View Enterprise DLP Audit Logs on Strata Cloud Manager

View Enterprise DLP Audit Logs on Strata Cloud Manager

1. Log in to Strata Cloud Manager.
2. Select ManageConfigurationData Loss PreventionAudit Log.
3. (Optional) Filter Enterprise DLP audit logs as needed.

   • Enter an email in the search bar to filter the audit logs by user.
   • Add New Filter to filter the Enterprise DLP audit logs based on:
     • Time—Select a predefined time frame or specify a Custom time frame. For the predefine time frame, you can select Past 60 Minutes, Past 24 Hours, Past 7 Days, Past 30 Days, or All
     • Channel—Select the security enforcement point where the change occurred. You can select Enterprise DLP, NGFW, Prisma Access, SaaS Security, and Strata Cloud Manager.
     • Event—Select the type of audit log event to view. You can select Create, Update, and Delete.
4. Click View Details to see detailed information about a specific audit log.

   You can view additional audit log details to better understand what changes in your Enterprise DLP configuration. When you update an existing data pattern, data profile, or other Enterprise DLP configuration object, Enterprise DLP highlights in red what the security admin deleted and highlights in green what the security admin added or changed.

   Some audit log data displayed when you View Details include:

   • What was configured in a newly created data pattern or data profile.
   • What was updated in an existing data pattern, data profile, or DLP Rule.
   • When you create an advanced detection method like a custom document type and data dictionary.
   • When you add or update an Endpoint DLP peripheral device.
   • When you add or update an Endpoint DLP policy rule.