fix image link

website/docs/sys-mgmt/events/index.md

@@ -4,14 +4,20 @@ title: Events
 
 Events are authentik's built-in logging system. Every event is logged, whether it is initiated by a user or by authentik.
 
+Certain information is stripped from events, to ensure that no passwords or other credentials are saved in the log.
+
+## About notifications
+
 Events can be used to define [notification rules](notifications.md), with specified [transport options](transports.md) of either local (in the authentik UI), email, or webhook.
 
-Certain information is stripped from events, to ensure that no passwords or other credentials are saved in the log.
+## About logging
+
+Logging of events in authentik provides several layers of transparency about user and system actions, from a quick view on the Overview dashboard, to a full, searchable list of all events, with a volume graph to highlight any spikes, in the Admin interface under **Events > Logs**.
+
+For more information refer to our [Logging documentation](./logging-events.md).
 
 ## Event retention and forwarding
 
-The event retention is configured in the **System > Settings** area of the Admin interface, with the default being set to 365 days.
+The event retention setting is configured in the **System > Settings** area of the Admin interface, with the default being set to 365 days.
 
 If you want to forward these events to another application, forward the log output of all authentik containers. Every event creation is logged with the log level "info". For this configuration, it is also recommended to set the internal retention time period to a short time frame (for example, `days=1`).
-
-## Audit logging

website/docs/sys-mgmt/events/logging-events.md

@@ -2,6 +2,30 @@
 title: Logging events
 ---
 
-shshhs
+Logs are an important tool for system diagnoses, event auditing, user management, reports, and so much more. Detailed information about events are captured, including the IP address of the client that triggered the event, the user, the date and timestamp, and the exact action made.
 
-## mmoo--
+Event logging in authentik is highly configurable; you can define the [retention period](./index.md#event-retention-and-forwarding) for storing and displaying events, configure which exact events should trigger a [notification](./notifications.md), and view low-level details about when and where the event happened.
+
+## Enhanced audit logging (Enterprise)
+
+In the enterprise version, each Event details page in the UI, details about each event are abstracted and displayed in an easy-to-access table, and for any event that involves an object being created or modified, the code `diffs` are displayed as well. This allows you to quickly see the previous and new configuration settings.
+
+For example, say an authentik administraotr updates a user's email address; the old email address and the new one are shown when you drill down in that event's details.
+
+![](./events-diffs.png)
+
+Areas of the authentik UI where you can view these audits details are:
+
+- **Admin interface > Dashboards > Overview**: In the **Recent events** section, click the name of an event to view details.
+
+- **Admin interface > Events > Logs**: In the list of events, click the arrow toggle beside the name of the even that you want to view details for.
+
+## Viewing events in maps and charts (Enterprise)
+
+With the enterprise version, you can view recent events on both a world map view with pinpoints of where events occurred and also as a color-coded chart displaying type of event and volume of each type.
+
+![](./event-map-chart.png)
+
+### Troubleshooting with event logs
+
+For details about troubleshooting using logs, including setting the log level (info, warning, etc.), enabling `trace` mode, viewing past logs, and streaming logs in real-time, refer to [Capturing logs in authentik](../../troubleshooting/logs.mdx).

website/docs/sys-mgmt/events/transports.md

@@ -2,13 +2,13 @@
 title: Transports
 ---
 
-To receive notifications about events, you will need to [create](#create-a-transport) a transport object, then create a notification rule and a policy. For details on this workflow refer to
+To receive notifications about events, you will need to [create](#create-a-transport) a transport object, then create a notification rule and a policy. For details refer to [Workflow overview](./notifications.md#workflow-overview).
 
 ## Transport modes
 
 Notifications can be sent to users via multiple mediums, or _transports_:
 
-- Local
+- Local (in the authentik user interface)
 - Email
 - Webhook (generic)
 - Webhook (Slack/Discord)
@@ -19,7 +19,9 @@ This transport will manifest the notification within the authentik user interfac
 
 ### Email
 
-select this transport to send event notificstions to an email address. Note that by default, the [global email configuration](../../install-config/install/docker-compose.mdx#email-configuration-optional-but-recommended) is used.
+Select this transport to send event notifications to an email address. Note that by default, the [global email configuration](../../install-config/install/docker-compose.mdx#email-configuration-optional-but-recommended) is used.
+
+To edit an email address, follow the same instructions as above, those for configuring the email during installation.
 
 ### Webhook (generic)
 
@@ -54,9 +56,8 @@ This sends a request using the Slack-specific format. This is also compatible wi
 
 ## Create a transport
 
-1. Log in as an administrator, open the authentik Admin interface, and navigate to **Event > Notification Transports**.
+1. Log in as an administrator to the authentik Admin interface, and navigate to **Event > Notification Transports**.
 
 2. Click **Create** to add a new transport, or click the **Edit** icon next to an existing transport to modify it.
 
 3. Define the **Name** and **Mode** for the transport, enter required configuration settings, and then click **Create**.
-