Auditing

PAM logs every action — who accessed what, who changed what, and when. This audit trail is essential for compliance reviews and incident investigation.

​

What gets logged

Each event includes:

• Timestamp — when it happened
• Actor — who did it: a user (name, email, IP address) or a machine identity, named as it’s named in your organization
• Action — what was done
• Target — what was affected
• Details — relevant context (e.g., what changed)

An identity has no email address, so its events show Machine Identity where a person’s email would be. Everything an AI agent does is logged the same way a person’s activity is.

​

Viewing audit logs

1. Go to Privileged Access Management → Audit Logs
2. Browse the log (newest first) or use filters

​

Audit logs vs session recordings

These are complementary: Audit logs track metadata — who accessed what account, when, from where. They tell you that something happened. Session recordings capture content — the actual queries and commands. They tell you what was done during the session. For a complete picture, you need both. The audit log tells you Alice accessed the orders-db at 2pm; the session recording shows you exactly what queries she ran.

​

Retention

Audit logs are retained according to your organization’s policy. Events are immutable — they can’t be modified or deleted.

​

Common use cases

Access reviews — Filter by date range to see who accessed what during a specific period. Incident investigation — Search for a specific account or user to trace actions before or after an incident. Change tracking — Filter by event type to see configuration changes (template updates, membership changes). Activity reports — Filter by actor to see everything a specific user or machine identity did. Break-glass review: Filter for PAM Access Policy Bypassed to see every grant that skipped an approver, with the reason given. Each entry names the account, the folder, and how many approvers were skipped.

​

Next steps