Is there any documentation available that outlines the differences between audit logs and user activity logs? My understanding is that audit logs encompass various events in Workday, including user activities like sign-in logs.

In the event a forwarder crashed, let's say 24-48 hours of downtime.How can we recover the events that were meant to be ingested by the forwarder?How much data, in GB, will be ingested into CSIEM after the downtime? Is there a specific interval for t...

Do you have any documentation on the integration of Workday with CSIEM? I understand this typically involves a third-party API, but are there any resources available that could be shared with the client to guide them through the process?