This object carries the username of the person who initiated the audited action, as a variable binding in the firewall's SNMP notification. Administrators use it to attribute a specific configuration change or access event to a particular account for accountability. For example, seeing repeated audit entries from an unexpected username performing configuration changes would prompt an admin to check whether that account has been compromised.