[Response Ops][Reporting] Scheduled Reports - Audit Logging (merging into feature branch) by ymao1 · Pull Request #221846 · elastic/kibana

ymao1 · 2025-05-28T20:11:40Z

Towards #216313

Note

This PR will be merged into a feature branch

Summary

Logs audit events when users use the schedule/list/disable scheduled reports APIs

To Verify

Set xpack.security.audit.enabled: true in Kibana config and start ES and Kibana
Use the API to schedule some reports and then list and disable using the API

For example:

POST kbn:/internal/reporting/schedule/printablePdfV2
{
    "schedule": {
        "rrule": {
            "freq": 3,
            "interval": 1,
            "byhour": [0,1,2],
            "byminute": [50,55]
        }
    },
    "jobParams":"(browserTimezone:America/New_York,layout:(dimensions:(height:2220,width:1409),id:preserve_layout),locatorParams:!((id:DASHBOARD_APP_LOCATOR,params:(dashboardId:edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b,preserveSavedFilters:!t,timeRange:(from:now-7d/d,to:now),useHash:!f,viewMode:view))),objectType:dashboard,title:'[Logs] Web Traffic',version:'9.1.0')"
}

GET kbn:/internal/reporting/scheduled/list

PATCH kbn:/internal/reporting/scheduled/bulk_disable
{
    "ids": ["<reportId>"]
}

In your kibana folder, go to logs/audit.log. You should be able to see some audit events logged, for example

{"event":{"action":"scheduled_report_schedule","category":["database"],"type":["creation"],"outcome":"unknown"},"kibana":{"space_id":"default","session_id":"m82PsJ/ryDwhpCtaoQQkFSjEthWTlMshadIeMY5l+Ww=","saved_object":{"type":"scheduled_report","id":"c871e247-5dd4-4f0a-8419-e70eb184645a","name":"PDF"}},"user":{"id":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","name":"elastic","roles":["superuser"]},"trace":{"id":"e255102c-6ef9-4264-9cbd-9333a0910577"},"client":{"ip":"127.0.0.1"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2025-06-10T15:06:55.369-04:00","message":"User is creating scheduled report [id=c871e247-5dd4-4f0a-8419-e70eb184645a] [name=PDF]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95125,"uptime":359.058969666},"transaction":{"id":"1fd4a03b23a4ad0d"}}
{"event":{"action":"scheduled_report_list","category":["database"],"type":["access"],"outcome":"success"},"kibana":{"space_id":"default","session_id":"m82PsJ/ryDwhpCtaoQQkFSjEthWTlMshadIeMY5l+Ww=","saved_object":{"type":"scheduled_report","id":"5f878787-1ea3-4704-b43c-b25e27376e5a"}},"user":{"id":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","name":"elastic","roles":["superuser"]},"trace":{"id":"7fc9d281-ea86-4d1b-b9f2-8f2143d058e0"},"client":{"ip":"127.0.0.1"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.11.0"},"@timestamp":"2025-06-10T15:13:03.960-04:00","message":"User has accessed scheduled report [id=5f878787-1ea3-4704-b43c-b25e27376e5a]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":95125,"uptime":727.648898875},"transaction":{"id":"bb9eabc53740c18c"}}

…apping'

…-fix'

…:ersin-erdal/kibana into 216308-support-rrule-for-task-scheduling

…te --fix'

… src/core/server/integration_tests/ci_checks'

…:ersin-erdal/kibana into 216308-support-rrule-for-task-scheduling

… src/core/server/integration_tests/ci_checks'

…:ersin-erdal/kibana into 216308-support-rrule-for-task-scheduling

…heduled-reports-task

…o scheduled-reports-audit

elasticmachine · 2025-06-12T22:47:21Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: d06a49e

Failed CI Steps

FTR Configs #18

Test Failures

[job] [logs] FTR Configs #18 / Entity Analytics - Entity Store @ess Host transform logic Install Entity Store and test Host transform "before each" hook for "Should return 200 and status 'running' for all engines"

Metrics [docs]

✅ unchanged

History

💚 Build #307202 succeeded 1705d76
💔 Build #303209 failed 93c806d

cc @ymao1

js-jankisalvi

Verified locally, works as expected 👍

doakalexi

LGTM! tested locally and works as expected

Resolves #216313 ## Summary This is a feature branch that contains the following commits. Each individual linked PR contains a summary and verification instructions. * Schedule API - #219771 * Scheduled report task runner - #219770 * List and disable API - #220922 * Audit logging - #221846 * Send scheduled report emails - #220539 * Commit to check license - f5f9d9d * Update to list API response format - #224262 --------- Co-authored-by: Ersin Erdal <ersin.erdal@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Ersin Erdal <92688503+ersin-erdal@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: Alexi Doak <109488926+doakalexi@users.noreply.github.com>

Resolves elastic#216313 ## Summary This is a feature branch that contains the following commits. Each individual linked PR contains a summary and verification instructions. * Schedule API - elastic#219771 * Scheduled report task runner - elastic#219770 * List and disable API - elastic#220922 * Audit logging - elastic#221846 * Send scheduled report emails - elastic#220539 * Commit to check license - elastic@f5f9d9d * Update to list API response format - elastic#224262 --------- Co-authored-by: Ersin Erdal <ersin.erdal@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Ersin Erdal <92688503+ersin-erdal@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: Alexi Doak <109488926+doakalexi@users.noreply.github.com> (cherry picked from commit a409627) # Conflicts: # src/platform/packages/private/kbn-reporting/common/routes.ts # x-pack/platform/plugins/private/canvas/server/feature.test.ts # x-pack/platform/plugins/private/reporting/server/core.ts # x-pack/platform/plugins/private/reporting/server/features.ts # x-pack/platform/plugins/shared/features/server/__snapshots__/oss_features.test.ts.snap # x-pack/platform/test/api_integration/apis/features/features/features.ts # x-pack/test_serverless/api_integration/test_suites/chat/platform_security/authorization.ts # x-pack/test_serverless/api_integration/test_suites/observability/platform_security/authorization.ts # x-pack/test_serverless/api_integration/test_suites/search/platform_security/authorization.ts # x-pack/test_serverless/api_integration/test_suites/security/platform_security/authorization.ts

ersin-erdal and others added 30 commits April 9, 2025 18:38

Support rrule for task scheduling

a74e49d

remove redundant return

6163f7e

add functional tests

20ecece

[CI] Auto-commit changed files from 'node scripts/styled_components_m…

c29a08e

…apping'

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

de20db1

…-fix'

fix linting

65f0960

Merge branch '216308-support-rrule-for-task-scheduling' of github.com…

2dde5f6

…:ersin-erdal/kibana into 216308-support-rrule-for-task-scheduling

fix linter

717cadb

[CI] Auto-commit changed files from 'node scripts/check_mappings_upda…

72b108e

…te --fix'

Merge branch 'main' into 216308-support-rrule-for-task-scheduling

38e69ef

[CI] Auto-commit changed files from 'node scripts/jest_integration -u…

c9e71ba

… src/core/server/integration_tests/ci_checks'

Merge branch 'main' into 216308-support-rrule-for-task-scheduling

5f6fad9

Allowing shared concurrency task types

d05d9c8

Merge branch 'main' into 216308-support-rrule-for-task-scheduling

4a04b90

set second to [0]

249f14c

Merge branch '216308-support-rrule-for-task-scheduling' of github.com…

4c60d8e

…:ersin-erdal/kibana into 216308-support-rrule-for-task-scheduling

testing schedule is more resilient

4a14142

remove "only"

4ec1bca

Merge branch 'main' into 216308-support-rrule-for-task-scheduling

1275f1e

Merge branch 'main' into 216308-support-rrule-for-task-scheduling

8aff2c9

Merge branch 'main' into shared-concurrency-tasks

04b70a2

Merge branch 'main' into shared-concurrency-tasks

c9547ae

throw when interval is not provided for the next run calculation

850ec64

Merge branch '216308-support-rrule-for-task-scheduling' of github.com…

10c40e5

…:ersin-erdal/kibana into 216308-support-rrule-for-task-scheduling

Merge branch 'main' into 216308-support-rrule-for-task-scheduling

af75dfb

[CI] Auto-commit changed files from 'node scripts/jest_integration -u…

95cf333

… src/core/server/integration_tests/ci_checks'

update read me

d5227aa

Merge branch '216308-support-rrule-for-task-scheduling' of github.com…

2a1482e

…:ersin-erdal/kibana into 216308-support-rrule-for-task-scheduling

Merge branch 'main' into shared-concurrency-tasks

372d4c7

update read me

62fe072

ymao1 added 6 commits May 22, 2025 10:03

adding logging

296449b

handling last run search errors

c32bea7

Merge branch 'scheduled-reports' of github.com:elastic/kibana into sc…

d60bbff

…heduled-reports-task

Merge branch 'scheduled-reports' of github.com:elastic/kibana into sc…

3955376

…heduled-reports-task

Merge branch 'scheduled-reports-task' into scheduled-reports-find

2242eee

Merge

93c806d

ymao1 mentioned this pull request May 28, 2025

[Response Ops][Reporting] Scheduled Reports #221028

Merged

ymao1 added 9 commits May 29, 2025 15:34

Fixing test

0466ce7

Merge

c3cb16e

Cleanup

83ad071

Merge

60fa1eb

Merge

dac0556

Merge branch 'scheduled-reports-find' into scheduled-reports-audit

a3c7213

Merge

1052022

Merge branch 'scheduled-reports-audit' of github.com:ymao1/kibana int…

7d850a6

…o scheduled-reports-audit

Adding audit logging

1705d76

ymao1 changed the title ~~[Response Ops][Reporting] Scheduled Reports - Audit Logging~~ [Response Ops][Reporting] Scheduled Reports - Audit Logging (merging into feature branch) Jun 10, 2025

ymao1 self-assigned this Jun 10, 2025

ymao1 requested review from js-jankisalvi and pmuellr June 11, 2025 00:03

ymao1 marked this pull request as ready for review June 11, 2025 00:03

ymao1 requested a review from a team as a code owner June 11, 2025 00:03

Merge

d06a49e

js-jankisalvi approved these changes Jun 13, 2025

View reviewed changes

doakalexi approved these changes Jun 13, 2025

View reviewed changes

ymao1 merged commit f2782b0 into elastic:scheduled-reports Jun 15, 2025
9 of 10 checks passed

ymao1 deleted the scheduled-reports-audit branch June 15, 2025 17:04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Response Ops][Reporting] Scheduled Reports - Audit Logging (merging into feature branch)#221846

[Response Ops][Reporting] Scheduled Reports - Audit Logging (merging into feature branch)#221846
ymao1 merged 147 commits intoelastic:scheduled-reportsfrom
ymao1:scheduled-reports-audit

ymao1 commented May 28, 2025 •

edited

Loading

Uh oh!

elasticmachine commented Jun 12, 2025

Uh oh!

js-jankisalvi left a comment

Uh oh!

doakalexi left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

ymao1 commented May 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

To Verify

Uh oh!

elasticmachine commented Jun 12, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

History

Uh oh!

js-jankisalvi left a comment

Choose a reason for hiding this comment

Uh oh!

doakalexi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

ymao1 commented May 28, 2025 •

edited

Loading