Reference for Creating Activity Records

The following table describes Activity Record elements.

Netwrix recommends limiting the input Activity Records file to 50MB and maximum 1,000 Activity Records.

Element	Mandatory	Datatype	Description
Activity Record main elements
RID	No	string	RID is a unique key of the Activity Record. Netwrix Auditor creates the identifier automatically when you write an Activity Record to the Audit Database. RID is included in output Activity Records only.
Who	Yes	nvarchar 255	A specific user who made the change (e.g., Enterprise\ Administrator, Admin@enterprise.onmicrosoft.com).
Action	Yes	—	Activity captured by Auditor (varies depending on the data source).
What	Yes	nvarchar max	A specific object that changed (e.g., NewPolicy).
When	Yes	dateTime	The moment when the change occurred. This field supports the following datetime formats: YYYY-MM-DDTHH:mm:ssZ (UTC), YYYY-MM-DDTHH:mm:ss+HH:mm (positive UTC offset), and YYYY-MM-DDTHH:mm:ss-HH:mm (negative UTC offset).
Where	Yes	nvarchar 255	A resource where the change occurred (e.g., Enterprise-SQL, FileStorage.enterprise.local). The resource name can be a FQDN or NetBIOS server name, Active Directory domain or container, SQL Server instance, SharePoint farm, VMware host, etc.
ObjectType	Yes	nvarchar 255	A type of affected object or its class (e.g., user, mailbox).
Monitoring Plan	No	nvarchar 255	The Auditor object that is responsible for monitoring a given data source and item. Sub-elements: Name and ID. If you provide a monitoring plan name for input Activity Records, create the plan in Netwrix Auditor, add the Netwrix API data source to the plan, and enable it for monitoring. This ensures Netwrix Auditor writes data to the database associated with this plan.
DataSource	No	nvarchar max	IT infrastructure monitored with Auditor (e.g., Active Directory). For input Activity Records, the data source is automatically set to Netwrix API.
Item	No	nvarchar max	The exact object that is monitored (e.g., a domain name, SharePoint farm name) or integration name. Sub-element: Name. Netwrix Auditor adds the item type inside the name value in brackets (e.g., enterprise.local (Domain)). For input Activity Records, Netwrix Auditor automatically sets the type to Integration; you don't need to provide it. The output Activity Records may contain various item types depending on the monitoring plan configuration: AD container NetApp Computer Office 365 tenant Domain Oracle Database instance EMC Isilon SharePoint farm Dell VNX/VNXe SQL Server instance Integration VMware ESX/ESXi/vCenter IP range Windows file share. If you provide an item name for input Activity Records, include this item in the monitoring plan within the Netwrix API data source. If you specify an item that doesn't exist, Netwrix Auditor still writes the data to the plan's database, but the data isn't available for search using the Item filter.
Workstation	No	nvarchar max	An originating workstation from which the change occurred (e.g., WKSwin12.enterprise.local).
IsArchiveOnly	No	—	IsArchiveOnly allows saving Activity Record to the Long-Term Archive only. In this case, these Activity Records will not be available for search in the Auditor client.
DetailList	No	—	Information specific to the data source, e.g., assigned permissions, before-and-after values, and start-and-end dates. References details.
Detail sub-elements (provided that DetailList exists)
PropertyName	Yes	nvarchar 255	The name of a modified property.
Message	No	string	Object-specific details about the change. Message is included in output Activity Records only.
Before	No	ntext	The previous value of the modified property.
After	No	ntext	The new value of the modified property.