As mentioned, SharePoint site activities aren't captured by default. You'll need to follow these steps to make sure a site's activity is included in the audit logs:
Enabling auditing of SharePoint site activities may appear on the exam. However, in the future, audit experiences in SharePoint will be powered by the Unified Audit pipeline which will replace trimming and choosing specific events to audit per site collection as described here.
- Go to Site Settings (Settings | Site Settings for the classic experience, and Settings | Site information | View all site settings for the modern experience).
- Click on Site collection audit settings under Site Collection Administration.
- Check boxes for each activity you want to monitor (editing items, deleting items, editing permissions, and so on) and click OK to save:
- Repeat this for each site collection you want included in the audit logs.
Now, let's see how to enable Exchange mailbox activity audits.