docs/data/reusables/audit_log/audit-log-search-by-operation.md

Search based on operation

Use the operation qualifier to limit actions to specific types of operations. For example:

• operation:access finds all events where a resource was accessed.
• operation:authentication finds all events where an authentication event was performed.
• operation:create finds all events where a resource was created.
• operation:modify finds all events where an existing resource was modified.
• operation:remove finds all events where an existing resource was removed.
• operation:restore finds all events where an existing resource was restored.
• operation:transfer finds all events where an existing resource was transferred.