A security engineer is configuring API access for a third-party tool to pull data from the Falcon Identity Protection API. They are confused about the differences between the available API permissions. Which permission should be granted to allow read-only access to authentication event logs?