I have a query regarding kibana, I assigned a role to a user (lets say User1). After some days that role was revoked from that user. I want to track who revoked that role from that user(User1) ?
You can capture this information via Elasticsearch's audit logging but it is not enabled by default.
Hope this helps.