Who deleted the customer list, and who made that inbox rule.
A search in Audit is a job that runs in the background, in UTC. We find who deleted the customer list and an inbox rule created from an unknown IP address at night, and open the full record. Then we look at searches every investigator should know, how to export and preserve the results, and when Activity explorer is enough.