Endpoint Activity Log on Management Server

[Prasanna]

Hi Team,

The query is regarding the Sandblast Agent Activity Logs which are visible via the Advanced Tab --> Logging --> View Logs. Refer the attachment, the details highlighted needs to be made available for forensics centrally by an administrator.

1. Are these events/logs automatically stored on the management server are well by default?
   If Yes, then where can we view these events on management server?
   If No, how can be sync these events on management server.

2. How many days of events/logs are stored on the management server by default? Or is there any way to configure this setting.

[PhoneBoy]

Presumably this information would also be available in SmartView similar to network security logs and follow the same retention rules you’ve configured for this.
Note: available disk space is a factor in how long logs are retained.