> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/monitor-administrative-activity.md).

# Monitor administrative activity

From Settings → Management Audit Logs, you can track the status of all administrative and investigative actions. Cortex AgentiX stores audit logs for 365 days. Use the page filters to narrow the results or manage tables to add or remove fields as needed.

To ensure you and your colleagues stay informed about administrative activity, you can configure notification forwarding to forward your Management Audit log to an email distribution list, Syslog server, or Slack channel.

The following table describes the default and optional fields that you can view in alphabetical order.

| FIELD       | DESCRIPTION                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Email       | Email address of the administrative user                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Description | Descriptive summary of the administrative action. Hover over this field to view more detailed information in a pop-up tooltip. This enables you to know exactly what has changed, and, if necessary, roll back the change.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Host Name   | Name of any relevant affected hosts                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| ID          | Unique ID of the action                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Result      | Result of the administrative action: Success, Partial, or Fail.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| Subtype     | Subcategory of action                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Timestamp   | Time and date of the action                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| Type        | <p>Type of activity logged, one of the following:</p><ul><li>Issue Exclusions: Suppression of particular issues from Cortex AgentiX .</li><li>Issue Fields: Modification of issue fields.</li><li>Issue Layouts: Modification of issue layouts.</li><li>Issue Layout Rules: Modification of issue layout rules.</li><li>Issue Notifications: Modification of the format or timing of issues.</li><li>Issue Rules: Modification of issue rules.</li><li>API Key: Modification of the Cortex AgentiX API key.</li><li>Authentication: User sessions started, along with the user name that started the session.</li><li>Dashboards: Use of particular dashboards.</li><li>Case Management: Actions taken on cases, issues, and artifacts in cases.</li><li>Ingest Data: Import of data for immediate use or storage in a database.</li><li>Integrations: Integration operations, such as integrating Slack for outbound notifications.</li><li>Licensing: Any licensing-related operation.</li><li>Managed Threat Hunting: Activity relating to managed threat hunting.</li><li>Public API: Authentication activity using an associated Cortex AgentiX API key.</li><li>Query Center: Operations in the Query Center.</li><li>Remediation: Remediation operations.</li><li>Reporting: Any reporting activity.</li><li>Response: Remedial actions taken. For example: Isolate a host, undo host isolation, add a file hash signature to the block list, or undo the addition to the block list.</li><li>Rules: Modification of rules.</li><li>Rules Exceptions: Creation, editing, or deletion under Rules exceptions.</li><li>SaaS Collection: Any collected SaaS data.</li><li>Script Execution: Any script execution.</li><li>Starred Cases: Modification of starred cases.</li><li>Vulnerability Assessment: Any vulnerability assessment activity.</li></ul> |
| User Name   | The user who performed the action.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/monitor-administrative-activity.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.