Download a CSV with identity provider activity

Complete this procedure to download a CSV that contains identity provider activity. Each table shows the latest 500 connections. However, you can download a CSV file to see up to 50,000 of the most recent activity based on the filters you applied.

You must be an ETP super administrator or a user with a specific permission to view this report. For more information, see Enterprise Threat Protector roles.

How to

  1. In the navigation menu, select Monitoring > Activity. Click the Identity Provider Activity tab.
    Note: If you are trying the new Enterprise Center interface, in the navigation menu, select Threat Analytics > Activity > Identity Provider Activity.
  2. Filter activity as needed.
    1. To filter data based on date and time, see Filter data based on date and time.
    2. To create a filter and add data to the filter, see Configure and apply a filter and Add identity provider activity data to a filter.
  3. To add or remove data columns to the activity table, see Add or remove data columns to the identity provider activity data table.
  4. Click Download CSV (Identity Provider Activities).