How to retrieve user activities

Summary:

How can we obtain detailed and specific audit information in Oracle Cloud Fusion to identify the following?

• Who created a user
• The user’s activities
• The IP address/location where the user was created
• The IP address/location from which the user performed activities

We have already enabled the audit policy as recommended by Oracle Support, but the available audit logs do not provide the detailed information needed for our investigation. We also found a user account with elevated privileges that none of our team members acknowledge creating, so we need precise audit trails to trace this event.

Are there additional configurations, logs, or tools required to retrieve this level of audit detail?