Who deleted the customer list, and who made that inbox rule.
A search in Audit is a job that runs in the background, in UTC. We find who deleted the customer list and an inbox rule created from an unknown IP address at night, and open the full record. Then we look at searches every investigator should know, how to export and preserve the results, and when Activity explorer is enough.
Step through More in Investigate logs and user activity
These videos have no narration — the sound is background music and interface clicks. Step through presents the same content as text.