Audit Logs for Notification Profiles and Incident Settings
Strata Cloud Manager records every configuration change to notification profiles and incident settings, publishing each modification to the Strata Logging Service log viewer.
| Where Can I Use This? | What Do I Need? |
|---|
|
|
- One of the following licenses:
|
Strata Cloud Manager records every create, update, and delete action for notification
profiles and incident settings, publishing these modifications to the
Strata Logging Service log viewer. To
determine who made a configuration change, which fields were modified, and when the
change occurred, use the log viewer directly within Strata Cloud Manager.
Audit logging provides complete visibility into modifications made to notification
profiles and incident settings, simplifying post-incident analysis and troubleshooting.
When alert behaviors or incident settings change unexpectedly, you can trace the
modifications to identify the exact cause and maintain operational compliance.
Each audit log entry captures the following details:
- Change type- Specifies whether the action was a create, update, or delete
action.
- Affected object- Identifies the name of the notification profile or incident
setting that changed.
- Modified fields- Lists the specific fields that changed along with their
before-and-after values. Sensitive fields such as webhook credentials, passwords,
and signing secrets are redacted in audit logs.
- User- Identifies the administrator who made the change.
- Timestamp- Records the date and time of the modification.
The following table describes all fields available in audit logs.
| Field Name | Description |
|---|
| TSG ID | The ID that uniquely identifies a Tenant Service Group (TSG) that
this log record is associated with. |
| Log Source | Identifies the origin of the data—the system that produced the
data, for example, incidents. |
| Device SN | Unique identifier of the log source. For example, if an incident
generates the log, this is the incident setting ID, for example,
ba6ffb4c-d14f-4b95-ba56-49de6. |
| Time Received | Time the log was received in Strata Logging Service. The platform
populates this field automatically. |
| Event Time | Time when the log was generated. |
| Event Name | The name associated with an event, for example,
Incident Setting UPDATE. |
| Event Details | Details about the event, including the specific fields that changed
and their before-and-after values. |
| Event Result | The result of an event, for example, success or failure. |
| Platform Type | The platform type. Valid types are VM, PA, NGFW, and Strata Cloud
Manager. |
| Device Name | Name of the log source—the setting name or notification
profile name, for example,
Test_setting_posture_LOG1. |
| Event ID | System-generated unique identifier for audit records, for example,
a4d17255-63e1-47b6-8e84-42c0d74d0f7f. |
| Event Subcategory | The sub-category of the event defined by the application, for
example, Settings or Notification Profile. |
| Event Source User UUID | The unique UUID for the user who made the change. |
| Event Source User First Name | The first name of the user who made the change. |
| Event Source User EMail | The email address of the user who made the change. |
Audit log entries are retained under a rolling six-month visibility window. Entries
older than six months expire automatically. Existing role-based access control (RBAC)
restricts access to audit log data to administrator roles.
To locate specific changes quickly, filter audit log entries by Event Category as
"Incidents" and Event Subcategory as "Settings" or "Notification Profiles". You
can also access the log viewer directly from the Settings and Notification
Profiles pages.
View Audit Logs for Notification Profiles
- In Strata Cloud Manager, select Incidents >
Incidents.
- Select Notification Profiles.
Click Notification Profiles Change Log to open Log
Viewer, pre-filtered to notification profile entries.
Review the list of audit log entries. Each entry shows the change type,
notification profile name, fields changed with before-and-after values, user
who made the change, and timestamp of the change.
View Audit Logs for Incident Settings
- In Strata Cloud Manager, select Incidents >
Incidents.
- Select Settings.
Click Settings Change Log to open Log Viewer,
pre-filtered to incident settings entries.
Review the list of audit log entries. Each entry shows the change type,
incident setting name, fields changed with before-and-after values, user who
made the change, and time stamp of the change.
You can also choose Notification Profiles or
Incident Settings in Log Viewer to display only entries
for that page. Entries older than six months are not visible.
