Policies are updated regularly.
Some users get assigned access to certain devices and some will be removed.
To track what changes were made in the policy
Release : 3.4
Component : PRIVILEGED ACCESS MANAGEMENT
Syslog and session logs (Sessions > Logs) will have records of policy updates (PAM-CMN-2192 messages), creations (PAM-CMN-2193) and deletions (PAM-CMN-1484).
Note that in a cluster environment, any primary site node can perform these changes, but each node will show changes made while logged on to that node only. You will have to review the session logs of each primary site cluster node. If you have Syslog or Splunk integration, and all primary site nodes point to the same Syslog or Splunk server, you should perform your searches on the Syslog or Splunk server.
Look for following keywords.
Created policy.User: X;Host: Y
Updated policy.User: X;Host: Y
Association between user X and device Y deleted
Syslog showing creation of policy for user "CN=PAM Admin1,OU=PAM-Admins,DC=kimlabs,DC=net"
Sessions log showing Policy creation.
Syslog showing Policy Update.
Sessions log showing Policy Update
Syslog showing Policy removal.
Sessions log showing policy removal