I am looking to implement comprehensive Kibana audit logging to monitor user activities effectively. Specifically, I want to capture the following events:
User Login and Logout: I need to log when users log in and log out of Kibana. Currently, I understand that the login event is captured, but I would like to confirm how to also capture logout events, especially those initiated by the user and those due to session expiration.
User Actions: I want to track all actions performed by users, including:
Creation and deletion of visualizations, dashboards, and alerts.
Accessing different spaces and saved objects.
Any other significant changes or interactions within Kibana.
I am currently using ELK version 7.11.1 with a Platinum License.
From my research, I found that enabling audit logging requires setting xpack.security.audit.enabled to true in the kibana.yml configuration file. I tried this, but it did not work for me.
Could anyone provide insights on the following:
What features or configurations are required to enable detailed audit logging in Kibana?
How to set up and collect audit logs efficiently?
Any best practices for parsing and analyzing these logs to make them actionable?
If there are specific security settings, plugins, or tools I need to configure or integrate, I’d greatly appreciate any insights or examples.
Hi,
I encountered an indentation issue, but after resolving it, Kibana successfully started capturing logs. Below is the log entry I obtained. My next goal is to track specific user activities, such as:
User Actions:
Tracking all actions performed by users, including the creation and deletion of visualizations, dashboards, index/index patterns, and alerts.
Manual downloading of data through Discover or Visualizations.
Accessing different spaces and saved objects.
Any other significant changes or interactions within Kibana.
Log captured in the audit.log file:
{"@timestamp":"2024-11-26T07:44:06.369+00:00","message":"User [test_krish] has logged in using basic provider [name=basic]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":7559},"ecs":{"version":"1.6.0"},"event":{"action":"user_login","category":"authentication","outcome":"success"},"user":{"name":"test_krish","roles":["data_role_all","viewer"]},"kibana":{"authentication_provider":"basic","authentication_type":"basic","authentication_realm":"default_native","lookup_realm":"default_native"},"trace":{"id":"bf410e25-abfd-4438-bf73-cefc1a9505ac"}}
The next step is likely to use Filebeat to read this log and forward it to a monitoring cluster.
You can review the documentation to understand what auditing events exist and then you can perform various actions to generate audit activity into your monitoring cluster which you can then visualize and alert on.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.