Security Relevant Event

Any event that attempts to change the security state of the system. Also, any event that attempts to violate the security policy of the system.

Any event that attempts to change the security state of the system, (e.g., change discretionary access controls, change the security level of the subject, change user password, etc.).Also, any event that attempts to violate the security policy of the system, (e.g., too many attempts to login, attempts to violate the mandatory access control limits of a device, attempts to downgrade a file, etc.) [TCSEC].