View Administrator Activity Logs

Monitor the activity and changes made by administrators on Prisma SaaS by viewing admin activity logs.
Prisma SaaS captures actions performed by each administrator in a log so you can audit activity and track changes. If an administrator has privileges to access all apps, they can audit activity and track changes for all administrators, but a team administrator only has access to the admin activity logs for the cloud apps they monitor.
You can view the activity logs for a specific administrator or use faceted search to narrow the list of all activity logs by searching for a date range or type of event. This enables you to search for a specific type of incident or investigate incidents within a certain time frame instead of navigating through pages of unrelated events. After collecting a list of specific events for reporting purposes, you can download the results of your search by clicking
  • View the administrative activity logs for a specific admin.
    1. Select
      Admin Accounts
    2. Select
      View Logs
    3. Admin Audit Logs
      display the timestamp of related events, admin role, email address, IP address, event type, and event description. Use faceted search to specify a date range or event to narrow the results even further.
  • Select
    Activity Logs
    to audit the activity for all administrators configured on Prisma SaaS.
    Use faceted search to narrow the results by specifying a date range, user email, event type, or role.

Related Documentation