{
  "modelName": "Change_Analysis",
  "displayName": "Change Analysis (Deprecated)",
  "description": "This model has been deprecated.",
  "editable": false,
  "objects": [
    {
      "comment": {
        "tags": [
          "change"
        ]
      },
      "objectName": "All_Changes",
      "displayName": "All Changes",
      "parentName": "BaseEvent",
      "fields": [
        {
          "comment": {
            "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
            "ta_relevant": false
          },
          "fieldName": "dest_bunit",
          "displayName": "dest_bunit",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": false,
          "hidden": false
        },
        {
          "comment": {
            "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
            "ta_relevant": false
          },
          "fieldName": "dest_category",
          "displayName": "dest_category",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": true,
          "hidden": false
        },
        {
          "comment": {
            "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
            "ta_relevant": false
          },
          "fieldName": "dest_priority",
          "displayName": "dest_priority",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": false,
          "hidden": false
        },
        {
          "comment": {
            "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
            "ta_relevant": false
          },
          "fieldName": "src_bunit",
          "displayName": "src_bunit",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": false,
          "hidden": false
        },
        {
          "comment": {
            "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
            "ta_relevant": false
          },
          "fieldName": "src_category",
          "displayName": "src_category",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": true,
          "hidden": false
        },
        {
          "comment": {
            "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
            "ta_relevant": false
          },
          "fieldName": "src_priority",
          "displayName": "src_priority",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": false,
          "hidden": false
        },
        {
          "comment": {
            "description": "This automatically generated field is used to access tags from within data models. Add-on builders do not need to populate it.",
            "ta_relevant": false
          },
          "fieldName": "tag",
          "displayName": "tag",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": true,
          "hidden": false
        },
        {
          "comment": {
            "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
            "ta_relevant": false
          },
          "fieldName": "user_bunit",
          "displayName": "user_bunit",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": false,
          "hidden": false
        },
        {
          "comment": {
            "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
            "ta_relevant": false
          },
          "fieldName": "user_category",
          "displayName": "user_category",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": true,
          "hidden": false
        },
        {
          "comment": {
            "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
            "ta_relevant": false
          },
          "fieldName": "user_priority",
          "displayName": "user_priority",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": false,
          "hidden": false
        }
      ],
      "calculations": [
        {
          "calculationID": "All_Changes_fillnull_change_type",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The type of change, such as filesystem or AAA (authentication, authorization, and accounting).",
                "expected_values": [
                  "restart"
                ],
                "recommended": true
              },
              "fieldName": "change_type",
              "displayName": "change_type",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(change_type) OR change_type=\"\",\"unknown\",change_type)"
        },
        {
          "calculationID": "All_Changes_fillnull_command",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The command that initiated the change.",
                "recommended": true
              },
              "fieldName": "command",
              "displayName": "command",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(command) OR command=\"\",\"unknown\",if(sourcetype==\"audittrail\",Operation.\" \".ObjectName,command))"
        },
        {
          "calculationID": "All_Changes_fillnull_dest",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The resource where change occurred. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name.",
                "recommended": true
              },
              "fieldName": "dest",
              "displayName": "dest",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(dest) OR dest=\"\",\"unknown\",dest)"
        },
        {
          "calculationID": "All_Changes_fillnull_dvc",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The device that reported the change, if applicable, such as a FIP or CIM server. You can alias this from more specific fields, such as dvc_host, dvc_ip, or dvc_name.",
                "recommended": true
              },
              "fieldName": "dvc",
              "displayName": "dvc",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(dvc) OR dvc=\"\",\"unknown\",dvc)"
        },
        {
          "calculationID": "All_Changes_fillnull_object",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "Name of the affected object on the resource, such as a router interface, user account, or server volume.",
                "recommended": true
              },
              "fieldName": "object",
              "displayName": "object",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(object) OR object=\"\",\"unknown\",object)"
        },
        {
          "calculationID": "All_Changes_fillnull_object_attrs",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The attributes that were updated on the updated resource object, if applicable.",
                "recommended": true
              },
              "fieldName": "object_attrs",
              "displayName": "object_attrs",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": true,
              "hidden": false
            }
          ],
          "expression": "if(isnull(object_attrs) OR object_attrs=\"\",\"unknown\",object_attrs)"
        },
        {
          "calculationID": "All_Changes_fillnull_object_category",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "Generic name for the class of the updated resource object. Expected values may be specific to an app.",
                "expected_values": [
                  "directory",
                  "file",
                  "group",
                  "registry",
                  "user"
                ],
                "recommended": true
              },
              "fieldName": "object_category",
              "displayName": "object_category",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(object_category) OR object_category=\"\",\"unknown\",object_category)"
        },
        {
          "calculationID": "All_Changes_fillnull_object_id",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The unique updated resource object ID as presented to the system, if applicable. For example, a SID, UUID, or GUID value.",
                "recommended": true
              },
              "fieldName": "object_id",
              "displayName": "object_id",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(object_id) OR object_id=\"\",\"unknown\",object_id)"
        },
        {
          "calculationID": "All_Changes_fillnull_object_path",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The path of the modified resource object, if applicable, such as a file, directory, or volume.",
                "recommended": true
              },
              "fieldName": "object_path",
              "displayName": "object_path",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(object_path) OR object_path=\"\",\"unknown\",object_path)"
        },
        {
          "calculationID": "All_Changes_fillnull_status",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "Status of the update.",
                "expected_values": [
                  "success",
                  "failure"
                ],
                "recommended": true
              },
              "fieldName": "status",
              "displayName": "status",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(status) OR status=\"\",\"unknown\",status)"
        },
        {
          "calculationID": "All_Changes_fillnull_result",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The vendor-specific result of a change, or clarification of an action status. For example, status=failure may be accompanied by result=blocked by policy or result=disk full. Note: result is a string. Use msg_severity_id for severity ID fields that are integer data types.",
                "expected_values": [
                  "lockout"
                ],
                "recommended": true
              },
              "fieldName": "result",
              "displayName": "result",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnotnull(result) AND result!=\"\",result,if(isnotnull(signature) AND signature!=\"\",signature,\"unknown\"))"
        },
        {
          "calculationID": "All_Changes_fillnull_result_id",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "A result indicator for an action status.",
                "recommended": true
              },
              "fieldName": "result_id",
              "displayName": "result_id",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnotnull(result_id) AND result_id!=\"\",result_id,if(isnotnull(signature_id) AND signature_id!=\"\",signature_id,-1))"
        },
        {
          "calculationID": "All_Changes_fillnull_src",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The resource where the change was originated. You can alias this from more specific fields, such as src_host, src_ip, or src_name.",
                "recommended": true
              },
              "fieldName": "src",
              "displayName": "src",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(src) OR src=\"\",\"unknown\",src)"
        },
        {
          "calculationID": "All_Changes_fillnull_user",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The user or entity performing the change. For account changes, this is the account that was changed (see src_user for user or entity performing the change).",
                "recommended": true
              },
              "fieldName": "user",
              "displayName": "user",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(user) OR user=\"\",\"unknown\",user)"
        },
        {
          "calculationID": "All_Changes_vendor_product",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The vendor and product or service that detected the change. This field can be automatically populated by vendor and product fields in your data.",
                "recommended": true
              },
              "fieldName": "vendor_product",
              "displayName": "vendor_product",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "case(isnotnull(vendor_product),vendor_product,isnotnull(vendor) AND vendor!=\"unknown\" AND isnotnull(product) AND product!=\"unknown\",vendor.\" \".product,isnotnull(vendor) AND vendor!=\"unknown\" AND (isnull(product) OR product=\"unknown\"),vendor.\" unknown\",(isnull(vendor) OR vendor=\"unknown\") AND isnotnull(product) AND product!=\"unknown\",\"unknown \".product,isnotnull(sourcetype),sourcetype,1=1,\"unknown\")"
        },
        {
          "calculationID": "All_Changes_fillnull_action",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The action performed on the resource.",
                "expected_values": [
                  "acl_modified",
                  "cleared",
                  "created",
                  "deleted",
                  "modified",
                  "read",
                  "stopped",
                  "updated"
                ],
                "recommended": true
              },
              "fieldName": "action",
              "displayName": "action",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(action) OR action=\"\",\"unknown\",action)"
        }
      ],
      "constraints": [
        {
          "search": "(`cim_Change_Analysis_indexes`) tag=change"
        }
      ],
      "children": [
        
      ]
    },
    {
      "comment": {
        "tags": [
          "change",
          "audit"
        ]
      },
      "objectName": "Auditing_Changes",
      "displayName": "Auditing Changes",
      "parentName": "All_Changes",
      "fields": [
        
      ],
      "calculations": [
        
      ],
      "constraints": [
        {
          "search": "tag=audit"
        }
      ],
      "children": [
        
      ]
    },
    {
      "comment": {
        "tags": [
          "change",
          "endpoint"
        ]
      },
      "objectName": "Endpoint_Changes",
      "displayName": "Endpoint Changes",
      "parentName": "All_Changes",
      "fields": [
        
      ],
      "calculations": [
        
      ],
      "constraints": [
        {
          "search": "tag=endpoint"
        }
      ],
      "children": [
        
      ]
    },
    {
      "comment": {
        "tags": [
          "change",
          "endpoint"
        ]
      },
      "objectName": "Filesystem_Changes",
      "displayName": "Filesystem Changes",
      "parentName": "Endpoint_Changes",
      "fields": [
        
      ],
      "calculations": [
        {
          "calculationID": "Filesystem_Changes_eval_file_access_time",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The time the file (the object of the event) was accessed.",
                "recommended": true
              },
              "fieldName": "file_access_time",
              "displayName": "file_access_time",
              "type": "timestamp",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(file_access_time) OR file_access_time=\"\",0,file_access_time)"
        },
        {
          "calculationID": "Filesystem_Changes_eval_file_create_time",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The time the file (the object of the event) was created.",
                "recommended": true
              },
              "fieldName": "file_create_time",
              "displayName": "file_create_time",
              "type": "timestamp",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(file_create_time) OR file_create_time=\"\",0,file_create_time)"
        },
        {
          "calculationID": "Filesystem_Changes_eval_file_hash",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "A cryptographic identifier assigned to the file object affected by the event.",
                "recommended": true
              },
              "fieldName": "file_hash",
              "displayName": "file_hash",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(file_hash) OR file_hash=\"\",\"unknown\",file_hash)"
        },
        {
          "calculationID": "Filesystem_Changes_eval_file_modify_time",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The time the file (the object of the event) was altered.",
                "recommended": true
              },
              "fieldName": "file_modify_time",
              "displayName": "file_modify_time",
              "type": "timestamp",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(file_modify_time) OR file_modify_time=\"\",0,file_modify_time)"
        },
        {
          "calculationID": "Filesystem_Changes_eval_file_name",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The name of the file that is the object of the event (without location information related to local file or directory structure).",
                "recommended": true
              },
              "fieldName": "file_name",
              "displayName": "file_name",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(file_name) OR file_name=\"\",\"unknown\",file_name)"
        },
        {
          "calculationID": "Filesystem_Changes_eval_file_path",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The location of the file that is the object of the event, in local file and directory structure terms.",
                "recommended": true
              },
              "fieldName": "file_path",
              "displayName": "file_path",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(file_path) OR file_path=\"\",\"unknown\",file_path)"
        },
        {
          "calculationID": "Filesystem_Changes_eval_file_acl",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "Access controls associated with the file affected by the event.",
                "recommended": true
              },
              "fieldName": "file_acl",
              "displayName": "file_acl",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(file_acl) OR file_acl=\"\",\"unknown\",file_acl)"
        },
        {
          "calculationID": "Filesystem_Changes_eval_file_size",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The size of the file that is the object of the event, in kilobytes.",
                "recommended": true
              },
              "fieldName": "file_size",
              "displayName": "file_size",
              "type": "number",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnum(file_size),file_size,null())"
        }
      ],
      "constraints": [
        {
          "search": "(object_category=file OR object_category=directory)"
        }
      ],
      "children": [
        
      ]
    },
    {
      "comment": {
        "tags": [
          "change",
          "endpoint"
        ]
      },
      "objectName": "Registry_Changes",
      "displayName": "Registry Changes",
      "parentName": "Endpoint_Changes",
      "fields": [
        
      ],
      "calculations": [
        
      ],
      "constraints": [
        {
          "search": "object_category=registry"
        }
      ],
      "children": [
        
      ]
    },
    {
      "comment": {
        "tags": [
          "change",
          "endpoint"
        ]
      },
      "objectName": "Endpoint_Restarts",
      "displayName": "Endpoint Restarts",
      "parentName": "Endpoint_Changes",
      "fields": [
        
      ],
      "calculations": [
        
      ],
      "constraints": [
        {
          "search": "action=modified change_type=restart"
        }
      ],
      "children": [
        
      ]
    },
    {
      "comment": {
        "tags": [
          "change",
          "endpoint"
        ]
      },
      "objectName": "Other_Endpoint_Changes",
      "displayName": "Other Endpoint Changes",
      "parentName": "Endpoint_Changes",
      "fields": [
        
      ],
      "calculations": [
        
      ],
      "constraints": [
        {
          "search": "NOT (object_category=file OR object_category=directory OR object_category=registry OR change_type=restart)"
        }
      ],
      "children": [
        
      ]
    },
    {
      "comment": {
        "tags": [
          "change",
          "network"
        ]
      },
      "objectName": "Network_Changes",
      "displayName": "Network Changes",
      "parentName": "All_Changes",
      "fields": [
        
      ],
      "calculations": [
        
      ],
      "constraints": [
        {
          "search": "tag=network"
        }
      ],
      "children": [
        
      ]
    },
    {
      "comment": {
        "tags": [
          "change",
          "network"
        ]
      },
      "objectName": "Device_Restarts",
      "displayName": "Device Restarts",
      "parentName": "Network_Changes",
      "fields": [
        
      ],
      "calculations": [
        
      ],
      "constraints": [
        {
          "search": "action=modified change_type=restart"
        }
      ],
      "children": [
        
      ]
    },
    {
      "comment": {
        "tags": [
          "change",
          "account"
        ]
      },
      "objectName": "Account_Management",
      "displayName": "Account Management",
      "parentName": "All_Changes",
      "fields": [
        {
          "comment": {
            "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
            "ta_relevant": false
          },
          "fieldName": "src_user_bunit",
          "displayName": "src_user_bunit",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": false,
          "hidden": false
        },
        {
          "comment": {
            "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
            "ta_relevant": false
          },
          "fieldName": "src_user_category",
          "displayName": "src_user_category",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": true,
          "hidden": false
        },
        {
          "comment": {
            "description": "This field is automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. Do not define extractions for this field when writing add-ons.",
            "ta_relevant": false
          },
          "fieldName": "src_user_priority",
          "displayName": "src_user_priority",
          "type": "string",
          "fieldSearch": "",
          "required": false,
          "multivalue": false,
          "hidden": false
        }
      ],
      "calculations": [
        {
          "calculationID": "Account_Management_fillnull_dest_nt_domain",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The NT domain of the destination, if applicable.",
                "recommended": true
              },
              "fieldName": "dest_nt_domain",
              "displayName": "dest_nt_domain",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(dest_nt_domain) OR dest_nt_domain=\"\",\"unknown\",dest_nt_domain)"
        },
        {
          "calculationID": "Account_Management_fillnull_src_nt_domain",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "The NT domain of the source, if applicable.",
                "recommended": true
              },
              "fieldName": "src_nt_domain",
              "displayName": "src_nt_domain",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(src_nt_domain) OR src_nt_domain=\"\",\"unknown\",src_nt_domain)"
        },
        {
          "calculationID": "Account_Management_fillnull_src_user",
          "calculationType": "Eval",
          "outputFields": [
            {
              "comment": {
                "description": "For account changes, the user or entity performing the change.",
                "recommended": true
              },
              "fieldName": "src_user",
              "displayName": "src_user",
              "type": "string",
              "fieldSearch": "",
              "required": false,
              "multivalue": false,
              "hidden": false
            }
          ],
          "expression": "if(isnull(src_user) OR src_user=\"\",\"unknown\",src_user)"
        }
      ],
      "constraints": [
        {
          "search": "tag=account"
        }
      ],
      "children": [
        
      ]
    },
    {
      "comment": {
        "tags": [
          "change",
          "account"
        ]
      },
      "objectName": "Accounts_Created",
      "displayName": "Created Accounts",
      "parentName": "Account_Management",
      "fields": [
        
      ],
      "calculations": [
        
      ],
      "constraints": [
        {
          "search": "action=\"created\""
        }
      ],
      "children": [
        
      ]
    },
    {
      "comment": {
        "tags": [
          "change",
          "account"
        ]
      },
      "objectName": "Accounts_Deleted",
      "displayName": "Deleted Accounts",
      "parentName": "Account_Management",
      "fields": [
        
      ],
      "calculations": [
        
      ],
      "constraints": [
        {
          "search": "action=\"deleted\""
        }
      ],
      "children": [
        
      ]
    },
    {
      "comment": {
        "tags": [
          "change",
          "account"
        ]
      },
      "objectName": "Account_Lockouts",
      "displayName": "Locked Accounts",
      "parentName": "Account_Management",
      "fields": [
        
      ],
      "calculations": [
        
      ],
      "constraints": [
        {
          "search": "result=\"lockout\""
        }
      ],
      "children": [
        
      ]
    },
    {
      "comment": {
        "tags": [
          "change",
          "account"
        ]
      },
      "objectName": "Accounts_Updated",
      "displayName": "Updated Accounts",
      "parentName": "Account_Management",
      "fields": [
        
      ],
      "calculations": [
        
      ],
      "constraints": [
        {
          "search": "action=\"updated\" OR action=\"modified\""
        }
      ],
      "children": [
        
      ]
    }
  ]
}