Audit Logs
Audit logs represent user, object, or setting events in your organization. Specific events related to all users identified in your Exabeam Security Operations Platform are logged, including activities within the user interface and configuration activities. This is especially useful for reviewing activities for audits (for example GDPR).
Note
Internal audit logs of activity performed by Exabeam employees supporting customer environments are not available for customer consumption.
Exabeam stores all audit logs and provides a query interface in Search that you can use to find and export audit logs.
Note
For information on setting retention limits for your audit logs, see Global Log Retention in the Exabeam Search Guide.
Types of Audit Logs
The following table displays the types of events captured in the audit log for the Exabeam Security Operations Platform by feature area. Each event also has an associated activity type—as defined in the common information model—that references additional, granular fields that you can use to search your audit logs. For each event, the activity type is displayed in parentheses.
Feature | Events |
|---|---|
API Settings |
|
Authentication |
|
Cloud Collectors |
|
Context Management |
|
Correlation Rules |
|
Dashboards |
|
Dashboard Visualizations |
|
Role Settings |
|
Search |
|
SSO Settings |
|
Threat Center |
|
User Settings |
|
Audit Log Visibility
To access audit logs, use the Search app available from the Exabeam Security Operations Platform. From Search, you can view all audit logs over a specific time period and search for specific audit log types. For ease of use, an Audit Logs tab is accessible in the Search query builder. For information about using the Audit Logs tab, see Basic Search in the Search Feature Guide.
In the common information model, all audit logs are assigned to the Exabeam vendor and Audit Log product.
For example, to search for events related to case modification events in Threat Center, use the following parameters in your Search query:
vendor:
Exabeamproduct:
Audit Logactivity_type:
case-modify
 |