Following audit rule example code.
you can use example below to create audit events in workflows for any event you wish to do so, audit event are good way to export to SIEM events you want to monitor beside OOB events such login etc
import sailpoint.object.AuditEvent;
import sailpoint.server.Auditor;
import sailpoint.object.Attributes;
AuditEvent event = new AuditEvent();
event.setAction("Change Attribute");
event.setTarget(identity.getName());
// example of change coming from HR but you can use it to different source of event as source
event.setApplication("HR Employees");
event.setAttributeName(attributeName);
Attributes attributes = new Attributes();
attributes.put("oldValue",oldValue);
attributes.put("newValue",newValue);
event.setAttributes(attributes);
context.saveObject(event);
context.commitTransaction();