Skip to content

ECS Audit logging lack of identifiable description on saved object #100523

@Leaf-Lin

Description

@Leaf-Lin

Describe the feature:
As of writing, when ECS audit logging is enabled, we can see the saved object is getting accessed, found or deleted via its ID. Sample ECS audit log message looks like [1]:

User is creating search [id=xxx]
User has accessed search [id=xxx]
User is requesting [/api/saved_objects/search/xxx] endpoint
User is deleting search [id=xxx]

But there's no clear indication what saved object is associated with ID xxx.
If the saved object has not been deleted, one could do GET .kibana/_search?q=xxx to identify the object.

Once it was deleted, is there a way to identify from kibana audit logs?

Describe a specific use case for the feature:
Having the ability to identify deleted saved object from ECS audit logs.


[1] Saved object here could be search/index-pattern/map/visualization/graph-workspace etc.

Metadata

Metadata

Assignees

Labels

Feature:Security/AuditPlatform Security - Audit Logging featureTeam:SecurityPlatform Security: Auth, Users, Roles, Spaces, Audit Logging, etc t//enhancementNew value added to drive a business result

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions