How to review audit trails

Audit logs are detailed records of user activities and system actions within StackOps Elastic to support your operational needs. They track important events such as:

User login and logout attempts
Authentication successes and failures
Access requests and their outcomes (granted or denied) These logs provide useful insights for security audits and monitoring overall system activity.

All StackOps Elastic audit logs are stored in a dedicated StackOps Elastic central monitoring cluster. Each tenant deployment is preconfigured to connect to the central monitoring cluster via cross-cluster search (CCS) capabilities.

CCS uses the Audit Log View to search and view audit logs specific to your deployment environment directly from your system.

Access audit logs

StackOps Elastic provides a predefined search query in each Saved Object for you to access and review the Elasticsearch and Kibana audit logs. This means you don’t need to create these searches from scratch, saving time and simplifying log exploration.

To view audit logs using predefined query

Replace tenant_deployment_name with your deployment name in the corresponding URL:

Elasticsearch audit logs:

https://${tenant_deployment_name}.kb.ap-southeast-1.aws.found.io/app/discover#/view/95c6fe1f-a3eb-4a01-a00a-a75ed1a602c5

Kibana audit logs:

https://${tenant_deployment_name}.kb.ap-southeast-1.aws.found.io/app/discover#/view/a5b1371d-fd8a-45b1-973e-cb9b50735375

Review audit logs

A set of baseline SIEM audit rules is published to all tenant deployments during provisioning to track activities and support auditing requirements. For more details, refer to Innersource.

Review Elasticsearch audit logs

Elasticsearch audit logs capture interactions with the Elasticsearch cluster such as database events like changes, creations, and deletions. Key fields associated with the Elastic audit logs are:

Field	Description
timestamp	Indicates when the event was triggered.
user.name	Indicates who performed the activity.
message	Describes what was done, and providing details of the REST API.
event.dataset	Always refers to the value “elasticsearch.audit”.
url.original	Indicates the REST API endpoint that was called. Refer to Elastic API documentation for endpoints that can trigger events.
http.request.method	The standard HTTP request method used, such as GET, POST, PUT, or DELETE.
event.outcome	Shows the outcome of the REST API call, which can be success or failure.

Example: Elasticsearch audit log query

event.dataset :"elasticsearch.audit" and url.original: /_data_stream/* and http.request.method :"DELETE" and event.action: "authentication_success" and event.outcome :"success"

Example: Elasticsearch audit log query result

{
  "_index": "rc_elasticnonprodmonit:.ds-elastic-cloud-logs-8-2024.04.22-000551",
  "_id": "jZnNA48BwoMHSRO1if-T",
  "_source": {
    "log": {
      "file": {
        "path": "/app/logs/17cc34e3022e4e139e354a6eb3bd1c46_audit.json"
      }
    },
    "message": "{\"type\": \"audit\", \"timestamp\":\"2024-04-22T03:15:47,932+0000\", \"cluster.uuid\":\"xxxxxxxxxxxx\", \"node.id\":\"9H4P1j8lTe2Ulx5y0ymFOA\", \"event.type\":\"rest\", \"event.action\":\"authentication_success\", \"authentication.type\":\"TOKEN\", \"user.name\":\"xxxxxxx\", \"user.realm\":\"cloud-saml-kibana\", \"origin.type\":\"rest\", \"origin.address\":\"xxx.xxx.xxx.xx:60702\", \"realm\":\"cloud-saml-kibana\", \"url.path\":\"/_security/user/testuser\", \"request.method\":\"DELETE\", \"request.id\":\"hjuPrXk-Q2mkIcGYPmQvDw\", \"opaque_id\":\"118d9cbe-cd06-491c-bd7f-5efb6847a1f0;kibana:application:management:\", \"x_forwarded_for\":\"xxx.xxx.xxx.xxx\"}",
    "related": {
      "user": [
        "xxxxxx"
      ]
    },
    "http": {
      "request": {
        "method": "DELETE",
        "id": "hjuPrXk-Q2mkIcGYPmQvDw"
      }
    },
    "event": {
      "ingested": "2024-04-22T03:15:52.846061060Z",
      "created": "2024-04-22T03:15:48.798Z",
      "kind": "event",
      "module": "elasticsearch",
      "action": "authentication_success",
      "category": "database",
      "dataset": "elasticsearch.audit",
      "outcome": "success"
    },
    "user": {
      "name": "xxxxxxxxx"
    }
  }
}

Review Kibana audit logs

Kibana audit logs captures with Kibana cluster such as user access or configuration activities. Key fields associated with Kibana audit logs are:

Field	Description
timestamp	Indicates when the event was triggered.
user.name	Indicates who performed the activity.
message	Describes what was done, and providing details of the REST API.
event.dataset	Always refers to the value “kibana.audit”.
event.type	Indicates the event type: change, creation, deletion, or access.
event.action	Refer to the Elastic Kibana documentation for values of events that can be filtered.
event.outcome	Shows the outcome of the REST API call, which can be success, unknown, or failure.

Example: Kibana audit log query

event.dataset :"kibana.audit" and event.action :"saved_object_update" and event.type: "change"

Example: Kibana audit log query result

{
  "_index": "rc_elasticnonprodmonit:.ds-elastic-cloud-logs-8-2024.04.22-000551",
  "_id": "mfjwA48BwoMHSRO1uj1e",
  "_source": {
    "log": {
      "file": {
        "path": "/app/logs/kibana_audit.json"
      }
    },
    "fileset": {
      "name": "audit"
    },
    "message": "User is updating index-pattern [id=aa1a3368-6b89-4225-a2bc-f90690dea2c9]",
    "@timestamp": "2024-04-22T03:54:17.874+00:00",
    "related": {
      "user": [
        "xxxxxxxx"
      ]
    },
    "event": {
      "ingested": "2024-04-22T03:54:19.102129624Z",
      "created": "2024-04-22T03:54:18.098Z",
      "kind": "event",
      "module": "kibana",
      "action": "saved_object_update",
      "category": [
        "database"
      ],
      "type": [
        "change"
      ],
      "dataset": "kibana.audit"
    },
    "kibana": {
      "saved_object": {
        "id": "aa1a3368-6b89-4225-a2bc-f90690dea2c9",
        "type": "index-pattern"
      },
      "space_id": "default"
    },
    "user": {
      "roles": [
        "tenant_admin"
      ],
      "name": "xxxxxx",
    }
  }
}

Manage API keys using service accounts

Known issues