Tracking down who created Dashboards and Visualizations

Elastic Stack Kibana
1

Is there any ways to track down who created a dashboard and visualizaions? I do not see any options or places to indicate who created it, who was last person to modify it, and when. It will be very helpful when audit tons of the dashbords and visualizations. Please advise.

Thank you,
Shaw

2

Looked in the logs for the event when creating a visualization and I don't see who created it.

{
   "type":"response",
   "@timestamp":"2020-10-08T15:53:12Z",
   "tags":[
      
   ],
   "pid":7,
   "method":"post",
   "statusCode":200,
   "req":{
      "url":"/api/saved_objects/visualization?overwrite=true",
      "method":"post",
      "headers":{
         "host":"localhost:5601",
         "connection":"keep-alive",
         "content-length":"881",
         "kbn-version":"7.6.0",
         "user-agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36",
         "content-type":"application/json",
         "accept":"*/*",
         "origin":"http://localhost:5601",
         "sec-fetch-site":"same-origin",
         "sec-fetch-mode":"cors",
         "sec-fetch-dest":"empty",
         "referer":"http://localhost:5601/app/kibana",
         "accept-encoding":"gzip, deflate, br",
         "accept-language":"en-US,en;q=0.9"
      },
      "remoteAddress":"172.19.0.1",
      "userAgent":"172.19.0.1",
      "referer":"http://localhost:5601/app/kibana"
   },
   "res":{
      "statusCode":200,
      "responseTime":996,
      "contentLength":9
   },
   "message":"POST /api/saved_objects/visualization?overwrite=true 200 996ms - 9.0B"
}

Looked in the Kibana index and also in the exported JSON and can see updated time but not by whom.

image
image3466×1436 326 KB

So my answer is no unless the reason I am not seeing it is due to not having security enabled and only the default user. You can try to replicate what I did above on your side to see if it does show a user ID.

4

Thank you @aaron-nimocks for your prompt response. I do see the "updated_at" info, that is good and now I need to figure out how I can enable security feature to present the username in the doc, any ideas?

5

@Shaw enable audit logging

6

Great, thank you! I will check with my DevOps person for the enable audit logging status. Do you have a sample screenshot what kind of user info/format will be presented in the query result for dashboard/visualization?

7

I was on a call with your DevOps person when you asked. :slight_smile:

No I don't have a screenshot but here are the fields it should capture.

When audit logging is enabled, security events are persisted to a dedicated <clustername>_audit.json file on the host’s file system (on each node).

First I would try to locate that file and see the contents.

8

Hah~ Cool, this is very helpful, thank! I will check with my DevOps further.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.