Thanks for your response! Maybe my question is not clear enough. Sorry about that. My question is that if someone with admin role deletes audit events or some other events, e.g. index=audit | delete, this activity will be logged as an event into index=_internal? In other words, if some deletes events by running the delete command, it can be traced and trackable, correct? Thanks.
... View more