# Audit Watchers

**URL:** <https://discuss.elastic.co/t/audit-watchers/264436>\
**Category:** Kibana\
**Created:** [February 16, 2021, 1:24pm UTC](https://discuss.elastic.co/t/audit-watchers/264436 "2021-02-16T13:24:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bmbrit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bmbrit/32/63571_2.png) [@bmbrit](https://discuss.elastic.co/u/bmbrit)\
**Post date:** [February 16, 2021, 1:24pm UTC](https://discuss.elastic.co/t/audit-watchers/264436/1 "2021-02-16T13:24:59Z")

</div>

Hi,

Is it possible to audit the watcher changes?  
We want to monitor who modifies the watcher and would like to audit this information.  
Since we as a team have got access(admin) to the Watcher, the watcher is getting modified and we do not know who works on it.

It would be great to see who has modified it.

Thanks in advance for your help.

Thanks, Brit

---

<div class="post-metadata">

**Author:** ![bmbrit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bmbrit/32/63571_2.png) [@bmbrit](https://discuss.elastic.co/u/bmbrit)\
**Post date:** [February 17, 2021, 4:55pm UTC](https://discuss.elastic.co/t/audit-watchers/264436/2 "2021-02-17T16:55:18Z")

</div>

Anyone around could help me with this question?

---

<div class="post-metadata">

**Author:** ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)\
**Post date:** [February 17, 2021, 5:16pm UTC](https://discuss.elastic.co/t/audit-watchers/264436/3 "2021-02-17T17:16:50Z")

</div>

Have u tried enabling audit logs? Audit logs are **disabled** by default. To enable this functionality, you must set `xpack.security.audit.enabled` to `true` in `kibana.yml` .

> **[Audit logs | Kibana Guide \[7.11\] | Elastic](https://www.elastic.co/guide/en/kibana/current/xpack-security-audit-logging.html)**

---

<div class="post-metadata">

**Author:** ![bmbrit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bmbrit/32/63571_2.png) [@bmbrit](https://discuss.elastic.co/u/bmbrit)\
**Post date:** [February 17, 2021, 5:36pm UTC](https://discuss.elastic.co/t/audit-watchers/264436/4 "2021-02-17T17:36:13Z")

</div>

Appreciate your response Rashmi.  
I will go through the documentation and update the setting as our environment is in ElasticCloud. I hope, I shall update the same in the cloud settings.

Once again, appreciating your response!!

Thanks, Brit

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 17, 2021, 5:36pm UTC](https://discuss.elastic.co/t/audit-watchers/264436/5 "2021-03-17T17:36:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.