Protocols (Regular Profile) : Managing Audit, Shadowing and Alerts for Protocols : Audit and Shadowing Rights : WhatsApp
  
WhatsApp
Audit and shadowing rights applicable to the WhatsApp protocol:
Audit: Connection - Enables the auditing of WhatsApp Desktop attempts to connect to a WhatsApp server.
The Connection action is written to the log.
Audit: Web Connection - Enables the auditing of attempts to connect to the WhatsApp Web host.
The Connection action is written to the log. Unlike WhatsApp Desktop connections, Web is indicated in the Name field of the WhatsApp Web connection record.
Audit: Incoming Messages - Enables the auditing of user attempts to receive instant messages or audio messages. Can be selected only together with Audit: Outgoing Messages.
The Chat action and WhatsApp user IDs of all chat participants are written to the log. The user ID of the local participant precedes the user ID of a remote participant.
Audit: Incoming Files - Enables the auditing of user attempts to receive a file.
The Incoming File action and the name of the file are written to the log.
Audit: Outgoing Messages - Enables the auditing of user attempts to send instant messages or audio messages. Can be selected only together with Audit: Incoming Messages.
The Chat action and WhatApp user IDs of all chat participants are written to the log.
Audit: Outgoing Files - Enables the auditing of user attempts to send a file.
The Outgoing File action and the name of the file are written to the log.
Shadowing: Incoming Messages - Enables the shadow copying of received instant messages.
Shadow copies of received messages are written to the log as .txt files. A shadow copy of messages is written to the log after 30 minutes of inactivity (that is, 30 minutes after the last active exchange in the chat window) or if the user signs out of WhatsApp. It contains an exact record of all received messages.
Shadowing: Incoming Files - Enables the shadow copying of received files.
Shadow copies of received files are written to the log.
Shadowing: Outgoing Messages - Enables the shadow copying of sent instant messages.
Shadow copies of sent instant messages are written to the log as .txt files. A shadow copy of messages is written to the log after 30 minutes of inactivity (that is, 30 minutes after the last active exchange in the chat window) or if the user signs out of Telegram. It contains an exact record of all sent messages.
Shadowing: Outgoing Files - Enables the shadow copying of sent files.
Shadow copies of sent files are written to the log.