Business relevant audit logging for EEM

We need to monitor user activity in the system (this is enforced by the law). But audit logging in the EEM is very technical and suitable tor this purpose. It generate very high amount of records for every business relevant operation. I see, that every action (business relevat) create several entries in the audit log. And these records are not easy to read, understand and classify (it can be, that the documentation is missing some taxonomy, how understand these events). We have already the idea https://ideas.ibm.com/ideas/EVI-I-274 to improve at least content of the message. 

There is important to know, that detailed application logs are typically stored for 30 - 90 days. The security audit logs are stored for more than 12 month in the SIEM. So we need control amount of records which are send to SIEM.

It is important to understand the end user behaviour in the SIEM:

• Users are creating, updatig or deleting some object like EventSources, Options - this is about quite standard operations
• Users are adding/removing groups to control object visibility - even though it can be update API call technically, form security audit perspective it is change of user access rights and it should be visible in the SIEM log, that some user performed such operation 
• Users are changing some important state information - e.g. publising of the Option is not simply the update (even though the update API is used) and again it should be logged 
• Users are configuring the product environment - e-g- add new gateway to the group... 
• Gateways are reading the configuration from the EEM... - we should see, that configuration was propagated to the gateway

But in SIEM we don't need to see the technical details, e.g. that storage was affected. We need to see the top level relevant business event. Rest of the logs will be stored for shorter time in the central log management as standard application logs.