diff --git a/provider-dev/docgen/provider-data/headerContent2.txt b/provider-dev/docgen/provider-data/headerContent2.txt
index 3da5fb2..52a4fd2 100644
--- a/provider-dev/docgen/provider-data/headerContent2.txt
+++ b/provider-dev/docgen/provider-data/headerContent2.txt
@@ -165,8 +165,8 @@ Audit events for the last day - cursor-paginated, the time window pushed down as
 SELECT
   id,
   json_extract(attributes, '$.timestamp') AS timestamp,
-  json_extract(attributes, '$.attributes.action') AS action,
-  json_extract(attributes, '$.attributes.evt.name') AS event
+  json_extract(attributes, '$.attributes.evt.name') AS event,
+  json_extract(attributes, '$.attributes.usr.email') AS actor
 FROM datadog.organization.audit_logs
 WHERE "filter[from]" = 'now-1d';
 ```
diff --git a/website/docs/index.md b/website/docs/index.md
index ede6208..eb2a425 100644
--- a/website/docs/index.md
+++ b/website/docs/index.md
@@ -192,8 +192,8 @@ Audit events for the last day - cursor-paginated, the time window pushed down as
 SELECT
   id,
   json_extract(attributes, '$.timestamp') AS timestamp,
-  json_extract(attributes, '$.attributes.action') AS action,
-  json_extract(attributes, '$.attributes.evt.name') AS event
+  json_extract(attributes, '$.attributes.evt.name') AS event,
+  json_extract(attributes, '$.attributes.usr.email') AS actor
 FROM datadog.organization.audit_logs
 WHERE "filter[from]" = 'now-1d';
 ```