SeCloseObjectAuditAlarm

VOID __fastcall SeCloseObjectAuditAlarm(VOID *Object, VOID *Handle, UINT8 GenerateOnClose){
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  if( GenerateOnClose )
  {
    memset(&SubjectContext, 0, sizeof(SubjectContext));
    SeCaptureSubjectContext(&SubjectContext);
    SepAdtCloseObjectAuditAlarm((_UNICODE_STRING *)&SeSubsystemName, Handle, &SubjectContext, Object, 1u);
    SeReleaseSubjectContext(&SubjectContext);
  }
}

Referenced by:

ObCloseHandleTableEntry