What types of Audit Events does Prisma Cloud capture in the Investigate Page?
1760
Created On 02/20/23 21:59 PM - Last Modified 04/17/24 20:07 PM
Question
What types of Audit Events from CloudTrail does Prisma Cloud capture in the Investigate Page?
Environment
- Prisma Cloud
- Audit Logs
Answer
Prisma Cloud doesn't ingest read only events. Most of the write events are ingested with a few exceptions.
List is a read only event.
Write could be a CreateUser event.
When running the RQL the Investigate Page will not display any results as we do not ingest that data.
In AWS: CloudTrail > Event History > ListHostedZones
In Prisma Cloud: Investigate Page > Search Audit event
Additional Information
View our documentation on Audit Logs here .