Support for saved objects name attribute in audit log by elena-shostak · Pull Request #206644 · elastic/kibana

elena-shostak · 2025-01-14T17:25:26Z

Summary

Added support for human readable name attribute for saved objects audit.

Functions that were not updated:

authorizeFind - now we log audit before the actual find with only types. Find is complex one, that can return a lot of saved objects. The benefit of adding a separate audit event vs potential performance cost can be considered negligible.

kibana/src/core/packages/saved-objects/api-server-internal/src/lib/apis/find.ts

Line 166 in 2f6b9f6

authorizationResult = await securityExtension.authorizeFind({

deleteByNamespace - doesn't have an audit log itself, however is used only along with the delete which adds audit log with SO name

kibana/x-pack/platform/plugins/shared/spaces/server/spaces_client/spaces_client.ts

Lines 223 to 225 in 2f6b9f6

    
           await this.repository.deleteByNamespace(id); 
        
           await this.repository.delete('space', id);

checkConflicts - audit was intensionally bypassed

kibana/x-pack/platform/plugins/shared/security/server/saved_objects/saved_objects_security_extension.ts

Lines 945 to 948 in 2f6b9f6

    
           // auditing is intentionally bypassed, this function in the previous Security SOC wrapper implementation 
        
           // did not have audit logging. This is primarily because it is only used by Kibana and is not exposed in a 
        
           // public HTTP API 
        
           auditOptions: { bypass: 'always' },

disableLegacyUrlAliases - function calls bulkUpdate in the end (which adds audit log with SO name already). Adding name to the disableLegacyUrlAliases audit log, will result in double saved objects get operation which is not feasible.

kibana/x-pack/platform/plugins/shared/spaces/server/spaces_client/spaces_client.ts

Lines 228 to 234 in 2f6b9f6

    
           public async disableLegacyUrlAliases(aliases: LegacyUrlAliasTarget[]) { 
        
             const attributes = { disabled: true }; 
        
             const objectsToUpdate = aliases.map(({ targetSpace, targetType, sourceId }) => { 
        
               const id = `${targetSpace}:${targetType}:${sourceId}`; 
        
               return { type: LEGACY_URL_ALIAS_TYPE, id, attributes }; 
        
             }); 
        
             await this.repository.bulkUpdate(objectsToUpdate);

How to test

Best way to test it is from the Manage Saved Objects page with audit enabled.

Import some test data set from the main page.
Go to the Manage Saved Objects:
- Update single SO
- Delete singe SO
- Bulk update SOs
- Bulk delete SOs
- Import/export SOs

Checklist

Unit or functional tests were updated or added to match the most common scenarios
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines

Release note

Added support for human readable name attribute for saved objects audit events.

Closes: #200538
Closes: #100523

elena-shostak · 2025-01-15T14:00:54Z

/ci

Dosant

src/platform/plugins/shared/files/server/integration_tests/file_service.test.ts lgtm

SiddharthMantri

Really cool! 🎉 I've left one nit below.

SiddharthMantri · 2025-01-22T12:34:43Z

src/core/packages/saved-objects/api-server-internal/src/lib/apis/bulk_get.ts

        namespaces = await getAvailableSpaces();
      }
+
+      const getFields = () => {


Nit: Can this function change to a pure function so that it doesn't mutate the external variable fields? fields being an argument to the getFields function instead of maybe depending on it from the external context?

elena-shostak · 2025-01-22T15:46:34Z

@elasticmachine merge upstream

TinaHeiligers · 2025-01-27T20:59:00Z

src/core/packages/saved-objects/base-server-internal/src/saved_objects_type_registry.ts

    return this.types.get(type)?.management?.importableAndExportable ?? false;
  }
+
+  public getNameAttribute(type: string) {


Having defaults as undefined isn't ideal because it leads to messy code where we're always having to safeguard against undefined properties.
WDYT about using a default such as "anonymous" or even "unnamed"? That way we could search for those more easily.

Made it unknown since we mostly use it for audit (unknown outcome etc). Pushed in c3071cc

TinaHeiligers · 2025-01-27T22:41:57Z

src/core/packages/saved-objects/utils-server/src/saved_objects_utils.ts

+      title?: string;
+    };
+
+    const fallbackTitle = attributes?.name ?? attributes?.title ?? '';


prefer explicit (if somewhat verbose) code that's easier to read for all developers.
for example:

Suggested change

const fallbackTitle = attributes?.name ?? attributes?.title ?? '';

const fallbackTitle = attributes?.name || attributes?.title || '';

Pushed in c3071cc

TinaHeiligers · 2025-01-27T22:48:27Z

src/core/packages/saved-objects/utils-server/src/saved_objects_utils.ts

+
+    if (nameAttribute) {
+      return (
+        (attributes?.[nameAttribute as keyof (typeof savedObject)['attributes']] as string) ??


Isn't nameAttribute one of name, title or ''? We may need to make this clearer for non-typescript buffs. I, for one, find it hard to wrap my head around 😵‍💫

Simplified it in c3071cc

elena-shostak · 2025-01-28T10:16:00Z

@elasticmachine merge upstream

…o 200538-so-names

TinaHeiligers

Nicely done, LGTM on CI green

TinaHeiligers · 2025-01-27T23:02:52Z

src/core/packages/saved-objects/server/src/saved_objects_type.ts

   */
  name: string;
+  /**
+   * The attribute path to the saved object's name


Adding a bit more detail about where the nameAttribute is used and its behavior will prevent unintended use down the road. nameAttribute and name could get confusing to new consumers.

Suggested change

* The attribute path to the saved object's name

* The path to the attribute to be used as a human-readable name for audit logging. Defaults to the path to the name or title when not defined.

Or something along those lines.

TinaHeiligers · 2025-01-28T21:49:06Z

The failing test was skipped in main. I'm pulling in the changes and re-running CI.

TinaHeiligers · 2025-01-28T21:49:37Z

@elasticmachine merge upstream

elasticmachine · 2025-01-28T23:21:32Z

💚 Build Succeeded

Buildkite Build
Commit: 97f8488

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/core-saved-objects-server`	134	137	+3
`@kbn/core-saved-objects-utils-server`	6	12	+6
total			+9

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`@kbn/core`	826	827	+1

Unknown metric groups

API count

id	before	after	diff
`@kbn/core-saved-objects-server`	566	573	+7
`@kbn/core-saved-objects-utils-server`	36	42	+6
`@kbn/core-security-server`	146	147	+1
`@kbn/security-plugin-types-server`	282	283	+1
`security`	461	462	+1
total			+16

History

💔 Build #270867 failed 75f792a
💚 Build #269346 succeeded d0255a2
💛 Build #268140 was flaky 5ada548
💔 Build #268091 failed f277dda
💔 Build #268075 failed 373926d

kibanamachine · 2025-01-29T08:03:47Z

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/13026951673

## Summary Added support for human readable `name` attribute for saved objects audit. - Updated the saved object type/registration with `nameAttribute` option - Updated the Saved Objects Security Extension to support passing object names to the audit functions - Updated the audit logger with a configuration option to opt out of including saved object names (the SOR and SSC should be aware of this to avoid operations when they are not necessary) - Updated Saved Object Repository functions - [x] `bulkCreate` - [x] `bulkGet` - [x] `bulkResolve` - [x] `bulkUpdate` - [x] `collectMultiNamespaceReferences` - [x] `get` - [x] `updateObjectsSpaces` - [x] `bulkDelete` - [x] `delete` - [x] `removeReferencesTo` - [x] Updated Secure Spaces Client functions - [x] `auditObjectsForSpaceDeletion` Functions that were not updated: - `authorizeFind` - now we log audit before the actual find with only types. Find is complex one, that can return a lot of saved objects. The benefit of adding a separate audit event vs potential performance cost can be considered negligible. https://github.com/elastic/kibana/blob/2f6b9f67d8351a5688e9c3753a4a7234e466dc6a/src/core/packages/saved-objects/api-server-internal/src/lib/apis/find.ts#L166 - `deleteByNamespace` - doesn't have an audit log itself, however is used only along with the `delete` which adds audit log with SO name https://github.com/elastic/kibana/blob/2f6b9f67d8351a5688e9c3753a4a7234e466dc6a/x-pack/platform/plugins/shared/spaces/server/spaces_client/spaces_client.ts#L223-L225 - `checkConflicts` - audit was intensionally bypassed https://github.com/elastic/kibana/blob/2f6b9f67d8351a5688e9c3753a4a7234e466dc6a/x-pack/platform/plugins/shared/security/server/saved_objects/saved_objects_security_extension.ts#L945-L948 - `disableLegacyUrlAliases` - function calls `bulkUpdate` in the end (which adds audit log with SO name already). Adding name to the `disableLegacyUrlAliases` audit log, will result in double saved objects get operation which is not feasible. https://github.com/elastic/kibana/blob/2f6b9f67d8351a5688e9c3753a4a7234e466dc6a/x-pack/platform/plugins/shared/spaces/server/spaces_client/spaces_client.ts#L228-L234 ## How to test Best way to test it is from the `Manage Saved Objects` page with audit enabled. - Import some test data set from the main page. - Go to the `Manage Saved Objects`: - Update single SO - Delete singe SO - Bulk update SOs - Bulk delete SOs - Import/export SOs ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) ### Release note Added support for human readable name attribute for saved objects audit events. __Closes: https://github.com/elastic/kibana/issues/200538__ --------- Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> (cherry picked from commit 7b26912)

kibanamachine · 2025-01-29T08:09:37Z

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…#208680) # Backport This will backport the following commits from `main` to `8.x`: - [Support for saved objects name attribute in audit log (#206644)](#206644)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Elena Shostak <165678770+elena-shostak@users.noreply.github.com>

elena-shostak added 19 commits January 15, 2025 10:31

bulkCreate, bulkUpdate, bulkResolve

6d81b9b

wip

ec24d2f

wip

3e700c3

remove_references_to

8e9916b

Tests

c104bb1

bulk_get

fc32743

get

beba019

check_conflicts

a9e71bb

bulk_delete

d68cad2

delete

242ef7b

auditObjectsForSpaceDeletion

efc5f1c

Fixes

a834714

bulk_update, bulk_create tests

2dc7d7f

bulk_resolve tests

91f04b9

Fixes

797bdda

Fixes

fdb8782

Fixes

ac7f153

SO fix

9a935cc

Tests

883fafd

elena-shostak force-pushed the 200538-so-names branch from 341fee8 to 883fafd Compare January 15, 2025 09:33

elena-shostak added 4 commits January 15, 2025 10:51

bulk_get: fixes

bd251b4

Removed test.only

de2d138

bulk_get: fixes

508bdcc

saved_objects_security_extension: tests

84356fc

elena-shostak added Feature:Security/Audit Platform Security - Audit Logging feature release_note:enhancement backport:prev-minor Team:Security Platform Security: Auth, Users, Roles, Spaces, Audit Logging, etc t// labels Jan 16, 2025

Fixes

13d99b3

Merge branch 'main' into 200538-so-names

5ada548

Dosant approved these changes Jan 20, 2025

View reviewed changes

SiddharthMantri approved these changes Jan 22, 2025

View reviewed changes

bulk_get adjusted getFields function

8be0c30

Merge branch 'main' into 200538-so-names

d0255a2

kpollich mentioned this pull request Jan 23, 2025

[Fleet] Add nameAttribute to Fleet's saved object models to support human-readable audit log entries #208110

Closed

TinaHeiligers reviewed Jan 27, 2025

View reviewed changes

Fixes

c3071cc

elasticmachine and others added 3 commits January 28, 2025 11:16

Merge branch 'main' into 200538-so-names

78bc1d4

bulk_get fix

f089359

Merge branch '200538-so-names' of github.com:elena-shostak/kibana int…

75f792a

…o 200538-so-names

TinaHeiligers approved these changes Jan 28, 2025

View reviewed changes

Merge branch 'main' into 200538-so-names

97f8488

elena-shostak merged commit 7b26912 into elastic:main Jan 29, 2025

kibanamachine added the v9.0.0 label Jan 29, 2025

kibanamachine mentioned this pull request Jan 29, 2025

[8.x] Support for saved objects name attribute in audit log (#206644) #208680

Merged

kibanamachine added the v8.18.0 label Jan 29, 2025

legrego mentioned this pull request Jan 29, 2025

ECS Audit logging lack of identifiable description on saved object #100523

Closed

elena-shostak mentioned this pull request Jun 18, 2025

[Response Ops][Reporting] Scheduled Reports #221028

Merged

	await this.repository.deleteByNamespace(id);

	await this.repository.delete('space', id);

	// auditing is intentionally bypassed, this function in the previous Security SOC wrapper implementation
	// did not have audit logging. This is primarily because it is only used by Kibana and is not exposed in a
	// public HTTP API
	auditOptions: { bypass: 'always' },

	public async disableLegacyUrlAliases(aliases: LegacyUrlAliasTarget[]) {
	const attributes = { disabled: true };
	const objectsToUpdate = aliases.map(({ targetSpace, targetType, sourceId }) => {
	const id = `${targetSpace}:${targetType}:${sourceId}`;
	return { type: LEGACY_URL_ALIAS_TYPE, id, attributes };
	});
	await this.repository.bulkUpdate(objectsToUpdate);

	const fallbackTitle = attributes?.name ?? attributes?.title ?? '';
	const fallbackTitle = attributes?.name \|\| attributes?.title \|\| '';

	* The attribute path to the saved object's name
	* The path to the attribute to be used as a human-readable name for audit logging. Defaults to the path to the name or title when not defined.

Conversation

elena-shostak commented Jan 14, 2025 • edited by legrego Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

How to test

Checklist

Release note

Uh oh!

elena-shostak commented Jan 15, 2025

Uh oh!

Dosant left a comment

Choose a reason for hiding this comment

Uh oh!

SiddharthMantri left a comment

Choose a reason for hiding this comment

Uh oh!

SiddharthMantri Jan 22, 2025

Choose a reason for hiding this comment

Uh oh!

elena-shostak commented Jan 22, 2025

Uh oh!

TinaHeiligers Jan 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elena-shostak Jan 28, 2025

Choose a reason for hiding this comment

Uh oh!

TinaHeiligers Jan 27, 2025

Choose a reason for hiding this comment

Uh oh!

elena-shostak Jan 28, 2025

Choose a reason for hiding this comment

Uh oh!

TinaHeiligers Jan 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elena-shostak Jan 28, 2025

Choose a reason for hiding this comment

Uh oh!

elena-shostak commented Jan 28, 2025

Uh oh!

TinaHeiligers left a comment

Choose a reason for hiding this comment

Uh oh!

TinaHeiligers Jan 27, 2025

Choose a reason for hiding this comment

Uh oh!

TinaHeiligers commented Jan 28, 2025

Uh oh!

TinaHeiligers commented Jan 28, 2025

Uh oh!

elasticmachine commented Jan 28, 2025

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Public APIs missing exports

API count

History

Uh oh!

kibanamachine commented Jan 29, 2025

Uh oh!

kibanamachine commented Jan 29, 2025

💚 All backports created successfully

Questions ?

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

elena-shostak commented Jan 14, 2025 •

edited by legrego

Loading

TinaHeiligers Jan 27, 2025 •

edited

Loading

TinaHeiligers Jan 27, 2025 •

edited

Loading