@DharmaReddy The Log-SecurityAudit class in Pega automatically stores security-related events like logins, logouts, failed authentication attempts, and security policy changes. The data is populated by Pega's internal security mechanisms at the platform level, not through rules like activities or data transforms, so a "contains" search won't show the source. When a security event occurs, the Pega engine records it in the pr_log_securityaudit database table, which is linked to the Log-SecurityAudit class through a Data-Admin-DB-Table mapping. Events can be triggered by actions such as incorrect passwords or privilege changes. If you need to trace this data, you can enable Security Event Logging under system settings or check the pr_log_securityaudit table directly in the database. This logging is primarily controlled by platform-level configurations and cannot be modified directly within the Pega UI