"auditType.category":Users\ and\ groups ("auditType.action":User\ details\ export\ failed OR "auditType.action":User\ details\ export\ started OR "auditType.action":User\ details\ exported)