anchor.diff:  [role="xpack"]
   [[audit-event-types]]
  -=== Audit event types
  +=== Audit events
   
   When you are <<enable-audit-logging,auditing security events>>, a single client
   request might generate multiple audit events, across multiple cluster nodes.
   The common `request.id` attribute can be used to correlate the associated events.
   
  -To specify the type of events you want to include in the auditing output, add
  -one or more of the following values for
  -<<xpack-sa-lf-events-include,`xpack.security.audit.logfile.events.include`>> in
  -`elasticsearch.yml`.
  +Use the <<xpack-sa-lf-events-include,`xpack.security.audit.logfile.events.include`>> 
  +setting in `elasticsearch.yml` to specify the kind of events you want to include
  +in the auditing output.
  +
  +NOTE: Certain audit events require the `security_config_change` event type to
  +audit the related event action. The description of impacted audit events
  +indicate whether that event type is required.
   
   [[event-access-denied]]
   `access_denied`::
  
positive.code: Logged when the <<security-api-create-api-key,create API key>> or the
  <<security-api-grant-api-key, grant API key>> APIs are invoked to create a new
  API key.
  +
  .Example
  [%collapsible%open]
  
negative.code: Logged when the <<security-api-enable-user,enable user API>> is invoked to
  enable a native or a built-in user.
  +
  You must include the `security_config_change` event type to audit the related
  event action.
  +
  .Example
  [%collapsible%open]
  ====
  