I’m looking into specific categories of logs (authentication logs, create/change/revoke perms, group membership changes, privileged access logs) in order to monitor those specifics behaviors.
Is there any guidance available about the fields to filter the logs for, to obtain the above set/categories ?
Audit log’s categories are present in audit.3 logs but not all audit.2 logs are tagged with those categories, while (as of today) audit.2 is still the recommended logs to analyze.
https://www.palantir.com/docs/foundry/security/audit-log-categories/