What is usually meant by "payload" in security audit events?

Question

Information Security

For example, there is a SIEM arcsight audit log, you need to define payload fields, what is it?

Answer 1

I will assume that that can be somehow used for the purposes of correlation of events. Well, that is, v=5.1 is garbage, but action=login is useful