Vault's Auditing & Logging Capabilities

Audit Report

• We now have cameras in our house, cars, offices or kinda everywhere to record everything just in case if there is something suspicious that we need to look at in future, Similarly Audit feature in Google Vault is that camera which keeps track of all performed actions by permitted users, e.g larry@domain.com exported a search result from XYZ matter, on this date, that time.
  
  
• Google Vault retains audit data for the lifetime of a Vault customer, you can either download all audit logs OR can also filter down to download only the required logs.
  (for e.g only the audit logs From 26-FEB-2018 TO 31-DEC-2018 where “export” or “search” actions were performed by larry@domain.com)
  
  
• These audit logs are immutable, which means no one can change them, so you always get an accurate picture of who did what in Vault, these logs are downloaded as CSV, which you can take to any supported system (e.g Google Sheet or MS Excel) to read.

Your Google Vault audit files will have the following header fields (depending on what you select while export as shown in above screenshot)