Audit Prisma Access Agent Logs

Table of Contents

Prisma Access Agent Logs and Management Logs

Lean how to audit Prisma Access Agent logs using the log viewer or Strata Logging Service.

Where Can I Use This?	What Do I Need?
Prisma Access (Managed by Strata Cloud Manager) Prisma Access (Managed by Panorama) Strata Logging Service	Minimum Required Prisma Access Version: 5.1 Preferred or Innovation Prisma Access license with the Mobile User subscription Prisma Access Agent version: 25.1.0.14 macOS 14 and later or Windows 10 version 2024 and later desktop devices Contact your Palo Alto Networks account representative to activate the Prisma Access Agent feature

You can audit any activity or action performed by a user on the Prisma Access Agent using the log viewer or Strata Logging Service. You can audit activity such as connecting and disconnecting to Prisma Access, including any state changes, such as login, configuration, tunnel, among others.

To learn how to use the log viewer, you can explore logs in detail.

Open the log viewer or Strata Logging Service.
- From Strata Cloud Manager, select Incidents & AlertsLog ViewerEndpointTroubleshooting (Prisma Access Agent):
- From Strata Logging Service, select ExploreEndpointTroubleshooting (Prisma Access Agent).
If no data is displayed, increase the time range to show more entries.
To narrow the scope of the logs in the table, you can create queries based on the column headings in the log viewer, and save the queries as filters for use later.
1. Enter a log query in the search field. Click to display a list of Prisma Access Agent fields and select an item from the list, or start typing the name of a field and select from the list of matching items.
  
  You can create a query for Prisma Access troubleshooting logs using the information in Endpoint Logs.
2. Select an operator, such as =, !=, < >, or LIKE and a value for the field. You can build on the query by adding AND or OR operators. For example, to query Windows endpoints that successfully logged out of a Prisma Access location, you can create a query such as:
  Endpoint OS Type = 'Windows' AND Event ID Value = 'gateway-logout' AND Event Status = 'success'
  
  You can use the LIKE operator to filter on values that match a pattern you provide. For example, to show all event ID values that start with gateway, you can specify:
  Event Status LIKE 'gateway%'
3. Select a different time range if needed.
4. Click the right arrow to begin the query.
5. To save the query for future use, click the filter save icon. Then, enter a descriptive Name for the query and Save the filter for future use.
6. (Optional) Export the log query results to a .csv file and download the file to your computer for further analysis with a spreadsheet app.
7. To view the details in a log, click the
  
  icon next to a log in the table to open the LOG DETAILS window.
  
  To show all the details in the log, select Log Details.