index="REPLACE_WITH_AUDIT_INDEX" sourcetype="REPLACE_WITH_AUDIT_SOURCETYPE" earliest=-24h latest=now
| where app_id="REPLACE_WITH_EXACT_APP_ID"
| where action IN ("publish", "update", "delete", "permission_change")
| sort 500 + _time
| table _time app_id actor_id action object_id result src change_id event_id