1. In Vault, go to Reports > Audit.
  2. In Select date range, include start and end dates for the audit.
  3. In Select Vault users, include users on whom you want to run the audit. The Vault users you enter here have Vault privileges; you are auditing their actions in Vault (for example, if they've set retention rules, searched in matters, modified holds, or performed any other administrative actions).
  4. In Select action types, check the boxes next to actions about which you want audit information.
  5. Click Download CSV. A CSV file that contains audit information will be downloaded to your device.

https://support.google.com/vault/answer/4239060?hl=en