"auditType.category":Users\ and\ groups ("auditType.action":User\ permissions\ export\ failed OR "auditType.action":User\ permissions\ export\ started OR "auditType.action":User\ permissions\ exported)