Skip to content

[8.x] Support for saved objects name attribute in audit log (#206644)#208680

Merged
kibanamachine merged 1 commit intoelastic:8.xfrom
kibanamachine:backport/8.x/pr-206644
Jan 29, 2025
Merged

[8.x] Support for saved objects name attribute in audit log (#206644)#208680
kibanamachine merged 1 commit intoelastic:8.xfrom
kibanamachine:backport/8.x/pr-206644

Conversation

@kibanamachine
Copy link
Copy Markdown
Contributor

Backport

This will backport the following commits from main to 8.x:

Questions ?

Please refer to the Backport tool documentation

## Summary

Added support for human readable `name` attribute for saved objects
audit.
- Updated the saved object type/registration with `nameAttribute` option
- Updated the Saved Objects Security Extension to support passing object
names to the audit functions
- Updated the audit logger with a configuration option to opt out of
including saved object names (the SOR and SSC should be aware of this to
avoid operations when they are not necessary)
- Updated Saved Object Repository functions
     - [x] `bulkCreate`
     - [x] `bulkGet`
     - [x] `bulkResolve`
     - [x] `bulkUpdate`
     - [x] `collectMultiNamespaceReferences`
     - [x] `get`
     - [x] `updateObjectsSpaces`
    - [x] `bulkDelete`
    - [x] `delete`
    - [x] `removeReferencesTo`
- [x] Updated Secure Spaces Client functions
    - [x] `auditObjectsForSpaceDeletion`

Functions that were not updated:

- `authorizeFind` - now we log audit before the actual find with only
types. Find is complex one, that can return a lot of saved objects. The
benefit of adding a separate audit event vs potential performance cost
can be considered negligible.

https://github.com/elastic/kibana/blob/2f6b9f67d8351a5688e9c3753a4a7234e466dc6a/src/core/packages/saved-objects/api-server-internal/src/lib/apis/find.ts#L166
- `deleteByNamespace` - doesn't have an audit log itself, however is
used only along with the `delete` which adds audit log with SO name

https://github.com/elastic/kibana/blob/2f6b9f67d8351a5688e9c3753a4a7234e466dc6a/x-pack/platform/plugins/shared/spaces/server/spaces_client/spaces_client.ts#L223-L225
- `checkConflicts`  - audit was intensionally bypassed

https://github.com/elastic/kibana/blob/2f6b9f67d8351a5688e9c3753a4a7234e466dc6a/x-pack/platform/plugins/shared/security/server/saved_objects/saved_objects_security_extension.ts#L945-L948
- `disableLegacyUrlAliases` - function calls `bulkUpdate` in the end
(which adds audit log with SO name already). Adding name to the
`disableLegacyUrlAliases` audit log, will result in double saved objects
get operation which is not feasible.

https://github.com/elastic/kibana/blob/2f6b9f67d8351a5688e9c3753a4a7234e466dc6a/x-pack/platform/plugins/shared/spaces/server/spaces_client/spaces_client.ts#L228-L234

## How to test

Best way to test it is from the `Manage Saved Objects` page with audit
enabled.

- Import some test data set from the main page.
- Go to the `Manage Saved Objects`:
    - Update single SO
    - Delete singe SO
    - Bulk update SOs
    - Bulk delete SOs
    - Import/export SOs

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

### Release note

Added support for human readable name attribute for saved objects audit
events.

__Closes: https://github.com/elastic/kibana/issues/200538__

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit 7b26912)
@kibanamachine kibanamachine added the backport This PR is a backport of another PR label Jan 29, 2025
@kibanamachine kibanamachine enabled auto-merge (squash) January 29, 2025 08:09
@kibanamachine kibanamachine merged commit 71ad7a2 into elastic:8.x Jan 29, 2025
@elasticmachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id before after diff
@kbn/core-saved-objects-server 134 137 +3
@kbn/core-saved-objects-utils-server 6 12 +6
total +9

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id before after diff
@kbn/core 825 826 +1
Unknown metric groups

API count

id before after diff
@kbn/core-saved-objects-server 566 573 +7
@kbn/core-saved-objects-utils-server 36 42 +6
@kbn/core-security-server 146 147 +1
@kbn/security-plugin-types-server 282 283 +1
security 461 462 +1
total +16

cc @elena-shostak

@Danouchka
Copy link
Copy Markdown

Hello, in which release of 8.x will this be available please @elena-shostak ?

@elena-shostak
Copy link
Copy Markdown
Contributor

@Danouchka hey, it landed in 8.18

@Danouchka
Copy link
Copy Markdown

Thank you very much , I found it !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants