name, OAuth user, OAuth application
name, OAuth client ID, OAuth scope,
OAuth event data, OAuth logged
activity IP address.
85. Rules audit log events: Rule event
name, Rule event description, Rule
triggering user, Rule name, Rule type,
Rule resource name, Resource ID,
Resource title, Resource type, Resource
owner, Recipients, Data source, Actor IP
address, Rule severity, Scan type,
Matched trigger, Matched detectors,
Triggered actions, Suppressed actions,
Date, Device ID, Device type.
86. SAML audit log events: SAML
event description, SAML Event name,
SAML triggering user, SAML
application name, SAML user
organization name, Initiated by, Failure
type, Response status, Second level
status, SAML logged activity IP address,
SAML event date.
87. Calendar application audit log
events: Activity name, Activity
description, Calendar user, Calendar ID,
Event title, Event ID, API kind, User
agent, Recipient email, Message ID,
Remote Exchange Web Server URL,
Error code, Requested window start,
Requested window end, Date, Calendar
logged activity IP address.
88. Context-Aware Access audit log
events: Event name, Context-Aware
access user, Context-Aware access
logged activity IP address, Device ID,
Access level applied, Context-Aware
access event date.
89. Web browser audit log events: Web
browser event name, Web browser event
date, Web browser event reason, Device
name, Device user, Web browser profile
user name, URL generating event,
Operating System of Web Browser, Web
browser triggered rule reason, Web
browser event result, Web browser
content name, Web browser content
VerDate Sep<11>2014
17:38 Jan 28, 2022
Jkt 256001
size, Web browser content hash, Web
browser content type, Web browser
trigger type, Web browser trigger user,
Web browser user agent, Web browser
client type.
90. Data Visualization audit log
events: Asset name, Event description,
User, Event name, Date, Asset type,
Owner, Asset ID, IP address, Connector
type, visibility, Prior visibility.
91. Devices audit log events: Device
ID, Event description, Date, Event name,
User, Device type, Application hash,
Serial number, Device model, OS
version, Policy name, Policy status
code, Windows OS edition, Account
registration change, Device action event,
Device application change, Device
compliance status, Device compromise,
Device OS update, Device ownership,
Device settings change, Device status
changed on Apple portal, Device sync,
Failed screen unlock attempts, Sign out
user, Suspicious activity, Work profile
support.
92. Cloud-based web storage
application audit log events: Cloudbased web storage application event
name, Cloud-based web storage
application event description, Cloudbased web storage application item type,
Cloud-based web storage application
item ID, Cloud-based web storage
application item visibility, Cloud-based
web storage application item prior
visibility, Cloud-based web storage
application user, Cloud-based web
storage application visitor Boolean
value, Cloud-based web storage
application file owner, Cloud-based web
storage application event date, Cloudbased web storage application event IP
address.
93. Groups audit log events: Groups
event name, Groups event description,
Groups event user, Groups event date.
94. Chat audit log events: Chat event
name, Chat event description, Chat
event user, Chat event date.
95. Whiteboard application audit log
events: Whiteboard application ID
Whiteboard application event
description, Whiteboard application
event name, Whiteboard application
event user, Whiteboard application
gevent date.
96. Note application audit log events:
Note application event name, Note
application event description, Note
application event user, Note application
event note owner, Note application
event date, Note application note URI,
Note application attachment URI.
97. Password vault audit log events:
Password vault actor, Password vault
event timestamp, Password vault event
name, Password vault application
username, Password vault application
installation name, Password vault
PO 00000
Frm 00138
Fmt 4703
Sfmt 4703
4969
application credential name, Password
vault API client version.
98. Takeout audit log events: Takeout
event description, Takeout products
requested, Takeout Job ID, Takeout
event date, Takeout event IP address.
99. User accounts audit log events:
User account event description, User
account event date, User account event
IP address, two-step verification disable,
two-step verification enroll, Account
password change, Account recovery
email change, Account recovery phone
change, Account recovery secret
question change, Account recovery
secret answer change.
100. Voice audit log events: Voice
event name, Voice event description,
Voice event date, Voice event user,
Voice receiving phone number, Voice
placing phone number, Voice call
duration, Voice group message status,
Voice call cost, Auto Attendant couldn’t
route to voicemail recipient, Auto
attendant deleted, Auto attendant failed
to transfer to a user, Auto attendant
published, Auto attendant received a
voicemail, Auto attendant voicemail
failed to deliver, Auto attendant
voicemail failed to forward.
101. User setting changes: 2-Step
Verification Scratch Codes Of User
Deleted, New 2-Step Verification
Scratch Codes Generated For User, 3Legged Oauth Device Tokens Revoked,
3-Legged Oauth Token Revoked, Add
Recovery Email For User, Add Recovery
Phone For User, Admin Privileges
Granted For User, Admin Privileges
Revoked For User, Application Specific
Password Revoked For User, Automatic
Contact Sharing Changed For User, Bulk
Upload Notification, User Invite
Cancelled, Custom Attribute Changed,
External Id Changed, Gender Changed,
Ims Changed, IP Whitelisted, Keywords
Changed, User Location Changed, User
Organization Changed, User Phone
Numbers Changed, User Recovery Email
Changed, User Recovery Phone
Changed, User Relation Changed, User
Address Changed, User Email Monitor
Created, Data Transfer Requested For
User, Delegated Admin Privileges
Granted, Account Information Dump
Deleted, Email Monitor Deleted,
Mailbox Dump Deleted, Profile Photo
Deleted, First Name Changed, Gmail
Account Reset, Last Name Changed,
Mail Routing Destination Created, Mail
Routing Destination Deleted, Nickname
Created, Nickname Deleted, Password
Changed, Password Change Required
On Next Login, Recovery Email
Removed, Recovery Phone Removed,
Account Information Requested,
Mailbox Dump Requested, User Invite
Resent, Cookies Reset For User And
Forced Relogin, Security Key Registered
E:\FR\FM\31JAN1.SGM
31JAN1
4970
Federal Register / Vol. 87, No. 20 / Monday, January 31, 2022 / Notices
For User, Security Key Revoked, User
Invite Sent, Temporary Password
Viewed, 2-Step Verification Turned Off,
User Session Unblocked, Profile Photo
Updated, User Advanced Protection
Unenroll, User Archived, User Birthdate
Changed, User Created, User Deleted,
User Downgraded From Social Media
Application, User Enrolled In 2-Step
Verification, User List Downloaded,
User Org Unit Changed, User Put In 2Step Verification Grace Period, User
Renamed, User Strong Auth Unenrolled,
User Suspended, User Unarchived, User
Undeleted, User Unsuspended, User
Upgraded To Social Media Application.
102. Application Authoring
application audit log elements: App
synced, App edited, App added, App
deleted, App invocation added, App
invocation edited, App invocation
deleted, App invocation action
performed, App read call made, App bot
invocation.
RECORD SOURCE CATEGORIES:
Employees; contractors; customers.
ROUTINE USES OF RECORDS MAINTAINED IN THE
SYSTEM, INCLUDING CATEGORIES OF USERS AND
THE PURPOSES OF SUCH USES:
Standard routine uses 1. through 9.
apply. In addition:
(a) To appropriate agencies, entities,
and persons when (1) the Postal Service
suspects or has confirmed that there has
been a breach of the system of records;
(2) the Postal Service has determined
that as a result of the suspected or
confirmed breach there is a risk of harm
to individuals, the Postal Service
(including its information systems,
programs, and operations), the Federal
Government, or national security; and
(3) the disclosure made to such
agencies, entities, and persons is
reasonably necessary to assist in
connection with the Postal Service’s
efforts to respond to the suspected or
confirmed breach or to prevent,
minimize, or remedy such harm.
POLICIES AND PRACTICES FOR STORAGE OF
RECORDS:
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL
SAFEGUARDS:
SECURITIES AND EXCHANGE
COMMISSION
Paper records, computers, and
computer storage media are located in
controlled-access areas under
supervision of program personnel.
Computer access is limited to
authorized personnel with a current
security clearance, and physical access
is limited to authorized personnel who
must be identified with a badge.
Access to records is limited to
individuals whose official duties require
such access. Contractors and licensees
are subject to contract controls and
unannounced on-site audits and
inspections.
Computers are protected by
encryption, mechanical locks, card key
systems, or other physical access control
methods. The use of computer systems
is regulated with installed security
software, computer logon
identifications, and operating system
controls including access controls,
terminal and transaction logging, and
file management software.
[Release No. 34–94050; File No. SR–
NYSEARCA–2022–01]
RECORD ACCESS PROCEDURES:
Requests for access must be made in
accordance with the Notification
Procedure above and USPS Privacy Act
regulations regarding access to records
and verification of identity under 39
CFR 266.5.
CONTESTING RECORD PROCEDURES:
See Notification Procedure and
Record Access Procedures above.
NOTIFICATION PROCEDURES:
Customers wanting to know if other
information about them is maintained in
this system of records must address
inquiries in writing to the Chief
Information Officer and Executive Vice
President and include their name and
address.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
Automated database, computer
storage media, and paper.
HISTORY:
khammond on DSKJM1Z7X2PROD with NOTICES
POLICIES AND PRACTICES FOR RETRIEVAL OF
RECORDS:
May 10th, 2021; 86 FR 24902.
*
*
*
*
*
Records relating to system
administration are retrievable by user
ID.
Joshua J. Hofer,
Attorney, Ethics and Legal Compliance.
[FR Doc. 2022–01064 Filed 1–28–22; 8:45 am]
POLICIES AND PRACTICES FOR RETENTION AND
DISPOSAL OF RECORDS:
BILLING CODE 7710–12–P
Records relating to system
administration are retained for twentyfour months.
VerDate Sep<11>2014
17:38 Jan 28, 2022
Jkt 256001
PO 00000
Self-Regulatory Organizations; NYSE
Arca, Inc.; Notice of Filing and
Immediate Effectiveness of Proposed
Rule Change of Non-Substantive
Conforming Changes to Rules 10.9120
and 10.9560
January 25, 2022.
Pursuant to Section 19(b)(1) 1 of the
Securities Exchange Act of 1934 (the
‘‘Act’’) 2 and Rule 19b–4 thereunder,3
notice is hereby given that, on January
10, 2022, NYSE Arca, Inc. (the
‘‘Exchange’’) filed with the Securities
and Exchange Commission (the
‘‘Commission’’) the proposed rule
change as described in Items I and II
below, which Items have been prepared
by the self-regulatory organization. The
Commission is publishing this notice to
solicit comments on the proposed rule
change from interested persons.
I. Self-Regulatory Organization’s
Statement of the Terms of the Substance
of the Proposed Rule Change
The Exchange proposes nonsubstantive conforming changes to
Rules 10.9120 and 10.9560 of the
Exchange’s disciplinary rules. The
proposed rule change is available on the
Exchange’s website at www.nyse.com, at
the principal office of the Exchange, and
at the Commission’s Public Reference
Room.
II. Self-Regulatory Organization’s
Statement of the Purpose of, and
Statutory Basis for, the Proposed Rule
Change
In its filing with the Commission, the
Exchange included statements
concerning the purpose of, and basis for,
the proposed rule change and discussed
any comments it received on the
proposed rule change. The text of those
statements may be examined at the
places specified in Item IV below. The
Exchange has prepared summaries, set
forth in sections A, B, and C below, of
the most significant parts of such
statements.
A. Self-Regulatory Organization’s
Statement of the Purpose of, and the
Statutory Basis for, the Proposed Rule
Change
1. Purpose
The Exchange proposes nonsubstantive conforming changes to
1 15
U.S.C. 78s(b)(1).
U.S.C. 78a.
3 17 CFR 240.19b–4.
2 15
Frm 00139
Fmt 4703
Sfmt 4703
E:\FR\FM\31JAN1.SGM
31JAN1
Agencies
[Federal Register Volume 87, Number 20 (Monday, January 31, 2022)]
[Notices]
[Pages 4964-4970]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2022-01064]
-----------------------------------------------------------------------
POSTAL SERVICE
Privacy Act of 1974; System of Records
AGENCY: Postal Service\TM\.
ACTION: Notice of a modified system of records.
-----------------------------------------------------------------------
SUMMARY: The United States Postal Service\TM\ (USPSTM) is
proposing to modify a General Privacy Act System of Records to support
the implementation of a suite of cloud-based workplace productivity
software.
DATES: These revisions will become effective without further notice on
March 2, 2022, unless comments received on or before that date result
in a contrary determination.
ADDRESSES: Comments may be submitted via email to the Privacy and
Records Management Office, United States Postal Service Headquarters
([email protected]). Arrangements to view copies of any written comments
received, to facilitate public inspection, will be made upon request.
FOR FURTHER INFORMATION CONTACT: Janine Castorina, Chief Privacy and
Records Management Officer, Privacy and Records Management Office, 202-
268-3069 or [email protected].
SUPPLEMENTARY INFORMATION: This notice is in accordance with the
Privacy Act requirement that agencies publish their systems of records
in the Federal Register when there is a revision, change, or addition,
or when the agency establishes a new system of records.
I. Background
The Postal Service is constantly seeking methods to improve
employee productivity and efficiency. To that end, the Postal Service
will implement a suite of cloud-based workplace productivity
applications. These applications will expand employee access to various
programs, allowing more employees to utilize resources to increase
productivity and team collaboration.
II. Rationale for Changes to USPS Privacy Act Systems of Records
The Postal Service is proposing to modify USPS System of Records
(SOR) 550.200 Commercial Information Technology Resources--
Administrative to support the implementation of a suite of cloud-based
workplace productivity software. This system will be modified in
conjunction with USPS 550.000 Commercial Information Technology
Resources--Infrastructure and USPS 550.100 Commercial Information
Technology Resources--Applications to reflect the full scope of
application implementation. Revisions to these SORs will be submitted
independent of this notice. More information on accompanying changes
can be found within those SORs.
This system specifically reflects data elements created from a user
or application's interactions with other applications. Revisions to the
existing SOR to support this implementation are documented as additions
to existing category of records Video Platform Activities beginning
with ``Video Platform Event Date,'' and further as new categories of
records 80 through 102.
III. Description of the Modified System of Records
Pursuant to 5 U.S.C. 552a(e)(11), interested persons are invited to
submit written data, views, or arguments on this proposal. A report of
the proposed revisions has been sent to Congress and to the Office of
Management and Budget for their evaluations. The Postal Service does
not expect this amended system of records to have any adverse effect on
individual privacy rights. The notice for 550.200 Commercial
Information Technology Resources--Administrative, provided below in its
entirety, is as follows:
SYSTEM NAME AND NUMBER:
550.200 Commercial Information Technology Resources--
Administrative.
SECURITY CLASSIFICATION:
None.
SYSTEM LOCATION:
All USPS facilities and contractor sites.
SYSTEM MANAGER(S):
For records of computer access authorizations: Chief Information
Officer and Executive Vice President, United States Postal Service, 475
L'Enfant Plaza SW, Washington, DC 20260.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
39 U.S.C. 401, 403, and 404.
PURPOSE(S) OF THE SYSTEM:
1. To provide active and passive monitoring and review of
information system applications and user activities.
2. To generate logs and reports of information system application
and user activities.
3. To provide a means of auditing commercial information system
activities across applications and users.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
1. Individuals with authorized access to USPS computers,
information resources, and facilities, including employees,
contractors, business partners, suppliers, and third parties.
2. Individuals participating in web-based meetings, web-based video
conferencing, web-based communication applications, and web-based
collaboration applications.
CATEGORIES OF RECORDS IN THE SYSTEM:
1. General Audit Log activities: DateTime, IP Address, User
Activity, User Item Accessed, Activity Detail, Object ID, Record Type,
Client IP Address, CorrelationID, CreationTime, EventData, EventSource,
ItemType, OrganizationID, UserAgent, USerKEy, UserType, Version,
Workload.
2. File and page activities: Accessed file, Change retention label
for a file, Deleted file marked as a record, Checked in file, Changed
record status to locked, Changed record status to unlocked, Checked out
file, Copied file, Discarded file checkout, Deleted file, Deleted file
from recycle bin, Deleted file from second-stage recycle bin, Detected
document sensitivity mismatch, Detected malware in file, Deleted file
marked as a record, Downloaded file, Modified file, Moved file,
Recycled all minor versions of file, Recycled all versions of file,
Recycled version of file, Renamed file, Restored file, Uploaded file,
Viewed page, View signaled by client, Performed search query.
3. Folder activities: Copied folder, Created folder, Deleted
folder, Deleted folder from recycle bin, Deleted folder from second-
stage recycle bin, Modified folder, Moved folder, Renamed folder,
Restored folder.
4. Cloud-based Enterprise Storage activities: Created list, Created
list column, Created list content type, Created list item, Created site
column, Created site content type, Deleted list, Deleted list column,
Deleted list content type, Deleted list item, Deleted site column,
Deleted site content type, Recycled list item, Restored list, Restored
list item, Updated list, Updated list column, Updated list content
type, Updated list item, Updated site column, Updated site content
type.
5. Sharing and access request activities: Added permission level to
[[Page 4965]]
site collection, Accepted access request, Accepted sharing invitation,
Blocked sharing invitation, Created access request, Created a company
shareable link, Created an anonymous link, Created secure link, Deleted
secure link, Created sharing invitation, Denied access request, Removed
a company shareable link, Removed an anonymous link, Shared filer,
folder, or site, Unshared file folder or site, Updated access request,
Updated an anonymous link, Updated sharing invitation, Used a company
shareable link, Used an anonymous link, Used secure link, User added to
secure link, User removed from secure link, Withdrew sharing
invitation.
6. Synchronization activities: Allowed computer to sync files,
Blocked computer from syncing files, Downloaded files to computer,
Downloaded file changes to computer, Uploaded files to document
library, Uploaded file changes to document library.
7. Site permissions activities: Added site collection admin, Added
user of group to Cloud-based Enterprise Storage group, Broke permission
level inheritance, Broke sharing inheritance, Created group, Deleted
group, Modified access request setting, Modified ``Members Can Share''
setting, Modified permission level on site collection, Modified site
permissions, Removed site collection admin, Removed permission level
from site collection, Removed user or group from Cloud-based Enterprise
Storage group, Requested site admin permissions, Restored sharing
inheritance, Updated group.
8. Site administration activities: Added allowed data location,
Added exempt user agent, Added geo location admin, Allowed user to
create groups, Cancelled site geo move, Changed a sharing policy,
Changed deice access policy, Changed exempt user agents, Changed
network access policy, Completed site geo move, Created Sent To
connection, Created site collection, Deleted orphaned hub site, Deleted
Sent To connection, Deleted site, Enabled document preview, Enabled
legacy workflow, Enabled Office on Demand, Enabled result source for
People Searched, Enabled RSS feeds, Failed site swap, Joined site to
hub site, Registered hub site, Removed allowed data location, Removed
geo location admin, Renamed site, Scheduled site rename, Scheduled site
swap, Scheduled site geo move, Set host site, Set storage quota for geo
location, Swapped site, Unjoined site from hub site, Unregistered hub
site.
9. Cloud-based Email Server mailbox activities: Created mailbox
item, Copied messages to another folder, User signed in to mailbox,
Accessed mailbox items, Sent message using Send On Behalf permissions,
Purged messages from mailbox, Moved messages to Deleted Items folder,
Moved messages to another folder, Sent message using Send As
permissions, Sent message, Updated message, Deleted messages from
Deleted Items folder, New-Inbox Rule Create-Inbox Rule from email web
application, Set-Inbox Rule Modify inbox rule from email web
application, Update inbox rules from email web application, Added
delegate mailbox permissions, Removed delegate mailbox permissions,
Added permissions to folder, Modified permissions of folder, Removed
permissions from folder, Added or removed user with delegate access to
calendar folder, Labeled message as a record.
10. Retention policy and retention level activities: Created
retention label, Created retention policy, Configured settings for a
retention policy, Deleted retention label, Deleted retention policy,
Deleted settings from a retention policy, Updated retention label,
Updated retention policy, Updated settings for a retention policy,
Enabled regulatory record option for retention labels.
11. User administration activities: Added user, Deleted user, Set
license properties, Reset user password, Changed user password, Changed
user license, Updated user, Set property that forces user to change
password.
12. Enterprise User Administration group administration activities:
Added group, Updated group, Deleted group, Added member to group,
Removed member from group.
13. Application administration activities: Added service principal,
Removed a service principal from the directory, Set delegation entry,
Removed credentials from a service principal, Added delegation entry,
Added credentials to a service principal, Removed delegation entry.
14. Role administration activities: Added member to Role, Removed a
user from a directory role, Set company contact information.
15. Directory administration activities: Added a partner to the
directory, Removed a partner from the directory, Added domain to
company, Removed domain from company, Updated domain, Set domain
authentication, Verified domain, Updated the federation settings for a
domain, Verified email verified domain, Turned on Enterprise
Information Technology Account Administration sync, Set password
policy, Set company information.
16. eDiscovery activities: Created content search, Deleted content
search, Changed content search, Started content search, Stopped content
search, Started export of content search, Started export report,
Previewed results of content search, Purged results of content search,
Started analysis of content search, Removed export of content search,
Removed preview results of content search, Removed purse action
performed on content search, Removed analysis of content search,
Removed search report, Content search preview item listed, Content
search preview item viewed, Content search preview item downloaded,
Downloaded export of content search, Created search permissions filter,
Deleted search permissions filter, Changed search permissions filter,
Created hold in eDiscovery case, Deleted hold in eDiscovery case,
Changed hold in eDiscovery case, Created eDiscovery case, Deleted hold
in eDiscovery case, Changed hold in eDiscovery case, Created eDiscovery
case, Deleted eDiscovery data, Changed hold in eDiscovery case, Added
member to eDiscovery case, Removed member from eDiscovery case, Changed
eDiscovery case membership, Created eDiscovery administrator, Deleted
eDiscovery administrator, Changed eDiscovery administrator membership,
Remediation action created, Item deleted using Remediation, Created
workingset search, Updated workingset search, Deleted workingset
search, Previewed workingset search, Document viewed, Document
annotated, Document downloaded, Tag created, Tag edited, Tag deleted,
Tag files, Tag job, Created review set, Added Cloud-based productivity
software data, Added non-office data, Added data to another workingset,
Added remediated data, Run algo job, Run export job, Run burn job, Run
error remediation job, Run load comparison job, Updated case settings.
17. eDiscovery system command activities: Created content search,
Deleted content search, Changed content search, Started content search,
Stopped content search, created content search action, Deleted content
search action, Created search permissions filter, Deleted search
permissions filter, Changed search permissions filter, Created hold in
eDiscovery case, Deleted hold in eDiscovery case, Changed hold in
eDiscovery case, Created search query for eDiscovery case hold, Deleted
search query for eDiscovery case hold, Changed search query for
eDiscovery case hold, Created eDiscovery case, Deleted eDiscovery case,
Changed eDiscovery case, Added member to eDiscovery case, Removed
member from eDiscovery case, Changed
[[Page 4966]]
eDiscovery case membership, Created eDiscovery administrator, Deleted
eDiscovery administrator, Changed eDiscovery administrator membership.
18. Data Analysis application activities: Viewed program dashboard,
Created program dashboard, Edited program dashboard, Deleted program
dashboard, Shared program dashboard, Printed program dashboard, Copied
program dashboard, Viewed program tile, Exported program tile data,
Viewed program report, Deleted program report, Printed program report
page, Created program report, Edited program report, Copied program
report, Exported program artifact to another file format, Export
program activity events, Updated program workspace access, Restored
program workspace, Updated program workspace, Viewed program metadata,
Created program dataset, Deleted program dataset, Created program
group, Deleted program group, Added program group members, Retrieved
program groups, Retrieved program dashboard, Retrieved data sources
from program dataset, Retrieved upstream data flows from program
dataflow, Retrieved data sources from program dataflow, Removed program
group members, Retrieved links between datasets and dataflows, Created
organizational program content pack, Created program app, Installed
program app, Updated program app, Updated organization's program
settings, Started program trial, Started program extended trial,
Analyzed program dataset, Created program gateway, Deleted program
gateway, Added data source to program gateway, Removed data source from
program gateway, Changed program gateway admins, Changed program
gateway data source users, Set scheduled refresh on program dataset,
Unpublished program app, Deleted organizational program content pack,
Renamed program dashboard, Edited program dataset, Updated capacity
display name, Changed capacity state, Updated capacity admin, Changed
capacity user assignment, Migrated workspace to a capacity, Removed
workspace from a capacity, Retrieved program workspaces, Shared program
report, Generated program Embed Token, Discover program dataset data
sources, Updated program dataset data sources, Requested program
dataset refresh, Binded program dataset to gateway, Changed program
dataset data sources, Requested program dataset refresh, Binded program
dataset to gateway, Changed program dataset connections, Took over
program dataset, Updated program gateway data source credentials,
Imported file to program, Updated program dataset parameters, Generated
program dataflow SAS token, Created program dataflow, Updated program
dataflow, Deleted program dataflow, Viewed program dataflow, Exported
program dataflow, Set scheduled refresh on program dataflow, Requested
program dataflow refresh, Received program dataflow secret from Key
Vault, Attached dataflow storage account, Migrated dataflow storage
location, Updated dataflow storage assignment permissions, Set dataflow
storage location for workspace, Took ownership of program dataflow,
Canceled program dataflow refresh, Created program email subscription,
Updated program email subscription, Deleted program email subscription,
Created program folder, Deleted program folder, Updated program folder,
Added program folder access, Deleted program folder access, Updated
program folder access, Posted program comment, Deleted program comment,
Analyzed program report, Viewed program usage metrics, Edited program
dataset endorsement, Edited program dataflow endorsement, Edited
program report endorsement, Edited program app endorsement, Retrieved
list of modified workspaces in program tenant, Sent a scan request in
program tenant, Retrieve scan result in program tenant, Inserted
snapshot for user in program tenant, Updated snapshot for user in
program tenant, Deleted snapshot for user in program tenant, Inserted
snapshot for user in program tenant, Updated snapshot for user in
program tenant, Deleted snapshot for user in program tenant, Retrieved
snapshots for user in program tenant, Edited program certification
permission, Took over a program data source, Updated capacity custom
settings, Created workspace for program template app, Deleted workspace
for program template app, Updated settings for program template app,
Updated testing permissions for program template app, Created program
template app, Deleted program template app, Promoted program template
app, Installed program template app, Updated parameters for installed
program template app, Created install ticker for installing program
template app, Updated an organizational custom visual, Created an
organizational custom visual, Deleted an organizational custom visual,
Custom visual requested Enterprise Information Technology Account
Administration access token, Customer visual requested Cloud-based
productivity software access token, Connected to program dataset from
external app, Created program dataset from external app, Deleted
program dataset from external app, Edited program dataset from external
app, Requested program dataset refresh from external app, Requested SAS
token for program storage, Requested account key for program storage,
Assigned a workspace to a deployment pipeline, Removed a workspace from
a deployment pipeline, Deleted deployment pipeline, Created deployment
pipeline, Deployed to a pipeline stage, Updated deployment pipeline
configuration, Updated deployment pipeline access, Added external
resource, Added link to external resource, Deleted link to external
resource, Updated featured tables, Applied sensitivity label to program
artifact, Changed sensitivity label for program artifact, Deleted
sensitivity label from program artifact.
19. Productivity Analysis activities: Updated privacy setting,
Updated data access setting, Uploaded organization data, Created
meeting exclusion, Updated preferred meeting exclusion, Execute query,
Canceled query, Deleted result, Downloaded report, Accessed Odata link,
Viewed query visualization, Viewed explore, Created partition, Updated
partition, Deleted partition, User logged in, User logged out.
20. Briefing email activities: Updated user privacy settings,
Updated organization privacy settings.
21. Cloud-based Collaboration Application activities: Created team,
Deleted team, Added channel, Deleted channel, Changed organization
setting, Changed team setting, Changed channel setting, User signed in
to Cloud-based Collaboration Application, Added members, Changed role
of members, Removed members, Added bot to team, Removed bot from team,
Added tab, Removed tab, Updated tab, Added connector, Removed
connector, Updated connector, Downloaded analytics report, Upgraded
Cloud-based Collaboration Application device, Blocked Cloud-based
Collaboration Application device, Unblocked Cloud-based Collaboration
Application device, Changed configuration of Cloud-based Collaboration
Application device, Enrolled Cloud-based Collaboration Application
device, Installed app, Upgraded app, Uninstalled app, Published app,
Updated app, Deleted app, Deleted all organization apps, Performed
action on card, Added scheduling group, Edited scheduling group,
Deleted scheduling group, Added shift, Edited shift, Deleted shift,
Added time off, Edited time off, Deleted time off, Added open shift,
Edited open shift, Deleted open shift, Shared schedule, Clocked in
using Time clock, Clocked out using Time clock, Started break
[[Page 4967]]
using Time clock, Ended break using Time clock, Added Time clock entry,
Edited Time clock entry, Deleted Time clock entry, Added shift request,
Responded to shift request, Canceled shift request, Changed schedule
setting, Added workforce integration, Accepted off shift message.
22. Cloud-based Collaboration Application approvals activities:
Created new approval request, Viewed approval request details, Approved
approval request, Rejected approval request, Canceled approval request,
Shared approval request, File attached to approval request, Reassigned
approval request, Added e-signature to approval request.
23. Enterprise Social Network activities: Changed data retention
policy, Changed network configuration, Changed network profile
settings, Changed private content mode, Changed security configuration,
Created file, Created group, Deleted group, Deleted message, Downloaded
file, Exported data, Shared file, Suspended network user, Suspended
user, Updated file description, Updated file name, Viewed file.
24. Enterprise Customer Relationship Management activities:
Accessed out-of-box entity (deprecated), Accessed custom entity
(deprecated), Accessed admin entity (deprecated), Performed bulk
actions (deprecated), All Enterprise Customer Relationship Management
activities, Accessed Enterprise Customer Relationship Management admin
center (deprecated), Accessed internal management tool (deprecated),
Signed in or out (deprecated), Activated process or plug-in
(deprecated).
25. Information Systems Infrastructure Automation activities:
Created flow, Edited flow, Deleted flow, Edited flow permissions,
Deleted flow permissions, Started a Flow paid trial, Renewed a Flow
paid trial.
26. Application authoring program activities: Created app, Edited
app, Deleted app, Launched app, Published app, Marked app as Hero,
Marked app as Featured, Edited app permission, Restored app version.
27. Enterprise Automation DLP activities: Created DLP Policy,
Updated DLP Policy, Deleted DLP Policy.
28. Video platform activities: Created video, Edited video, Deleted
video, Uploaded video, Downloaded video, Edited video permission,
Viewed video, Shared video, Liked video, Unliked video, Commented on
video, Deleted video comment, Uploaded video text track, Deleted video
text track, Uploaded video thumbnail, Deleted video thumbnail, Replaced
video permissions and channel links, Marked video public, Marked video
private, Created Video platform group, Edited Video platform group,
Deleted Video platform group, Edited Video platform group memberships,
Created Video platform channel, Edited Video platform channel, Deleted
a Video platform channel, Replaced Video platform channel thumbnails,
Edited Video platform user settings, Edited tenant settings, Edited
global role members, Deleted Video platform user, Deleted Video
platform user's data report, Edited Video platform user, Exported Video
platform user's data report, Downloaded Video platform user's data
report, Video Platform Event Date, Video Platform Event Name, Video
Platform Event Description, Video Platform Meeting Code, Video Platform
Participant Identifiers.
29. Content explorer activities: Accessed item.
30. Quarantine activities: Previewed Quarantine message, Deleted
Quarantine message, Released Quarantine message, Exported Quarantine
message, Viewed Quarantine Message's header.
31. Customer Key Service Encryption activities: Fallback to
Availability Key
32. Form application activities: Created form, Edited form, Moved
form, Deleted form, Viewed form, Previewed form, Exported form, Allowed
share form for copy, Added form co-author, Removed form co-author,
Viewed response page, Created response, Updated response, Deleted all
responses, Deleted response, Viewed responses, Viewed response, Created
summary link, Deleted summary link, Updated from phishing status,
Updated user phishing status, Sent premium form product invitation,
Updated form setting, Updated user setting, Listed forms.
33. Sensitivity label activities: Applied sensitivity label to
site, Removed sensitivity label from site, Applied sensitivity label to
file, Changed sensitivity label applied to file, Removed sensitivity
label from file.
34. Local machine communications platform system command
activities: Set tenant federation.
35. Search activities: Performed email search, Performed Cloud-
based Enterprise Storage search.
36. Security analytics activities: Attempted to compromise
accounts.
37. Device activities: Printed file, Deleted file, Renamed file,
Created file, Modified file, Read file, Captured screen, Copied file to
removable media, Copied file to network share, Copied file to
clipboard, Uploaded file to cloud, File accessed by an unallowed
application.
38. Information barrier activities: Removed segment from site,
Changed segment of site, Applied segment to site.
39. On-premises DLP scanning activities: Matched DLP rule, Enforced
DLP rule.
40. Individual Productivity Analytics activities: Updated user
settings, Updated organization settings.
41. Exact Data Match (EDM) activities: Created EDM schema, Modified
EDM schema, Removed EDM scheme, Completed EDM data upload, Failed EDM
data upload.
42. Enterprise Information System Information Protection
activities: Accessed file, Discovered file, Applied sensitivity label,
Updated sensitivity label, Removed sensitivity label, Removed file,
Applied protection, Changed protection, Removed protection, Received
AIP heartbeat.
43. Data Repository Team Discussion Post Actions: Team Discussion
Post Updated, Team Discussion Post Destroyed.
44. Data Repository Team Discussion Post Reply Actions: Team
Discussion Post Reply Updated, Team Discussion Post Reply Destroyed.
45. Data Repository Enterprise Actions: Self-Hosted Runner Removed,
Self-Hosted Runner Registered, Self-Hosted Runner Group Created, Self-
Hosted Runner Group Removed, Self-Hosted Runner Removed From Group,
Self-Hosted Runner Added To Group, Self-Hosted Runner Group Member List
Updated, Self-Hosted Runner Group Configuration Changed, Self-Hosted
Runner Updated.
46. Data Repository Hook Actions: Hook Created, Hook Configuration
Changed, Hook Destroyed, Hook Events Altered.
47. Data Repository Integration Installation Request Actions:
Integration Installation Request Created, Integration Installation
Request Closed.
48. Data Repository Issue Action: Issue Destroyed.
49. Data Repository Org Actions: Secret Action Created, Member
Creation Disabled, Two Factor Authentication Requirement Disabled,
Member Creation Enabled, Two Factor Authentication Enabled, Member
Invited, Self-Hosted Runner Registered, Secret Action Removed, Member
Removed, Outside Collaborator Removed, Self-Hosted Runner Removed,
Self-Hosted Runner Group Created, Self-Hosted Runner Group Removed,
Self-Hosted Runner Group Updated, Secret Action Updated, Repository
Default Branch Named Updated, Default Repository Permission Updated,
Member Role Updated, Member Repository Creation Permission Updated.
[[Page 4968]]
50. Data Repository Organization Label Actions: Default Label
Created, Default Label Updated, Default Label Destroyed.
51. Data Repository Oauth Application Actions: Oauth Application
Created, Oauth Application Destroyed, Oauth Application Secret Restet,
Oauth Application Token Revoked, Oauth Application Transferred.
52. Data Repository Profile Picture Actions: Organization Profile
Picture Updated.
53. Data Repository Project Actions: Project Board Created, Project
Board Linked, Project Board Renamed, Project Board Updated, Project
Board Deleted, Project Board Unlinked, Project Board Permissions
Updated, Project Board Team Permissions Updated, Project Board User
Permission Updated.
54. Data Repository Protected Branch Actions: Branch Protection
Enabled, Branch Protection Destroyed, Branch Protection Enforced For
Administrators, Branch Enforcement Of Required Code Owner Enforced,
Stale Pull Request Dismissal Enforced, Branch Commit Signing Updated,
Pull Request Review Updated, Required Status Check Updated, Requirement
For Branch To Be Up To Date Before Merging Changed, Branch Update
Attempt Rejected, Branch Protection Requirement Overridden, Force Push
Enabled, Force Push Disabled, Branch Deletion Enabled, Branch Deletion
Disabled, Linear Commit History Enabled, Linear Commit History
Disabled.
55. Data Repository Repo Actions: User Visibility Changed, Actions
Enabled For Repository, Collaboration Member Added, Topic Added To
Repository, Repository Archived, Anonymous Git Read Access Disabled,
Anonymous Git Read Access Enabled, Anonymous Git Read Access Setting
Locked, Anonymous Git Read Access Setting Unlocked, New Repository
Created, Secret Created For Repository, Repository Deleted, Repository
Enabled, Secret Removed, User Removed, Self-Hosted Runner Registered,
Topic Removed From Repository, Repository Renamed, Self-Hosted Runner
Updated, Repository Transferred, Repository Transfer Started,
Repository Unarchived, Secret Action Updated.
56. Data Repository Dependency Graph Actions: Dependency Graph
Disabled, Dependency Graph Disabled For New Repository, Dependency
Graph Enabled, Dependency Graph Enabled For New Repository.
57. Data Repository Secret Scanning Actions: Secret Scanning
Disabled For Individual Repository, Secret Scanning Disabled For All
Repositories, Secret Scanning Disabled For New Repositories, Secret
Scanning Enabled For Individual Repository, Secret Scanning Enabled For
All Repositories, Secret Scanning Enabled For New Repositories.
58. Data Repository Vulnerability Alert Actions: Vulnerable
Dependency Alert Created, Vulnerable Dependency Alert Dismissed,
Vulnerable Dependency Alert Resolved.
59. Data Repository Team Actions: Member Added To Team, Repository
Added To Team, Team Parent Changed, Team Privacy Level Changed, Team
Created, Member Demoted In Team, Team Destroyed, Member Promoted In
Team, Member Removed From Team, Repository Removed From Team.
60. Data Repository Team Discussion Actions: Team Discussion
Disabled, Team Discussion Enabled.
61. Data Repository Workflow Actions: Workflow Run Cancelled,
Workflow Run Completed, Workflow Run Created, Workflow Run Deleted,
Workflow Run Rerun, Workflow Job Prepared.
62. Data Repository Account Actions: Billing Plan Change, Plan
Change, Pending Plan Change, Pending Subscription Change.
63. Data Repository Advisory Credit Actions: Accept Credit, Create
Credit, Decline Credit, Destroy Credit.
64. Data Repository Billing Actions: Change Billing Type, Change
Email.
65. Data Repository Bot Alerts Actions: Disable Bot, Enable Bot.
66. Data Repository Bot Alerts for New Repository Actions: Disable
Alerts, Enable Alerts.
67. Data Repository Bot Security Alerts for Update Actions: Disable
Security Update Alerts, Enable Security Update Alerts.
68. Data Repository Bot Security Alerts for New Repository Actions:
Disable New Repository Security Alerts, Enable New Repository Security
Alerts.
69. Data Repository Environment Actions: Create Actions Secret,
Delete, Remove Actions Secret, Update Actions Secret.
70. Data Repository Git Actions: Clone, Fetch, Push.
71. Data Repository Marketplace Agreement Signature Actions:
Create.
72. Data Repository Marketplace Listing Actions: Approve, Create,
Delist, Redraft, Reject.
73. Data Repository Members Can Create Pages Actions: Enable,
Disable.
74. Data Repository Organization Credential Authorization Actions:
Security Assertion Markup Language Single-Sign On Authorized, Security
Assertion Markup Language Single-Sign On Deauthorized, Authorized
Credentials Revoked.
75. Data Repository Package Actions: Package Version Published,
Package Version Deleted, Package Deleted, Package Version Restored,
Package Restored.
76. Data Repository Payment Method Actions: Payment Method Cleared,
Payment Method Created, Payment Method Updated.
77. Data Repository Advisory Actions: Security Advisory Closed,
Common Vulnerabilities And Exposures Advisory Requested, Data
Repository Security Advisory Made Public, Data Repository Security
Advisory Withdrawn, Security Advisory Opened, Security Advisory
Published, Security Advisory Reopened, Security Advisory Updated.
78. Data Repository Content Analysis: Data Use Settings Enabled,
Data Use Settings Disabled.
79. Data Repository Sponsors Actions: Repo Funding Link Button
Toggle, Repo Funding Links File Action, Sponsor Sponsorship Cancelled,
Sponsor Sponsorship Created, Sponsor Sponsorship Preference Changed,
Sponsor Sponsorship Tier Changed, Sponsored Developer Approved,
Sponsored Developer Created, Sponsored Developer Profile Updated,
Sponsored Developer Request Submitted For Approval, Sponsored Developer
Tier Description Updated, Sponsored Developer Newsletter Sent,
Sponsored Developer Invited From Waitlist, Sponsored Developer Joined
From Waitlist.
80. Administrator audit log events: Admin privileges grant, Group
events, Marketplace login audit change, Auto provisioning automatically
disabled.
81. Group enterprise audit log events: Add service account
permission, Remove service account permission, Add user, Add user role,
Remove user, Request to join, Approve join request, Reject join
request, Invite user, Accept invitation, Reject invitation, Revoke
invitation, Join, Ban user including with moderation, Unban user, Add
all users in domain, Create group, Delete group, Create namespace,
Delete namespace, Change info setting, Add info setting, Remove info
setting, Add member role, Remove user role, Membership expiration
added, Membership expiration removed, Membership expiration updated.
82. Software vendor employee interaction events: Event date,
Software product name, Software vendor employee email, Software vendor
employee home office location, Software vendor employee access
justification, Justification tickets, Log ID, Software product resource
accessed name.
[[Page 4969]]
83. Login events: Two-step verification enabled, Two-step
verification disabled, Account password change, Account recovery email
change, Account recovery phone change, Account recovery secret question
change, Account recovery secret answer change, Advanced Protection
enroll, Advanced Protection unenroll, Failed login, Government-backed
attack attempt, Leaked password detected, Login challenged, Login
verification, Logout, Out of domain email forwarding enabled,
Successful login, Suspicious Login, Suspicious login blocked,
Suspicious login from less secure app blocked, Suspicious programmatic
login locked, User suspended, User suspended through spam relay, User
suspended through spam, User suspended through suspicious activity.
84. OAuth Token audit log events: OAuth event description, OAuth
event name, OAuth user, OAuth application name, OAuth client ID, OAuth
scope, OAuth event data, OAuth logged activity IP address.
85. Rules audit log events: Rule event name, Rule event
description, Rule triggering user, Rule name, Rule type, Rule resource
name, Resource ID, Resource title, Resource type, Resource owner,
Recipients, Data source, Actor IP address, Rule severity, Scan type,
Matched trigger, Matched detectors, Triggered actions, Suppressed
actions, Date, Device ID, Device type.
86. SAML audit log events: SAML event description, SAML Event name,
SAML triggering user, SAML application name, SAML user organization
name, Initiated by, Failure type, Response status, Second level status,
SAML logged activity IP address, SAML event date.
87. Calendar application audit log events: Activity name, Activity
description, Calendar user, Calendar ID, Event title, Event ID, API
kind, User agent, Recipient email, Message ID, Remote Exchange Web
Server URL, Error code, Requested window start, Requested window end,
Date, Calendar logged activity IP address.
88. Context-Aware Access audit log events: Event name, Context-
Aware access user, Context-Aware access logged activity IP address,
Device ID, Access level applied, Context-Aware access event date.
89. Web browser audit log events: Web browser event name, Web
browser event date, Web browser event reason, Device name, Device user,
Web browser profile user name, URL generating event, Operating System
of Web Browser, Web browser triggered rule reason, Web browser event
result, Web browser content name, Web browser content size, Web browser
content hash, Web browser content type, Web browser trigger type, Web
browser trigger user, Web browser user agent, Web browser client type.
90. Data Visualization audit log events: Asset name, Event
description, User, Event name, Date, Asset type, Owner, Asset ID, IP
address, Connector type, visibility, Prior visibility.
91. Devices audit log events: Device ID, Event description, Date,
Event name, User, Device type, Application hash, Serial number, Device
model, OS version, Policy name, Policy status code, Windows OS edition,
Account registration change, Device action event, Device application
change, Device compliance status, Device compromise, Device OS update,
Device ownership, Device settings change, Device status changed on
Apple portal, Device sync, Failed screen unlock attempts, Sign out
user, Suspicious activity, Work profile support.
92. Cloud-based web storage application audit log events: Cloud-
based web storage application event name, Cloud-based web storage
application event description, Cloud-based web storage application item
type, Cloud-based web storage application item ID, Cloud-based web
storage application item visibility, Cloud-based web storage
application item prior visibility, Cloud-based web storage application
user, Cloud-based web storage application visitor Boolean value, Cloud-
based web storage application file owner, Cloud-based web storage
application event date, Cloud-based web storage application event IP
address.
93. Groups audit log events: Groups event name, Groups event
description, Groups event user, Groups event date.
94. Chat audit log events: Chat event name, Chat event description,
Chat event user, Chat event date.
95. Whiteboard application audit log events: Whiteboard application
ID Whiteboard application event description, Whiteboard application
event name, Whiteboard application event user, Whiteboard application
gevent date.
96. Note application audit log events: Note application event name,
Note application event description, Note application event user, Note
application event note owner, Note application event date, Note
application note URI, Note application attachment URI.
97. Password vault audit log events: Password vault actor, Password
vault event timestamp, Password vault event name, Password vault
application username, Password vault application installation name,
Password vault application credential name, Password vault API client
version.
98. Takeout audit log events: Takeout event description, Takeout
products requested, Takeout Job ID, Takeout event date, Takeout event
IP address.
99. User accounts audit log events: User account event description,
User account event date, User account event IP address, two-step
verification disable, two-step verification enroll, Account password
change, Account recovery email change, Account recovery phone change,
Account recovery secret question change, Account recovery secret answer
change.
100. Voice audit log events: Voice event name, Voice event
description, Voice event date, Voice event user, Voice receiving phone
number, Voice placing phone number, Voice call duration, Voice group
message status, Voice call cost, Auto Attendant couldn't route to
voicemail recipient, Auto attendant deleted, Auto attendant failed to
transfer to a user, Auto attendant published, Auto attendant received a
voicemail, Auto attendant voicemail failed to deliver, Auto attendant
voicemail failed to forward.
101. User setting changes: 2-Step Verification Scratch Codes Of
User Deleted, New 2-Step Verification Scratch Codes Generated For User,
3-Legged Oauth Device Tokens Revoked, 3-Legged Oauth Token Revoked, Add
Recovery Email For User, Add Recovery Phone For User, Admin Privileges
Granted For User, Admin Privileges Revoked For User, Application
Specific Password Revoked For User, Automatic Contact Sharing Changed
For User, Bulk Upload Notification, User Invite Cancelled, Custom
Attribute Changed, External Id Changed, Gender Changed, Ims Changed, IP
Whitelisted, Keywords Changed, User Location Changed, User Organization
Changed, User Phone Numbers Changed, User Recovery Email Changed, User
Recovery Phone Changed, User Relation Changed, User Address Changed,
User Email Monitor Created, Data Transfer Requested For User, Delegated
Admin Privileges Granted, Account Information Dump Deleted, Email
Monitor Deleted, Mailbox Dump Deleted, Profile Photo Deleted, First
Name Changed, Gmail Account Reset, Last Name Changed, Mail Routing
Destination Created, Mail Routing Destination Deleted, Nickname
Created, Nickname Deleted, Password Changed, Password Change Required
On Next Login, Recovery Email Removed, Recovery Phone Removed, Account
Information Requested, Mailbox Dump Requested, User Invite Resent,
Cookies Reset For User And Forced Relogin, Security Key Registered
[[Page 4970]]
For User, Security Key Revoked, User Invite Sent, Temporary Password
Viewed, 2-Step Verification Turned Off, User Session Unblocked, Profile
Photo Updated, User Advanced Protection Unenroll, User Archived, User
Birthdate Changed, User Created, User Deleted, User Downgraded From
Social Media Application, User Enrolled In 2-Step Verification, User
List Downloaded, User Org Unit Changed, User Put In 2-Step Verification
Grace Period, User Renamed, User Strong Auth Unenrolled, User
Suspended, User Unarchived, User Undeleted, User Unsuspended, User
Upgraded To Social Media Application.
102. Application Authoring application audit log elements: App
synced, App edited, App added, App deleted, App invocation added, App
invocation edited, App invocation deleted, App invocation action
performed, App read call made, App bot invocation.
RECORD SOURCE CATEGORIES:
Employees; contractors; customers.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND THE PURPOSES OF SUCH USES:
Standard routine uses 1. through 9. apply. In addition:
(a) To appropriate agencies, entities, and persons when (1) the
Postal Service suspects or has confirmed that there has been a breach
of the system of records; (2) the Postal Service has determined that as
a result of the suspected or confirmed breach there is a risk of harm
to individuals, the Postal Service (including its information systems,
programs, and operations), the Federal Government, or national
security; and (3) the disclosure made to such agencies, entities, and
persons is reasonably necessary to assist in connection with the Postal
Service's efforts to respond to the suspected or confirmed breach or to
prevent, minimize, or remedy such harm.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Automated database, computer storage media, and paper.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Records relating to system administration are retrievable by user
ID.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
Records relating to system administration are retained for twenty-
four months.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
Paper records, computers, and computer storage media are located in
controlled-access areas under supervision of program personnel.
Computer access is limited to authorized personnel with a current
security clearance, and physical access is limited to authorized
personnel who must be identified with a badge.
Access to records is limited to individuals whose official duties
require such access. Contractors and licensees are subject to contract
controls and unannounced on-site audits and inspections.
Computers are protected by encryption, mechanical locks, card key
systems, or other physical access control methods. The use of computer
systems is regulated with installed security software, computer logon
identifications, and operating system controls including access
controls, terminal and transaction logging, and file management
software.
RECORD ACCESS PROCEDURES:
Requests for access must be made in accordance with the
Notification Procedure above and USPS Privacy Act regulations regarding
access to records and verification of identity under 39 CFR 266.5.
CONTESTING RECORD PROCEDURES:
See Notification Procedure and Record Access Procedures above.
NOTIFICATION PROCEDURES:
Customers wanting to know if other information about them is
maintained in this system of records must address inquiries in writing
to the Chief Information Officer and Executive Vice President and
include their name and address.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
HISTORY:
May 10th, 2021; 86 FR 24902.
* * * * *
Joshua J. Hofer,
Attorney, Ethics and Legal Compliance.
[FR Doc. 2022-01064 Filed 1-28-22; 8:45 am]
BILLING CODE 7710-12-P