SharePoint Audit Policy: Custom

Custom is not actually an audit flag you can enable. It simply corresponds to events that are logged by a SharePoint application rather than the SharePoint system itself. LOGbinder for SharePoint logs several custom security events such as those listed below regarding audit trail integrity. Any event LOGbinder does not recognize will be recorded as event ID 18. There are some undocumented events logged by the SharePoint system and LOGbinder reports these using event ID 18 until if and when LOGbinder development assigns them a new event ID.