# Auditing Security Events visualizing **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-security\ **Created:** [October 10, 2018, 8:03pm UTC](https://discuss.elastic.co/t/auditing-security-events-visualizing/151929 "2018-10-10T20:03:00Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [October 10, 2018, 8:03pm UTC](https://discuss.elastic.co/t/auditing-security-events-visualizing/151929/1 "2018-10-10T20:03:00Z")
Hi All , I am going to enable Auditing Security Events . Its out put will be an index and a log file . My question is , how can we use this index and log file ? Is this events are visualizing in kibana ? In monitoring we can visualize the monitoring data in kibana. I am comparing this Auditing with Monitoring ---
**Author:** ![Albert\_Zaharovits](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/albert_zaharovits/32/24390_2.png) [@Albert\_Zaharovits](https://discuss.elastic.co/u/Albert_Zaharovits)\ **Post date:** [October 14, 2018, 10:20am UTC](https://discuss.elastic.co/t/auditing-security-events-visualizing/151929/2 "2018-10-14T10:20:56Z")
Hi @rijinmp, There's no complete solution, for what you're describing, inside the elastic stack at the moment. We are however actively working on it. The approach we are taking is to use the [logfile output](https://www.elastic.co/guide/en/elasticsearch/reference/current/auditing-settings.html#general-audit-settings) for ES auditing, use Filebeat to ship them to an ES index and have templates and dashboards in Kibana for that. Right now, there is no perfect solution "that just works" like monitoring, you have to put these pieces together yourself if you need it now. ---
**Author:** ![ludaca](https://avatars.discourse-cdn.com/v4/letter/l/ac8455/32.png) [@ludaca](https://discuss.elastic.co/u/ludaca)\ **Post date:** [October 14, 2018, 1:35pm UTC](https://discuss.elastic.co/t/auditing-security-events-visualizing/151929/3 "2018-10-14T13:35:31Z")
Hi, I'm installed x-pack trial and checking it's functionality especially for audit events. I'd like to "record" in .security\_audit\_log queries performed by kibana users. Now I see in log only record with request title, for exmaple: request=[ShardSearchTransportRequest] If a particular index was searched, how to see exactly what is the search pattern and other details? Are there other setting in l aticsearch.yml?se ---
**Author:** ![Albert\_Zaharovits](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/albert_zaharovits/32/24390_2.png) [@Albert\_Zaharovits](https://discuss.elastic.co/u/Albert_Zaharovits)\ **Post date:** [October 14, 2018, 1:59pm UTC](https://discuss.elastic.co/t/auditing-security-events-visualizing/151929/4 "2018-10-14T13:59:54Z")
Hi @ludaca, The `xpack.security.audit.logfile.events.emit_request_body` (or `xpack.security.audit.index.events.emit_request_body`) is the setting you're looking for. More about them [here](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/auditing-settings.html#event-audit-settings). ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [October 15, 2018, 9:26am UTC](https://discuss.elastic.co/t/auditing-security-events-visualizing/151929/5 "2018-10-15T09:26:46Z")
Hi @Albert_Zaharovits The audit index is created now . I can see this index in monitoring menu in kibana. Name is like " .security\_audit\_log-2018._._ " May I visualize this index data in Kibana ? ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [October 15, 2018, 9:27am UTC](https://discuss.elastic.co/t/auditing-security-events-visualizing/151929/6 "2018-10-15T09:27:48Z")
Can you provide any documentation about this Security audit Dashboard templates ? ---
**Author:** ![Albert\_Zaharovits](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/albert_zaharovits/32/24390_2.png) [@Albert\_Zaharovits](https://discuss.elastic.co/u/Albert_Zaharovits)\ **Post date:** [October 15, 2018, 11:10am UTC](https://discuss.elastic.co/t/auditing-security-events-visualizing/151929/7 "2018-10-15T11:10:13Z")
AFAIK There are no Dashboard templates for the Security Audit. We are working on this. ---
**Author:** ![ludaca](https://avatars.discourse-cdn.com/v4/letter/l/ac8455/32.png) [@ludaca](https://discuss.elastic.co/u/ludaca)\ **Post date:** [October 15, 2018, 11:27am UTC](https://discuss.elastic.co/t/auditing-security-events-visualizing/151929/8 "2018-10-15T11:27:18Z")
I'm searching created .security\_audit\_log and can't find the kibana authenticated user name and request performed by this user. Is it possible at all? or only elastic user can be audited? ---
**Author:** ![Albert\_Zaharovits](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/albert_zaharovits/32/24390_2.png) [@Albert\_Zaharovits](https://discuss.elastic.co/u/Albert_Zaharovits)\ **Post date:** [October 15, 2018, 12:48pm UTC](https://discuss.elastic.co/t/auditing-security-events-visualizing/151929/9 "2018-10-15T12:48:33Z")
> [@ludaca](#): > > Is it possible at all? or only elastic user can be audited? Yes all users are audited . ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [October 15, 2018, 12:59pm UTC](https://discuss.elastic.co/t/auditing-security-events-visualizing/151929/10 "2018-10-15T12:59:17Z")
HI lucanda , It is a hidden index. If you are searching in KIbana , use this menu : management/elasticsearch/index\_management Then enable "Include system indices" One more thing your user should authorized to see this index. If you are login as a supers user , you can see it definitely. ---
**Author:** ![ludaca](https://avatars.discourse-cdn.com/v4/letter/l/ac8455/32.png) [@ludaca](https://discuss.elastic.co/u/ludaca)\ **Post date:** [October 15, 2018, 2:22pm UTC](https://discuss.elastic.co/t/auditing-security-events-visualizing/151929/11 "2018-10-15T14:22:56Z")
Here is my elasticsearch.yml x-pack settings: xpack.security.enabled: true xpack.security.audit.enabled: true xpack.security.audit.outputs: [index, logfile] xpack.security.audit.logfile.events.emit\_request\_body: true xpack.security.audit.index.events.emit\_request\_body: true I'm logged in kibana with testuser2 and performed some search on index named logstash-panelcasesol-2017-09-23 when I curl .security\_audit\_log-2018.10.15/\_search, and expect to see username "testuser2" and his action , but it's not there { "\_index" : ".security\_audit\_log-2018.10.15", "\_type" : "doc", "\_id" : "QEgFdWYBIOFrTQ7XwJCh", "\_score" : 1.0, "\_source" : { "@timestamp" : "2018-10-15T00:00:02.443Z", "node\_name" : "es-data1-642", "node\_host\_name" : "10.244.4.148", "node\_host\_address" : "10.244.4.148", "layer" : "transport", "event\_type" : "access\_granted", "origin\_type" : "rest", "origin\_address" : "10.244.4.149", "action" : "indices:data/read/search", "principal" : "elastic", "realm" : "reserved", "roles" : [ "superuser" ], "indices" : [ "_", "-_" ], "request" : "SearchRequest" } }, What do I miss? ---
**Author:** ![rijinmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijinmp/32/24634_2.png) [@rijinmp](https://discuss.elastic.co/u/rijinmp)\ **Post date:** [October 15, 2018, 3:48pm UTC](https://discuss.elastic.co/t/auditing-security-events-visualizing/151929/12 "2018-10-15T15:48:56Z")
Try this in yml file: xpack.security.audit.enabled: true xpack.security.audit.outputs: [index, logfile] xpack.security.audit.logfile.prefix.emit\_node\_name: true xpack.security.audit.logfile.prefix.emit\_node\_host\_address: true xpack.security.audit.logfile.prefix.emit\_node\_host\_name: true xpack.security.audit.index.settings: index: number\_of\_shards: 1 number\_of\_replicas: 1 ---
**Author:** ![ludaca](https://avatars.discourse-cdn.com/v4/letter/l/ac8455/32.png) [@ludaca](https://discuss.elastic.co/u/ludaca)\ **Post date:** [October 16, 2018, 7:09am UTC](https://discuss.elastic.co/t/auditing-security-events-visualizing/151929/13 "2018-10-16T07:09:30Z")
All this relates node&host, maybe you know paramete rsfor user aud?iintg ---
**Author:** ![phani\_krishna](https://avatars.discourse-cdn.com/v4/letter/p/b5e925/32.png) [@phani\_krishna](https://discuss.elastic.co/u/phani_krishna)\ **Post date:** [October 31, 2018, 9:14am UTC](https://discuss.elastic.co/t/auditing-security-events-visualizing/151929/14 "2018-10-31T09:14:13Z")
Hello ludaca, I'm having the same issue but atleast couldn't able to see the "search" actions["action" : "indices:data/read/search"]. The audit log index only shows me the actions from the principal "\_xpack\_security" and not from any other users. Could you pls let me know if there is something missing in my config files ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 28, 2018, 9:14am UTC](https://discuss.elastic.co/t/auditing-security-events-visualizing/151929/15 "2018-11-28T09:14:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.