> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.5/troubleshoot-and-reference/troubleshoot/management-audit-logs.md). # Management audit logs The management audit logs display a log of all administrative user interactions within Cortex XSOAR. By default, the logs are sorted by Timestamp and cover which users interacted in what way with system objects, and associated data. {% hint style="info" %} ### Note The audit logs do not include actions performed in the War Room. These actions are documented in the War Room. {% endhint %} You can filter by field, such as email, ID, user name, and type and you can save filters for later use. In addition, you can adjust the appearance of the columns and add or remove columns. To view the audit logs, go to Settings & Info → **Management Audit Logs**. To export the management audit logs as a `tsv` text-based file, click the **Export to file** button. The following are the management audit log types.
API Keys Includes the following sub types: * Add New Key * Edit Key * Delete Key
Authentication Includes the following subtypes: * Login * Logout
Licensing Includes details about the license, such as expiration and ingestion violation.
Permissions Includes user role permissions such as: * Role created * User permissions assigned * User Group created * Role deleted * User permissions revoked
Cortex Automation | Type | Sub Type | | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | **Classifier** | Incident and indicator classifier subtypes, such as add, copy, and edit subtypes. | | **Content** | Includes content bundle subtypes, such as install and download. | | **ContentPack** | Includes content pack subtypes, such as install, and delete. | | **ContributionPack** | Includes contribution content pack subtypes, such as add, edit, and delete. | | **Credentials** | Includes integration credential subtypes, such as add, edit, and delete. | | **Dashboard** | Includes dashboard subtypes such as add, edit, and delete. | | **Engine** | Includes engine subtypes such as add, edit, and delete. | | **Entry** |

Includes the following subtypes in an incident investigation:

| | **HyperProcess** | Includes the add and delete subtypes for the Hyper Process. | | **Incident** | Includes incident subtypes, such as add, edit, close, execute, and duplicate. | | **IncidentField** | Includes incident field subtypes, such as add, edit, delete, and export | | **Incident Layout** | Includes incident layout subtypes, such as add, duplicate, edit, attach, and detach. | | **IncidentType** | Includes incident type subtypes, such as attach, detach, enabled, disabled, and delete. | | **Indicator** | Includes indicator subtypes, such as edit, add, and delete. | | **IndicatorBulkEdit** | Includes the indicator bulk edit subtype, such as edit. | | **Integration permissions** | Includes the indicator permissions edit subtype. | | **Integrations** | Includes integration subtypes, such as add, edit, and delete. | | **IntegrationsConfig** | Includes integration configuration subtypes, such as add, edit, and upload. | | **Investigation** | Includes investigation subtypes, such as add, edit, and reopen. | | **Jobs** | Includes job subtypes, such as add, edit, delete, pause, and abort. | | **Layout** | Includes indicator layout subtypes, such as copy, detach, edit, attach, and detach. | | **List** | Includes list subtypes such as add, edit, and delete. | | **Playbook** | Includes playbook subtypes such as add, edit, copy, upload, and delete. | | **PreprocessRule** | Includes pre-processing rule subtypes such as add and edit. | | **Script** | Includes script subtypes such as copy, upload, edit, and delete. | | **ServerConfiguration** | Includes the server configuration edit subtype. | | **ThreatIntelReport** | Includes the Threat Intel Report subtypes such as create, edit, and delete. | | **Whitelist** | Includes the whitelist subtypes such as delete, **batchcreate**, and add. | | **Widget** | Includes the widget subtypes such as edit add and reset. |
XSOAR Migration Includes audit information about the migration from Cortex XSOAR 6 to 8, such as whether users were migrated, the cutoff date, and whether content and integrations were resynced.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.5/troubleshoot-and-reference/troubleshoot/management-audit-logs.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.