View Audit Logs

Select a

Time Range

to view the activity details by users in the system.

Select [ ] the columns you want to display and their order.



After selecting the columns, you can

Download

all administrator activity.

The details are in a CSV format.



View the data in the CSV file. The Prisma Cloud audit log includes the following fields, which are available for ingestion in to your security information and event management systems:

Field Name	Description
action	Contains the entire content of the audit log, which describes the actions performed by the Prisma Cloud user and details of the resource changed by the action.
user	Name of the Prisma Cloud user that performed the action.
ipAddress	IP address that the user logged-in with. If the action is a background process, which is not triggered by a user with an IP address, the placeholder Prisma Public Cloud Internal IP value is displayed.
resourceName	Prisma Cloud resource object that the activity was performed on.
resourceType	Category of the activity performed by the Prisma Cloud user. The values for this field are: Account Group Alert Config Alert Rule Alerts Anomaly Settings bridgecrew provision CidrBlock Cloud Account Cloud Accounts Data Pattern Data Profile Download Job IaC Scan iam provision Integration Investigate - Search Login Login Ip Whitelist Check Notification Template pcn provision PublicNetwork Saved Filter Secure - Policy Secure - Report Security - SAML Session Timeout SSO Bypass Management TenantConfig twistlock provision User Management User Profile User Role
result	Result of the action performed. The values for this field are: Success Successful True Failed Failure False
timestamp	Time that the Prisma Cloud audit event occurred, in epoch format and UTC timezone.