Examine gradual extraction, sensitive-data access, and changes in observed volume against measured history. Follow the finding back to relevant activity.
Decide what to retain and take the evidence with you.
Use audit rules to retain full details, retain summaries, or count matching events without storing them. Export Events search results for further analysis and audit workflows.