By default Mac OS logon event is used. However, in some cases it is required to create a separate event. For example, when the predefined event is used for domain joined workstations, you can create a custom event with type Generic for the non-domain joined workstations. In this case you will need to point these [non-domain] workstations to the custom event using the following parameter in the event_name: <CustomEventName> configuration file:
/Library/Security/SecurityAgentPlugins/aucore_login.bundle/Contents/etc/aucore_login.conf