Admin Audit Logging Enhancement

Admin Audit Logging records administrative actions performed in the Forcepoint DSPM console, capturing who made a change, what changed, and when it happened.

Overview

Admin Audit Logging records the administrative actions performed in the Forcepoint DSPM console. Every time an administrator creates, updates, or deletes a configuration item in a supported module, DSPM writes an audit entry capturing who made the change, what changed, and when it happened.

The feature is designed to support two primary needs:

  • Audit trail for console activity — day-to-day compliance and governance. Any administrative action generates a log entry with the actor, the change, the timestamp, and the resulting value, available for review.
  • Security incident investigation — forensics. An analyst can query and reconstruct a timeline after an incident (for example, an unexpected reclassification or configuration change) to determine root cause and support regulatory reporting.
Note: Audit logging begins from the moment the feature is enabled. It does not retroactively capture changes made before the feature was released.

Key Concepts

The following concepts describe what audit logging captures and how it presents the history of tracked configuration items.

What is captured

When a tracked configuration item changes, DSPM records the new value of the field. The console then builds a lineage of the item so you can see how a value has changed over time across successive edits.

Change lineage

Rather than storing a full before-and-after copy of every field, DSPM stores each new value as it is committed. Viewing the lineage of an item shows the ordered history of its values, letting you trace how a configuration reached its current state.

Sensitive data handling

Credentials and other secrets are masked in the audit log. For example, when a scan account or scan configuration is created or updated, the credential values are not written in clear text.

Supported Modules and Actions

The following modules and their configuration objects are covered by admin audit logging. Each tracked object records CREATE, UPDATE, and DELETE operations unless noted otherwise.

Table 1. Supported modules and actions
Module Tracked object(s) What is logged Notes
Taxonomy Tagsets, Tags, DLP policy groups Compliance, distribution, and classification tags added, updated, or deleted; classification overrides on DSPM or endpoint DLP; classifiers enabled or disabled —
Notifications Data control rules Data control rules created, updated, or deleted Managed via webhook manager
Data source Scan accounts, Scan configurations Scan configurations created, updated, or deleted Credentials are masked
Pattern matching / Detectors Regex, Detectors Regex and detector definitions created, updated, or deleted —
FDC settings Agent settings, Plugin settings FDC settings created, updated, or deleted —
Remediation Remediation live events Remediation actions Available via Live Events Log

Who Can View Audit Logs

Access to admin audit logs is controlled by role-based access control (RBAC). The following roles can view audit logs:

Table 2. Roles with audit log access
Role Access
Super Administrator Full access to view all admin audit logs
Admin Access to view admin audit logs
Auditor Access to view admin audit logs for compliance and investigation

Users without one of these roles will not see the audit log views.

Viewing Audit Logs in the DSPM Console

Admin audit logs are viewable directly within the DSPM console. From the console you can review the recorded actions on screen and, where a value has changed over time, you may review the audit trail of each change.

Reviewing entries

  1. Navigate to Administration > Live Events > User Actions in the DSPM console.
  2. Each row represents a single administrative action, showing the user, timestamp, functionality, module, the recorded value, and the operation type.
  3. Select an item to view its change lineage and see how the value evolved across edits.

Exporting

Audit logs can be exported as a file for offline review or to submit as evidence during an audit. The same log content is also displayed on screen within the console.

Viewing Audit Logs in Grafana

In addition to the DSPM console, admin audit logs are available in Grafana. This gives auditors and analysts a dashboard-based view for querying activity and reconstructing timelines during an investigation. The underlying dataset is exposed as the user action audit log.

Log Entry Format

Each audit log entry contains the following fields:

Table 3. Audit log entry fields
Field Description / Example
User The administrator who performed the action (e.g. user1, user.2@abcd.com)
Date The date the action occurred (mm/dd/yyyy)
Functionality Name The area of the product affected (e.g. Taxonomy / <page name> / <feature name>)
Module Name The specific module or object type (e.g. Compliance tag)
Value The recorded value of the changed item (e.g. { "name": "xxx", "pattern": "XXX" })
UserActionOperationType The type of action: CREATE, UPDATE, or DELETE

Availability and Behaviour

  • Supported on both cloud and on-premises DSPM deployments.
  • Logging begins at the time the feature is enabled; historical changes are not backfilled.