Audit events report user activity at management consoles.
User activity include users logging on or off management consoles and making configuration changes to managed entities.
|Entity Audit||21||Entity Audit events report activity by a manged client, a micro service, or a user at a management console. The activity can be a create, update, and delete operation on a managed entity. For example, the Policy service records policy change events, the SEP client reports local policy changes, and the policy administrator updates policies at the console.|
|Policy Override Audit||22||Reports user policy override activity at a management console or a managed client.|
|User Session Audit||20||Reports user logon and logoff activity at a management console or a managed client.|