F5 Workforce AI Security supports two methods for accessing User Activity logs. These methods support different use cases and operational requirements.

Some organizations need continuous, automated export of User Activity logs to external systems such as AWS S3 buckets, Splunk, or SIEM platforms. For automated export, see the Configuring Telemetry Destinations documentation. Telemetry destinations provide real-time log delivery. This supports long-term retention, compliance archiving, and automated alerting. This is the recommended approach for production deployments that need full visibility into GenAI usage.

This document focuses on manual log exports through the Workforce AI Security admin interface. Manual exports enable admins to download filtered User Activity logs as CSV files. Admins can use these files for ad-hoc analysis, troubleshooting, or generating targeted reports. This method is ideal for investigating specific incidents or reviewing recent activity. It is also ideal for analyzing individual user behavior or creating one-time reports for stakeholders.

Admins can export User Activity logs manually. This requires admin access to the Workforce AI Security admin interface. No additional configuration or cloud permissions are required for manual downloads.

For automated telemetry export, see the Configuring Telemetry Destinations documentation for detailed prerequisites and configuration steps.

The manual export feature enables admins to download filtered User Activity logs as a file. Admins can use this file for analysis, reporting, or offline review. The export process captures all log entries that match the currently applied filters. This lets admins generate targeted exports that contain only relevant events.

Before exporting logs, admins should apply filters. This narrows the results to the desired log entries. Filters help reduce the export file size. They also ensure that the downloaded data contains only relevant information for the intended analysis.

Available filters include date range, user or actor, destination service, and policy decision. Other available filters include violations, risk level, and intent classification. Admins can combine multiple filters to create precise queries that match specific use cases. For example, this could mean exporting all blocked requests in the past week. It could also mean exporting all interactions with a specific GenAI service by a particular user.

To apply filters:

The log table updates to show only entries that match the applied filters. Admins can add multiple filters to further refine the results before exporting.

Once the desired filters are applied, the log table shows the correct entries. Admins can then download the filtered logs as a CSV file.

To download User Activity logs:

The exported CSV file includes all log fields visible in the User Activity table. It also includes additional metadata fields. The file name includes a timestamp indicating when the export was generated.

The manual export generates a CSV (comma-separated values) file. This file can be opened in spreadsheet applications such as Microsoft Excel, Google Sheets, or Apple Numbers. The file contains one row per log entry. Columns represent different log fields.

Common fields in the export include timestamp, user email, user name, destination service, and policy decision. Other common fields include violations, risk scores, intent classifications, and message content. The exact fields may vary based on the event type and policy configuration.

Organizations can import the CSV file into analysis tools or data visualization platforms. They can also import it into custom applications for further processing. The CSV format provides a simple, widely compatible format for offline analysis and reporting.

Organizations that require continuous, automated export of User Activity logs should configure telemetry destinations rather than relying on manual exports. Telemetry destinations deliver logs in real time or near-real time. They export automatically every 15 minutes and support multiple destination types. They also send full event data in structured JSON format without manual intervention.

Telemetry destinations support AWS S3 buckets for long-term storage and analytics. They also support Splunk HEC indexes for SIEM integration and real-time monitoring. They also support generic HTTPS endpoints for custom integrations with third-party platforms. Organizations can configure multiple destinations simultaneously. This sends logs to different systems for different purposes.

The Configuring Telemetry Destinations documentation has complete instructions on configuring automated telemetry export. This includes AWS connector setup, Splunk HEC token creation, and HTTPS endpoint configuration.