View Audit Logs
View audit logs for all the activities performed on Prisma Cloud.
As part of compliance requirement for organizations, companies need to demonstrate they are proactively tracking security issues and taking steps to remediate issues as they occur. The Prisma Cloud Audit Logs section enables companies to prepare for such audits so that they can demonstrate compliance. The Audit logs list all actions initiated by Prisma Cloud administrators. It lists who did what and when, to help you identify any configuration changes and activity initiated on a cloud account of behalf of the administrator who initiated the action. To access audit logs select .
- Select aTime Rangeto view the activity details by users in the system.
- Select (
) the columns you want to display and their order.
- After selecting the columns, you canDownloadall administrator activity.The details are in a CSV format.
- View the data in the CSV file. The Prisma Cloud audit log includes the following fields, which are available for ingestion in to your security information and event management systems:Field NameDescriptionactionContains the entire content of the audit log, which describes the actions performed by the Prisma Cloud user and details of the resource changed by the action.userName of the Prisma Cloud user that performed the action.ipAddressIP address that the user logged-in with.If the action is a background process, which is not triggered by a user with an IP address, the placeholderPrisma Public Cloud Internal IPvalue is displayed.resourceNamePrisma Cloud resource object that the activity was performed on.resourceTypeCategory of the activity performed by the Prisma Cloud user.The values for this field are:
- Account Group
- Alert Config
- Alert Rule
- Alerts
- Anomaly Settings
- bridgecrew provision
- CidrBlock
- Cloud Account
- Cloud Accounts
- Data Pattern
- Data Profile
- Download Job
- IaC Scan
- iam provision
- Integration
- Investigate - Search
- Login
- Login Ip Whitelist Check
- Notification Template
- pcn provision
- PublicNetwork
- Saved Filter
- Secure - Policy
- Secure - Report
- Security - SAML
- Session Timeout
- SSO Bypass Management
- TenantConfig
- twistlock provision
- User Management
- User Profile
- User Role
- Suppression
- Enforcement exception rule
- Enforcement default settings
- Repository
resultResult of the action performed.The values for this field are:- Success
- Successful
- True
- Failed
- Failure
- False
timestampTime that the Prisma Cloud audit event occurred, in epoch format and UTC timezone.
