Audit Watchers

Elastic Stack Kibana
#1

Hi,

Is it possible to audit the watcher changes?
We want to monitor who modifies the watcher and would like to audit this information.
Since we as a team have got access(admin) to the Watcher, the watcher is getting modified and we do not know who works on it.

It would be great to see who has modified it.

Thanks in advance for your help.

Thanks, Brit

#2

Anyone around could help me with this question?

#3

Have u tried enabling audit logs? Audit logs are disabled by default. To enable this functionality, you must set xpack.security.audit.enabled to true in kibana.yml .

#4

Appreciate your response Rashmi.
I will go through the documentation and update the setting as our environment is in ElasticCloud. I hope, I shall update the same in the cloud settings.

Once again, appreciating your response!!

Thanks, Brit