Admin Activity

Introduction

This article describes how to provide a full audit trail for changes applied to your Harmony SASE configuration to better allow administrators to investigate related issues and satisfy compliance audits. Whether it be tracking the creation of Networks and groups, down to understanding changes made to firewall rules, Admin Activity provides quick and easy visibility into the actions of your Admins to paint a full picture of changes made to your Harmony SASE platform.

Steps

To view Admin activity, select Monitor & Logs and then Admin Activity in the Management Platform on the left side.
You’ll see a list of Admins, along with a listing of their latest activity on the platform, Networks they may have modified, and IP they were connected from at the time of the change.
In the menu at the top of the screen, you can sort activities by type, member (admin), time range, and network. You can even export this data if you wish.

List of Auditable actions

Auditable Actions

Application
Application created
Application creation failed
Application deleted
Application changed
Application enabled
Application disabled
Policy created
Policy deleted
Policy changed

Support Access
Support access granted
Support access revoked

Role
Role assigned
Password
Password reset
Password changed

Group
Group created
Group updated
Group deleted
Group member added
Group member deleted
Group network added
Group network deleted

Monitor & Logs
Web activity report exported
Active sessions report exported

Member
Member invited
Member deleted
Exported members list
Member created
Member update
Member Profile update

Billing
Subscription cancelled
Subscription activated
Subscription reactivated
Plan changed
Payment method updated

License
Member license purchased
Member license removed
Gateway license purchased
Gateway license removed

Add-On
Add-on purchased

Integration
Integration created
Integration enabled
Integration disabled
Integration deleted

Api Key
Api key created
Api key deleted

Access Policy
Access Policy rule added
Access Policy rule updated
Access Policy rule deleted
Access Policy rule priority updated
Access Policy rule status updated

Bypass Rules
Bypass rule added
Bypass rule updated
Bypass rule deleted
Bypass rule priority updated

Configuration Profile
Configuration Profile added
Configuration Profile updated
Configuration Profile deleted
Trusted wired network added
Trusted wired network deleted
Trusted wired network disabled
Trusted wired network enabled
Trusted WiFi network added
Trusted WiFi network deleted

Identity Provider
Identity provider created
Identity provider updated
Identity provider disabled
Identity provider deleted
SCIM integration enabled
SCIM integration disabled
SCIM token create

Login
Account unblocked

Objects
Address updated
Address deleted
Address added
Service added
Service updated
Service deleted
Custom URL added
Custom URL updated
Custom URL deleted

Posture Check
Posture profile update
Posture profile created
Posture profile deleted
Posture profile check failed

Network
Network created
Network updated
Network creation failed
Network deleted
Region created
Region deleted
Gateway created
Custom gateway created
Gateway deleted
Gateway restarted
Tunnel created
Gateway state changed
Tunnel updated
Tunnel deleted
DNS filtering updated
DNS filtering deleted
Private DNS updated
Private DNS enabled
Private DNS disabled
Regional private DNS updated
Regional private DNS enabled
Regional private DNS disabled
Custom network created
Custom network creation failed
Custom region created
Network Split Tunneling
Network groups changed

Firewall
Firewall rules updated
Firewall rules update failed
Firewall rule added
Firewall rule updated
Firewall rule priority updated
Firewall rule deleted

Support Contacts