Every audit event generated at the advanced IM is sent to the platform audit repository via Router module.
This type of audit events are stored as System audit so it can be queried through Audit_sysadmin ontology, filtered by module IDENTITY_MANAGER.
