We are currently evaluating ProGet and other Inedo products for enterprise use. As part of that evaluation, we need to understand what administrative and security events are captured, and how those events can be exported to our internal centralized logging platform.

Examples of gaps we have noticed currently in the system logging:

• Changes to policies on a feed. Today we can see feed creation in proget event logs in the UI but thats about it.
• Creation or deletion of API keys are not logged
• Creation of User is logged but which permission was given to the user is not logged
• If an anonymous user is provided access to something it only logs the privilege ID and doesn't provide more information that an anon user was provided administer, Manage Feed, Publish Package etc.

Please provide below if available:

• Whether a documented, exhaustive list of audited event types exists per product
• Whether the events are accessible via API or webhook, or whether direct database access is the only option, and if the latter, whether the schema is considered stable across product versions
• Whether audit events are subject to the same automatic purge as Diagnostic Center messages, and whether the retention period is configurable

Thank you,
Dev