How to Use Audit Logs

Overview

The Audit Log page is found under Reports > Audit Log.

The Audit Log page table displays activities taken in the system such as policy changes, playbook changes, etc., and enables you to view and filter this information.

• Audit logs enable traceability across the platform for your environment
• Review audit log events to see exactly which changes were made in Spirion, by whom, and at what time

What are Audit Events?

• An Audit “Event” is one discrete action the platform records, such as a user log-in, changing a role, editing a policy, or running a scan
• Audit Log events queue in PostgreSQL for Agents v13.6+ (Agents v13-13.5 use RabbitMQ) and then move to the database
• The event then continues to Audit Log table
• The Audit Log does not retain non-functional event types
• The event state must be successful to be recorded
• Any event that fails is removed from the Audit Log
• When the Type filter uses only event types triggered in Spirion Sensitive Data Platform, they are displayed on the Audit Log screen
• • See the How to Use Filters to Find an Audit Log section

How to Grant User Access to the Audit Log

• Access to the Audit Log page is limited to users of specific roles.
• To access Audit Logs, an Administrator must apply the Manage privilege in the Manage Administrative Settings area for the user. From the left side navigation menu, navigate to Settings > User Management.
• The Audit Log page is available only to users who are members of a role which contain the Manage privilege.

How to View Audit Logs

Use the following steps to view Audit Logs:

1. From the left side navigation menu, click Reports.
   
   
2. Next, click Audit Log.
   
   
3. The Audit Log page appears.
   
   

Audit Log Table Columns

The Audit Log table displays these columns:

How to Sort Table Columns

Sort your Audit Logs by table column to instantly bring your desired focus area to the top of the Audit Log table. For example, sort by date to view the oldest or the most recent Audit logs.

Use the following steps to sort table columns:

1. Click a column to sort ascending.
   
   
2. Click the column again to sort descending.
   
   

How to Search for an Audit Log

You can search for an Audit log by Account Name, Action Type, or Location.

Use the following steps to search for an audit log:

1. Enter the name of the log in the Search entry field.
   
   
2. Click the magnifying glass (search) icon or press Enter.
3. The result displays.
4. Click the x to clear the search.

How to View Audit Log Details

Use the following steps to view the details of an Audit log:

1. From the Audit Log page locate the log you want to view in the Audit Log list.
2. Click the More Options menu at the end of the column.
   
   
3. Click View Details.
   
   
4. The Log Details window opens.
   
   
5. Click Close to close the window and return to the previous screen.

How to Use Filters to Find an Audit Log

Note: The Type filter only uses and displays event types triggered in Sensitive Data Platform.

To use the filter feature to find an Audit Log based on specific criteria:

1. In the upper left of the screen, go to the Filters.
2. For the selection criteria, select one or more items from the list of filters.
3. • IP Address
   • For audits, the user's IP Address is preferred.
   • Date/Time
   • Type
   • Action Type
   • Location
   • Description
     
     
3. Click Apply to apply the filter to the Audit Log list.
   
   
4. Click Clear and then click Apply to remove the filter.