Monitor administrative activity

Monitor Cortex AgentiX management audit logs for administrative and investigative activity, filter log entries, and forward audit notifications to email, syslog, or Slack.

From Settings → Management Audit Logs, you can track the status of all administrative and investigative actions. Cortex AgentiX stores audit logs for 365 days. Use the page filters to narrow the results or manage tables to add or remove fields as needed.

To ensure you and your colleagues stay informed about administrative activity, you can configure notification forwarding to forward your Management Audit log to an email distribution list, Syslog server, or Slack channel.

The following table describes the default and optional fields that you can view in alphabetical order.

FIELD	DESCRIPTION
Email	Email address of the administrative user
Description	Descriptive summary of the administrative action. Hover over this field to view more detailed information in a pop-up tooltip. This enables you to know exactly what has changed, and, if necessary, roll back the change.
Host Name	Name of any relevant affected hosts
ID	Unique ID of the action
Result	Result of the administrative action: Success, Partial, or Fail.
Subtype	Subcategory of action
Timestamp	Time and date of the action
Type	Type of activity logged, one of the following: Issue Exclusions: Suppression of particular issues from Cortex AgentiX . Issue Fields: Modification of issue fields. Issue Layouts: Modification of issue layouts. Issue Layout Rules: Modification of issue layout rules. Issue Notifications: Modification of the format or timing of issues. Issue Rules: Modification of issue rules. API Key: Modification of the Cortex AgentiX API key. Authentication: User sessions started, along with the user name that started the session. Dashboards: Use of particular dashboards. Case Management: Actions taken on cases, issues, and artifacts in cases. Ingest Data: Import of data for immediate use or storage in a database. Integrations: Integration operations, such as integrating Slack for outbound notifications. Licensing: Any licensing-related operation. Managed Threat Hunting: Activity relating to managed threat hunting. Public API: Authentication activity using an associated Cortex AgentiX API key. Query Center: Operations in the Query Center. Remediation: Remediation operations. Reporting: Any reporting activity. Response: Remedial actions taken. For example: Isolate a host, undo host isolation, add a file hash signature to the block list, or undo the addition to the block list. Rules: Modification of rules. Rules Exceptions: Creation, editing, or deletion under Rules exceptions. SaaS Collection: Any collected SaaS data. Script Execution: Any script execution. Starred Cases: Modification of starred cases. Vulnerability Assessment: Any vulnerability assessment activity.
User Name	The user who performed the action.