Each event is broken down into <<field-event-category, category>>, <<field-event-type, type>>, <<field-event-action, action>> and <<field-event-outcome, outcome>> fields

Refer to <<xpack-security-ecs-audit-schema>> for a table of fields that get logged with audit event.

[[xpack-security-ecs-audit-schema]]

==== ECS audit schema

Audit logs are written in JSON using https://www.elastic.co/guide/en/ecs/1.6/index.html[Elastic Common Schema (ECS)] specification.

[cols="2*<"]

|======

2+a| ===== Base Fields

| *Field*

| *Description*

| `@timestamp`

| Time when the event was generated.

Example: `2016-05-23T08:05:34.853Z`

| `message`

| Human readable description of the event.

2+a| ===== Event Fields

| *Field*

| *Description*

| [[field-event-action]] `event.action`

| The action captured by the event.

Refer to <<xpack-security-ecs-audit-logging>> for a table of possible actions.

| [[field-event-category]] `event.category`

| High level category associated with the event.

This field is closely related to `event.type`, which is used as a subcategory.

Possible values:

`database`,

`web`,

`authentication`

| [[field-event-type]] `event.type`

| Subcategory associated with the event.

This field can be used along with the `event.category` field to enable filtering events down to a level appropriate for single visualization.

Possible values:

`creation`,

`access`,

`change`,

`deletion`

| [[field-event-outcome]] `event.outcome`

| Denotes whether the event represents a success or failure.

Possible values:

`success`,

`failure`,

`unknown`

2+a| ===== User Fields

| *Field*

| *Description*

| `user.name`

| Login name of the user.

Example: `jdoe`

| `user.roles[]`

| Set of user roles at the time of the event.

Example: `[kibana_admin, reporting_user]`

2+a| ===== Kibana Fields

| *Field*

| *Description*

| `kibana.space_id`

| ID of the space associated with the event.

Example: `default`

| `kibana.session_id`

| ID of the user session associated with the event.

Each login attempt results in a unique session id.

| `kibana.saved_object.type`

| Type of saved object associated with the event.

Example: `dashboard`

| `kibana.saved_object.id`

| ID of the saved object associated with the event.

| `kibana.authentication_provider`

| Name of the authentication provider associated with the event.

Example: `my-saml-provider`

| `kibana.authentication_type`

| Type of the authentication provider associated with the event.

Example: `saml`

| `kibana.authentication_realm`

| Name of the Elasticsearch realm that has authenticated the user.

Example: `native`

| `kibana.lookup_realm`

| Name of the Elasticsearch realm where the user details were retrieved from.

Example: `native`

| `kibana.add_to_spaces[]`

| Set of space IDs that a saved object is being shared to as part of the event.

Example: `[default, marketing]`

| `kibana.delete_from_spaces[]`

| Set of space IDs that a saved object is being removed from as part of the event.

Example: `[marketing]`

2+a| ===== Error Fields

| *Field*

| *Description*

| `error.code`

| Error code describing the error.

| `error.message`

| Error message.

2+a| ===== HTTP and URL Fields

| *Field*

| *Description*

| `http.request.method`

| HTTP request method.

Example: `get`, `post`, `put`, `delete`

| `url.domain`

| Domain of the url.

Example: `www.elastic.co`

| `url.path`

| Path of the request.

Example: `/search`

| `url.port`

| Port of the request.

Example: `443`

| `url.query`

| The query field describes the query string of the request.

Example: `q=elasticsearch`

| `url.scheme`

| Scheme of the request.

Example: `https`

2+a| ===== Tracing Fields

| *Field*

| *Description*

| `trace.id`

| Unique identifier allowing events of the same transaction from {kib} and {es} to be be correlated.

|======