+ # what type of auth this is
+ if args[0].has_key('AuthMethod'):
+ auth_methods = ['session', 'password', 'capability', 'gpg', 'hmac','anonymous']
+ auth_method = args[0]['AuthMethod']
+ if auth_method in auth_methods:
+ event['auth_type'] = auth_method