Audit Event Queries

Use audit event queries to investigate audit data for insight into privileged activities and suspicious or anomalous activities.

Prisma Cloud ingests various services and associated user and event data from AWS, Azure, and GCP cloud services. You can investigate console and API access, monitor privileged activities, and detect account compromise and unusual user behavior in your cloud environment. Because Cloud Service Provider audit logs can be high volume, Prisma Cloud regularly evaluates these logs and filters them out if they are found to be of negligible security value; such logs are not persisted in Prisma Cloud and cannot be used in RQL queries.

To investigate events, use event from cloud.audit_logs where queries in the search box. The query uses the event data that Prisma Cloud ingested from the audit logs to help you learn who did what and when on your cloud assets. After you run audit event search queries, you can view the results in Graph View or Table View.