generic audit event - stored in db table, log or ELK etc.
Some of these may end up as emails or alerts.
With the Mongo implementation, there are two tables: Audit for events to be reviewed and
AuditCleared for reviewed events. You need your own purging
of the AuditCleared table.
The Play Controller for these is controllers.AdminAudit
these are also used for cluster notifications
TODO should have a configurable workflow for each of these - what's the pattern?