diff --git a/internal/cmd/config/config.go b/internal/cmd/config/config.go
index 5b862cd94..832782a4e 100644
--- a/internal/cmd/config/config.go
+++ b/internal/cmd/config/config.go
@@ -657,6 +657,14 @@ func parseEventing(eventObj *ast.ObjectItem) (*event.EventerConfig, error) {
 			}
 		}
 
+		// parse map into event types
+		if s.AuditConfig != nil && s.AuditConfig.FilterOverridesHCL != nil {
+			s.AuditConfig.FilterOverrides = make(map[event.DataClassification]event.FilterOperation, len(s.AuditConfig.FilterOverridesHCL))
+			for k, v := range s.AuditConfig.FilterOverridesHCL {
+				s.AuditConfig.FilterOverrides[event.DataClassification(k)] = event.FilterOperation(v)
+			}
+		}
+
 		if err := s.Validate(); err != nil {
 			return nil, err
 		}
diff --git a/internal/cmd/config/config_test.go b/internal/cmd/config/config_test.go
index 73bfca194..9a0210f24 100644
--- a/internal/cmd/config/config_test.go
+++ b/internal/cmd/config/config_test.go
@@ -799,6 +799,52 @@ func TestController_EventingConfig(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "audit_config",
+			config: []string{
+				`events {
+					audit_enabled = true
+					sink {
+						name = "audit-sink"
+						format = "cloudevents-json"
+						event_types = ["audit"]
+						file {
+							file_name = "audit.log"
+						}
+						audit_config {
+							audit_filter_overrides {
+								sensitive = ""
+								secret    = "hmac-sha256"
+							}
+						}
+					}
+				}`,
+			},
+			wantEventerConfig: &event.EventerConfig{
+				AuditEnabled: true,
+				Sinks: []*event.SinkConfig{
+					{
+						Type:       "file",
+						Name:       "audit-sink",
+						Format:     "cloudevents-json",
+						EventTypes: []event.Type{"audit"},
+						FileConfig: &event.FileSinkTypeConfig{
+							FileName: "audit.log",
+						},
+						AuditConfig: &event.AuditConfig{
+							FilterOverridesHCL: map[string]string{
+								"sensitive": "",
+								"secret":    "hmac-sha256",
+							},
+							FilterOverrides: event.AuditFilterOperations{
+								event.SensitiveClassification: event.NoOperation,
+								event.SecretClassification:    event.HmacSha256Operation,
+							},
+						},
+					},
+				},
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/internal/observability/event/audit_config.go b/internal/observability/event/audit_config.go
index b26c1dd0f..0fb4c8625 100644
--- a/internal/observability/event/audit_config.go
+++ b/internal/observability/event/audit_config.go
@@ -10,7 +10,8 @@ import (
 type AuditConfig struct {
 	// FilterOverrides provide an optional a set of overrides for the
 	// FilterOperations to be applied to DataClassifications.
-	FilterOverrides AuditFilterOperations `hcl:"audit_filter_overrides"`
+	FilterOverrides    AuditFilterOperations `hcl:"-"`
+	FilterOverridesHCL map[string]string     `hcl:"audit_filter_overrides"`
 
 	// wrapper to use for audit event crypto operations.
 	wrapper wrapping.Wrapper