Describe the feature:
As of writing, when ECS audit logging is enabled, we can see the saved object is getting accessed, found or deleted via its ID. Sample ECS audit log message looks like [1]:
User is creating search [id=xxx]
User has accessed search [id=xxx]
User is requesting [/api/saved_objects/search/xxx] endpoint
User is deleting search [id=xxx]
But there's no clear indication what saved object is associated with ID xxx.
If the saved object has not been deleted, one could do GET .kibana/_search?q=xxx to identify the object.
Once it was deleted, is there a way to identify from kibana audit logs?
Describe a specific use case for the feature:
Having the ability to identify deleted saved object from ECS audit logs.
[1] Saved object here could be search/index-pattern/map/visualization/graph-workspace etc.
Describe the feature:
As of writing, when ECS audit logging is enabled, we can see the saved object is getting accessed, found or deleted via its ID. Sample ECS audit log message looks like [1]:
But there's no clear indication what saved object is associated with ID
xxx.If the saved object has not been deleted, one could do
GET .kibana/_search?q=xxxto identify the object.Once it was deleted, is there a way to identify from kibana audit logs?
Describe a specific use case for the feature:
Having the ability to identify deleted saved object from ECS audit logs.
[1] Saved object here could be search/index-pattern/map/visualization/graph-workspace etc.