Audit logs are records of events and changes in Helix Enterprise. They are used to review user activity and to improve user efficiency, security, and performance. Audit logs document user actions on the following event types:
Alerts
Rules
Cases
Lists
Data Policies
Archive searches
Index searches
Notification settings (changes made to Alert Level on the Application Settings > Notifications page)
Notification schemes (changes made to Notification Preferences on the Application Settings > Notifications page.
Custom pattern DB files (when a file is uploaded or deleted on the Application Settings > Parsing page)
Creating, cloning, and deleting custom dashboards
Audit logs are visible to all users. Administrators can define class DOES NOT EQUAL trellix_audit as a constraint in a data policy rule to limit access to audit logs. For more information on creating and editing data policies, see Managing data policies.
To search audit logs, use class=trellix_audit and one of the event types listed above. The information in the search results includes audititemid, the alert or rule ID for example, and description, which outlines the change made by the user.
Examples
The following examples show how to search for audit logs and some of the user actions that the log can capture:
class=trellix_audit eventtype=alertThis example shows changes made by a user to alerts. Some of these changes include the state of the alert, the risk score, and who the alert is assigned to.
class=trellix_audit eventtype=ruleThis example shows changes made by a user to rules. Some of these changes include whether the rule has been enabled or disabled and any distinguishers added or removed from the rule.
class=trellix_audit eventtype=caseThis example shows changes made by a user to cases. Some of these changes include to the severity and priority of the case.