---
title: "Audit Logs"
slug: "audit-logs"
updated: 2026-10-01T15:52:39Z
published: 2026-10-01T15:52:39Z
canonical: "docs.redcanary.com/audit-logs"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Logs

Zscaler MDR records audit logs when a number of actions are taken by both users and the platform. The list of activities resulting in audit logs is continually growing and includes events such as the following:

- Authentication token usage
- Automation trigger and playbook execution
- Canary exporter key generation
- Email preparation and sending
- Endpoint live response actions
- Login success and failure
- Multi-factor authentication enabling/disabling
- User invitations
- User role changes

Only users with the **Admin** role can view audit logs.

## View Audit Logs

To view audit logs, click your user icon at the top right of your Zscaler MDR portal, then click **Audit Logs**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/reviewauditlogs-1_01.png?sv=2026-02-06&spr=https&st=2026-10-31T00%3A51%3A39Z&se=2026-10-31T01%3A51%3A39Z&sr=c&sp=r&sig=Xz01KzLs8dysUlaPlGWZOAat5CvlG9fj02yACgS8oyk%3D)

## Filter Audit Logs

You can filter your audit logs by attribute, and then download a CSV of the results.

1. Enter attributes in the Audit Log filter bar, and then press **Enter**.
2. Click to download a CSV of filtered logs. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/reviewauditlogs-1_02.png?sv=2026-02-06&spr=https&st=2026-10-31T00%3A51%3A39Z&se=2026-10-31T01%3A51%3A39Z&sr=c&sp=r&sig=Xz01KzLs8dysUlaPlGWZOAat5CvlG9fj02yACgS8oyk%3D)

### Supported Filter Attributes

| **Attribute** | **Description** | **Example** |
| --- | --- | --- |
| Creation Time | The date and time the audit log was created. | `created_at:2020-04-05..2020-04-08` |
| Action | The audit log action type. You can search for multiple actions at once by separating them with a vertical bar (`\|`). | `action:"Automate Playbook Executed"` `action:"Send Email"\|"Send Webhook"` |
| User | The user who executed an action. | `user:johndoe@example.com` `user:automatebot+noreply@redcanary.com` |

Dates are specified using `from..to` syntax, where `from` and `to` are date-times or ISO 8601 dates. You can omit either `from` or `to` to filter for unbounded times.

### Supported Filter Action Types

| Category | Events |
| --- | --- |
| Authentication | `"Authentication Token Reset", "Authentication Token Used", "Forced Sign Out", "Login Failure", "Login Successful", "Multi Factor Auth Disabled", "Multi Factor Auth Enabled"` |
| Automate | `"Automate Action Executed", "Automate Playbook Executed", "Automate Respond Executed", "Automate Respond Trigger Matched", "Automate Respond Trigger Rejected", "Automate Scheduling Action Execution", "Automate Scheduling Action Execution For Successful Playbook", "Automate Scheduling Playbook Execution", "Automate Trigger Executed"` |
| Integrations | `"Integration Successfully Triggered", "Integration Unsuccessfully Triggered", "Send Webhook", "Send Webhook Failure"` |
| Notifications | `"Email Prepared", "Email Sent", "SMS Message Status Changed"` |
| Security | `"Endpoint Deisolated", "Endpoint Isolated", "Endpoint Isolation Status Changed", "External Alert Confirmed Threatening", "External Alert Dismissed As Not Threat", "Hash Banned", "Live Response Isolation"` |
| User Management | `"User Added", "User Destroyed", "User Invitation Accepted", "User Invitation Sent", "User Removed", "User Role Added", "User Role Removed"` |
| Others | `"Activity Monitor Created", "Activity Monitored Deleted", "Activity Monitor Updated", "Allowed Email Domains Changed", "Application Status Changed", "Canary Exporter Keys Generated", "External Alert Source Sync Succeeded", "Live Response Command", "Password Reset", "Sso Login Failure", "Sso Login Successful"` |

## Trigger Automation Playbooks

You can use automation playbooks to trigger playbooks when an audit log is created.

1. From the navigation menu, click **Automation**.
2. Click **Configure** **new trigger** and select **When an Audit Log is created.**
3. Click **Add condition** and configure the trigger to match the desired audit log type.
4. Associate one or more playbooks to the trigger.

Learn more about taking action with [playbooks and actions](/doc/docs/key-concepts-automation).

## Support for EDR/EPP Audit Logs

Zscaler MDR collects and records audit logs from certain Endpoint Detection and Response (EDR)/Endpoint Protection Platform (EPP) platforms so you can take advantage of the Zscaler MDR API and automation features.

Carbon Black Response EDR and CrowdStrike Falcon support EPP/EDR audit log collection.

| Integration | Audit Log Support |
| --- | --- |
| Carbon Black Response EDR | For Carbon Black Response EDR deployments hosted by Zscaler MDR, the contents of the Live Response log and Endpoint Isolation log are analyzed and mapped to the endpoints and users as much as possible. The action for each audit log will be... - `live_response_command` for entries from the Live Response log. - `endpoint_isolated and endpoint_deisolated` for entries from the Endpoint Isolation log. ### |
| CrowdStrike Falcon | CrowdStrike Falcon processes and maps raw events labeled Event_UserActivityAuditEvent and Event_AuthActivityAuditEvent to endpoints and users in Zscaler MDR. The action for each audit log is based on the OperationName of the raw CrowdStrike event. |