Investigators need to know which OCI identity changed a network security rule. Which source is most relevant?

1. OCI Audit records for the infrastructure API activity
2. Only the current PDF download count
3. Only the portal's visual theme history
4. Only learner completion telemetry