Which parameter is required to forward audit logging?

The ENABLEAUDITLOGGINGFORWARDING parameter is a specific configuration setting used to activate the forwarding of audit logs from the IBM platform to an external Security Information and Event Management (SIEM) system. Setting this parameter to true enables the mechanism that sends generated audit records to a configured syslog endpoint. This is distinct from simply enabling the audit service itself; it specifically controls the egress of the log data.

A. AUDITCONTENTBYPROVIDERS: This parameter likely controls the scope or type of audit content to be collected from different providers, not the action of forwarding the collected logs.
C. AUDITENABLED: This is a more general parameter that serves as a master switch to turn the audit logging service on or off. Forwarding cannot occur if auditing is disabled, but this parameter does not control forwarding itself.
D. SAS API SERVER AUDIT ENABLED: This parameter is too specific, as it would enable auditing only for the SAS API server component, not the system-wide mechanism for forwarding all collected audit logs.

1. IBM Cloud Pak for Security Documentation: In the section on configuring audit logging

the procedure for forwarding logs is detailed. It explicitly states

"To enable audit logging forwarding

set the ENABLEAUDITLOGGINGFORWARDING parameter to true."

Source: IBM Documentation

IBM Cloud Pak for Security 1.10

"Forwarding audit logs to your SIEM". (Specific section: "Procedure"

Step 3).

2. IBM Cloud Pak for Security Documentation: The configuration parameters for the audit logging service are listed in a table. This table defines enableauditloggingforwarding as the parameter to "Enable or disable audit logging forwarding."

Source: IBM Documentation

IBM Cloud Pak for Security 1.10

"Configuring audit logging". (Specific section: "Audit logging service parameters").