Vault Audits

If any activity within Vault needed to be checked up on, then an audit report can be created to discover which user created particular rules, or removed certain data.

Vault audits let you view the actions of Vault users during a specific time period.

To view the audit of Vault users, you can navigate to 'Reports'→'Audits.'

Actions logged in audits cannot be deleted or truncated by Google or by any Vault administrator as long as your organization continues to use Vault.

If your organization terminates its Vault service, audit data is deleted after approximately 30 days.

You can run and export Vault audits as CSV files. These files can be viewed in any spreadsheet viewer, including Google Sheets.

https://support.google.com/vault/answer/4239060?hl=en