The zonename token records the zone in which the audit event occurred. The string “global” indicates audit events that occur in the global zone.
The praudit -x command shows the content of the zonename token:
<zone name="graphzone"/>