index="REPLACE_WITH_AUDIT_INDEX" sourcetype="REPLACE_WITH_AUDIT_SOURCETYPE" earliest=-7d latest=now
| where app_id="REPLACE_WITH_EXACT_APP_ID" AND tenant_id="REPLACE_WITH_EXACT_TENANT_ID"
| where action IN ("read", "download", "export", "permission_change")
| sort 500 + _time
| table _time app_id tenant_id actor_id action object_id result src event_id