audit-event

Use when adding or changing an audit event, the audit log schema, SIEM export, or anything writing to audit_events. Also use when adding a code path that grants or denies access, since denials are events. Triggers on "audit", "audit log", "audit_events", "SIEM", "journal", "access log", "who read what".