#Audit log viewer pro how to

The type of user who triggered the event, either a Code42 user or a Code42 support user. The Code42 uniqueВ UIDВ (userUid) of the person who was acted upon in the event. The Code42 username of the person who was acted upon in the event. If the acting user was an API call (for example, for a Console login event), thisВ field displays details of the API.ДЇollowing are the fields that appear in the Additional event details section of the Event details panel. The public IP addressВ of the device used to triggerВ the event.Дetails of the browser and device used to trigger the event. By default,В theВ username of support users address (public) The type of user who triggered the event:В a Code42 user,В a Code42 support user, or the Code42 system.Д¬ode42 support users are users given support accessВ to your Code42 environmentВ toВ perform investigationВ and adjust settings as needed. If the acting user was a SCIMВ provisioning system (for example, for an External attributes change event), the entry appears as the provisioning provider Username credentialsВ from Code42 (forВ example, type The Code42 usernameВ of the acting userВ whoВ triggeredВ the event. To return to the list without applying any filters, click Cancel.ДЇollowing are the fields that appear in the User section of the Event details panel. Use commas to separate multiple IP addresses.Д¬lick ApplyВ to apply the selected filter criteria to the list and display only the events that match that criteria.

High risk employee alert settings changedДЇilters the events by a specific public IP addressВ involved in the event.

Departing employee departure date changed.

Departing employee alert settings changed.

See the Event typesВ section below for a descriptionВ of each event type. Select All eventsВ in a category to filterВ by all available event types in thatВ category. All eventsВ filters by all available event types.Д®vent types are organizedВ into categories. You can also select All datesВ to view all events that have been logged.ДЇilters results by event types. Select CustomВ to enter start and end dates to use to filter events.

To find those users, you can filter on the user type Code42 support user and then filter on the Add user event type.ДЇilters the list by the selected date range. By default, the Code42 support user's name is Code42 support user can create additional users that appear in the Audit Log. Select to search for events triggered by a Code42 support user.В Code42 support users are Customer ChampionsВ given support access to your Code42 environment toВ perform investigationВ and adjust settings as needed. Select to search for events triggered by aВ Code42 user. Use commas to separate multiple usernames.

When you click Apply, events that match all filters appear in the list.ДЇilters the list by events associated with a specific Code42 username. To filter the events listed in theВ Audit Log, click Filter and select the criteria to use.

#Audit log viewer pro how to

For information about how to ingest Audit Log events into Splunk, see Install and manage the Code42 Insider Threat app for Splunk.In addition to searching Audit Log events using APIs, you can also use py42 to query the Audit Log.Although event results of different event types are returned at different intervals, they are always listed in the orderВ they occurred. Event results are returned within five minutes of the event occurrence.Events that are recorded in the Audit Log can originate from actions taken in the Code42 console, Code42 APIs, an integration with Code42, or an external user provisioning system.While there is noВ limit to the number of events recorded in Audit Log, you can export only a maximum of 100,000 events at once.В To work around this limitation, see Troubleshooting.

The Audit Log records events for the last 90 days.В If you want to maintain Audit Log output for longer than 90 days, export the resultsВ to your own systems for storage.You must have the Audit Log ViewerВ role to view events in theВ Audit Log.