Safelisting Audit Event Fields for the Logs
To prevent logging of sensitive data for an audit event, the Common Audit Framework uses a safelist to specify which audit event fields appear in the logs.
By default, only safelisted audit event fields are included in the logs. For information about how to include non-safelisted audit event fields, or exclude safelisted audit event fields, see "Including or Excluding Audit Event Fields In Logs".
Audit event fields use JSON pointer notation, and are taken from the JSON schema for the audit event content. The following event fields are safelisted:
/_id/timestamp/eventName/transactionId/trackingIds/userId(Available in IG logs from IG 7.2)/client/server/http/request/secure/http/request/method/http/request/path/http/request/headers/accept/http/request/headers/accept-api-version/http/request/headers/content-type/http/request/headers/host/http/request/headers/user-agent/http/request/headers/x-forwarded-for/http/request/headers/x-forwarded-host/http/request/headers/x-forwarded-port/http/request/headers/x-forwarded-proto/http/request/headers/x-original-uri/http/request/headers/x-real-ip/http/request/headers/x-request-id/http/request/headers/x-requested-with/http/request/headers/x-scheme/request/response