Ok, so having fought my way through getting eDir and IDM sending events, and Sentinel receiving them, I'm not fighting with UserApp. It's old (4.02). It's configured to audit, and is attempting to send events to Sentinel, but it looks like it's old enough that the signing algorythm is no longer valid (https://www.netiq.com/support/kb/doc.php?id=7017764). Other than dumbing down Sentinel to accept old signing, is there any other way to get this working?