Audit Logs and Traceability
Review audit log details for registered agent actions, understand current limitations
of Agent Identity Security, and find solutions for common configuration and authentication
issues.
| Where Can I Use This? | What Do I Need? |
|---|
- Prisma AIRS — Agent Identity Security (US East region)
|
- Agent Identity Security module licensed and activated via Strata
Cloud Manager
- AI Gateway activated with at least one data plane instance
running
- Enterprise IdP (Okta or Microsoft Entra ID) federated with
CyberArk Idira
- User directory synced to AI Gateway via Cloud Identity Engine
(CIE)
|
Every action performed through a registered agent is logged with full
attribution, allowing you to trace any sequence of tool calls back to a specific agent,
user, and task. In your Strata Cloud Manager console, go to AI Security >
Agent Identity > Audit Logs.
Each log entry includes:
Audit logs are delivered with a maximum delay of 1 minute, enabling
near-real-time investigation of agent behavior during and after incidents.
Agent authentication events are managed through the
Idira Audit Service.
To view these logs within Idira, users must have the
Auditor role assigned in
Idira Identity. For centralized monitoring, Idira audit logs can be integrated directly
with your enterprise SIEM system. Idira supports integrating Audit with SIEM
applications so that you can monitor your services audit events in any third-party SIEM
application. For more information, see
centralized monitoring and
Export audit activities to SIEM applications.
