As a Tenant Auditor, you can export the audit events shown in the Audit section of the Anaplan Administration console as a file in Common Event Format (CEF):

    1. Click Export.
      2. AuditServiceExportHighlighted
    2. If you want to specify a name for the export file other than the default, enter the name you want in the Name box.
      3. Save File popup with a filename entered in the Name box
    3. Click Save.

    Exported audit event logs contain event-specific entries with relevant information for each event, such as the user ID, tenant ID, and other information. A modified example in CEF format:

    2019-03-29T12:50:22.000Z CEF:0|Anaplan, Inc.|||USR-<num>|User login success|id=<ID> userId=<user ID> tenantId=<tenant ID> eventTimeZone=UTC createdDate=<date time stamp> createdTimeZone=UTC success=true objectId=<object ID> ipAddress=<IP address> userAgent=<user agent> Safari/537.36 checksum=<checksum>

    2019-03-29T12:50:27.000Z CEF:0|Anaplan, Inc.|||USR-13|User access model success|id=<ID> userId=<user ID> tenantId=<tenant ID> eventTimeZone=UTC createdDate=<date time stamp> createdTimeZone=UTC success=true objectId=<object ID> ipAddress=<IP address> userAgent=<user agent>checksum=<checksum>