### Search based on operation

Use the `operation` qualifier to limit actions to specific types of operations. For example:

* `operation:access` finds all events where a resource was accessed.
* `operation:authentication` finds all events where an authentication event was performed.
* `operation:create` finds all events where a resource was created.
* `operation:modify` finds all events where an existing resource was modified.
* `operation:remove` finds all events where an existing resource was removed.
* `operation:restore` finds all events where an existing resource was restored.
* `operation:transfer` finds all events where an existing resource was transferred.