# ES audit security events for user management audit trails, etc
**URL:** https://discuss.elastic.co/t/es-audit-security-events-for-user-management-audit-trails-etc/234856
**Category:** Elasticsearch
**Created:** [May 29, 2020, 4:45am UTC](https://discuss.elastic.co/t/es-audit-security-events-for-user-management-audit-trails-etc/234856 "2020-05-29T04:45:20Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@hendry.lim](https://discuss.elastic.co/u/hendry.lim)
#### Post date: [May 29, 2020, 4:45am UTC](https://discuss.elastic.co/t/es-audit-security-events-for-user-management-audit-trails-etc/234856/1 "2020-05-29T04:45:20Z")
Hi,
is there a way to audit user management events in ES currently?
We need to audit creation/update/removal of users in ES.
We also need to audit password changes.
This may be a question for Kibana. Is there a way to "force password change" when user logs in?
Thanks.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 29, 2020, 4:53am UTC](https://discuss.elastic.co/t/es-audit-security-events-for-user-management-audit-trails-etc/234856/2 "2020-05-29T04:53:10Z")
[https://www.elastic.co/guide/en/elasticsearch/reference/current/enable-audit-logging.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/enable-audit-logging.html) perhaps?
And no, there's not one at the moment. That would depend entirely on what auth realm you used too.
---
### Author:  [@hendry.lim](https://discuss.elastic.co/u/hendry.lim)
#### Post date: [May 29, 2020, 4:59am UTC](https://discuss.elastic.co/t/es-audit-security-events-for-user-management-audit-trails-etc/234856/3 "2020-05-29T04:59:59Z")
We have got the audit logging enabled and ingested into ES, but based on [https://www.elastic.co/guide/en/elasticsearch/reference/7.7/audit-event-types.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.7/audit-event-types.html), we don't think there is such security event for user management audit events.
We are using the native realm currently.
Thanks.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 26, 2020, 5:00am UTC](https://discuss.elastic.co/t/es-audit-security-events-for-user-management-audit-trails-etc/234856/4 "2020-06-26T05:00:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.