Audit Logging Enhancement for Threat Protection Policy Changes

Why is it useful?

Currently, modifications made to Threat Protection policies—such as enabling or disabling “Global Denial of Service” or other protection rules—are not recorded in the audit logs, even when all audit options (including “Policy Management”) are enabled.
Having these changes logged is critical for security compliance, traceability, and accountability. It helps administrators and auditors verify who made security-related configuration changes, when, and why. This is especially important for environments adhering to audit and regulatory standards (e.g., ISO or internal IT governance).

Who would benefit from it?

Security and Compliance Teams: To monitor and validate configuration integrity of critical security policies.

System Administrators and Auditors: To track administrative actions during audits or post-incident reviews.

Customers and Enterprises using API Gateway: To strengthen operational transparency and governance over threat protection management.

How should it work?

Whenever any configuration under Policies → Threat Protection is modified (enabled, disabled, or updated), the system should:

Generate an audit log entry capturing key details—such as the user, timestamp, action (enable/disable/update), and affected policy name.

Display the entry in the Analytics → Audit Logs section like it is doing for other policies changes.