Explorer III

Solved

Sample Audit Log Notify

Forum|Forum|4 months ago
January 26, 2026
2 replies
224 views

Hello All,

We would like to receive audit log activities via email at specific intervals for specific users. When we tried using a notification rule, it only allowed us to select individual statuses. Has anyone tried this before? We are also open to hearing about any different notification rules you have used.

Thanks in advance

Best answer by sahirrao

Hi @adem_netsys
Kindly refer to the attached sample playbook, which is expected to satisfy your requirements.

Staff

Hello @adem_netsys

Can you forward the logs using the 'Log Forwarding' option to a syslog server and then perform automation directly from there? Would that help?

adem_netsysAuthor

Explorer III

Actually, we can see the audit logs on SOAR. Can't we retrieve them via the API, or if there is an API endpoint, we could use a code snippet?

Staff

Hi @adem_netsys
Kindly refer to the attached sample playbook, which is expected to satisfy your requirements.

adem_netsysAuthor

Explorer III

Hi @sahirrao,

Thank you your response. This is exactly what I wanted.