Option A establishes an external record before portal retention expires. Zscaler’s Log Streaming Service documentation states that LSS supports third-party SIEM integration and includes audit-log information among its supported content. The log-stream content reference also documents the audit-log format. Administrators should export available records on a defined schedule and stream supported ZIA or ZPA administrative audit data to a SIEM with retention aligned to legal, compliance, and forensic requirements. The SIEM then enables long-term correlation by administrator, action, timestamp, request ID, and affected object. Current configurations cannot reconstruct every historical change, and sign-on evaluations show authentication decisions rather than a complete entitlement-change history. Firewall Insights and ZDX Experience data describe traffic or performance; neither is an authoritative archive of administrator actions.