anchor.diff:  
   --
   
  -. Choose which types of realms you want to use to authenticate users. 
  -** <<configuring-ad-realm,Configure an Active Directory realm>>.
  -** <<configuring-file-realm,Configure a file realm>>.
  -** <<configuring-ldap-realm,Configure an LDAP realm>>.
  -** <<configuring-native-realm,Configure a native realm>>.
  -** <<configuring-pki-realm,Configure a PKI realm>>.
  -** <<configuring-saml-realm,Configure a SAML realm>>.
  -** <<configuring-kerberos-realm,Configure a Kerberos realm>>.
  +. Choose which types of realms you want to use to authenticate users.
  ++
  +--
  +TIP: The types of authentication realms that you can enable varies according to
  +your subscription. For more information, see https://www.elastic.co/subscriptions.
  + 
  +--
  +** <<configuring-ad-realm,Active Directory realms>>
  +** <<configuring-file-realm,File realms>>
  +** <<configuring-kerberos-realm,Kerberos realms>>
  +** <<configuring-ldap-realm,LDAP realms>>
  +** <<configuring-native-realm,Native realms>>
  +** <<configuring-pki-realm,PKI realms>>
  +** <<configuring-saml-realm,SAML realms>>
   
   . Set up roles and users to control access to {es}.
   +
  
positive.code: auditing. For more information, see
  {stack-ov}/elasticsearch-security.html[Securing the {stack}].
  
  To use {es} {security-features}:
  
  . Verify that you are using a license that includes the {security-features}.
  +
  --
  If you want to try all of the platinum features, you can start a 30-day trial.
  At the end of the trial period, you can purchase a subscription to keep using
  the full functionality. For more information, see
  https://www.elastic.co/subscriptions and
  {stack-ov}/license-management.html[License Management].
  --
  
  . Verify that the `xpack.security.enabled` setting is `true` on each node in
  your cluster. If you are using a trial license, the default value is `false`.
  For more information, see {ref}/security-settings.html[Security Settings in {es}].
  
  . If you plan to run {es} in a Federal Information Processing Standard (FIPS) 
  140-2 enabled JVM, see <<fips-140-compliance>>. 
  
  . Configure Transport Layer Security (TLS/SSL) for internode-communication.
  +
  --
  NOTE: This requirement applies to clusters with more than one node and to
  clusters with a single node that listens on an external interface. Single-node
  clusters that use a loopback interface do not have this requirement.  For more
  information, see
  {stack-ov}/encrypting-communications.html[Encrypting Communications].
  
  --
  .. <<node-certificates,Generate node certificates for each of your {es} nodes>>.
  
  .. <<tls-transport, Enable TLS on each {es} node>>.
  
  . If it is not already running, start {es}.
  
  
negative.code: // NOTCONSOLE
  --
  
  . [[enable-auditing]](Optional) Enable auditing to keep track of attempted and
  successful interactions with your {es} cluster:
  +
  --
  TIP: Audit logging is available with specific subscriptions. For more
  information, see https://www.elastic.co/subscriptions.
  
  .. Add the following setting to `elasticsearch.yml` on all nodes in your cluster:
  +
  [source,yaml]
  