Administration - Displays actions performed by administrators during the designated period, such as adding a new access role or configuring user directories. Also displays actions made on administrators, such as adding a new administrator or changing an administrator's permissions.

Log on/Log out - Displays log on and log out actions so you know which administrators where active during the designated period.

Status - Displays actions performed on status reports and logs, such as deleting an entry or creating an audit record.

Policy management - Displays actions performed on policies, such as updating predefined policies, editing quick policies, or creating a new policy.

Reporting - Displays actions performed on reports during the designated period, such as editing or creating a new report.

Incident management - Displays actions performed on incidents, such as deleting incidents.

Archiving - Displays actions performed on incident archives, such as deleting or restoring an archive.

System modules - Displays actions performed on system modules, such as editing a configuration or adding a module.