View Administrator Activity Logs

Monitor the activity and changes made by administrators on Prisma SaaS by viewing admin activity logs.
Prisma SaaS captures actions performed by each administrator in a log so you can audit activity and track changes. If an administrator has privileges to access all apps, they can audit activity and track changes for all administrators, but a team administrator only has access to the admin activity logs for the cloud apps they monitor.
You can view the activity logs for a specific administrator or use faceted search to narrow the list of all activity logs by searching for a date range or type of event. This enables you to search for a specific type of incident or investigate incidents within a certain time frame instead of navigating through pages of unrelated events. After collecting a list of specific events for reporting purposes, you can download the results of your search by clicking
CSV
.
  • View the administrative activity logs for a specific admin.
    1. Select
      Settings
      Admin Accounts
      .
    2. Select
      View Logs
      .
      admin-activity-logs-single-admin.png
    3. Admin Audit Logs
      display the timestamp of related events, admin role, email address, IP address, event type, and event description. Use faceted search to specify a date range or event to narrow the results even further.
      admin-activity-logs-single-admin-detail.png
  • Select
    Settings
    Activity Logs
    to audit the activity for all administrators configured on Prisma SaaS.
    Use faceted search to narrow the results by specifying a date range, user email, event type, or role.
    admin-activity-logs-all-admin.png

Related Documentation