The administrator wants to review the Console audit logs from within the Console. Which page in the Console should the administrator use to review this data, if it can be reviewed at all?

Prisma Cloud records all administrative actions performed within the Console, creating an audit trail for security and compliance. This includes user logins, policy modifications, and rule creation. To review these logs directly within the user interface, an administrator must navigate to the 'History' page, which is located under the 'Manage > View Logs' section of the Console.

A. Navigate to Monitor > Events > Host Log Inspection: This page is for viewing logs collected by Defenders from protected hosts, not for viewing the Console's own audit logs.
B. The audit logs can be viewed only externally to the Console: This is incorrect. While logs can be forwarded to external systems like a SIEM, they are also viewable directly within the Prisma Cloud Console.
C. Navigate to Manage > Defenders > View Logs: This section provides access to the operational logs of the Defender agents themselves, not the audit trail of user actions on the Console.

1. Palo Alto Networks

Prisma Cloud Administrator's Guide (SaaS)

"Audits". This section describes the audit logging capabilities and specifies the navigation path. It states

"To view a history of events

go to Manage > View Logs > History."

2. Palo Alto Networks

Prisma Cloud Docs

"Console audit trail". The documentation confirms that "Prisma Cloud maintains an audit trail of all actions performed in Console" and that these can be viewed on the Manage > View Logs > History page.