anchor.diff:  [[audit-event-types]]
   === Audit event types
   
  -When you are <<auditing,auditing security events>>, each request can generate 
  -multiple audit events. The following is a list of the events that can be generated:
  +When you are <<auditing,auditing security events>>, each request can generate
  +multiple audit events.
  +
  +The following is a list of the events that can be generated:
   
   |======
   | `anonymous_access_denied`         | | | Logged when a request is denied due to a missing
  
positive.code: [[audit-event-attributes]]
  === Audit event attributes
  
  The following table shows the common attributes that can be associated with every event.
  
  .Common attributes
  [cols="2,7",options="header"]
  |======
  | Attribute           | Description
  | `timestamp`         | When the event occurred.
  | `node_name`         | The name of the node.
  | `node_host_name`    | The hostname of the node.
  | `node_host_address` | The IP address of the node.
  | `layer`             | The layer from which this event originated: `rest`, `transport` or `ip_filter`
  | `event_type`        | The type of event that occurred: `anonymous_access_denied`,
                          `authentication_failed`, `access_denied`, `access_granted`,
                          `connection_granted`, `connection_denied`, `tampered_request`,
                          `run_as_granted`, `run_as_denied`.
  |======
  
  The following tables show the attributes that can be associated with each type of event.
  The log level determines  which attributes are included in a log entry.
  
  .REST anonymous_access_denied attributes
  [cols="2,7",options="header"]
  |======
  | Attribute         | Description
  | `origin_address`  | The IP address from which the request originated.
  | `uri`             | The REST endpoint URI.
  | `request_body`    | The body of the request, if enabled.
  |======
  
  .REST authentication_success attributes
  [cols="2,7",options="header"]
  |======
  | Attribute         | Description
  | `user`            | The authenticated user.
  | `realm`           | The realm that authenticated the user.
  | `uri`             | The REST endpoint URI.
  | `params`          | The REST URI query parameters.
  | `request_body`    | The body of the request, if enabled.
  |======
  
  .REST authentication_failed attributes
  [cols="2,7",options="header"]
  |======
  | Attribute         | Description
  | `origin_address`  | The IP address from which the request originated.
  | `principal`       | The principal (username) that failed authentication.
  | `uri`             | The REST endpoint URI.
  | `request_body`    | The body of the request, if enabled.
  |======
  
  .REST realm_authentication_failed attributes
  [cols="2,7",options="header"]
  |======
  | Attribute         | Description
  | `origin_address`  | The IP address from which the request originated.
  | `principal`       | The principal (username) that failed authentication.
  | `uri`             | The REST endpoint URI.
  | `request_body`    | The body of the request, if enabled.
  | `realm`           | The realm that failed to authenticate the user.
                        NOTE: A separate entry is logged for each
                              consulted realm.
  |======
  
  .Transport anonymous_access_denied attributes
  [cols="2,7",options="header"]
  |======
  | Attribute         | Description
  | `origin_type`     | Where the request originated: `rest` (request
                        originated from a REST API request), `transport`
                        (request was received on the transport channel),
                        `local_node` (the local node issued the request).
  | `origin_address`  | The IP address from which the request originated.
  | `action`          | The name of the action that was executed.
  | `request`         | The type of request that was executed.
  | `indices`         | A comma-separated list of indices this request
                        pertains to (when applicable).
  |======
  
  .Transport authentication_success attributes
  [cols="2,7",options="header"]
  |======
  | Attribute         | Description
  | `origin_type`     | Where the request originated: `rest` (request
                        originated from a REST API request), `transport`
                        (request was received on the transport channel),
                        `local_node` (the local node issued the request).
  | `origin_address`  | The IP address from which the request originated.
  | `user`            | The authenticated user.
  | `realm`           | The realm that authenticated the user.
  | `action`          | The name of the action that was executed.
  | `request`         | The type of request that was executed.
  |======
  
  .Transport authentication_failed attributes
  [cols="2,7",options="header"]
  |======
  | Attribute         | Description
  | `origin_type`     | Where the request originated: `rest` (request
                        originated from a REST API request), `transport`
                        (request was received on the transport channel),
                        `local_node` (the local node issued the request).
  | `origin_address`  | The IP address from which the request originated.
  | `principal`       | The principal (username) that failed authentication.
  | `action`          | The name of the action that was executed.
  | `request`         | The type of request that was executed.
  | `indices`         | A comma-separated list of indices this request
                        pertains to (when applicable).
  |======
  
  .Transport realm_authentication_failed attributes
  [cols="2,7",options="header"]
  |======
  | Attribute         | Description
  | `origin_type`     | Where the request originated: `rest` (request
                        originated from a REST API request), `transport`
                        (request was received on the transport channel),
                        `local_node` (the local node issued the request).
  | `origin_address`  | The IP address from which the request originated.
  | `principal`       | The principal (username) that failed authentication.
  | `action`          | The name of the action that was executed.
  | `request`         | The type of request that was executed.
  | `indices`         | A comma-separated list of indices this request
                        pertains to (when applicable).
  | `realm`           | The realm that failed to authenticate the user.
                        NOTE: A separate entry is logged for each
                              consulted realm.
  |======
  
  .Transport access_granted attributes
  [cols="2,7",options="header"]
  |======
  | Attribute         | Description
  | `origin_type`     | Where the request originated: `rest` (request
                        originated from a REST API request), `transport`
                        (request was received on the transport channel),
                        `local_node` (the local node issued the request).
  | `origin_address`  | The IP address from which the request originated.
  | `principal`       | The principal (username) that passed authentication.
  | `roles`           | The set of roles granting permissions.
  | `action`          | The name of the action that was executed.
  | `request`         | The type of request that was executed.
  | `indices`         | A comma-separated list of indices this request
                        pertains to (when applicable).
  |======
  
  .Transport access_denied attributes
  [cols="2,7",options="header"]
  |======
  | Attribute         | Description
  | `origin_type`     | Where the request originated: `rest` (request
                        originated from a REST API request), `transport`
                        (request was received on the transport channel),
                        `local_node` (the local node issued the request).
  | `origin_address`  | The IP address from which the request originated.
  | `principal`       | The principal (username) that failed authentication.
  | `roles`           | The set of roles granting permissions.
  | `action`          | The name of the action that was executed.
  | `request`         | The type of request that was executed.
  | `indices`         | A comma-separated list of indices this request
                        relates to (when applicable).
  |======
  
  .Transport tampered_request attributes
  [cols="2,7",options="header"]
  |======
  | Attribute         | Description
  | `origin_type`     | Where the request originated: `rest` (request
                        originated from a REST API request), `transport`
                        (request was received on the transport channel),
                        `local_node` (the local node issued the request).
  | `origin_address`  | The IP address from which the request originated.
  | `principal`       | The principal (username) that failed to authenticate.
  | `action`          | The name of the action that was executed.
  | `request`         | The type of request that was executed.
  | `indices`         | A comma-separated list of indices this request
                        pertains to (when applicable).
  |======
  
  .IP filter connection_granted attributes
  [cols="2,7",options="header"]
  |======
  | Attribute           | Description
  | `origin_address`    | The IP address from which the request originated.
  | `transport_profile` | The transport profile the request targeted.
  | `rule`              | The <<ip-filtering, IP filtering>> rule that granted
                          the request.
  
negative.code: [cols="2,7",options="header"]
  |======
  | Attribute           | Description
  | `transport_profile` | The transport profile the request targeted.
  | `rule`              | The <<ip-filtering, IP filtering>> rule that denied
                          the request.
  