Events

This topic describes the purpose of the Illumio CloudSecure product event log feature and provides a general example of how you would use it. Note that the user interface displays up to 10,000 events, removes system events older than 30 days, and removes audit events older than 365 days.

Displaying Events

Audit Events Tab

This tab shows user initiated-events such as logging in or creating a policy. You can use filtering parameters to choose what the report includes.

In the Events page, the Audit Events tab displays the following information about user-initiated events:

• Filter drop-down menu so you can search for different properties
• Success/Fail (green check mark/red X; column and filter property)
• Timestamp (column and filter property)
• Event Type (column and filter property)
  • User Login/Logout
  • User Added/Removed
  • Authentication Failure
  • Access changes (various)
  • Account changes (various)
  • Application changes (various)
• Category (column and filter property)
  • Onboarding
  • Policy
  • Labeling
• User (column and filter property)
• Details (column and filter property)
• CSP (filter property)
• Account ID (filter property)

Click a row to see the event properties, including CSP, Account ID, and Tenant ID, listed in a panel.

System Events Tab

The System Events tab displays system-initiated events such as synchronizing resources or auto-creating an application based on a discovery rule. The information listed is similar to that seen in the Audit Events tab.

Exporting an Events Report

1. Click Export on either the Audit Events or System Events tab.
2. Edit the report name and select the format.
3. Click the Scheduling Section toggle to the on position to schedule the export unless you want to export the report immediately.
4. If you choose to schedule your report, select your recurrence and time.
5. Click Save when done.
6. Go to the Generated Reports page to download the exported report.