As a Tenant Auditor, you can export the audit events shown in the Audit section of the Anaplan Administration console as a file in Common Event Format (CEF):
- Click Export.
- If you want to specify a name for the export file other than the default, enter the name you want in the Name box.
- Click Save.


Exported audit event logs contain event-specific entries with relevant information for each event, such as the user ID, tenant ID, and other information. A modified example in CEF format:
2019-03-29T12:50:22.000Z CEF:0|Anaplan, Inc.|||USR-<num>|User login success|id=<ID> userId=<user ID> tenantId=<tenant ID> eventTimeZone=UTC createdDate=<date time stamp> createdTimeZone=UTC success=true objectId=<object ID> ipAddress=<IP address> userAgent=<user agent> Safari/537.36 checksum=<checksum>
2019-03-29T12:50:27.000Z CEF:0|Anaplan, Inc.|||USR-13|User access model success|id=<ID> userId=<user ID> tenantId=<tenant ID> eventTimeZone=UTC createdDate=<date time stamp> createdTimeZone=UTC success=true objectId=<object ID> ipAddress=<IP address> userAgent=<user agent>checksum=<checksum>