The audit log in Trellix Wise™ for Private Cloud provides a read-only, chronological record of security and administrative activity, including analyst and agent response actions. Use the audit log to review user activity, track configuration and permission changes, and review response actions performed by analysts and agents. You can view details for individual events and filter the log to find specific activities.
The log records the following activities:
Sign-in attempts
Changes to user roles and permissions
Security configuration changes
Response actions
Trellix Wise™ for Private Cloud retains audit log entries for 7 days. The system removes entries automatically after the retention period.
View the audit log
Log in to Trellix Wise™ for Private Cloud.
Go to Settings > Logs > Audit Log.
Review the list of entries to identify the activity, user, and status.
Select an audit log entry to open the details panel.
Review the available details, including the Timestamp, Status, User, Event, Method, Endpoint, Entry ID, Request, and Response.
Scroll down to load additional entries.
Select the information icon next to the page title to view the retention period.
Filter the audit log
Enter a term in Filter to search the log.
Select Time Range to change the reporting period.
Select the filter icon in a column header to filter by Created, Action Summary, User, Role, Source, or Status.
Select Refresh to reload the list with the current filters.