Audit Logging in Behavior Threats
Focus
Focus
SaaS Security

Audit Logging in Behavior Threats

Table of Contents

Audit Logging in Behavior Threats

Learn about audit logging in Behavior Threats.
Where Can I Use This?What Do I Need?
  • Strata Cloud Manager
  • Data Security license
Or any of the following licenses that include the Data Security license:
  • CASB-X
  • CASB-PA
Audit logging in Behavior Threats is a central capability that tracks all administrative actions taken within the Behavioral Threats platform. The primary goal of comprehensive audit logging is to provide full compliance tracking. By ensuring that every action an admin takes is completely traceable for auditors, the platform meets the compliance standards required to operate across industries. By ensuring that administrative workflows are fully traceable for auditors, the system helps you maintain accountability and meet strict security standards. The platform automatically captures and logs the following administrative events:
  • User Risk Management: Resetting a user's risk score.
  • Watchlist Management: Creating, modifying, or deleting custom watchlists, as well as adding or removing specific users from those watchlists.
  • Policy Configuration: Modifying static policy weights and enabling or disabling policies.
  • Report Distribution:Downloading user reports and incidents.
Administrators have the ability to view, search, and download all audit logs related to behavioral threats. You can access the logs by following these steps:
  1. Select Strata Cloud ManagerLog ViewerCommonAudit.
  2. Apply a time filter, such as the "Last 7 days," to narrow down the results.
  3. Filter for the specific log source. In the Search field, type: Log source = 'Behavior Threats' or Device SN = 'Behavior Threats'.
  4. To open a specific log record, click on that log's detail icon (first column on the left).
    The log details page consists of two tabs. The general traffic details which contains 39 specific parameters including details like who performed the action, what the action was, when it happened, and other associated details.