Security responders need evidence of who changed a network configuration. Which OCI record is most directly relevant?

1. Only the monthly bill for the compartment.
2. Only successful application HTTP responses.
3. Audit events for the corresponding management API operations.
4. The instance's CPU utilization average.