@froztbyte @hailey whenever there's an audit event, an entry gets written to a log followed by a notification being sent to an audit server that grabs it, extracts the data, and feeds it to a user-specified script which can e.g. run clamav, detect phishing, etc, and then potentially freeze a site