I do not know the answer to your question, but i suspect you will stand a better chance at finding a good answer on the linux-audit list.
You can subscribe here: https://www.redhat.com/mailman/listinfo/linux-audit
Thanks for the pointer (google failed me on that one!). I just subscribed, so will post there soon.
Note though that this list is moderated. So it may be a while before your request for subscription is processed.
Noted, thanks again!