diff --git a/ProcessMaker/Events/UserRestored.php b/ProcessMaker/Events/UserRestored.php
new file mode 100644
index 0000000000..6e146ade1e
--- /dev/null
+++ b/ProcessMaker/Events/UserRestored.php
@@ -0,0 +1,66 @@
+<?php
+
+namespace ProcessMaker\Events;
+
+use Illuminate\Foundation\Events\Dispatchable;
+use ProcessMaker\Contracts\SecurityLogEventInterface;
+use ProcessMaker\Models\User;
+use ProcessMaker\Traits\FormatSecurityLogChanges;
+
+class UserRestored implements SecurityLogEventInterface
+{
+    use Dispatchable;
+    use FormatSecurityLogChanges;
+
+    private User $user;
+
+    /**
+     * Create a new event instance.
+     *
+     * @return void
+     */
+    public function __construct(User $data)
+    {
+        $this->user = $data;
+    }
+
+    /**
+     * Get specific data related to the event
+     *
+     * @return array
+     */
+    public function getData(): array
+    {
+        return [
+            'name' => [
+                'label' => $this->user->getAttribute('username'),
+                'link' => route('users.edit', $this->user),
+            ],
+            'email' => $this->user->getAttribute('email'),
+            'last_modified' => $this->user->getAttribute('updated_at'),
+        ];
+    }
+
+    /**
+     * Get specific changes without format related to the event
+     *
+     * @return array
+     */
+    public function getChanges(): array
+    {
+        return [
+            'id' => $this->user->getAttribute('id'),
+            'username' => $this->user->getAttribute('username'),
+        ];
+    }
+
+    /**
+     * Get the Event name with the syntax ‘[Past-test Action] [Object]’
+     *
+     * @return string
+     */
+    public function getEventName(): string
+    {
+        return 'UserRestored';
+    }
+}
diff --git a/ProcessMaker/Http/Controllers/Api/UserController.php b/ProcessMaker/Http/Controllers/Api/UserController.php
index da1cf4be64..9ed4e57563 100644
--- a/ProcessMaker/Http/Controllers/Api/UserController.php
+++ b/ProcessMaker/Http/Controllers/Api/UserController.php
@@ -9,6 +9,7 @@
 use ProcessMaker\Events\UserCreated;
 use ProcessMaker\Events\UserDeleted;
 use ProcessMaker\Events\UserGroupMembershipUpdated;
+use ProcessMaker\Events\UserRestored;
 use ProcessMaker\Events\UserUpdated;
 use ProcessMaker\Exception\ReferentialIntegrityException;
 use ProcessMaker\Http\Controllers\Controller;
@@ -579,6 +580,9 @@ public function restore(Request $request)
 
         if ($user instanceof User) {
             $user->restore();
+
+            // Register the Event
+            UserRestored::dispatch($user);
         }
 
         return response([], 200);
diff --git a/ProcessMaker/Providers/EventServiceProvider.php b/ProcessMaker/Providers/EventServiceProvider.php
index 57bdaf3dd4..c2ce0bdc4f 100644
--- a/ProcessMaker/Providers/EventServiceProvider.php
+++ b/ProcessMaker/Providers/EventServiceProvider.php
@@ -55,6 +55,7 @@
 use ProcessMaker\Events\UserCreated;
 use ProcessMaker\Events\UserDeleted;
 use ProcessMaker\Events\UserGroupMembershipUpdated;
+use ProcessMaker\Events\UserRestored;
 use ProcessMaker\Events\UserUpdated;
 use ProcessMaker\Listeners\SecurityLogger;
 
@@ -148,6 +149,7 @@ public function boot()
             $this->app['events']->listen(UserCreated::class, SecurityLogger::class);
             $this->app['events']->listen(UserDeleted::class, SecurityLogger::class);
             $this->app['events']->listen(UserGroupMembershipUpdated::class, SecurityLogger::class);
+            $this->app['events']->listen(UserRestored::class, SecurityLogger::class);
             $this->app['events']->listen(UserUpdated::class, SecurityLogger::class);
         }
     }
diff --git a/resources/lang/en.json b/resources/lang/en.json
index db38db4a17..ff01aa9676 100644
--- a/resources/lang/en.json
+++ b/resources/lang/en.json
@@ -1022,6 +1022,7 @@
   "UserCreated": "User Created",
   "UserDeleted": "User Deleted",
   "UserGroupsUpdated": "User Groups Updated",
+  "UserRestored": "User Restored",
   "UserUpdated": "User Updated",
   "Username": "Username",
   "User_name": "Username",
diff --git a/tests/Feature/Api/SecurityLogsTest.php b/tests/Feature/Api/SecurityLogsTest.php
index 4c6af4f780..68530713ba 100644
--- a/tests/Feature/Api/SecurityLogsTest.php
+++ b/tests/Feature/Api/SecurityLogsTest.php
@@ -6,14 +6,18 @@
 use Faker\Factory as Faker;
 use Illuminate\Support\Facades\Artisan;
 use Illuminate\Support\Facades\Auth;
+use ProcessMaker\Events\EnvironmentVariablesCreated;
+use ProcessMaker\Events\EnvironmentVariablesDeleted;
+use ProcessMaker\Events\EnvironmentVariablesUpdated;
 use ProcessMaker\Events\SettingsUpdated;
-use ProcessMaker\Events\SignalCreated;
-use ProcessMaker\Managers\SignalManager;
+use ProcessMaker\Events\UserCreated;
+use ProcessMaker\Events\UserDeleted;
+use ProcessMaker\Events\UserRestored;
+use ProcessMaker\Events\UserUpdated;
+use ProcessMaker\Models\EnvironmentVariable;
 use ProcessMaker\Models\Permission;
-use ProcessMaker\Models\Process;
 use ProcessMaker\Models\SecurityLog;
 use ProcessMaker\Models\Setting;
-use ProcessMaker\Models\SignalData;
 use ProcessMaker\Models\User;
 use ProcessMaker\Providers\AuthServiceProvider;
 use Tests\Feature\Shared\RequestHelper;
@@ -186,6 +190,8 @@ public function testSettingUpdated()
             $this->assertCount(1, $collection);
             $securityLog = $collection->first();
             $this->assertEquals('SettingsUpdated', $securityLog->getAttribute('event'));
+            $this->assertIsObject($securityLog->getAttribute('data'));
+            $this->assertIsObject($securityLog->getAttribute('changes'));
         } else {
             $this->assertCount(0, $collection);
         }