---
schema_version: "1"
id: 74746bd5017db22c2ff42f64f65de2b6f84c1e4babbddcc5a0319aeb82c14c33
title: Audit Trail Access Log Fields
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/mktg/264-0-0/mc_as_security_event_audit_trail.md
canonical_url: https://help.salesforce.com/s/articleView?id=mktg.mc_as_security_event_audit_trail.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 7da0a904c333fd035867bacb28a590f79492501c57150dc7bccc58c9c6f65553
description: View the audit data from the Audit Trail security event extract available in Automation Studio.
products:
  - Marketing
  - Marketing Cloud Engagement
release: "264"
---
# Audit Trail Access Log Fields

View the audit data from the Audit Trail security event extract available in Automation Studio.

## Security Event Extract Fields

This table describes the columns and values that are present in the Audit Trail Access Log.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:31.545741324921135%">
          <col style="width:68.45425867507886%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d18274e44">Column</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d18274e47">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Column" class="slds-cell-wrap" style="vertical-align:top;" headers="d18274e44 ">User</td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d18274e47 ">&nbsp;</td>

          </tr>
          <tr class="">
            <td data-label="Column" class="slds-cell-wrap" style="vertical-align:top;" headers="d18274e44 ">UserName</td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d18274e47 ">&nbsp;</td>

          </tr>
          <tr class="">
            <td data-label="Column" class="slds-cell-wrap" style="vertical-align:top;" headers="d18274e44 ">AccessDate</td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d18274e47 ">&nbsp;</td>

          </tr>
          <tr class="">
            <td data-label="Column" class="slds-cell-wrap" style="vertical-align:top;" headers="d18274e44 ">FromIP</td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d18274e47 ">The field values contain IP addresses included on allowlists.</td>

          </tr>
          <tr class="">
            <td data-label="Column" class="slds-cell-wrap" style="vertical-align:top;" headers="d18274e44 ">SecurityEventTypeID</td>

            <td data-label="Description" class="slds-cell-wrap" rowspan="2" style="vertical-align:top;" headers="d18274e47 ">See Security Events.</td>

          </tr>
          <tr class="">
            <td data-label="Column" class="slds-cell-wrap" style="vertical-align:top;" headers="d18274e44 ">SecurityEventType</td>

          </tr>
          <tr class="">
            <td data-label="Column" class="slds-cell-wrap" style="vertical-align:top;" headers="d18274e44 ">LoginStatusID</td>

            <td data-label="Description" class="slds-cell-wrap" rowspan="2" style="vertical-align:top;" headers="d18274e47 ">See Login Status.</td>

          </tr>
          <tr class="">
            <td data-label="Column" class="slds-cell-wrap" style="vertical-align:top;" headers="d18274e44 ">LoginStatusName</td>

          </tr>
          <tr class="">
            <td data-label="Column" class="slds-cell-wrap" style="vertical-align:top;" headers="d18274e44 ">UserAgent</td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d18274e47 ">The session ID associated with the access event. This column is only available
              to Advanced Audit Trail users.</td>

          </tr>
          <tr class="">
            <td data-label="Column" class="slds-cell-wrap" style="vertical-align:top;" headers="d18274e44 ">Event Source</td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d18274e47 ">The source of the access event.</td>

          </tr>
        </tbody>
      </table>

## Security Events

This table lists the possible values for SecurityEventTypeID and SecurityEventType.

  
| SecurityEventTypeID | SecurityEventType | Description |
| --- | --- | --- |
| 1 | Login Attempted | Duplicate values can be present when users log in from different machines, or when viewed using spreadsheet software that truncates milliseconds from time values. |
| 2 | Security Question Answered |   |
| 3 | Password Changed |   |
| 4 | Administrator Access | A member of the Salesforce Support team has logged in to the account as an account user. |
| 5 | Administrator Unlock | An administrator unlocked a user. |
| 6 | Redirect | For users provisioned with IMH Redirect flow, the user is redirected to CAS pages and they try to log in from Members. |
| 7 | Security Setting Changed Impersonation |   |
| 8 | Logout |   |
| 9 | Request Authorization Code |   |
| 10 | Request Token |   |

For context, review the Security Events table alongside the Login Status table. For example, a Login Attempted event (SecurityEventTypeID = 1) can have one of these statuses:

Failed (LoginStatusID = 1): The login attempt failed.

Successful (LoginStatusID = 4): The login attempt is successful.

## Login Status

This table lists the possible values for LoginStatusID and LoginStatusName.

  
| LoginStatusID | LoginStatusName | Description |
| --- | --- | --- |
| 0 | AccountDisabled | The account is disabled. |
| 1 | Failed | The login attempt failed. |
| 2 | MustChangePassword | The user's password has expired and must be changed. |
| 3 | NotSet | The login status hasn’t been set. |
| 4 | Successful | The login was successful. |
| 5 | UserAccountDisabled | The user's account is disabled. |
| 6 | InMaintenance | The login was unsuccessful because of a maintenance event. |
| 7 | UsernamePasswordLock | The user account was locked because they entered an incorrect password too many times. |
| 8 | SecurityQuestionAnswerLock | The user account was locked because they entered incorrect security question answers too many times. |
| 9 | BusinessUnitDisabled | The Business Unit account is no longer active. |
| 10 | SystemDBUnavailable | An internal database error occurred in the process of verifying a user. |
| 11 | AccountLocked | The account is locked. |
| 12 | FailedNotOnWhitelist |   |
| 13 | FailedInvalidActivationLink | The login failed because the user clicked an invalid or expired activation link. |
| 14 | FailedDeviceNotActivated | Unable to activate the device using two-factor authentication. |
| 15 | FailedDeviceNotActivateNeedMobile | The login failed because the user's device isn’t activated as required by the account's security settings, and a mobile number is required for SMS verification. |
| 16 | FailedSsoOnlyLogin | Single Sign-On (SSO) is required to log in to the account, but the user attempted to log in using a different method. |
| 17 | SecurityActivationCodeLock | The user has been locked out from using their username or password, security question or answer, and activation code. |
| 18 | MustChangePasswordNoIDV | The user must change their password. |
| 19 | InvalidCasApplication |   |
| 20 | Logout | The user logged out. |
| 21 | AppNotAuthorized | The app wasn't authorized using the OAuth2 Authorize API. |