> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/audit-trail.md).

# Audit Trail

The audit trail displays a log of all administrative user interactions with Cortex XSOAR. The log is sorted by date and covers which users interacted in what way with system objects, and associated data. The audit trail does not include actions performed in the war room. These actions are documented in the War Room.

You can search the audit trail log for user interactions based on free text.

To view an audit trail, navigate to Settings → ADVANCED → **Audit Trail**.

To customize which columns are visible in the audit trail log, click the table settings button.

To export the audit trail log, use the **/settings/audits** endpoint from the Cortex XSOAR REST API. See the Cortex XSOAR REST API documentation.

**Extract a Day’s Audit Trail**

You can write a script that runs daily to extract that day's audit trail, and upload it to your SIEM with uploader programs. The following is an example of a curl command that will fetch all audits from June 22, 2017 and later - up to 10,000 actions.

**` curl -k -X POST https://`` `` `*****`<IP>`*****` :`` `` `*****`<PORT>`*****` /settings/audits -H 'accept: application/json' -H 'authorization:`` `` `*****`<API KEY>`*****`' -H 'content-type: application/json' -d '{"size" : 10000,"query": "modified:>2017-06-22T00:00:00"}'`**

**Purge Audit Entries**

You can define the retention period of the audit trail. To purge periodically, add a server setting in Settings → About → **Troubleshooting** where the key is:

* **`demisto.audits.purge`**

  True will start the purging process.
* **`demisto.audits.purge.retention`**

  The value is the number of days to save the log. Default is 365.

To define how often to check the audit trail log, in Settings → About → **Troubleshooting** add **`demisto.audits.purge.delay`** where the value is how often to run the retention (**`demisto.audits.purge.retention`**). The default is every 24 hours.

Purging can also be done manually. The following is an example of a curl command that will purge all audits from June 22, 2017 to June 30, 2017.

**` curl -k -X POST https://`` `` `*****`<IP>`*****` :`` `` `*****`<PORT>`*****` /settings/audits/purge -H 'accept: application/json' -H 'authorization:`` `` `*****`<API KEY>`*****`' -H 'content-type: application/json' -d '{"page": 0, "size": 100,"fromDate": "2017-07-22T09:01:08.462954465+03:00","toDate": "2017-07-30T12:23:08.462954597+03:00","period": {"by": "","toValue": null, "fromValue": null, "field": "" }, "fromDateLicense": "0001-01-01T00:00:00Z"}'`**

The following table describes components and actions

| Component                       | Actions                                                                                                                                                                                                                                                                                                                                                                                                                  |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **`Account`**                   | <ul><li><strong><code>block</code></strong></li><li><strong><code>unblock</code></strong></li><li><strong><code>add</code></strong></li><li><strong><code>delete</code></strong></li><li><strong><code>stop</code></strong></li><li><strong><code>start</code></strong></li></ul>                                                                                                                                        |
| **`API keys`**                  | <ul><li><strong><code>delete</code></strong></li><li><strong><code>add</code></strong></li></ul>                                                                                                                                                                                                                                                                                                                         |
| **`App Server`**                | <ul><li><strong><code>restart</code></strong></li></ul>                                                                                                                                                                                                                                                                                                                                                                  |
| **`Backup`**                    | <ul><li><strong><code>edit</code></strong></li></ul>                                                                                                                                                                                                                                                                                                                                                                     |
| **`Canvas`**                    | <ul><li><strong><code>add</code></strong></li><li><strong><code>edit</code></strong></li><li><strong><code>delete</code></strong></li></ul>                                                                                                                                                                                                                                                                              |
| **`Classifier`**                | <ul><li><strong><code>add</code></strong></li><li><strong><code>copy</code></strong></li><li><strong><code>edit</code></strong></li></ul>                                                                                                                                                                                                                                                                                |
| **`Content`**                   | <ul><li><strong><code>install</code></strong></li></ul>                                                                                                                                                                                                                                                                                                                                                                  |
| **`Content Pack`**              | <ul><li><strong><code>edit</code></strong></li><li><strong><code>delete</code></strong></li></ul>                                                                                                                                                                                                                                                                                                                        |
| **`Contribution Pack`**         | <ul><li><strong><code>add</code></strong></li><li><strong><code>edit</code></strong></li><li><strong><code>delete</code></strong></li></ul>                                                                                                                                                                                                                                                                              |
| **`Credentials`**               | <ul><li><strong><code>add</code></strong></li><li><strong><code>edit</code></strong></li><li><strong><code>delete</code></strong></li></ul>                                                                                                                                                                                                                                                                              |
| **`Dashboard`**                 | <ul><li><strong><code>add</code></strong></li><li><strong><code>delete</code></strong></li><li><strong><code>edit</code></strong></li></ul>                                                                                                                                                                                                                                                                              |
| **`Engine`**                    | <ul><li><strong><code>add</code></strong></li><li><strong><code>edit</code></strong></li></ul>                                                                                                                                                                                                                                                                                                                           |
| **`Entry`**                     | <ul><li><strong><code>restore</code></strong></li><li><strong><code>delete</code></strong></li><li><strong><code>removeentrypermanently</code></strong></li><li><strong><code>edit</code></strong></li></ul>                                                                                                                                                                                                             |
| **`Execute`**                   | <ul><li><strong><code>add</code></strong></li></ul>                                                                                                                                                                                                                                                                                                                                                                      |
| **`Host`**                      | <ul><li><strong><code>delete</code></strong></li><li><strong><code>downloadconf</code></strong></li><li><strong><code>add</code></strong></li></ul>                                                                                                                                                                                                                                                                      |
| **`HyperProcess (reputation)`** | <ul><li><strong><code>add</code></strong></li><li><strong><code>delete</code></strong></li></ul>                                                                                                                                                                                                                                                                                                                         |
| **`Incident`**                  | <ul><li><strong><code>edit</code></strong></li><li><strong><code>close</code></strong></li><li><strong><code>execute</code></strong></li><li><strong><code>delete</code></strong></li><li><strong><code>duplicate</code></strong></li><li><strong><code>notcreated</code></strong></li><li><strong><code>add</code></strong></li></ul>                                                                                   |
| **`Incident field`**            | <ul><li><strong><code>add</code></strong></li><li><strong><code>edit</code></strong></li><li><strong><code>delete</code></strong></li></ul>                                                                                                                                                                                                                                                                              |
| **`Incident type`**             | <ul><li><strong><code>attach</code></strong></li><li><strong><code>detach</code></strong></li><li><strong><code>disable</code></strong></li><li><strong><code>enable</code></strong></li><li><strong><code>delete</code></strong></li><li><strong><code>edit</code></strong></li><li><strong><code>add</code></strong></li></ul>                                                                                         |
| **`Indicator`**                 | <ul><li><strong><code>edit</code></strong></li><li><strong><code>add</code></strong></li><li><strong><code>delete</code></strong></li></ul>                                                                                                                                                                                                                                                                              |
| **`Indicator bulk edit`**       | <ul><li><strong><code>edit</code></strong></li></ul>                                                                                                                                                                                                                                                                                                                                                                     |
| **`Integration permissions`**   | <ul><li><strong><code>edit</code></strong></li></ul>                                                                                                                                                                                                                                                                                                                                                                     |
| **`Integrations`**              | <ul><li><strong><code>add</code></strong></li><li><strong><code>delete</code></strong></li><li><strong><code>edit</code></strong></li></ul>                                                                                                                                                                                                                                                                              |
| **`Integrations Config`**       | <ul><li><strong><code>add</code></strong></li><li><strong><code>edit</code></strong></li><li><strong><code>delete</code></strong></li><li><strong><code>upload</code></strong></li></ul>                                                                                                                                                                                                                                 |
| **`Investigation`**             | <ul><li><strong><code>close</code></strong></li><li><strong><code>reopen</code></strong></li><li><strong><code>edit</code></strong></li><li><strong><code>add</code></strong></li></ul>                                                                                                                                                                                                                                  |
| **`Invite`**                    | <ul><li><strong><code>add</code></strong></li><li><strong><code>utilized</code></strong></li><li><strong><code>delete</code></strong></li></ul>                                                                                                                                                                                                                                                                          |
| **`Jobs`**                      | <ul><li><strong><code>add</code></strong></li><li><strong><code>edit</code></strong></li><li><strong><code>disable</code></strong></li><li><strong><code>enable</code></strong></li><li><strong><code>delete</code></strong></li><li><strong><code>pause</code></strong></li><li><strong><code>resume</code></strong></li><li><strong><code>runnow</code></strong></li><li><strong><code>abort</code></strong></li></ul> |
| **`Layout`**                    | <ul><li><strong><code>add</code></strong></li><li><strong><code>copy</code></strong></li><li><strong><code>edit</code></strong></li></ul>                                                                                                                                                                                                                                                                                |
| **`License`**                   | <ul><li><strong><code>invalid</code></strong></li></ul>                                                                                                                                                                                                                                                                                                                                                                  |
| **`List`**                      | <ul><li><strong><code>edit</code></strong></li><li><strong><code>add</code></strong></li><li><strong><code>delete</code></strong></li></ul>                                                                                                                                                                                                                                                                              |
| **`Live Backup`**               | <ul><li><strong><code>switch</code></strong></li><li><strong><code>add</code></strong></li><li><strong><code>delete</code></strong></li></ul>                                                                                                                                                                                                                                                                            |
| **`Login`**                     | <ul><li><strong><code>failure</code></strong></li><li><strong><code>in</code></strong></li><li><strong><code>out</code></strong></li><li><strong><code>outall</code></strong></li><li><strong><code>outmyself</code></strong></li><li><strong><code>outmyselfothersessions</code></strong></li><li><strong><code>outuser</code></strong></li></ul>                                                                       |
| **`Logout`**                    | <ul><li><strong><code>failure</code></strong></li></ul>                                                                                                                                                                                                                                                                                                                                                                  |
| **`Marketplace Register`**      | <ul><li><strong><code>create</code></strong></li></ul>                                                                                                                                                                                                                                                                                                                                                                   |
| **`Password policy`**           | <ul><li><strong><code>edit</code></strong></li></ul>                                                                                                                                                                                                                                                                                                                                                                     |
| **`Playbook`**                  | <ul><li><strong><code>add</code></strong></li><li><strong><code>edit</code></strong></li><li><strong><code>attach</code></strong></li><li><strong><code>detach</code></strong></li><li><strong><code>upload</code></strong></li><li><strong><code>copy</code></strong></li><li><strong><code>delete</code></strong></li></ul>                                                                                            |
| **`Preprocess rule`**           | <ul><li><strong><code>edit</code></strong></li><li><strong><code>add</code></strong></li></ul>                                                                                                                                                                                                                                                                                                                           |
| **`Propagation label`**         | <ul><li><strong><code>delete</code></strong></li><li><strong><code>add</code></strong></li><li><strong><code>edit</code></strong></li></ul>                                                                                                                                                                                                                                                                              |
| **`RemoteDB`**                  | <ul><li><strong><code>download</code></strong></li><li><strong><code>enable</code></strong></li><li><strong><code>disable</code></strong></li><li><strong><code>add</code></strong></li><li><strong><code>create</code></strong></li></ul>                                                                                                                                                                               |
| **`Role`**                      | <ul><li><strong><code>add</code></strong></li><li><strong><code>edit</code></strong></li><li><strong><code>delete</code></strong></li></ul>                                                                                                                                                                                                                                                                              |
| **`Script`**                    | <ul><li><strong><code>copy</code></strong></li><li><strong><code>upload</code></strong></li><li><strong><code>edit</code></strong></li><li><strong><code>add</code></strong></li><li><strong><code>delete</code></strong></li></ul>                                                                                                                                                                                      |
| **`Server Configuration`**      | <ul><li><strong><code>edit</code></strong></li></ul>                                                                                                                                                                                                                                                                                                                                                                     |
| **`Task`**                      | <ul><li><strong><code>add</code></strong></li><li><strong><code>copy</code></strong></li></ul>                                                                                                                                                                                                                                                                                                                           |
| **`Telemetry`**                 | <ul><li><strong><code>edit</code></strong></li></ul>                                                                                                                                                                                                                                                                                                                                                                     |
| **`User`**                      | <ul><li><strong><code>edit</code></strong></li><li><strong><code>lockout</code></strong></li><li><strong><code>unlock</code></strong></li><li><strong><code>add</code></strong></li><li><strong><code>enable</code></strong></li><li><strong><code>setpassword</code></strong></li></ul>                                                                                                                                 |
| **`Whitelist`**                 | <ul><li><strong><code>delete</code></strong></li><li><strong><code>batchcreate</code></strong></li><li><strong><code>add</code></strong></li></ul>                                                                                                                                                                                                                                                                       |
| **`Widget`**                    | <ul><li><strong><code>edit</code></strong></li><li><strong><code>add</code></strong></li><li><strong><code>reset</code></strong></li></ul>                                                                                                                                                                                                                                                                               |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/configure-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/audit-trail.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.