| Event ID | Title | Audit Flag |
| 11 | Site collection audit policy changed | SecurityChange |
| 12 | Audit policy changed | SecurityChange |
| 13 | Document checked in | CheckIn |
| 14 | Document checked out | CheckOut |
| 15 | Child object deleted | ChildDelete |
| 16 | Child object moved | Move |
| 17 | Object copied | Copy |
| 18 | Custom event | Custom |
| 19 | Object deleted | Delete |
| 20 | SharePoint audit logs deleted | SecurityChange |
| 21 | Object moved | Move |
| 22 | Object profile changed | ProfileChange |
| 23 | SharePoint object structure changed | SchemaChange |
| 24 | Search performed | Search |
| 25 | SharePoint group created | SecurityChange |
| 26 | SharePoint group deleted | SecurityChange |
| 27 | SharePoint group member added | SecurityChange |
| 28 | SharePoint group member removed | SecurityChange |
| 29 | Unique permissions created | SecurityChange |
| 30 | Unique permissions removed | SecurityChange |
| 31 | Permissions updated | SecurityChange |
| 32 | Permissions removed | SecurityChange |
| 33 | Unique permission levels created | SecurityChange |
| 34 | Permission level created | SecurityChange |
| 35 | Permission level deleted | SecurityChange |
| 36 | Permission level modified | SecurityChange |
| 37 | SharePoint site collection administrator added | SecurityChange |
| 38 | SharePoint site collection administrator removed | SecurityChange |
| 39 | Object restored | Delete |
| 40 | Site collection updated | Update |
| 41 | Web updated | Update |
| 42 | Document library updated | Update |
| 43 | Document updated | Update |
| 44 | List updated | Update |
| 45 | List item updated | Update |
| 46 | Folder updated | Update |
| 47 | Document viewed | View |
| 48 | Document library viewed | View |
| 49 | List viewed | View |
| 50 | Object viewed | View |
| 51 | Workflow accessed | Workflow |
| 52 | Information management policy created | Unknown or not applicable |
| 53 | Information management policy changed | Unknown or not applicable |
| 54 | Site collection information management policy created | Unknown or not applicable |
| 55 | Site collection information management policy changed | Unknown or not applicable |
| 56 | Export of objects started | Unknown or not applicable |
| 57 | Export of objects completed | Unknown or not applicable |
| 58 | Import of objects started | Unknown or not applicable |
| 59 | Import of objects completed | Unknown or not applicable |
| 60 | Possible tampering warning | Custom |
| 61 | Retention policy processed | Custom |
| 62 | Document fragment updated | Unknown or not applicable |
| 63 | Content type imported | Unknown or not applicable |
| 64 | Information management policy deleted | Unknown or not applicable |
| 65 | Item declared as a record | Unknown or not applicable |
| 66 | Item undeclared as a record | Unknown or not applicable |
| 67 | Netwrix SharePoint Audit Event | Custom |