Audit Events Integration with Okta System Log
Okta Privileged Access audit events integration with the Okta System Log lets Okta administrators access audit events directly through the System Log. Okta Privileged Access administrators can use this feature to view, search, and query the System Log for specific audit events and filter them based on a specific value.
All the Okta Privileged Access audit events available in the Okta System Log are documented in the Event Types page. The audit events are prefixed with the pam namespace for easy searching and selection by event types.
Prerequisites
-
Ensure that you're signed in to the Okta Admin Console.
-
Verify that you have the required permission in Okta org-wide settings. See Standard administrator roles and permissions for details.
-
You must have your Okta org connected to your Okta Privileged Access team. See Set up Okta Privileged Access.
View Okta Privileged Access audit events in the Okta System Log
-
In the Admin Console, go to .
Okta recommends assigning the lowest privileges required to view the logs, such as the Report Administrator role, to Okta Privileged Access administrators who need to view audit events in the Okta System Log.
-
Specify a date range to filter the report. Events are retained by Okta retains events for 90 days, so the earliest available starting date range is three months prior.
-
Use the search filter to find your audit events. For example, you can search "(PAM)" to list all Okta Privileged Access audit events. See System Log filters and search for more information.
-
Click the search icon to generate the report.
Results
The Okta System Log page displays the following information for each Okta Privileged Access audit event:
| Feature | Field description |
|---|---|
|
Time |
Timestamp of the event. |
|
Actor |
The user who initiated the event. |
|
Event information |
Details about the event. All audit events have the "(PAM)" prefix. |
|
Target |
App integration or user that received the event or action. Depending on the event type, there maybe one or more target type. For example, when you create a group, the group itself will be a target and the team will be another target. |