From where ANOM_MK_EXEC , ANOM_ROOT_TRANS ,comes ?

Hello list There are particularly interesting for IDS evens , like ANOM_MK_EXEC , ANOM_ROOT_TRANS These audit events are listed in RHEL7 Security guide. On my Ubuntu distro they are absent on user space level /usr/include/linux/audit.h I have RHEL7 kernel sourcel linux-3.10.0-514.16.1.el7 which I downloaded from Centos ANOM_MK_EXE, ANOM_ROOT_TRANS does not appear there, neither in include linux-3.10.0-514.16.1.el7/include/uapi/linux/audit.h nor in c files Please help me to unsderstand who sends these events ? ThanX, Lev