Audit log categories for marketplace installations changes

What audit log categories can I use to detect changes to marketplace installations i.e. new installations or changes to existing ones?

For background, I have a separate production space and I’ve configured RBAC so that only certain groups can deploy into a particular space. But I also want to be able to monitor for such changes to verify if they are ever happening outside authorised change windows.