Skip to main content
Version: v2.x

Cyral activity logs

Cyral maintains an audit log, called the Cyral activity Log, listing user actions carried out through Cyral. Cyral activity log records the actions of your Cyral administrators, including logins, logouts, and edits to service accounts used for Cyral SSO.

View Cyral activity logs​

To view the log, click the Cyral Activity Logs button in the lower left of the Cyral control plane UI. You must be logged in as a user with the View Audit Logs permission in order to view the logs. In the default configuration, the Super Admin role has this permission.

Cyral activity log contents​

The log shows:

  • Action: Cyral's short name for the action
  • User: Who did the action
  • Description: What the user did, such as logging in, making an administrative change, or getting an access token
  • Time: When the action was done

Export Cyral activity logs​

You can export Cyral activity logs to your SIEM platform. This export can rely on the same SIEM integration that you use to send Cyral sidecar logs (data activity logs) to your SIEM platform, or you can set up a separate SIEM integration.

Prerequisites​

  • Set up your SEIM integration

  • Verify that your Cyral control plane has network access to your SIEM platform.

    caution

    The Cyral control plane must have network connectivity to your SIEM platform in order to export activity logs.

Procedure​

Set up export of Cyral activity logs to your SIEM platform as follows:

  1. Near the bottom of the left menu panel of the Cyral control plane UI, click Cyral Activity Logs.

  2. Click Configure Log Forwarding.

  3. Click the checkbox for the SEIM that will receive Cyral audit logs.

  4. Click Save.