Management audit log messages - Administrator Guide - Cortex XSIAM - Cortex

Management audit log messages - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product

Cortex XSIAM

Creation date

2024-03-06

Last date published

2025-03-20

Category

Administrator Guide

Abstract

View the types of Cortex XSIAM management audit log messages that are sent.

Cortex XSIAM management audit log messages are sent based on the various log types, for example, Action Center, Alert Rules, or Authentication. It is recommended that you review the subtype, status, and informational fields for each message.

Action Center
Agent Configuration
Agent Exception Rules
Alert Exclusion
Alert Management
Alert Notifications
Alert Rules
Alert Exclusions
Allowed Domains
API Key
Apps
Asset Inventory
Asset Roles
Asset Tag Rules
Asset Uploads
Authentication
Automation Rules
Automation Settings
Broker API
Broker VMs
Business Unit Change
SaaS Collection
Custom Fields
Dashboards
Datasets
Dataset Views
Data Retention
Device Control Custom Device
Device Control Permanent Exceptions
Extensions Policy Rules
Device Control Profile
Device Control Temporary Exceptions
Agent Installation
EDL Management
Effective IP Ranges
Endpoint Groups
Endpoint Administration
Event Forwarding
Device Control Violations
Device Permanent Exceptions
Device Temp Exceptions
Disk Encryption Visibility
Featured Alert Fields
Forensics
Global Exceptions
Host Insights
Disk Encryption Profile
Host Firewall
Host Firewall Profile
Incident Domains
Incident Layout Rules
Incident Management
Incident Properties
Incident Timeline Event
Indicator rules
Ingest Data
Integrations
Layout Rules
Licensing
Live Terminal
Lookups
Managed Detection & Response
MSSP
Managed Threat Hunting
Permissions
Playbook Triggers
Policy & Profiles
Prevention Policy Rules
Prisma Integration
Extensions Profile
Public API
Query Center
Query Library
Remediation
Remediation Path Rules
Reporting
Response
Rules
Rules Exceptions
Scoring Rules
XDR Collector Configuration
XDR Collectors Groups
XDR Collectors Policy
XDR Collectors Profile
Script Execution
Security Settings
Server Settings
Starred Incidents
Support
System
Tenant Takeover
Vulnerability Assessment
Vulnerability Tests
XCloud Integration
XDM Config
XQL Parsing Rules
Public API
Cortex Automation
- Sub Type—Command - War Room
  - Status—Success
  - Severity—Informational
  - Details— IncidentID:({ID}), IncidentType:({type}), IncidentName:({name}), Command:({command}), Arguments:({arg1})="arg1val" ({arg2})="arg2val" ({argn})="argnval", ID: ({num})
- Sub Type—Command - Playground
  - Status—Success
  - Severity—Informational
XSOAR Migration