Every configuration change made in the console: who made it, what they changed, and when. Use it to answer "when did this setting change, and who changed it".
Both can be streamed to your own SIEM from the Log Forwarding page.
This is the log that answers "when did this setting change, and who changed it", which is the question that arrives after something has gone wrong. Every change made in the console is here, including the ones made by an administrator with every permission.
Fowl