Audit Events for Android Devices

Table 1. Device Events
Requirement Event Name Additional Information
FAU_ALT_EXT.2.1 Add new device
FAU_ALT_EXT.2.1 Device connected
FAU_ALT_EXT.2.1 Device disconnected
FAU_ALT_EXT.2.1 Device has not been connected for N (minutes/hours/days)
FAU_ALT_EXT.2.1 Device is missing mandatory application
FAU_ALT_EXT.2.1 Device un-enroll requested by admin
FAU_ALT_EXT.2.1 Device un-enroll requested by user
FAU_ALT_EXT.2.1 Device unenrolled By Admin
FAU_ALT_EXT.2.1 Device unenrolled By User
FAU_ALT_EXT.2.1 Package package_name version version_number has been uninstalled
FAU_ALT_EXT.2.1 Device relocated due to re-enrollment
FAU_ALT_EXT.2.1 Device's administrative access is disabled
Profile installed
Profile failed to remove
Profile failed to install, because all of its payloads cannot be installed
Profile installed by administrative action
Device security violated
Blocked incoming phone call
Blocked outgoing phone call
Custom Data configured
Data Collection configured
Device License Error
Device is in roaming
Device security configured
Encryption Level
Feature is not supported
File(s) synchronized
Geofencing Configured
Malware application detected
Malware application quarantined
Malware application quarantine reset
Malware file detected
Malware file quarantined
Malware file quarantine reset
SIM Card Changed
SIM Card Inserted
SIM Card Removed
SafetyNet Attestation Status
Terms and Conditions pushed to device
User accepted Terms and Conditions
User rejected Terms and Conditions
Table 2. Device Status Events
Requirement Event Name Additional Information
FAU_CRP_EXT.1.1 Operating System Version
Available Internal Storage
Available External Storage
Available Memory
Available System Memory
Battery Status
Cellular Carrier
IP Address
SSID
WiFi Access Point MAC Address
WiFi Signal Strength