Which event log subtype captures FortiSASE SSL VPN user creation?

FortiSASE writes any change to a user account—add, delete, modify—in the User Events log subtype. The log field subtype=user is triggered when an SSL VPN account is first created in the service, so that creation event is stored in the User Events category, not in VPN, Endpoint, or Administrator logs.

A. Endpoint Events – records device posture/agent status, not identity-management actions.

B. VPN Events – captures connection and tunnel status (connect, disconnect, renegotiate), not account provisioning.

D. Administrator Events – logs admin logins and configuration changes, but user objects created by the authentication service are recorded under User Events.

1. Fortinet “FortiSASE Log Reference 24.1”

Table 3-2 “Event log subtypes”

pg. 18 – ‘user: user creation / deletion / update’.

2. Fortinet “FortiSASE Administration Guide 24.1”

§12.3 “Viewing Event Logs”

pg. 137 – “User Events show when a user is created

removed

or modified

including first-time SSL VPN user creation.”

3. Fortinet “FortiOS 7.4 Log Message Reference”

Chapter ‘event’

entry subtype=user (accounts)

pg. 144 – lists logid 0100040002 “User created”.