Monitor activities
This topic describes how to monitor and audit activity on CEM.
The audit log enables you to comply with local and federal compliance regulation that requires organizations to monitor user activity on SaaS platforms.
View audit records
You can view the audit log of user activity on the Cloud Entitlements Manager > Activities page. The following details are displayed for each record:
|
Item |
Description |
|---|---|
|
Time |
The date and time of the recorded event. |
|
User |
The user who triggered the event. Events triggered by CEM are listed under system user. |
|
Event type |
The event type. For details, see Event types. |
|
Details |
Additional information about the event. Each event type generates different details. |
Event types
Cloud Entitlements Manager generates an audit record for the following user or system activities:
The following table describes user events:
|
Activity |
Description |
|---|---|
|
User added |
A new user was added to CEM. |
|
User edited |
Edits were saved to user details. |
|
User deleted |
A user was deleted from CEM. |
|
User disabled |
A user was temporarily disabled. |
|
User enabled |
A disabled user was enabled. |
|
Signed in |
A user signed into CEM. |
|
Signed out |
A user signed out of CEM. |
|
Re-send user invitation |
An invitation to join CEM was re-sent. |
The following table describes integration events:
|
Activity |
Description |
|---|---|
|
Webhook sent |
A webhook event triggered CEM to send payload to a webhook URL. |
|
API key created |
An admin created a new API key. |
|
Entity uploaded to pending accounts. |
A user account was uploaded to pending accounts in your Privilege Cloud deployment. |
The following table describes workspace events:
|
Activity |
Description |
|---|---|
|
Workspace connected |
A user connected a workspace to CEM. |
|
Workspace edited |
A user edited workspace details. |
|
Workspace deleted |
A user deleted a workspace from CEM. |
|
Workspace connection suspended |
A user suspended a workspace from CEM. The workspace is no longer included in the scan. |
|
Workspace connection resumed |
A user resumed a suspended workspace. The workspace is included in the next scan. |
|
Workspace manually scanned |
A user initiated a scan of a specific workspace. |
|
Cloud entity marked as fix in progress |
A user marked a CEM recommendation as Fix in progress |
|
Cloud entity excluded |
A user excluded a cloud entity from the CEM scan. |
|
Workspace(s) found |
One or more workspaces were found during the last scan. |
|
Workspace disconnected |
A user disconnected a workspace from CEM. |
