Web application firewallZero Trust
Access activity
Inspect sign-in attempts, access decisions, and configuration changes.
Log view
- Open Zero Trust > Access activity.
- Select View event to inspect a record.
- Select Load older events to continue through the history.
Select Export all logs to download the available events as JSON.
Recorded events
Access activity includes:
- Application requests, access grants, denials, and request completion.
- Identity-provider sign-in steps and errors.
- Email code requests, policy decisions, delivery results, and verification attempts.
- Session events and configuration changes.
Records include times, request IDs, source addresses, paths, identity status, and decision reasons. Passwords, codes, cookies, tokens, and query strings are excluded.
Delivery and retention
Access activity is not sampled like normal website request events. Delivery delays can cause recent records to appear later. If an access decision cannot be recorded, new application access is blocked.
Use JSON exports for your own archive. A request interrupted before completion may have no completion event. If records appear missing, contact support with the request ID and approximate time.