The query "File Deletions by User" shows, for each user and date range, how many files were deleted directly, emptied from the trash, or collected by the system garbage collector, with their total size, and how many of the user's files the garbage collector purged
Eight compliance queries for CMMC reviews: "Privileged Actions Audit", "Privileged Accounts", "Failed Login Summary", "MFA Coverage by User", "File Sharing Log", "Access Attempts by Removed Users", "User Certification Status" and "External SFTP Access Log"
tiAudit records four more tiCrypt events: bulk removal of directory entries (which includes emptying the trash), a file moved to the system trash, a file restored from it, and a change of group settings. The log streamer creates their tables when it starts, so restart it after upgrading; queries that read these events fail until it has
"List file actions" shows when a file was moved to the system trash, restored or purged; "List user actions performed" shows bulk removals, VMs launched from a VM configuration and group settings changes; "List group actions" shows member permission and settings changes
"Permission Change Audit" covers team membership changes, team permission changes and project membership modifications
"Files Deleted" and "User Files Deleted" list every removed file once and say how it was removed: deleted, emptied from the trash, or collected by the system, and whether it has been purged. They no longer have the Successful filter and list successful removals only
The files-deleted numbers in the statistics queries (by day, by month, and per team, project and user), "List Date Deletion Performed", "Deleted File Types", "Team Files Deleted" and "Project Files Deleted" include files emptied from the trash. Before, they counted only files deleted directly
"Group Statistics", "Project Statistics", and the files and groups columns of "User statistics" show the state as of the end date. Before, they counted only the changes between the start and end dates. "Group Statistics" and "Project Statistics" no longer have a start date
"Projects Members" and "Project Members" leave out users who were removed from the project after they were last added
"Group Owners" shows the current owner of each group, following ownership changes, and leaves out deleted groups
"Security Level Statistics" counts current projects under the security level they have now, including levels created before log collection began, and no longer has the Successful filter. Before, it used the level a project was created with and could come back empty
"Security Level Projects" also lists the security levels given to a project by a later change
"Team Statistics" counts the users removed between the start and end dates, as it does the users added, and its total is as of the end date. Before, removals were counted over all time
The files classified and files declassified queries and statistics count administrative tag changes: setting a project tag counts as classified and clearing it as declassified
"Failed Login Attempts" also lists failed challenges and has a Reason column with the server's error code
A query that fails shows the reason, such as a log table that does not exist yet, a missing column, the time limit or a result that is too large. Before, it showed only "Query failed:"
A query on a user, group or other object that is not in the audit log says that the object's creation is missing from the log. Before, it said "Object not found"
"Failed Login Attempts" applies its result size and newest-first order to all events. Before, it returned every refused session request in the period regardless of the result size
"VMs Created", "User VMs Created", "Team VMs Created", "Project VMs Created" and "List VM actions" include VMs launched from a VM configuration, which is how current tiCrypt versions start VMs, and such VMs are shown by name. Before, these queries listed only VMs created the old way and were usually empty
"Security Levels Listed" no longer fails when a security level was changed or deleted and its creation is not in the log
"Group Statistics" shows 1 user, the owner, for a group with no added members. Before, it showed 0
The file counts in "Group Statistics" and "User statistics", and the group count in "User statistics", include a file whose key was deleted and added again and a group the user left and rejoined. Before, one deletion or removal left them out for good
"Project Files Declassified" lists a file under the project it was removed from: the project of its latest tag change before the removal, or the project it was created under. Before, a file that was later classified into another project also appeared in that project's list, and a file that was only ever created under the project was missing
"Project Statistics" shows its description
"User Access Audit" shows the accessed file, drive or VM by name, and the first column of "List VM Actions" is labeled Action
"Team Downloads and Previews" no longer repeats rows for a user who was added to the team more than once
"Team Statistics By Day" no longer counts users whose addition to the team failed
Files and directories that were deleted show their deletion time in their details. Before, it was never filled in
Session expiry times in "List user login info" and "Users Last Login", the cleared-up-to time in "Cleared Old Accounts" and the creation and expiry times in "User Active Inboxes" sort and export as times
Queries with a result size return the most recent rows, and these lists are sorted newest first: "Users Launch Application", "User Launch Application", "User Downloads and Previews", "User Active Inboxes", "VM Launched", "Session Downgrade", "Groups Deleted" and "Cleared Old Accounts"
