If a characteristic term appears in the log, you can just search for it. e.g. "user master is working " Now you can also search the output results. e.g. send out notifications It is possible to make a query if you have a sample of the log and a description of the source type, etc.   ... View more

@jasonballard  This is completely specific to data you are collecting.  The master password used to access the backend vault was used - you need to identify correct events from the vault access logs. may be you can get help from the SME who is managing vault in your firm. same with other queries as well.  you can simulate and see how events are created for those actions specified by you. ... View more