View admin history for device transfers

Environment

• Knox Manage

Overview

On the Knox Manage console, you can find which admin transferred a device by searching for the device ID in an exported audit log.

How to find which admin transferred a device

First, you need the device ID to find the admin responsible for the device transfer.

To find the device ID:

1. On the Knox Manage console, go to Device.
2. Click the name of the device.
3. Under the Device Information tab, expand Detail.
4. Note the device ID displayed in Device ID for Knox Manage.

Next, search for the device ID in the audit log:

1. On the Knox Manage console, go to History > Audit Log.
2. Set the appropriate range for Log Data & Time.
3. In the Event field, copy and paste one of the following actions:
   • Delete Group Components (Device/User)
   • Add Group Components (Device/User)
4. Click Search. A filtered audit log appears.
5. Click Download to download the result as a ZIP file.
6. On your PC, extract the ZIP file and open the CSV file in a spreadsheet app.
7. In the Request History column, search for your device ID in the JSON object under the key entityIds. The admin ID can be viewed under User ID.