anchor.diff:  Events are logged to a dedicated `<clustername>_audit.json` file in
   `ES_HOME/logs`, on each cluster node.
   --
  +
  +To walk through the configuration of {security-features} in {es}, {kib}, {ls}, and {metricbeat}, see
  +{stack-ov}/security-getting-started.html[Getting started with security].
   
   :edit_url: https://github.com/elastic/elasticsearch/edit/{branch}/docs/reference/security/securing-communications/securing-elasticsearch.asciidoc
   include::{es-repo-dir}/security/securing-communications/securing-elasticsearch.asciidoc[]
  
positive.code: // NOTCONSOLE
  --
  
  . [[enable-auditing]]Enable auditing to keep track of attempted and successful interactions with
    your {es} cluster:
  +
  --
  .. Add the following setting to `elasticsearch.yml` on all nodes in your cluster:
  +
  [source,yaml]
  
negative.code: 
  --
  
  . Choose which types of realms you want to use to authenticate users.
  +
  --
  TIP: The types of authentication realms that you can enable varies according to
  your subscription. For more information, see https://www.elastic.co/subscriptions.
   
  --
  ** <<configuring-ad-realm,Active Directory realms>>
  ** <<configuring-file-realm,File realms>>
  ** <<configuring-kerberos-realm,Kerberos realms>>
  ** <<configuring-ldap-realm,LDAP realms>>
  ** <<configuring-native-realm,Native realms>>
  ** <<configuring-pki-realm,PKI realms>>
  ** <<configuring-saml-realm,SAML realms>>
  
  . Set up roles and users to control access to {es}.
  +
  