This image shows three serverless functions List Regions & Compartments, Fetch Audit Events, and Publish to Splunk. The functions are deployed in a private subnet. The List Regions & Compartments function is invoked by events generated in response to scheduled autoscaling operations. All the functions interact with the Streaming and Notifications services in the Oracle services network through a service gateway. The final function in the sequence, Publish to Splunk, exports audit data through a NAT gateway to a Splunk HTTP event collector.