Support audit ignore policy by actions by BigPandaToo · Pull Request #67477 · elastic/elasticsearch

BigPandaToo · 2021-01-13T20:02:37Z

Bulk operations may produce GBs of audit log events
while most of them are related/identical. This change
will allow to filter out events by their type of actions by
creating a new audit ignore policy - actions.

'xpack.security.audit.logfile.events.ignore_filters:
example1:
actions: ["indices:data/write/bulk", "cluster:admin/ilm/*"]'

Resolve: #60877
Related: #10836
Related: #37148

Adding new audit ignore policy - privileges For example, following policy will filter out all events, which actions minimal required privilege is either "read" or "delete": xpack.security.audit.logfile.events.ignore_filters: example: privileges: ["read", "delete"] Resolve: elastic#60877 Related: elastic#10836 Related: elastic#37148

elasticmachine · 2021-01-13T20:03:50Z

Pinging @elastic/es-security (Team:Security)

BigPandaToo · 2021-01-19T20:32:31Z

@elasticmachine update branch

Adding new audit ignore policy - privileges For example, following policy will filter out all events, which actions required privilege is either "read" or "delete": xpack.security.audit.logfile.events.ignore_filters: example: privileges: ["read", "delete"] Resolve: elastic#60877 Related: elastic#10836 Related: elastic#37148

...security/src/main/java/org/elasticsearch/xpack/security/audit/logfile/LoggingAuditTrail.java

docs/reference/settings/audit-settings.asciidoc

...security/src/main/java/org/elasticsearch/xpack/security/audit/logfile/LoggingAuditTrail.java

BigPandaToo · 2021-01-27T18:46:46Z

@elasticmachine update branch

BigPandaToo · 2021-01-27T20:02:58Z

@elasticmachine update branch

name) changing implementation to have to separate policies for `index_privileges` and `cluster_privileges`. If both are set for the same policy, throw the IllegalArgumentException.

authentication by introducing overloaded version of findPrivilegesThatGrant just checking if privileges which can grant the action regardless of the request and authentication context.

BigPandaToo · 2021-01-31T19:02:33Z

@elasticmachine update branch

findPrivilegesThatGrant each time.

BigPandaToo · 2021-02-02T09:39:49Z

@elasticmachine update branch

This reverts commit 79649e9

This reverts commit 96d22a4

This reverts commit 67574b2

This reverts commit 35573c8

…ndPrivilegesThatGrant each time." This reverts commit 7faa52f

…and authentication by introducing overloaded version of findPrivilegesThatGrant just checking if privileges which can grant the action regardless of the request and authentication context." This reverts commit 72b9aef

…e same name) changing implementation to have to separate policies for `index_privileges` and `cluster_privileges`. If both are set for the same policy, throw the IllegalArgumentException." This reverts commit 7dd8fe7

…e same name) changing implementation to have to separate policies for `index_privileges` and `cluster_privileges`. If both are set for the same policy, throw the IllegalArgumentException." This reverts commit cb5bc09

This reverts commit a918da1

Getting back to action filtering

new change makes most of the comments irrelevant, need new review

albertzaharovits

LGTM with only very small nits.

...security/src/main/java/org/elasticsearch/xpack/security/audit/logfile/LoggingAuditTrail.java

...c/test/java/org/elasticsearch/xpack/security/audit/logfile/LoggingAuditTrailFilterTests.java

Cleaning up some tests

BigPandaToo · 2021-02-28T19:31:09Z

@elasticmachine update branch

Cleaning up some tests

* Support audit ignore policy by index privileges Adding new audit ignore policy - privileges For example, following policy will filter out all events, which actions minimal required privilege is either "read" or "delete": xpack.security.audit.logfile.events.ignore_filters: example: privileges: ["read", "delete"] Resolve: elastic#60877 Related: elastic#10836 Related: elastic#37148 * Support audit ignore policy by index privileges Adding new audit ignore policy - privileges For example, following policy will filter out all events, which actions required privilege is either "read" or "delete": xpack.security.audit.logfile.events.ignore_filters: example: privileges: ["read", "delete"] Resolve: elastic#60877 Related: elastic#10836 Related: elastic#37148 * To avoid ambiguity (as cluster and index policies may have the same name) changing implementation to have to separate policies for `index_privileges` and `cluster_privileges`. If both are set for the same policy, throw the IllegalArgumentException. * To avoid ambiguity (as cluster and index policies may have the same name) changing implementation to have to separate policies for `index_privileges` and `cluster_privileges`. If both are set for the same policy, throw the IllegalArgumentException. * Fixing Api key related privilege check which expects request and authentication by introducing overloaded version of findPrivilegesThatGrant just checking if privileges which can grant the action regardless of the request and authentication context. * Fixing a test; adding a caching mechanism to avoid calling findPrivilegesThatGrant each time. * Support audit ignore policy by index privileges Addressing review feedback * Support audit ignore policy by index privileges Addressing review comments + changing approach: - use permission check instead of simple "checkIfGrants" - adding more testing * Support audit ignore policy by index privileges Addressing review comments + changing approach: - use permission check instead of simple "checkIfGrants" - adding more testing * Support audit ignore policy by index privileges Addressing review comments + changing approach: - use permission check instead of simple "checkIfGrants" - adding more testing * Support audit ignore policy by index privileges Addressing review comments + changing approach: - use permission check instead of simple "checkIfGrants" - adding more testing * Revert "Support audit ignore policy by index privileges" This reverts commit 152821e * Revert "Support audit ignore policy by index privileges" This reverts commit 79649e9 * Revert "Support audit ignore policy by index privileges" This reverts commit 96d22a4 * Revert "Support audit ignore policy by index privileges" This reverts commit 67574b2 * Revert "Support audit ignore policy by index privileges" This reverts commit 35573c8 * Revert "Fixing a test; adding a caching mechanism to avoid calling findPrivilegesThatGrant each time." This reverts commit 7faa52f * Revert "Fixing Api key related privilege check which expects request and authentication by introducing overloaded version of findPrivilegesThatGrant just checking if privileges which can grant the action regardless of the request and authentication context." This reverts commit 72b9aef * Revert "To avoid ambiguity (as cluster and index policies may have the same name) changing implementation to have to separate policies for `index_privileges` and `cluster_privileges`. If both are set for the same policy, throw the IllegalArgumentException." This reverts commit 7dd8fe7 * Revert "To avoid ambiguity (as cluster and index policies may have the same name) changing implementation to have to separate policies for `index_privileges` and `cluster_privileges`. If both are set for the same policy, throw the IllegalArgumentException." This reverts commit cb5bc09 * Revert "Support audit ignore policy by index privileges" This reverts commit a918da1 * Support audit ignore policy by actions Getting back to action filtering * Support audit ignore policy by actions Cleaning up some tests * Support audit ignore policy by actions Cleaning up some tests Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> # Conflicts: # x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/audit/logfile/LoggingAuditTrailTests.java

* Support audit ignore policy by actions Bulk operations may produce GBs of audit log events while most of them are related/identical. This change will allow to filter out events by their type of actions by creating a new audit ignore policy - actions. 'xpack.security.audit.logfile.events.ignore_filters: example1: actions: ["indices:data/write/bulk", "cluster:admin/ilm/*"]' Resolve: #60877 Related: #10836 Related: #37148 #69233

fbaligand · 2021-03-01T23:22:03Z

Thanks for this new feature!

BigPandaToo requested review from albertzaharovits and tvernum January 13, 2021 20:02

BigPandaToo added :Security/Audit X-Pack Audit logging Team:Security Meta label for security team v7.12.0 v8.0.0 labels Jan 13, 2021

BigPandaToo added the >enhancement label Jan 13, 2021

elasticmachine and others added 2 commits January 19, 2021 12:32

Merge branch 'master' into Audit_ignore_action

665749c

albertzaharovits reviewed Jan 20, 2021

View reviewed changes

...security/src/main/java/org/elasticsearch/xpack/security/audit/logfile/LoggingAuditTrail.java Outdated Show resolved Hide resolved

albertzaharovits reviewed Jan 20, 2021

View reviewed changes

...security/src/main/java/org/elasticsearch/xpack/security/audit/logfile/LoggingAuditTrail.java Outdated Show resolved Hide resolved

albertzaharovits reviewed Jan 20, 2021

View reviewed changes

docs/reference/settings/audit-settings.asciidoc Outdated Show resolved Hide resolved

albertzaharovits reviewed Jan 20, 2021

View reviewed changes

...security/src/main/java/org/elasticsearch/xpack/security/audit/logfile/LoggingAuditTrail.java Show resolved Hide resolved

Merge branch 'master' into Audit_ignore_action

b4a85d3

elasticmachine and others added 4 commits January 27, 2021 12:03

Merge branch 'master' into Audit_ignore_action

a7585b7

To avoid ambiguity (as cluster and index policies may have the same

cb5bc09

name) changing implementation to have to separate policies for `index_privileges` and `cluster_privileges`. If both are set for the same policy, throw the IllegalArgumentException.

To avoid ambiguity (as cluster and index policies may have the same

7dd8fe7

name) changing implementation to have to separate policies for `index_privileges` and `cluster_privileges`. If both are set for the same policy, throw the IllegalArgumentException.

Fixing Api key related privilege check which expects request and

72b9aef

authentication by introducing overloaded version of findPrivilegesThatGrant just checking if privileges which can grant the action regardless of the request and authentication context.

Merge branch 'master' into Audit_ignore_action

93103ae

BigPandaToo mentioned this pull request Feb 1, 2021

Support audit ignore policy by action #60877

Closed

Fixing a test; adding a caching mechanism to avoid calling

7faa52f

findPrivilegesThatGrant each time.

BigPandaToo requested a review from albertzaharovits February 1, 2021 16:37

Merge branch 'master' into Audit_ignore_action

08289b6

BigPandaToo added 9 commits February 22, 2021 20:00

Revert "Support audit ignore policy by index privileges"

7338afb

This reverts commit 79649e9

Revert "Support audit ignore policy by index privileges"

17adbe1

This reverts commit 96d22a4

Revert "Support audit ignore policy by index privileges"

68e1b6b

This reverts commit 67574b2

Revert "Support audit ignore policy by index privileges"

125e8f4

This reverts commit 35573c8

Revert "Fixing a test; adding a caching mechanism to avoid calling fi…

dfd002d

…ndPrivilegesThatGrant each time." This reverts commit 7faa52f

Revert "Support audit ignore policy by index privileges"

10e8e2a

This reverts commit a918da1

BigPandaToo changed the title ~~Support audit ignore policy by index privileges~~ Support audit ignore policy by actions Feb 22, 2021

Support audit ignore policy by actions

cb15d41

Getting back to action filtering

BigPandaToo requested review from albertzaharovits and tvernum February 23, 2021 08:17

albertzaharovits approved these changes Feb 25, 2021

View reviewed changes

Support audit ignore policy by actions

53f1e96

Cleaning up some tests

elasticmachine and others added 2 commits February 28, 2021 14:31

Merge branch 'master' into Audit_ignore_action

c96fcaa

Support audit ignore policy by actions

7a83508

Cleaning up some tests

BigPandaToo merged commit ee66d6f into elastic:master Mar 1, 2021

BigPandaToo mentioned this pull request Mar 1, 2021

[7.x] Support audit ignore policy by actions (#67477) #69737

Merged

BigPandaToo mentioned this pull request Mar 1, 2021

audit events ignore policies: add support for "actions" attribute #37148

Closed

BigPandaToo deleted the Audit_ignore_action branch April 19, 2021 13:49

tvernum added the release highlight label Apr 29, 2021

jakelandis added v8.0.0-alpha1 and removed v8.0.0 labels Jul 26, 2021

Conversation

BigPandaToo commented Jan 13, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elasticmachine commented Jan 13, 2021

Uh oh!

BigPandaToo commented Jan 19, 2021

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

BigPandaToo commented Jan 27, 2021

Uh oh!

BigPandaToo commented Jan 27, 2021

Uh oh!

BigPandaToo commented Jan 31, 2021

Uh oh!

BigPandaToo commented Feb 2, 2021

Uh oh!

albertzaharovits left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

BigPandaToo commented Feb 28, 2021

Uh oh!

fbaligand commented Mar 1, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

BigPandaToo commented Jan 13, 2021 •

edited

Loading