Merge pull request #27116 from holliep1/docs-editor/engineering-direct-portal-1733265125

Update engineering-direct-portal.md

Author: kelleyvice-msft

microsoft-365/enterprise/engineering-direct-portal.md

@@ -94,6 +94,8 @@ In this section:
 - [Auto Archive Detection](#auto-archive-detection)
 - [Remediate a Compromised Account](#remediate-a-compromised-account)
 
+- [Audit Log Summary](#audit-log-summary)
+
 <!---
 - [Guest Access in Teams](#guest-access-in-teams)
 - -->
@@ -329,6 +331,26 @@ This diagnostic is split into multiple sections that detail steps to remediate t
 
 If the user still shows signs of being compromised, reach out to Microsoft Support for further help.
 
+### Audit Log Summary
+
+The audit log summary provides a comprehensive overview or count of the activities tracked within your tenant’s audit log. This diagnostic tool is useful for reviewing admin actions, identifying unusual administrative activity, or investigating potential rogue administrators. 
+
+#### Inputs 
+
+- Search the number of days prior to the current date (max 30 days)
+
+  - If you enter 10, the diagnostic will review the log for up to 10 days prior to the current date
+  
+  - If left blank, the diagnostic will run with the value of 7 days 
+  
+#### Outputs 
+
+The output is split into two sections: 
+
+1. Users with High Activity – Users who have performed a specific action at a much higher rate than the average user will be listed here, along with the count of each action they have taken. 
+
+1. Full User List – All users, along with a list of their activities and corresponding counts, will be displayed here in alphabetical order. Actions performed by apps will be grouped together. 
+
 <!---
 ### Guest Access in Teams