For connects and certificate-verifies denied by event actions, log
the string resulting from the event expansion