[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-elasticsearch-audit":3,"mdc-dhdnne-key":36,"related-org-elastic-elasticsearch-audit":4350,"related-repo-elastic-elasticsearch-audit":4507},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":31,"sourceUrl":34,"mdContent":35},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Logs","logs",{"name":20,"slug":21,"type":15},"Audit","audit",{"name":23,"slug":24,"type":15},"Elasticsearch","elasticsearch",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:47:35.092599",null,41,[],{"repoUrl":26,"stars":25,"forks":29,"topics":32,"description":33},[],"Official Elastic Skills","https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fplugins\u002Felasticsearch\u002Fskills\u002Felasticsearch-audit","---\nname: elasticsearch-audit\ndescription: >\n  Enable, configure, and query Elasticsearch security audit logs. Use when the task\n  involves audit logging setup, event filtering, or investigating security incidents\n  like failed logins.\nmetadata:\n  author: elastic\n  version: 0.1.0\n---\n\n# Elasticsearch Audit Logging\n\nEnable and configure security audit logging for Elasticsearch via the cluster settings API. Audit logs record security\nevents such as authentication attempts, access grants and denials, role changes, and API key operations — essential for\ncompliance and incident investigation.\n\nFor Kibana audit logging (saved object access, login\u002Flogout, space operations), see **kibana-audit**. For authentication\nand API key management, see **elasticsearch-authn**. For roles and user management, see **elasticsearch-authz**. For\ndiagnosing security errors, see **elasticsearch-security-troubleshooting**.\n\nFor detailed API endpoints and event types, see [references\u002Fapi-reference.md](references\u002Fapi-reference.md).\n\n> **Deployment note:** Audit logging configuration differs across deployment types. See\n> [Deployment Compatibility](#deployment-compatibility) for details.\n\n## Jobs to Be Done\n\n- Enable or disable security audit logging on a cluster\n- Select which security events to record (authentication, access, config changes)\n- Create filter policies to reduce audit log noise\n- Query audit logs for failed authentication attempts\n- Investigate unauthorized access or privilege escalation incidents\n- Set up compliance-focused audit configuration\n- Detect brute-force login patterns from audit data\n- Configure audit output to an index for programmatic querying\n\n## Prerequisites\n\n| Item                   | Description                                                                |\n| ---------------------- | -------------------------------------------------------------------------- |\n| **Elasticsearch URL**  | Cluster endpoint (e.g. `https:\u002F\u002Flocalhost:9200` or a Cloud deployment URL) |\n| **Authentication**     | Valid credentials (see the elasticsearch-authn skill)                      |\n| **Cluster privileges** | `manage` cluster privilege to update cluster settings                      |\n| **License**            | Audit logging requires a gold, platinum, enterprise, or trial license      |\n\nPrompt the user for any missing values.\n\n## Enable Audit Logging\n\nEnable audit logging dynamically without a restart:\n\n```bash\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_cluster\u002Fsettings\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"persistent\": {\n      \"xpack.security.audit.enabled\": true\n    }\n  }'\n```\n\nTo disable, set `xpack.security.audit.enabled` to `false`. Verify current state:\n\n```bash\ncurl \"${ELASTICSEARCH_URL}\u002F_cluster\u002Fsettings?include_defaults=true&flat_settings=true\" \\\n  \u003Cauth_flags> | jq '.defaults | with_entries(select(.key | startswith(\"xpack.security.audit\")))'\n```\n\n## Audit Output\n\nAudit events can be written to two outputs. Both can be active simultaneously.\n\n| Output      | Setting value | Description                                                    |\n| ----------- | ------------- | -------------------------------------------------------------- |\n| **logfile** | `logfile`     | Written to `\u003CES_HOME>\u002Flogs\u002F\u003Ccluster>_audit.json`. Default.     |\n| **index**   | `index`       | Written to `.security-audit-*` indices. Queryable via the API. |\n\n### Configure output via API\n\n```bash\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_cluster\u002Fsettings\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"persistent\": {\n      \"xpack.security.audit.enabled\": true,\n      \"xpack.security.audit.outputs\": [\"index\", \"logfile\"]\n    }\n  }'\n```\n\nThe `index` output is required for programmatic querying of audit events. The `logfile` output is useful for shipping to\nexternal SIEM tools via Filebeat.\n\n> **Note:** On self-managed clusters, `xpack.security.audit.outputs` may require a static setting in `elasticsearch.yml`\n> on older versions (pre-8.x). On 8.x+, prefer the cluster settings API.\n\n## Select Events to Record\n\nControl which event types are included or excluded. By default, all events are recorded when audit is enabled.\n\n### Include specific events only\n\n```bash\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_cluster\u002Fsettings\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"persistent\": {\n      \"xpack.security.audit.logfile.events.include\": [\n        \"authentication_failed\",\n        \"access_denied\",\n        \"access_granted\",\n        \"anonymous_access_denied\",\n        \"tampered_request\",\n        \"run_as_denied\",\n        \"connection_denied\"\n      ]\n    }\n  }'\n```\n\n### Exclude noisy events\n\n```bash\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_cluster\u002Fsettings\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"persistent\": {\n      \"xpack.security.audit.logfile.events.exclude\": [\n        \"access_granted\"\n      ]\n    }\n  }'\n```\n\nExcluding `access_granted` significantly reduces log volume on busy clusters — use this when only failures matter.\n\n### Event types reference\n\n| Event                     | Fires when                                                 |\n| ------------------------- | ---------------------------------------------------------- |\n| `authentication_failed`   | Credentials were rejected                                  |\n| `authentication_success`  | User authenticated successfully                            |\n| `access_granted`          | An authorized action was performed                         |\n| `access_denied`           | An action was denied due to insufficient privileges        |\n| `anonymous_access_denied` | An unauthenticated request was rejected                    |\n| `tampered_request`        | A request was detected as tampered with                    |\n| `connection_granted`      | A node joined the cluster (transport layer)                |\n| `connection_denied`       | A node connection was rejected                             |\n| `run_as_granted`          | A run-as impersonation was authorized                      |\n| `run_as_denied`           | A run-as impersonation was denied                          |\n| `security_config_change`  | A security setting was changed (role, user, API key, etc.) |\n\nSee [references\u002Fapi-reference.md](references\u002Fapi-reference.md) for the complete event type list with field details.\n\n## Filter Policies\n\nFilter policies let you suppress specific audit events by user, realm, role, or index without disabling the event type\nglobally. Multiple policies can be active — an event is logged only if **no** policy filters it out.\n\n### Ignore system and internal users\n\n```bash\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_cluster\u002Fsettings\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"persistent\": {\n      \"xpack.security.audit.logfile.events.ignore_filters\": {\n        \"system_users\": {\n          \"users\": [\"_xpack_security\", \"_xpack\", \"elastic\u002Ffleet-server\"],\n          \"realms\": [\"_service_account\"]\n        }\n      }\n    }\n  }'\n```\n\n### Ignore health-check traffic on specific indices\n\n```bash\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_cluster\u002Fsettings\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"persistent\": {\n      \"xpack.security.audit.logfile.events.ignore_filters\": {\n        \"health_checks\": {\n          \"users\": [\"monitoring-user\"],\n          \"indices\": [\".monitoring-*\"]\n        }\n      }\n    }\n  }'\n```\n\n### Filter policy fields\n\n| Field     | Type          | Description                                          |\n| --------- | ------------- | ---------------------------------------------------- |\n| `users`   | array[string] | Usernames to exclude (supports wildcards)            |\n| `realms`  | array[string] | Realm names to exclude                               |\n| `roles`   | array[string] | Role names to exclude                                |\n| `indices` | array[string] | Index names or patterns to exclude (supports `*`)    |\n| `actions` | array[string] | Action names to exclude (e.g. `indices:data\u002Fread\u002F*`) |\n\nAn event is filtered out if it matches **all** specified fields within a single policy.\n\n### Remove a filter policy\n\nSet the policy to `null`:\n\n```bash\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_cluster\u002Fsettings\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"persistent\": {\n      \"xpack.security.audit.logfile.events.ignore_filters.health_checks\": null\n    }\n  }'\n```\n\n## Query Audit Events\n\nWhen the `index` output is enabled, audit events are stored in `.security-audit-*` indices and can be queried.\n\n### Search for failed authentication attempts\n\n```bash\ncurl -X POST \"${ELASTICSEARCH_URL}\u002F.security-audit-*\u002F_search\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"query\": {\n      \"bool\": {\n        \"filter\": [\n          { \"term\": { \"event.action\": \"authentication_failed\" } },\n          { \"range\": { \"@timestamp\": { \"gte\": \"now-24h\" } } }\n        ]\n      }\n    },\n    \"sort\": [{ \"@timestamp\": { \"order\": \"desc\" } }],\n    \"size\": 50\n  }'\n```\n\n### Search for access denied events on a specific index\n\n```bash\ncurl -X POST \"${ELASTICSEARCH_URL}\u002F.security-audit-*\u002F_search\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"query\": {\n      \"bool\": {\n        \"filter\": [\n          { \"term\": { \"event.action\": \"access_denied\" } },\n          { \"term\": { \"indices\": \"logs-*\" } },\n          { \"range\": { \"@timestamp\": { \"gte\": \"now-7d\" } } }\n        ]\n      }\n    },\n    \"sort\": [{ \"@timestamp\": { \"order\": \"desc\" } }],\n    \"size\": 20\n  }'\n```\n\n### Search for security configuration changes\n\n```bash\ncurl -X POST \"${ELASTICSEARCH_URL}\u002F.security-audit-*\u002F_search\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"query\": {\n      \"bool\": {\n        \"filter\": [\n          { \"term\": { \"event.action\": \"security_config_change\" } },\n          { \"range\": { \"@timestamp\": { \"gte\": \"now-7d\" } } }\n        ]\n      }\n    },\n    \"sort\": [{ \"@timestamp\": { \"order\": \"desc\" } }],\n    \"size\": 50\n  }'\n```\n\nThis captures role creation\u002Fdeletion, user changes, API key operations, and role mapping updates.\n\n### Count events by type and detect brute-force patterns\n\nUse `terms` aggregations on `event.action` (with `size: 0`) to count events by type over a time window. To detect\nbrute-force attempts, aggregate `authentication_failed` events by `source.ip` with `min_doc_count: 5`. See\n[references\u002Fapi-reference.md](references\u002Fapi-reference.md) for full aggregation query examples.\n\n## Correlate with Kibana Audit Logs\n\nKibana has its own audit log covering application-layer events that Elasticsearch does not see (saved object CRUD,\nKibana logins, space operations). When a user performs an action in Kibana, Kibana makes requests to Elasticsearch on\nthe user's behalf. Both systems record the same `trace.id` (passed via the `X-Opaque-Id` header), which serves as the\nprimary correlation key.\n\n> **Prerequisite:** Kibana audit must be enabled separately in `kibana.yml`. See the **kibana-audit** skill for setup\n> instructions, event types, and Kibana-specific filter policies.\n\n### Find ES audit events triggered by a Kibana action\n\nGiven a `trace.id` from a Kibana audit event, search the ES audit index to see the underlying Elasticsearch operations:\n\n```bash\ncurl -X POST \"${ELASTICSEARCH_URL}\u002F.security-audit-*\u002F_search\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"query\": {\n      \"bool\": {\n        \"filter\": [\n          { \"term\": { \"trace.id\": \"'\"${TRACE_ID}\"'\" } },\n          { \"range\": { \"@timestamp\": { \"gte\": \"now-24h\" } } }\n        ]\n      }\n    },\n    \"sort\": [{ \"@timestamp\": { \"order\": \"asc\" } }]\n  }'\n```\n\n### Correlate by user and time window\n\nWhen `trace.id` is unavailable (e.g. direct API calls), fall back to user + time-window correlation:\n\n```bash\ncurl -X POST \"${ELASTICSEARCH_URL}\u002F.security-audit-*\u002F_search\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"query\": {\n      \"bool\": {\n        \"filter\": [\n          { \"term\": { \"user.name\": \"'\"${USERNAME}\"'\" } },\n          { \"range\": { \"@timestamp\": { \"gte\": \"now-5m\" } } }\n        ]\n      }\n    },\n    \"sort\": [{ \"@timestamp\": { \"order\": \"asc\" } }]\n  }'\n```\n\nSecondary correlation fields: `user.name`, `source.ip`, and `@timestamp`.\n\n### Unified querying\n\nShip Kibana audit logs to Elasticsearch via Filebeat (see **kibana-audit** for the Filebeat config) so that both\n`.security-audit-*` (ES) and `kibana-audit-*` (Kibana) indices can be searched together in a single multi-index query\nfiltered by `trace.id`.\n\n## Examples\n\n### Enable audit logging for compliance\n\n**Request:** \"Enable audit logging and record all failed access and authentication events.\"\n\n```bash\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_cluster\u002Fsettings\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"persistent\": {\n      \"xpack.security.audit.enabled\": true,\n      \"xpack.security.audit.logfile.events.include\": [\n        \"authentication_failed\",\n        \"access_denied\",\n        \"anonymous_access_denied\",\n        \"run_as_denied\",\n        \"connection_denied\",\n        \"tampered_request\",\n        \"security_config_change\"\n      ]\n    }\n  }'\n```\n\nThis captures all denial and security change events while excluding high-volume success events.\n\n### Investigate a suspected unauthorized access attempt\n\n**Request:** \"Someone may have tried to access the `secrets-*` index. Check the audit logs.\"\n\n```bash\ncurl -X POST \"${ELASTICSEARCH_URL}\u002F.security-audit-*\u002F_search\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"query\": {\n      \"bool\": {\n        \"filter\": [\n          { \"terms\": { \"event.action\": [\"access_denied\", \"authentication_failed\"] } },\n          { \"wildcard\": { \"indices\": \"secrets-*\" } },\n          { \"range\": { \"@timestamp\": { \"gte\": \"now-48h\" } } }\n        ]\n      }\n    },\n    \"sort\": [{ \"@timestamp\": { \"order\": \"desc\" } }],\n    \"size\": 100\n  }'\n```\n\nReview `user.name`, `source.ip`, and `event.action` in the results to identify the actor and pattern.\n\n### Reduce audit noise on a busy cluster\n\n**Request:** \"Audit logs are too large. Filter out monitoring traffic and successful reads.\"\n\nExclude `access_granted` from event types, then add a filter policy for monitoring users and indices. See\n[Filter Policies](#filter-policies) for the full syntax.\n\n## Guidelines\n\n### Prefer index output for programmatic access\n\nEnable the `index` output to make audit events queryable. The `logfile` output is better for shipping to external SIEM\ntools via Filebeat but cannot be queried through the Elasticsearch API.\n\n### Start restrictive, then widen\n\nBegin with failure events only (`authentication_failed`, `access_denied`, `security_config_change`). Add success events\nonly when needed — they generate high volume.\n\n### Use filter policies instead of disabling events\n\nSuppress specific users or indices with filter policies rather than excluding entire event types.\n\n### Monitor audit index size\n\nSet up an ILM policy to roll over and delete old `.security-audit-*` indices. A 30-90 day retention is typical.\n\n### Enable Kibana audit for full coverage\n\nFor application-layer events (saved object access, Kibana logins, space operations), enable Kibana audit logging as\nwell. See the **kibana-audit** skill for setup. Use `trace.id` to correlate — see\n[Correlate with Kibana Audit Logs](#correlate-with-kibana-audit-logs) above.\n\n### Avoid superuser credentials\n\nUse a dedicated admin user or API key with `manage` privileges. Reserve `elastic` for emergency recovery only.\n\n## Deployment Compatibility\n\n| Capability                           | Self-managed | ECH          | Serverless    |\n| ------------------------------------ | ------------ | ------------ | ------------- |\n| ES audit via cluster settings        | Yes          | Yes          | Not available |\n| ES logfile output                    | Yes          | Via Cloud UI | Not available |\n| ES index output                      | Yes          | Yes          | Not available |\n| Filter policies via cluster settings | Yes          | Yes          | Not available |\n| Query `.security-audit-*`            | Yes          | Yes          | Not available |\n\n**ECH notes:** ES audit is configured via the cluster settings API. Logfile output is accessible through the Cloud\nconsole deployment logs. Index output works the same as self-managed.\n\n**Serverless notes:**\n\n- Audit logging is not user-configurable on Serverless. Security events are managed by Elastic as part of the platform.\n- If a user asks about auditing on Serverless, direct them to the Elastic Cloud console or their account team.\n",{"data":37,"body":40},{"name":4,"description":6,"metadata":38},{"author":8,"version":39},"0.1.0",{"type":41,"children":42},"root",[43,52,58,92,104,126,133,178,184,291,296,302,307,488,509,590,596,601,690,697,846,865,894,900,905,911,1122,1128,1283,1296,1302,1510,1521,1527,1539,1545,1725,1731,1908,1914,2082,2094,2100,2113,2253,2259,2278,2284,2483,2489,2688,2694,2883,2888,2894,2952,2958,2979,3006,3012,3024,3227,3233,3245,3445,3472,3478,3510,3516,3522,3532,3737,3742,3748,3765,3964,3988,3994,4003,4022,4028,4034,4053,4059,4083,4089,4094,4100,4112,4118,4143,4149,4168,4173,4313,4323,4331,4344],{"type":44,"tag":45,"props":46,"children":48},"element","h1",{"id":47},"elasticsearch-audit-logging",[49],{"type":50,"value":51},"text","Elasticsearch Audit Logging",{"type":44,"tag":53,"props":54,"children":55},"p",{},[56],{"type":50,"value":57},"Enable and configure security audit logging for Elasticsearch via the cluster settings API. Audit logs record security\nevents such as authentication attempts, access grants and denials, role changes, and API key operations — essential for\ncompliance and incident investigation.",{"type":44,"tag":53,"props":59,"children":60},{},[61,63,69,71,76,78,83,85,90],{"type":50,"value":62},"For Kibana audit logging (saved object access, login\u002Flogout, space operations), see ",{"type":44,"tag":64,"props":65,"children":66},"strong",{},[67],{"type":50,"value":68},"kibana-audit",{"type":50,"value":70},". For authentication\nand API key management, see ",{"type":44,"tag":64,"props":72,"children":73},{},[74],{"type":50,"value":75},"elasticsearch-authn",{"type":50,"value":77},". For roles and user management, see ",{"type":44,"tag":64,"props":79,"children":80},{},[81],{"type":50,"value":82},"elasticsearch-authz",{"type":50,"value":84},". For\ndiagnosing security errors, see ",{"type":44,"tag":64,"props":86,"children":87},{},[88],{"type":50,"value":89},"elasticsearch-security-troubleshooting",{"type":50,"value":91},".",{"type":44,"tag":53,"props":93,"children":94},{},[95,97,103],{"type":50,"value":96},"For detailed API endpoints and event types, see ",{"type":44,"tag":98,"props":99,"children":101},"a",{"href":100},"references\u002Fapi-reference.md",[102],{"type":50,"value":100},{"type":50,"value":91},{"type":44,"tag":105,"props":106,"children":107},"blockquote",{},[108],{"type":44,"tag":53,"props":109,"children":110},{},[111,116,118,124],{"type":44,"tag":64,"props":112,"children":113},{},[114],{"type":50,"value":115},"Deployment note:",{"type":50,"value":117}," Audit logging configuration differs across deployment types. See\n",{"type":44,"tag":98,"props":119,"children":121},{"href":120},"#deployment-compatibility",[122],{"type":50,"value":123},"Deployment Compatibility",{"type":50,"value":125}," for details.",{"type":44,"tag":127,"props":128,"children":130},"h2",{"id":129},"jobs-to-be-done",[131],{"type":50,"value":132},"Jobs to Be Done",{"type":44,"tag":134,"props":135,"children":136},"ul",{},[137,143,148,153,158,163,168,173],{"type":44,"tag":138,"props":139,"children":140},"li",{},[141],{"type":50,"value":142},"Enable or disable security audit logging on a cluster",{"type":44,"tag":138,"props":144,"children":145},{},[146],{"type":50,"value":147},"Select which security events to record (authentication, access, config changes)",{"type":44,"tag":138,"props":149,"children":150},{},[151],{"type":50,"value":152},"Create filter policies to reduce audit log noise",{"type":44,"tag":138,"props":154,"children":155},{},[156],{"type":50,"value":157},"Query audit logs for failed authentication attempts",{"type":44,"tag":138,"props":159,"children":160},{},[161],{"type":50,"value":162},"Investigate unauthorized access or privilege escalation incidents",{"type":44,"tag":138,"props":164,"children":165},{},[166],{"type":50,"value":167},"Set up compliance-focused audit configuration",{"type":44,"tag":138,"props":169,"children":170},{},[171],{"type":50,"value":172},"Detect brute-force login patterns from audit data",{"type":44,"tag":138,"props":174,"children":175},{},[176],{"type":50,"value":177},"Configure audit output to an index for programmatic querying",{"type":44,"tag":127,"props":179,"children":181},{"id":180},"prerequisites",[182],{"type":50,"value":183},"Prerequisites",{"type":44,"tag":185,"props":186,"children":187},"table",{},[188,207],{"type":44,"tag":189,"props":190,"children":191},"thead",{},[192],{"type":44,"tag":193,"props":194,"children":195},"tr",{},[196,202],{"type":44,"tag":197,"props":198,"children":199},"th",{},[200],{"type":50,"value":201},"Item",{"type":44,"tag":197,"props":203,"children":204},{},[205],{"type":50,"value":206},"Description",{"type":44,"tag":208,"props":209,"children":210},"tbody",{},[211,237,253,275],{"type":44,"tag":193,"props":212,"children":213},{},[214,223],{"type":44,"tag":215,"props":216,"children":217},"td",{},[218],{"type":44,"tag":64,"props":219,"children":220},{},[221],{"type":50,"value":222},"Elasticsearch URL",{"type":44,"tag":215,"props":224,"children":225},{},[226,228,235],{"type":50,"value":227},"Cluster endpoint (e.g. ",{"type":44,"tag":229,"props":230,"children":232},"code",{"className":231},[],[233],{"type":50,"value":234},"https:\u002F\u002Flocalhost:9200",{"type":50,"value":236}," or a Cloud deployment URL)",{"type":44,"tag":193,"props":238,"children":239},{},[240,248],{"type":44,"tag":215,"props":241,"children":242},{},[243],{"type":44,"tag":64,"props":244,"children":245},{},[246],{"type":50,"value":247},"Authentication",{"type":44,"tag":215,"props":249,"children":250},{},[251],{"type":50,"value":252},"Valid credentials (see the elasticsearch-authn skill)",{"type":44,"tag":193,"props":254,"children":255},{},[256,264],{"type":44,"tag":215,"props":257,"children":258},{},[259],{"type":44,"tag":64,"props":260,"children":261},{},[262],{"type":50,"value":263},"Cluster privileges",{"type":44,"tag":215,"props":265,"children":266},{},[267,273],{"type":44,"tag":229,"props":268,"children":270},{"className":269},[],[271],{"type":50,"value":272},"manage",{"type":50,"value":274}," cluster privilege to update cluster settings",{"type":44,"tag":193,"props":276,"children":277},{},[278,286],{"type":44,"tag":215,"props":279,"children":280},{},[281],{"type":44,"tag":64,"props":282,"children":283},{},[284],{"type":50,"value":285},"License",{"type":44,"tag":215,"props":287,"children":288},{},[289],{"type":50,"value":290},"Audit logging requires a gold, platinum, enterprise, or trial license",{"type":44,"tag":53,"props":292,"children":293},{},[294],{"type":50,"value":295},"Prompt the user for any missing values.",{"type":44,"tag":127,"props":297,"children":299},{"id":298},"enable-audit-logging",[300],{"type":50,"value":301},"Enable Audit Logging",{"type":44,"tag":53,"props":303,"children":304},{},[305],{"type":50,"value":306},"Enable audit logging dynamically without a restart:",{"type":44,"tag":308,"props":309,"children":314},"pre",{"className":310,"code":311,"language":312,"meta":313,"style":313},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","curl -X PUT \"${ELASTICSEARCH_URL}\u002F_cluster\u002Fsettings\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"persistent\": {\n      \"xpack.security.audit.enabled\": true\n    }\n  }'\n","bash","",[315],{"type":44,"tag":229,"props":316,"children":317},{"__ignoreMap":313},[318,373,401,428,447,456,465,474],{"type":44,"tag":319,"props":320,"children":323},"span",{"class":321,"line":322},"line",1,[324,330,336,341,347,353,358,363,368],{"type":44,"tag":319,"props":325,"children":327},{"style":326},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[328],{"type":50,"value":329},"curl",{"type":44,"tag":319,"props":331,"children":333},{"style":332},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[334],{"type":50,"value":335}," -X",{"type":44,"tag":319,"props":337,"children":338},{"style":332},[339],{"type":50,"value":340}," PUT",{"type":44,"tag":319,"props":342,"children":344},{"style":343},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[345],{"type":50,"value":346}," \"${",{"type":44,"tag":319,"props":348,"children":350},{"style":349},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[351],{"type":50,"value":352},"ELASTICSEARCH_URL",{"type":44,"tag":319,"props":354,"children":355},{"style":343},[356],{"type":50,"value":357},"}",{"type":44,"tag":319,"props":359,"children":360},{"style":332},[361],{"type":50,"value":362},"\u002F_cluster\u002Fsettings",{"type":44,"tag":319,"props":364,"children":365},{"style":343},[366],{"type":50,"value":367},"\"",{"type":44,"tag":319,"props":369,"children":370},{"style":349},[371],{"type":50,"value":372}," \\\n",{"type":44,"tag":319,"props":374,"children":376},{"class":321,"line":375},2,[377,382,387,392,397],{"type":44,"tag":319,"props":378,"children":379},{"style":343},[380],{"type":50,"value":381},"  \u003C",{"type":44,"tag":319,"props":383,"children":384},{"style":332},[385],{"type":50,"value":386},"auth_flag",{"type":44,"tag":319,"props":388,"children":389},{"style":349},[390],{"type":50,"value":391},"s",{"type":44,"tag":319,"props":393,"children":394},{"style":343},[395],{"type":50,"value":396},">",{"type":44,"tag":319,"props":398,"children":399},{"style":349},[400],{"type":50,"value":372},{"type":44,"tag":319,"props":402,"children":404},{"class":321,"line":403},3,[405,410,415,420,424],{"type":44,"tag":319,"props":406,"children":407},{"style":332},[408],{"type":50,"value":409},"  -H",{"type":44,"tag":319,"props":411,"children":412},{"style":343},[413],{"type":50,"value":414}," \"",{"type":44,"tag":319,"props":416,"children":417},{"style":332},[418],{"type":50,"value":419},"Content-Type: application\u002Fjson",{"type":44,"tag":319,"props":421,"children":422},{"style":343},[423],{"type":50,"value":367},{"type":44,"tag":319,"props":425,"children":426},{"style":349},[427],{"type":50,"value":372},{"type":44,"tag":319,"props":429,"children":431},{"class":321,"line":430},4,[432,437,442],{"type":44,"tag":319,"props":433,"children":434},{"style":332},[435],{"type":50,"value":436},"  -d",{"type":44,"tag":319,"props":438,"children":439},{"style":343},[440],{"type":50,"value":441}," '",{"type":44,"tag":319,"props":443,"children":444},{"style":332},[445],{"type":50,"value":446},"{\n",{"type":44,"tag":319,"props":448,"children":450},{"class":321,"line":449},5,[451],{"type":44,"tag":319,"props":452,"children":453},{"style":332},[454],{"type":50,"value":455},"    \"persistent\": {\n",{"type":44,"tag":319,"props":457,"children":459},{"class":321,"line":458},6,[460],{"type":44,"tag":319,"props":461,"children":462},{"style":332},[463],{"type":50,"value":464},"      \"xpack.security.audit.enabled\": true\n",{"type":44,"tag":319,"props":466,"children":468},{"class":321,"line":467},7,[469],{"type":44,"tag":319,"props":470,"children":471},{"style":332},[472],{"type":50,"value":473},"    }\n",{"type":44,"tag":319,"props":475,"children":477},{"class":321,"line":476},8,[478,483],{"type":44,"tag":319,"props":479,"children":480},{"style":332},[481],{"type":50,"value":482},"  }",{"type":44,"tag":319,"props":484,"children":485},{"style":343},[486],{"type":50,"value":487},"'\n",{"type":44,"tag":53,"props":489,"children":490},{},[491,493,499,501,507],{"type":50,"value":492},"To disable, set ",{"type":44,"tag":229,"props":494,"children":496},{"className":495},[],[497],{"type":50,"value":498},"xpack.security.audit.enabled",{"type":50,"value":500}," to ",{"type":44,"tag":229,"props":502,"children":504},{"className":503},[],[505],{"type":50,"value":506},"false",{"type":50,"value":508},". Verify current state:",{"type":44,"tag":308,"props":510,"children":512},{"className":310,"code":511,"language":312,"meta":313,"style":313},"curl \"${ELASTICSEARCH_URL}\u002F_cluster\u002Fsettings?include_defaults=true&flat_settings=true\" \\\n  \u003Cauth_flags> | jq '.defaults | with_entries(select(.key | startswith(\"xpack.security.audit\")))'\n",[513],{"type":44,"tag":229,"props":514,"children":515},{"__ignoreMap":313},[516,548],{"type":44,"tag":319,"props":517,"children":518},{"class":321,"line":322},[519,523,527,531,535,540,544],{"type":44,"tag":319,"props":520,"children":521},{"style":326},[522],{"type":50,"value":329},{"type":44,"tag":319,"props":524,"children":525},{"style":343},[526],{"type":50,"value":346},{"type":44,"tag":319,"props":528,"children":529},{"style":349},[530],{"type":50,"value":352},{"type":44,"tag":319,"props":532,"children":533},{"style":343},[534],{"type":50,"value":357},{"type":44,"tag":319,"props":536,"children":537},{"style":332},[538],{"type":50,"value":539},"\u002F_cluster\u002Fsettings?include_defaults=true&flat_settings=true",{"type":44,"tag":319,"props":541,"children":542},{"style":343},[543],{"type":50,"value":367},{"type":44,"tag":319,"props":545,"children":546},{"style":349},[547],{"type":50,"value":372},{"type":44,"tag":319,"props":549,"children":550},{"class":321,"line":375},[551,555,559,563,567,572,577,581,586],{"type":44,"tag":319,"props":552,"children":553},{"style":343},[554],{"type":50,"value":381},{"type":44,"tag":319,"props":556,"children":557},{"style":332},[558],{"type":50,"value":386},{"type":44,"tag":319,"props":560,"children":561},{"style":349},[562],{"type":50,"value":391},{"type":44,"tag":319,"props":564,"children":565},{"style":343},[566],{"type":50,"value":396},{"type":44,"tag":319,"props":568,"children":569},{"style":343},[570],{"type":50,"value":571}," |",{"type":44,"tag":319,"props":573,"children":574},{"style":326},[575],{"type":50,"value":576}," jq",{"type":44,"tag":319,"props":578,"children":579},{"style":343},[580],{"type":50,"value":441},{"type":44,"tag":319,"props":582,"children":583},{"style":332},[584],{"type":50,"value":585},".defaults | with_entries(select(.key | startswith(\"xpack.security.audit\")))",{"type":44,"tag":319,"props":587,"children":588},{"style":343},[589],{"type":50,"value":487},{"type":44,"tag":127,"props":591,"children":593},{"id":592},"audit-output",[594],{"type":50,"value":595},"Audit Output",{"type":44,"tag":53,"props":597,"children":598},{},[599],{"type":50,"value":600},"Audit events can be written to two outputs. Both can be active simultaneously.",{"type":44,"tag":185,"props":602,"children":603},{},[604,624],{"type":44,"tag":189,"props":605,"children":606},{},[607],{"type":44,"tag":193,"props":608,"children":609},{},[610,615,620],{"type":44,"tag":197,"props":611,"children":612},{},[613],{"type":50,"value":614},"Output",{"type":44,"tag":197,"props":616,"children":617},{},[618],{"type":50,"value":619},"Setting value",{"type":44,"tag":197,"props":621,"children":622},{},[623],{"type":50,"value":206},{"type":44,"tag":208,"props":625,"children":626},{},[627,659],{"type":44,"tag":193,"props":628,"children":629},{},[630,638,646],{"type":44,"tag":215,"props":631,"children":632},{},[633],{"type":44,"tag":64,"props":634,"children":635},{},[636],{"type":50,"value":637},"logfile",{"type":44,"tag":215,"props":639,"children":640},{},[641],{"type":44,"tag":229,"props":642,"children":644},{"className":643},[],[645],{"type":50,"value":637},{"type":44,"tag":215,"props":647,"children":648},{},[649,651,657],{"type":50,"value":650},"Written to ",{"type":44,"tag":229,"props":652,"children":654},{"className":653},[],[655],{"type":50,"value":656},"\u003CES_HOME>\u002Flogs\u002F\u003Ccluster>_audit.json",{"type":50,"value":658},". Default.",{"type":44,"tag":193,"props":660,"children":661},{},[662,670,678],{"type":44,"tag":215,"props":663,"children":664},{},[665],{"type":44,"tag":64,"props":666,"children":667},{},[668],{"type":50,"value":669},"index",{"type":44,"tag":215,"props":671,"children":672},{},[673],{"type":44,"tag":229,"props":674,"children":676},{"className":675},[],[677],{"type":50,"value":669},{"type":44,"tag":215,"props":679,"children":680},{},[681,682,688],{"type":50,"value":650},{"type":44,"tag":229,"props":683,"children":685},{"className":684},[],[686],{"type":50,"value":687},".security-audit-*",{"type":50,"value":689}," indices. Queryable via the API.",{"type":44,"tag":691,"props":692,"children":694},"h3",{"id":693},"configure-output-via-api",[695],{"type":50,"value":696},"Configure output via API",{"type":44,"tag":308,"props":698,"children":700},{"className":310,"code":699,"language":312,"meta":313,"style":313},"curl -X PUT \"${ELASTICSEARCH_URL}\u002F_cluster\u002Fsettings\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"persistent\": {\n      \"xpack.security.audit.enabled\": true,\n      \"xpack.security.audit.outputs\": [\"index\", \"logfile\"]\n    }\n  }'\n",[701],{"type":44,"tag":229,"props":702,"children":703},{"__ignoreMap":313},[704,743,766,789,804,811,819,827,834],{"type":44,"tag":319,"props":705,"children":706},{"class":321,"line":322},[707,711,715,719,723,727,731,735,739],{"type":44,"tag":319,"props":708,"children":709},{"style":326},[710],{"type":50,"value":329},{"type":44,"tag":319,"props":712,"children":713},{"style":332},[714],{"type":50,"value":335},{"type":44,"tag":319,"props":716,"children":717},{"style":332},[718],{"type":50,"value":340},{"type":44,"tag":319,"props":720,"children":721},{"style":343},[722],{"type":50,"value":346},{"type":44,"tag":319,"props":724,"children":725},{"style":349},[726],{"type":50,"value":352},{"type":44,"tag":319,"props":728,"children":729},{"style":343},[730],{"type":50,"value":357},{"type":44,"tag":319,"props":732,"children":733},{"style":332},[734],{"type":50,"value":362},{"type":44,"tag":319,"props":736,"children":737},{"style":343},[738],{"type":50,"value":367},{"type":44,"tag":319,"props":740,"children":741},{"style":349},[742],{"type":50,"value":372},{"type":44,"tag":319,"props":744,"children":745},{"class":321,"line":375},[746,750,754,758,762],{"type":44,"tag":319,"props":747,"children":748},{"style":343},[749],{"type":50,"value":381},{"type":44,"tag":319,"props":751,"children":752},{"style":332},[753],{"type":50,"value":386},{"type":44,"tag":319,"props":755,"children":756},{"style":349},[757],{"type":50,"value":391},{"type":44,"tag":319,"props":759,"children":760},{"style":343},[761],{"type":50,"value":396},{"type":44,"tag":319,"props":763,"children":764},{"style":349},[765],{"type":50,"value":372},{"type":44,"tag":319,"props":767,"children":768},{"class":321,"line":403},[769,773,777,781,785],{"type":44,"tag":319,"props":770,"children":771},{"style":332},[772],{"type":50,"value":409},{"type":44,"tag":319,"props":774,"children":775},{"style":343},[776],{"type":50,"value":414},{"type":44,"tag":319,"props":778,"children":779},{"style":332},[780],{"type":50,"value":419},{"type":44,"tag":319,"props":782,"children":783},{"style":343},[784],{"type":50,"value":367},{"type":44,"tag":319,"props":786,"children":787},{"style":349},[788],{"type":50,"value":372},{"type":44,"tag":319,"props":790,"children":791},{"class":321,"line":430},[792,796,800],{"type":44,"tag":319,"props":793,"children":794},{"style":332},[795],{"type":50,"value":436},{"type":44,"tag":319,"props":797,"children":798},{"style":343},[799],{"type":50,"value":441},{"type":44,"tag":319,"props":801,"children":802},{"style":332},[803],{"type":50,"value":446},{"type":44,"tag":319,"props":805,"children":806},{"class":321,"line":449},[807],{"type":44,"tag":319,"props":808,"children":809},{"style":332},[810],{"type":50,"value":455},{"type":44,"tag":319,"props":812,"children":813},{"class":321,"line":458},[814],{"type":44,"tag":319,"props":815,"children":816},{"style":332},[817],{"type":50,"value":818},"      \"xpack.security.audit.enabled\": true,\n",{"type":44,"tag":319,"props":820,"children":821},{"class":321,"line":467},[822],{"type":44,"tag":319,"props":823,"children":824},{"style":332},[825],{"type":50,"value":826},"      \"xpack.security.audit.outputs\": [\"index\", \"logfile\"]\n",{"type":44,"tag":319,"props":828,"children":829},{"class":321,"line":476},[830],{"type":44,"tag":319,"props":831,"children":832},{"style":332},[833],{"type":50,"value":473},{"type":44,"tag":319,"props":835,"children":837},{"class":321,"line":836},9,[838,842],{"type":44,"tag":319,"props":839,"children":840},{"style":332},[841],{"type":50,"value":482},{"type":44,"tag":319,"props":843,"children":844},{"style":343},[845],{"type":50,"value":487},{"type":44,"tag":53,"props":847,"children":848},{},[849,851,856,858,863],{"type":50,"value":850},"The ",{"type":44,"tag":229,"props":852,"children":854},{"className":853},[],[855],{"type":50,"value":669},{"type":50,"value":857}," output is required for programmatic querying of audit events. The ",{"type":44,"tag":229,"props":859,"children":861},{"className":860},[],[862],{"type":50,"value":637},{"type":50,"value":864}," output is useful for shipping to\nexternal SIEM tools via Filebeat.",{"type":44,"tag":105,"props":866,"children":867},{},[868],{"type":44,"tag":53,"props":869,"children":870},{},[871,876,878,884,886,892],{"type":44,"tag":64,"props":872,"children":873},{},[874],{"type":50,"value":875},"Note:",{"type":50,"value":877}," On self-managed clusters, ",{"type":44,"tag":229,"props":879,"children":881},{"className":880},[],[882],{"type":50,"value":883},"xpack.security.audit.outputs",{"type":50,"value":885}," may require a static setting in ",{"type":44,"tag":229,"props":887,"children":889},{"className":888},[],[890],{"type":50,"value":891},"elasticsearch.yml",{"type":50,"value":893},"\non older versions (pre-8.x). On 8.x+, prefer the cluster settings API.",{"type":44,"tag":127,"props":895,"children":897},{"id":896},"select-events-to-record",[898],{"type":50,"value":899},"Select Events to Record",{"type":44,"tag":53,"props":901,"children":902},{},[903],{"type":50,"value":904},"Control which event types are included or excluded. By default, all events are recorded when audit is enabled.",{"type":44,"tag":691,"props":906,"children":908},{"id":907},"include-specific-events-only",[909],{"type":50,"value":910},"Include specific events only",{"type":44,"tag":308,"props":912,"children":914},{"className":310,"code":913,"language":312,"meta":313,"style":313},"curl -X PUT \"${ELASTICSEARCH_URL}\u002F_cluster\u002Fsettings\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"persistent\": {\n      \"xpack.security.audit.logfile.events.include\": [\n        \"authentication_failed\",\n        \"access_denied\",\n        \"access_granted\",\n        \"anonymous_access_denied\",\n        \"tampered_request\",\n        \"run_as_denied\",\n        \"connection_denied\"\n      ]\n    }\n  }'\n",[915],{"type":44,"tag":229,"props":916,"children":917},{"__ignoreMap":313},[918,957,980,1003,1018,1025,1033,1041,1049,1057,1066,1075,1084,1093,1102,1110],{"type":44,"tag":319,"props":919,"children":920},{"class":321,"line":322},[921,925,929,933,937,941,945,949,953],{"type":44,"tag":319,"props":922,"children":923},{"style":326},[924],{"type":50,"value":329},{"type":44,"tag":319,"props":926,"children":927},{"style":332},[928],{"type":50,"value":335},{"type":44,"tag":319,"props":930,"children":931},{"style":332},[932],{"type":50,"value":340},{"type":44,"tag":319,"props":934,"children":935},{"style":343},[936],{"type":50,"value":346},{"type":44,"tag":319,"props":938,"children":939},{"style":349},[940],{"type":50,"value":352},{"type":44,"tag":319,"props":942,"children":943},{"style":343},[944],{"type":50,"value":357},{"type":44,"tag":319,"props":946,"children":947},{"style":332},[948],{"type":50,"value":362},{"type":44,"tag":319,"props":950,"children":951},{"style":343},[952],{"type":50,"value":367},{"type":44,"tag":319,"props":954,"children":955},{"style":349},[956],{"type":50,"value":372},{"type":44,"tag":319,"props":958,"children":959},{"class":321,"line":375},[960,964,968,972,976],{"type":44,"tag":319,"props":961,"children":962},{"style":343},[963],{"type":50,"value":381},{"type":44,"tag":319,"props":965,"children":966},{"style":332},[967],{"type":50,"value":386},{"type":44,"tag":319,"props":969,"children":970},{"style":349},[971],{"type":50,"value":391},{"type":44,"tag":319,"props":973,"children":974},{"style":343},[975],{"type":50,"value":396},{"type":44,"tag":319,"props":977,"children":978},{"style":349},[979],{"type":50,"value":372},{"type":44,"tag":319,"props":981,"children":982},{"class":321,"line":403},[983,987,991,995,999],{"type":44,"tag":319,"props":984,"children":985},{"style":332},[986],{"type":50,"value":409},{"type":44,"tag":319,"props":988,"children":989},{"style":343},[990],{"type":50,"value":414},{"type":44,"tag":319,"props":992,"children":993},{"style":332},[994],{"type":50,"value":419},{"type":44,"tag":319,"props":996,"children":997},{"style":343},[998],{"type":50,"value":367},{"type":44,"tag":319,"props":1000,"children":1001},{"style":349},[1002],{"type":50,"value":372},{"type":44,"tag":319,"props":1004,"children":1005},{"class":321,"line":430},[1006,1010,1014],{"type":44,"tag":319,"props":1007,"children":1008},{"style":332},[1009],{"type":50,"value":436},{"type":44,"tag":319,"props":1011,"children":1012},{"style":343},[1013],{"type":50,"value":441},{"type":44,"tag":319,"props":1015,"children":1016},{"style":332},[1017],{"type":50,"value":446},{"type":44,"tag":319,"props":1019,"children":1020},{"class":321,"line":449},[1021],{"type":44,"tag":319,"props":1022,"children":1023},{"style":332},[1024],{"type":50,"value":455},{"type":44,"tag":319,"props":1026,"children":1027},{"class":321,"line":458},[1028],{"type":44,"tag":319,"props":1029,"children":1030},{"style":332},[1031],{"type":50,"value":1032},"      \"xpack.security.audit.logfile.events.include\": [\n",{"type":44,"tag":319,"props":1034,"children":1035},{"class":321,"line":467},[1036],{"type":44,"tag":319,"props":1037,"children":1038},{"style":332},[1039],{"type":50,"value":1040},"        \"authentication_failed\",\n",{"type":44,"tag":319,"props":1042,"children":1043},{"class":321,"line":476},[1044],{"type":44,"tag":319,"props":1045,"children":1046},{"style":332},[1047],{"type":50,"value":1048},"        \"access_denied\",\n",{"type":44,"tag":319,"props":1050,"children":1051},{"class":321,"line":836},[1052],{"type":44,"tag":319,"props":1053,"children":1054},{"style":332},[1055],{"type":50,"value":1056},"        \"access_granted\",\n",{"type":44,"tag":319,"props":1058,"children":1060},{"class":321,"line":1059},10,[1061],{"type":44,"tag":319,"props":1062,"children":1063},{"style":332},[1064],{"type":50,"value":1065},"        \"anonymous_access_denied\",\n",{"type":44,"tag":319,"props":1067,"children":1069},{"class":321,"line":1068},11,[1070],{"type":44,"tag":319,"props":1071,"children":1072},{"style":332},[1073],{"type":50,"value":1074},"        \"tampered_request\",\n",{"type":44,"tag":319,"props":1076,"children":1078},{"class":321,"line":1077},12,[1079],{"type":44,"tag":319,"props":1080,"children":1081},{"style":332},[1082],{"type":50,"value":1083},"        \"run_as_denied\",\n",{"type":44,"tag":319,"props":1085,"children":1087},{"class":321,"line":1086},13,[1088],{"type":44,"tag":319,"props":1089,"children":1090},{"style":332},[1091],{"type":50,"value":1092},"        \"connection_denied\"\n",{"type":44,"tag":319,"props":1094,"children":1096},{"class":321,"line":1095},14,[1097],{"type":44,"tag":319,"props":1098,"children":1099},{"style":332},[1100],{"type":50,"value":1101},"      ]\n",{"type":44,"tag":319,"props":1103,"children":1105},{"class":321,"line":1104},15,[1106],{"type":44,"tag":319,"props":1107,"children":1108},{"style":332},[1109],{"type":50,"value":473},{"type":44,"tag":319,"props":1111,"children":1113},{"class":321,"line":1112},16,[1114,1118],{"type":44,"tag":319,"props":1115,"children":1116},{"style":332},[1117],{"type":50,"value":482},{"type":44,"tag":319,"props":1119,"children":1120},{"style":343},[1121],{"type":50,"value":487},{"type":44,"tag":691,"props":1123,"children":1125},{"id":1124},"exclude-noisy-events",[1126],{"type":50,"value":1127},"Exclude noisy events",{"type":44,"tag":308,"props":1129,"children":1131},{"className":310,"code":1130,"language":312,"meta":313,"style":313},"curl -X PUT \"${ELASTICSEARCH_URL}\u002F_cluster\u002Fsettings\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"persistent\": {\n      \"xpack.security.audit.logfile.events.exclude\": [\n        \"access_granted\"\n      ]\n    }\n  }'\n",[1132],{"type":44,"tag":229,"props":1133,"children":1134},{"__ignoreMap":313},[1135,1174,1197,1220,1235,1242,1250,1258,1265,1272],{"type":44,"tag":319,"props":1136,"children":1137},{"class":321,"line":322},[1138,1142,1146,1150,1154,1158,1162,1166,1170],{"type":44,"tag":319,"props":1139,"children":1140},{"style":326},[1141],{"type":50,"value":329},{"type":44,"tag":319,"props":1143,"children":1144},{"style":332},[1145],{"type":50,"value":335},{"type":44,"tag":319,"props":1147,"children":1148},{"style":332},[1149],{"type":50,"value":340},{"type":44,"tag":319,"props":1151,"children":1152},{"style":343},[1153],{"type":50,"value":346},{"type":44,"tag":319,"props":1155,"children":1156},{"style":349},[1157],{"type":50,"value":352},{"type":44,"tag":319,"props":1159,"children":1160},{"style":343},[1161],{"type":50,"value":357},{"type":44,"tag":319,"props":1163,"children":1164},{"style":332},[1165],{"type":50,"value":362},{"type":44,"tag":319,"props":1167,"children":1168},{"style":343},[1169],{"type":50,"value":367},{"type":44,"tag":319,"props":1171,"children":1172},{"style":349},[1173],{"type":50,"value":372},{"type":44,"tag":319,"props":1175,"children":1176},{"class":321,"line":375},[1177,1181,1185,1189,1193],{"type":44,"tag":319,"props":1178,"children":1179},{"style":343},[1180],{"type":50,"value":381},{"type":44,"tag":319,"props":1182,"children":1183},{"style":332},[1184],{"type":50,"value":386},{"type":44,"tag":319,"props":1186,"children":1187},{"style":349},[1188],{"type":50,"value":391},{"type":44,"tag":319,"props":1190,"children":1191},{"style":343},[1192],{"type":50,"value":396},{"type":44,"tag":319,"props":1194,"children":1195},{"style":349},[1196],{"type":50,"value":372},{"type":44,"tag":319,"props":1198,"children":1199},{"class":321,"line":403},[1200,1204,1208,1212,1216],{"type":44,"tag":319,"props":1201,"children":1202},{"style":332},[1203],{"type":50,"value":409},{"type":44,"tag":319,"props":1205,"children":1206},{"style":343},[1207],{"type":50,"value":414},{"type":44,"tag":319,"props":1209,"children":1210},{"style":332},[1211],{"type":50,"value":419},{"type":44,"tag":319,"props":1213,"children":1214},{"style":343},[1215],{"type":50,"value":367},{"type":44,"tag":319,"props":1217,"children":1218},{"style":349},[1219],{"type":50,"value":372},{"type":44,"tag":319,"props":1221,"children":1222},{"class":321,"line":430},[1223,1227,1231],{"type":44,"tag":319,"props":1224,"children":1225},{"style":332},[1226],{"type":50,"value":436},{"type":44,"tag":319,"props":1228,"children":1229},{"style":343},[1230],{"type":50,"value":441},{"type":44,"tag":319,"props":1232,"children":1233},{"style":332},[1234],{"type":50,"value":446},{"type":44,"tag":319,"props":1236,"children":1237},{"class":321,"line":449},[1238],{"type":44,"tag":319,"props":1239,"children":1240},{"style":332},[1241],{"type":50,"value":455},{"type":44,"tag":319,"props":1243,"children":1244},{"class":321,"line":458},[1245],{"type":44,"tag":319,"props":1246,"children":1247},{"style":332},[1248],{"type":50,"value":1249},"      \"xpack.security.audit.logfile.events.exclude\": [\n",{"type":44,"tag":319,"props":1251,"children":1252},{"class":321,"line":467},[1253],{"type":44,"tag":319,"props":1254,"children":1255},{"style":332},[1256],{"type":50,"value":1257},"        \"access_granted\"\n",{"type":44,"tag":319,"props":1259,"children":1260},{"class":321,"line":476},[1261],{"type":44,"tag":319,"props":1262,"children":1263},{"style":332},[1264],{"type":50,"value":1101},{"type":44,"tag":319,"props":1266,"children":1267},{"class":321,"line":836},[1268],{"type":44,"tag":319,"props":1269,"children":1270},{"style":332},[1271],{"type":50,"value":473},{"type":44,"tag":319,"props":1273,"children":1274},{"class":321,"line":1059},[1275,1279],{"type":44,"tag":319,"props":1276,"children":1277},{"style":332},[1278],{"type":50,"value":482},{"type":44,"tag":319,"props":1280,"children":1281},{"style":343},[1282],{"type":50,"value":487},{"type":44,"tag":53,"props":1284,"children":1285},{},[1286,1288,1294],{"type":50,"value":1287},"Excluding ",{"type":44,"tag":229,"props":1289,"children":1291},{"className":1290},[],[1292],{"type":50,"value":1293},"access_granted",{"type":50,"value":1295}," significantly reduces log volume on busy clusters — use this when only failures matter.",{"type":44,"tag":691,"props":1297,"children":1299},{"id":1298},"event-types-reference",[1300],{"type":50,"value":1301},"Event types reference",{"type":44,"tag":185,"props":1303,"children":1304},{},[1305,1321],{"type":44,"tag":189,"props":1306,"children":1307},{},[1308],{"type":44,"tag":193,"props":1309,"children":1310},{},[1311,1316],{"type":44,"tag":197,"props":1312,"children":1313},{},[1314],{"type":50,"value":1315},"Event",{"type":44,"tag":197,"props":1317,"children":1318},{},[1319],{"type":50,"value":1320},"Fires when",{"type":44,"tag":208,"props":1322,"children":1323},{},[1324,1341,1358,1374,1391,1408,1425,1442,1459,1476,1493],{"type":44,"tag":193,"props":1325,"children":1326},{},[1327,1336],{"type":44,"tag":215,"props":1328,"children":1329},{},[1330],{"type":44,"tag":229,"props":1331,"children":1333},{"className":1332},[],[1334],{"type":50,"value":1335},"authentication_failed",{"type":44,"tag":215,"props":1337,"children":1338},{},[1339],{"type":50,"value":1340},"Credentials were rejected",{"type":44,"tag":193,"props":1342,"children":1343},{},[1344,1353],{"type":44,"tag":215,"props":1345,"children":1346},{},[1347],{"type":44,"tag":229,"props":1348,"children":1350},{"className":1349},[],[1351],{"type":50,"value":1352},"authentication_success",{"type":44,"tag":215,"props":1354,"children":1355},{},[1356],{"type":50,"value":1357},"User authenticated successfully",{"type":44,"tag":193,"props":1359,"children":1360},{},[1361,1369],{"type":44,"tag":215,"props":1362,"children":1363},{},[1364],{"type":44,"tag":229,"props":1365,"children":1367},{"className":1366},[],[1368],{"type":50,"value":1293},{"type":44,"tag":215,"props":1370,"children":1371},{},[1372],{"type":50,"value":1373},"An authorized action was performed",{"type":44,"tag":193,"props":1375,"children":1376},{},[1377,1386],{"type":44,"tag":215,"props":1378,"children":1379},{},[1380],{"type":44,"tag":229,"props":1381,"children":1383},{"className":1382},[],[1384],{"type":50,"value":1385},"access_denied",{"type":44,"tag":215,"props":1387,"children":1388},{},[1389],{"type":50,"value":1390},"An action was denied due to insufficient privileges",{"type":44,"tag":193,"props":1392,"children":1393},{},[1394,1403],{"type":44,"tag":215,"props":1395,"children":1396},{},[1397],{"type":44,"tag":229,"props":1398,"children":1400},{"className":1399},[],[1401],{"type":50,"value":1402},"anonymous_access_denied",{"type":44,"tag":215,"props":1404,"children":1405},{},[1406],{"type":50,"value":1407},"An unauthenticated request was rejected",{"type":44,"tag":193,"props":1409,"children":1410},{},[1411,1420],{"type":44,"tag":215,"props":1412,"children":1413},{},[1414],{"type":44,"tag":229,"props":1415,"children":1417},{"className":1416},[],[1418],{"type":50,"value":1419},"tampered_request",{"type":44,"tag":215,"props":1421,"children":1422},{},[1423],{"type":50,"value":1424},"A request was detected as tampered with",{"type":44,"tag":193,"props":1426,"children":1427},{},[1428,1437],{"type":44,"tag":215,"props":1429,"children":1430},{},[1431],{"type":44,"tag":229,"props":1432,"children":1434},{"className":1433},[],[1435],{"type":50,"value":1436},"connection_granted",{"type":44,"tag":215,"props":1438,"children":1439},{},[1440],{"type":50,"value":1441},"A node joined the cluster (transport layer)",{"type":44,"tag":193,"props":1443,"children":1444},{},[1445,1454],{"type":44,"tag":215,"props":1446,"children":1447},{},[1448],{"type":44,"tag":229,"props":1449,"children":1451},{"className":1450},[],[1452],{"type":50,"value":1453},"connection_denied",{"type":44,"tag":215,"props":1455,"children":1456},{},[1457],{"type":50,"value":1458},"A node connection was rejected",{"type":44,"tag":193,"props":1460,"children":1461},{},[1462,1471],{"type":44,"tag":215,"props":1463,"children":1464},{},[1465],{"type":44,"tag":229,"props":1466,"children":1468},{"className":1467},[],[1469],{"type":50,"value":1470},"run_as_granted",{"type":44,"tag":215,"props":1472,"children":1473},{},[1474],{"type":50,"value":1475},"A run-as impersonation was authorized",{"type":44,"tag":193,"props":1477,"children":1478},{},[1479,1488],{"type":44,"tag":215,"props":1480,"children":1481},{},[1482],{"type":44,"tag":229,"props":1483,"children":1485},{"className":1484},[],[1486],{"type":50,"value":1487},"run_as_denied",{"type":44,"tag":215,"props":1489,"children":1490},{},[1491],{"type":50,"value":1492},"A run-as impersonation was denied",{"type":44,"tag":193,"props":1494,"children":1495},{},[1496,1505],{"type":44,"tag":215,"props":1497,"children":1498},{},[1499],{"type":44,"tag":229,"props":1500,"children":1502},{"className":1501},[],[1503],{"type":50,"value":1504},"security_config_change",{"type":44,"tag":215,"props":1506,"children":1507},{},[1508],{"type":50,"value":1509},"A security setting was changed (role, user, API key, etc.)",{"type":44,"tag":53,"props":1511,"children":1512},{},[1513,1515,1519],{"type":50,"value":1514},"See ",{"type":44,"tag":98,"props":1516,"children":1517},{"href":100},[1518],{"type":50,"value":100},{"type":50,"value":1520}," for the complete event type list with field details.",{"type":44,"tag":127,"props":1522,"children":1524},{"id":1523},"filter-policies",[1525],{"type":50,"value":1526},"Filter Policies",{"type":44,"tag":53,"props":1528,"children":1529},{},[1530,1532,1537],{"type":50,"value":1531},"Filter policies let you suppress specific audit events by user, realm, role, or index without disabling the event type\nglobally. Multiple policies can be active — an event is logged only if ",{"type":44,"tag":64,"props":1533,"children":1534},{},[1535],{"type":50,"value":1536},"no",{"type":50,"value":1538}," policy filters it out.",{"type":44,"tag":691,"props":1540,"children":1542},{"id":1541},"ignore-system-and-internal-users",[1543],{"type":50,"value":1544},"Ignore system and internal users",{"type":44,"tag":308,"props":1546,"children":1548},{"className":310,"code":1547,"language":312,"meta":313,"style":313},"curl -X PUT \"${ELASTICSEARCH_URL}\u002F_cluster\u002Fsettings\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"persistent\": {\n      \"xpack.security.audit.logfile.events.ignore_filters\": {\n        \"system_users\": {\n          \"users\": [\"_xpack_security\", \"_xpack\", \"elastic\u002Ffleet-server\"],\n          \"realms\": [\"_service_account\"]\n        }\n      }\n    }\n  }'\n",[1549],{"type":44,"tag":229,"props":1550,"children":1551},{"__ignoreMap":313},[1552,1591,1614,1637,1652,1659,1667,1675,1683,1691,1699,1707,1714],{"type":44,"tag":319,"props":1553,"children":1554},{"class":321,"line":322},[1555,1559,1563,1567,1571,1575,1579,1583,1587],{"type":44,"tag":319,"props":1556,"children":1557},{"style":326},[1558],{"type":50,"value":329},{"type":44,"tag":319,"props":1560,"children":1561},{"style":332},[1562],{"type":50,"value":335},{"type":44,"tag":319,"props":1564,"children":1565},{"style":332},[1566],{"type":50,"value":340},{"type":44,"tag":319,"props":1568,"children":1569},{"style":343},[1570],{"type":50,"value":346},{"type":44,"tag":319,"props":1572,"children":1573},{"style":349},[1574],{"type":50,"value":352},{"type":44,"tag":319,"props":1576,"children":1577},{"style":343},[1578],{"type":50,"value":357},{"type":44,"tag":319,"props":1580,"children":1581},{"style":332},[1582],{"type":50,"value":362},{"type":44,"tag":319,"props":1584,"children":1585},{"style":343},[1586],{"type":50,"value":367},{"type":44,"tag":319,"props":1588,"children":1589},{"style":349},[1590],{"type":50,"value":372},{"type":44,"tag":319,"props":1592,"children":1593},{"class":321,"line":375},[1594,1598,1602,1606,1610],{"type":44,"tag":319,"props":1595,"children":1596},{"style":343},[1597],{"type":50,"value":381},{"type":44,"tag":319,"props":1599,"children":1600},{"style":332},[1601],{"type":50,"value":386},{"type":44,"tag":319,"props":1603,"children":1604},{"style":349},[1605],{"type":50,"value":391},{"type":44,"tag":319,"props":1607,"children":1608},{"style":343},[1609],{"type":50,"value":396},{"type":44,"tag":319,"props":1611,"children":1612},{"style":349},[1613],{"type":50,"value":372},{"type":44,"tag":319,"props":1615,"children":1616},{"class":321,"line":403},[1617,1621,1625,1629,1633],{"type":44,"tag":319,"props":1618,"children":1619},{"style":332},[1620],{"type":50,"value":409},{"type":44,"tag":319,"props":1622,"children":1623},{"style":343},[1624],{"type":50,"value":414},{"type":44,"tag":319,"props":1626,"children":1627},{"style":332},[1628],{"type":50,"value":419},{"type":44,"tag":319,"props":1630,"children":1631},{"style":343},[1632],{"type":50,"value":367},{"type":44,"tag":319,"props":1634,"children":1635},{"style":349},[1636],{"type":50,"value":372},{"type":44,"tag":319,"props":1638,"children":1639},{"class":321,"line":430},[1640,1644,1648],{"type":44,"tag":319,"props":1641,"children":1642},{"style":332},[1643],{"type":50,"value":436},{"type":44,"tag":319,"props":1645,"children":1646},{"style":343},[1647],{"type":50,"value":441},{"type":44,"tag":319,"props":1649,"children":1650},{"style":332},[1651],{"type":50,"value":446},{"type":44,"tag":319,"props":1653,"children":1654},{"class":321,"line":449},[1655],{"type":44,"tag":319,"props":1656,"children":1657},{"style":332},[1658],{"type":50,"value":455},{"type":44,"tag":319,"props":1660,"children":1661},{"class":321,"line":458},[1662],{"type":44,"tag":319,"props":1663,"children":1664},{"style":332},[1665],{"type":50,"value":1666},"      \"xpack.security.audit.logfile.events.ignore_filters\": {\n",{"type":44,"tag":319,"props":1668,"children":1669},{"class":321,"line":467},[1670],{"type":44,"tag":319,"props":1671,"children":1672},{"style":332},[1673],{"type":50,"value":1674},"        \"system_users\": {\n",{"type":44,"tag":319,"props":1676,"children":1677},{"class":321,"line":476},[1678],{"type":44,"tag":319,"props":1679,"children":1680},{"style":332},[1681],{"type":50,"value":1682},"          \"users\": [\"_xpack_security\", \"_xpack\", \"elastic\u002Ffleet-server\"],\n",{"type":44,"tag":319,"props":1684,"children":1685},{"class":321,"line":836},[1686],{"type":44,"tag":319,"props":1687,"children":1688},{"style":332},[1689],{"type":50,"value":1690},"          \"realms\": [\"_service_account\"]\n",{"type":44,"tag":319,"props":1692,"children":1693},{"class":321,"line":1059},[1694],{"type":44,"tag":319,"props":1695,"children":1696},{"style":332},[1697],{"type":50,"value":1698},"        }\n",{"type":44,"tag":319,"props":1700,"children":1701},{"class":321,"line":1068},[1702],{"type":44,"tag":319,"props":1703,"children":1704},{"style":332},[1705],{"type":50,"value":1706},"      }\n",{"type":44,"tag":319,"props":1708,"children":1709},{"class":321,"line":1077},[1710],{"type":44,"tag":319,"props":1711,"children":1712},{"style":332},[1713],{"type":50,"value":473},{"type":44,"tag":319,"props":1715,"children":1716},{"class":321,"line":1086},[1717,1721],{"type":44,"tag":319,"props":1718,"children":1719},{"style":332},[1720],{"type":50,"value":482},{"type":44,"tag":319,"props":1722,"children":1723},{"style":343},[1724],{"type":50,"value":487},{"type":44,"tag":691,"props":1726,"children":1728},{"id":1727},"ignore-health-check-traffic-on-specific-indices",[1729],{"type":50,"value":1730},"Ignore health-check traffic on specific indices",{"type":44,"tag":308,"props":1732,"children":1734},{"className":310,"code":1733,"language":312,"meta":313,"style":313},"curl -X PUT \"${ELASTICSEARCH_URL}\u002F_cluster\u002Fsettings\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"persistent\": {\n      \"xpack.security.audit.logfile.events.ignore_filters\": {\n        \"health_checks\": {\n          \"users\": [\"monitoring-user\"],\n          \"indices\": [\".monitoring-*\"]\n        }\n      }\n    }\n  }'\n",[1735],{"type":44,"tag":229,"props":1736,"children":1737},{"__ignoreMap":313},[1738,1777,1800,1823,1838,1845,1852,1860,1868,1876,1883,1890,1897],{"type":44,"tag":319,"props":1739,"children":1740},{"class":321,"line":322},[1741,1745,1749,1753,1757,1761,1765,1769,1773],{"type":44,"tag":319,"props":1742,"children":1743},{"style":326},[1744],{"type":50,"value":329},{"type":44,"tag":319,"props":1746,"children":1747},{"style":332},[1748],{"type":50,"value":335},{"type":44,"tag":319,"props":1750,"children":1751},{"style":332},[1752],{"type":50,"value":340},{"type":44,"tag":319,"props":1754,"children":1755},{"style":343},[1756],{"type":50,"value":346},{"type":44,"tag":319,"props":1758,"children":1759},{"style":349},[1760],{"type":50,"value":352},{"type":44,"tag":319,"props":1762,"children":1763},{"style":343},[1764],{"type":50,"value":357},{"type":44,"tag":319,"props":1766,"children":1767},{"style":332},[1768],{"type":50,"value":362},{"type":44,"tag":319,"props":1770,"children":1771},{"style":343},[1772],{"type":50,"value":367},{"type":44,"tag":319,"props":1774,"children":1775},{"style":349},[1776],{"type":50,"value":372},{"type":44,"tag":319,"props":1778,"children":1779},{"class":321,"line":375},[1780,1784,1788,1792,1796],{"type":44,"tag":319,"props":1781,"children":1782},{"style":343},[1783],{"type":50,"value":381},{"type":44,"tag":319,"props":1785,"children":1786},{"style":332},[1787],{"type":50,"value":386},{"type":44,"tag":319,"props":1789,"children":1790},{"style":349},[1791],{"type":50,"value":391},{"type":44,"tag":319,"props":1793,"children":1794},{"style":343},[1795],{"type":50,"value":396},{"type":44,"tag":319,"props":1797,"children":1798},{"style":349},[1799],{"type":50,"value":372},{"type":44,"tag":319,"props":1801,"children":1802},{"class":321,"line":403},[1803,1807,1811,1815,1819],{"type":44,"tag":319,"props":1804,"children":1805},{"style":332},[1806],{"type":50,"value":409},{"type":44,"tag":319,"props":1808,"children":1809},{"style":343},[1810],{"type":50,"value":414},{"type":44,"tag":319,"props":1812,"children":1813},{"style":332},[1814],{"type":50,"value":419},{"type":44,"tag":319,"props":1816,"children":1817},{"style":343},[1818],{"type":50,"value":367},{"type":44,"tag":319,"props":1820,"children":1821},{"style":349},[1822],{"type":50,"value":372},{"type":44,"tag":319,"props":1824,"children":1825},{"class":321,"line":430},[1826,1830,1834],{"type":44,"tag":319,"props":1827,"children":1828},{"style":332},[1829],{"type":50,"value":436},{"type":44,"tag":319,"props":1831,"children":1832},{"style":343},[1833],{"type":50,"value":441},{"type":44,"tag":319,"props":1835,"children":1836},{"style":332},[1837],{"type":50,"value":446},{"type":44,"tag":319,"props":1839,"children":1840},{"class":321,"line":449},[1841],{"type":44,"tag":319,"props":1842,"children":1843},{"style":332},[1844],{"type":50,"value":455},{"type":44,"tag":319,"props":1846,"children":1847},{"class":321,"line":458},[1848],{"type":44,"tag":319,"props":1849,"children":1850},{"style":332},[1851],{"type":50,"value":1666},{"type":44,"tag":319,"props":1853,"children":1854},{"class":321,"line":467},[1855],{"type":44,"tag":319,"props":1856,"children":1857},{"style":332},[1858],{"type":50,"value":1859},"        \"health_checks\": {\n",{"type":44,"tag":319,"props":1861,"children":1862},{"class":321,"line":476},[1863],{"type":44,"tag":319,"props":1864,"children":1865},{"style":332},[1866],{"type":50,"value":1867},"          \"users\": [\"monitoring-user\"],\n",{"type":44,"tag":319,"props":1869,"children":1870},{"class":321,"line":836},[1871],{"type":44,"tag":319,"props":1872,"children":1873},{"style":332},[1874],{"type":50,"value":1875},"          \"indices\": [\".monitoring-*\"]\n",{"type":44,"tag":319,"props":1877,"children":1878},{"class":321,"line":1059},[1879],{"type":44,"tag":319,"props":1880,"children":1881},{"style":332},[1882],{"type":50,"value":1698},{"type":44,"tag":319,"props":1884,"children":1885},{"class":321,"line":1068},[1886],{"type":44,"tag":319,"props":1887,"children":1888},{"style":332},[1889],{"type":50,"value":1706},{"type":44,"tag":319,"props":1891,"children":1892},{"class":321,"line":1077},[1893],{"type":44,"tag":319,"props":1894,"children":1895},{"style":332},[1896],{"type":50,"value":473},{"type":44,"tag":319,"props":1898,"children":1899},{"class":321,"line":1086},[1900,1904],{"type":44,"tag":319,"props":1901,"children":1902},{"style":332},[1903],{"type":50,"value":482},{"type":44,"tag":319,"props":1905,"children":1906},{"style":343},[1907],{"type":50,"value":487},{"type":44,"tag":691,"props":1909,"children":1911},{"id":1910},"filter-policy-fields",[1912],{"type":50,"value":1913},"Filter policy fields",{"type":44,"tag":185,"props":1915,"children":1916},{},[1917,1937],{"type":44,"tag":189,"props":1918,"children":1919},{},[1920],{"type":44,"tag":193,"props":1921,"children":1922},{},[1923,1928,1933],{"type":44,"tag":197,"props":1924,"children":1925},{},[1926],{"type":50,"value":1927},"Field",{"type":44,"tag":197,"props":1929,"children":1930},{},[1931],{"type":50,"value":1932},"Type",{"type":44,"tag":197,"props":1934,"children":1935},{},[1936],{"type":50,"value":206},{"type":44,"tag":208,"props":1938,"children":1939},{},[1940,1967,1992,2017,2050],{"type":44,"tag":193,"props":1941,"children":1942},{},[1943,1952,1962],{"type":44,"tag":215,"props":1944,"children":1945},{},[1946],{"type":44,"tag":229,"props":1947,"children":1949},{"className":1948},[],[1950],{"type":50,"value":1951},"users",{"type":44,"tag":215,"props":1953,"children":1954},{},[1955,1957],{"type":50,"value":1956},"array",{"type":44,"tag":319,"props":1958,"children":1959},{},[1960],{"type":50,"value":1961},"string",{"type":44,"tag":215,"props":1963,"children":1964},{},[1965],{"type":50,"value":1966},"Usernames to exclude (supports wildcards)",{"type":44,"tag":193,"props":1968,"children":1969},{},[1970,1979,1987],{"type":44,"tag":215,"props":1971,"children":1972},{},[1973],{"type":44,"tag":229,"props":1974,"children":1976},{"className":1975},[],[1977],{"type":50,"value":1978},"realms",{"type":44,"tag":215,"props":1980,"children":1981},{},[1982,1983],{"type":50,"value":1956},{"type":44,"tag":319,"props":1984,"children":1985},{},[1986],{"type":50,"value":1961},{"type":44,"tag":215,"props":1988,"children":1989},{},[1990],{"type":50,"value":1991},"Realm names to exclude",{"type":44,"tag":193,"props":1993,"children":1994},{},[1995,2004,2012],{"type":44,"tag":215,"props":1996,"children":1997},{},[1998],{"type":44,"tag":229,"props":1999,"children":2001},{"className":2000},[],[2002],{"type":50,"value":2003},"roles",{"type":44,"tag":215,"props":2005,"children":2006},{},[2007,2008],{"type":50,"value":1956},{"type":44,"tag":319,"props":2009,"children":2010},{},[2011],{"type":50,"value":1961},{"type":44,"tag":215,"props":2013,"children":2014},{},[2015],{"type":50,"value":2016},"Role names to exclude",{"type":44,"tag":193,"props":2018,"children":2019},{},[2020,2029,2037],{"type":44,"tag":215,"props":2021,"children":2022},{},[2023],{"type":44,"tag":229,"props":2024,"children":2026},{"className":2025},[],[2027],{"type":50,"value":2028},"indices",{"type":44,"tag":215,"props":2030,"children":2031},{},[2032,2033],{"type":50,"value":1956},{"type":44,"tag":319,"props":2034,"children":2035},{},[2036],{"type":50,"value":1961},{"type":44,"tag":215,"props":2038,"children":2039},{},[2040,2042,2048],{"type":50,"value":2041},"Index names or patterns to exclude (supports ",{"type":44,"tag":229,"props":2043,"children":2045},{"className":2044},[],[2046],{"type":50,"value":2047},"*",{"type":50,"value":2049},")",{"type":44,"tag":193,"props":2051,"children":2052},{},[2053,2062,2070],{"type":44,"tag":215,"props":2054,"children":2055},{},[2056],{"type":44,"tag":229,"props":2057,"children":2059},{"className":2058},[],[2060],{"type":50,"value":2061},"actions",{"type":44,"tag":215,"props":2063,"children":2064},{},[2065,2066],{"type":50,"value":1956},{"type":44,"tag":319,"props":2067,"children":2068},{},[2069],{"type":50,"value":1961},{"type":44,"tag":215,"props":2071,"children":2072},{},[2073,2075,2081],{"type":50,"value":2074},"Action names to exclude (e.g. ",{"type":44,"tag":229,"props":2076,"children":2078},{"className":2077},[],[2079],{"type":50,"value":2080},"indices:data\u002Fread\u002F*",{"type":50,"value":2049},{"type":44,"tag":53,"props":2083,"children":2084},{},[2085,2087,2092],{"type":50,"value":2086},"An event is filtered out if it matches ",{"type":44,"tag":64,"props":2088,"children":2089},{},[2090],{"type":50,"value":2091},"all",{"type":50,"value":2093}," specified fields within a single policy.",{"type":44,"tag":691,"props":2095,"children":2097},{"id":2096},"remove-a-filter-policy",[2098],{"type":50,"value":2099},"Remove a filter policy",{"type":44,"tag":53,"props":2101,"children":2102},{},[2103,2105,2111],{"type":50,"value":2104},"Set the policy to ",{"type":44,"tag":229,"props":2106,"children":2108},{"className":2107},[],[2109],{"type":50,"value":2110},"null",{"type":50,"value":2112},":",{"type":44,"tag":308,"props":2114,"children":2116},{"className":310,"code":2115,"language":312,"meta":313,"style":313},"curl -X PUT \"${ELASTICSEARCH_URL}\u002F_cluster\u002Fsettings\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"persistent\": {\n      \"xpack.security.audit.logfile.events.ignore_filters.health_checks\": null\n    }\n  }'\n",[2117],{"type":44,"tag":229,"props":2118,"children":2119},{"__ignoreMap":313},[2120,2159,2182,2205,2220,2227,2235,2242],{"type":44,"tag":319,"props":2121,"children":2122},{"class":321,"line":322},[2123,2127,2131,2135,2139,2143,2147,2151,2155],{"type":44,"tag":319,"props":2124,"children":2125},{"style":326},[2126],{"type":50,"value":329},{"type":44,"tag":319,"props":2128,"children":2129},{"style":332},[2130],{"type":50,"value":335},{"type":44,"tag":319,"props":2132,"children":2133},{"style":332},[2134],{"type":50,"value":340},{"type":44,"tag":319,"props":2136,"children":2137},{"style":343},[2138],{"type":50,"value":346},{"type":44,"tag":319,"props":2140,"children":2141},{"style":349},[2142],{"type":50,"value":352},{"type":44,"tag":319,"props":2144,"children":2145},{"style":343},[2146],{"type":50,"value":357},{"type":44,"tag":319,"props":2148,"children":2149},{"style":332},[2150],{"type":50,"value":362},{"type":44,"tag":319,"props":2152,"children":2153},{"style":343},[2154],{"type":50,"value":367},{"type":44,"tag":319,"props":2156,"children":2157},{"style":349},[2158],{"type":50,"value":372},{"type":44,"tag":319,"props":2160,"children":2161},{"class":321,"line":375},[2162,2166,2170,2174,2178],{"type":44,"tag":319,"props":2163,"children":2164},{"style":343},[2165],{"type":50,"value":381},{"type":44,"tag":319,"props":2167,"children":2168},{"style":332},[2169],{"type":50,"value":386},{"type":44,"tag":319,"props":2171,"children":2172},{"style":349},[2173],{"type":50,"value":391},{"type":44,"tag":319,"props":2175,"children":2176},{"style":343},[2177],{"type":50,"value":396},{"type":44,"tag":319,"props":2179,"children":2180},{"style":349},[2181],{"type":50,"value":372},{"type":44,"tag":319,"props":2183,"children":2184},{"class":321,"line":403},[2185,2189,2193,2197,2201],{"type":44,"tag":319,"props":2186,"children":2187},{"style":332},[2188],{"type":50,"value":409},{"type":44,"tag":319,"props":2190,"children":2191},{"style":343},[2192],{"type":50,"value":414},{"type":44,"tag":319,"props":2194,"children":2195},{"style":332},[2196],{"type":50,"value":419},{"type":44,"tag":319,"props":2198,"children":2199},{"style":343},[2200],{"type":50,"value":367},{"type":44,"tag":319,"props":2202,"children":2203},{"style":349},[2204],{"type":50,"value":372},{"type":44,"tag":319,"props":2206,"children":2207},{"class":321,"line":430},[2208,2212,2216],{"type":44,"tag":319,"props":2209,"children":2210},{"style":332},[2211],{"type":50,"value":436},{"type":44,"tag":319,"props":2213,"children":2214},{"style":343},[2215],{"type":50,"value":441},{"type":44,"tag":319,"props":2217,"children":2218},{"style":332},[2219],{"type":50,"value":446},{"type":44,"tag":319,"props":2221,"children":2222},{"class":321,"line":449},[2223],{"type":44,"tag":319,"props":2224,"children":2225},{"style":332},[2226],{"type":50,"value":455},{"type":44,"tag":319,"props":2228,"children":2229},{"class":321,"line":458},[2230],{"type":44,"tag":319,"props":2231,"children":2232},{"style":332},[2233],{"type":50,"value":2234},"      \"xpack.security.audit.logfile.events.ignore_filters.health_checks\": null\n",{"type":44,"tag":319,"props":2236,"children":2237},{"class":321,"line":467},[2238],{"type":44,"tag":319,"props":2239,"children":2240},{"style":332},[2241],{"type":50,"value":473},{"type":44,"tag":319,"props":2243,"children":2244},{"class":321,"line":476},[2245,2249],{"type":44,"tag":319,"props":2246,"children":2247},{"style":332},[2248],{"type":50,"value":482},{"type":44,"tag":319,"props":2250,"children":2251},{"style":343},[2252],{"type":50,"value":487},{"type":44,"tag":127,"props":2254,"children":2256},{"id":2255},"query-audit-events",[2257],{"type":50,"value":2258},"Query Audit Events",{"type":44,"tag":53,"props":2260,"children":2261},{},[2262,2264,2269,2271,2276],{"type":50,"value":2263},"When the ",{"type":44,"tag":229,"props":2265,"children":2267},{"className":2266},[],[2268],{"type":50,"value":669},{"type":50,"value":2270}," output is enabled, audit events are stored in ",{"type":44,"tag":229,"props":2272,"children":2274},{"className":2273},[],[2275],{"type":50,"value":687},{"type":50,"value":2277}," indices and can be queried.",{"type":44,"tag":691,"props":2279,"children":2281},{"id":2280},"search-for-failed-authentication-attempts",[2282],{"type":50,"value":2283},"Search for failed authentication attempts",{"type":44,"tag":308,"props":2285,"children":2287},{"className":310,"code":2286,"language":312,"meta":313,"style":313},"curl -X POST \"${ELASTICSEARCH_URL}\u002F.security-audit-*\u002F_search\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"query\": {\n      \"bool\": {\n        \"filter\": [\n          { \"term\": { \"event.action\": \"authentication_failed\" } },\n          { \"range\": { \"@timestamp\": { \"gte\": \"now-24h\" } } }\n        ]\n      }\n    },\n    \"sort\": [{ \"@timestamp\": { \"order\": \"desc\" } }],\n    \"size\": 50\n  }'\n",[2288],{"type":44,"tag":229,"props":2289,"children":2290},{"__ignoreMap":313},[2291,2332,2355,2378,2393,2401,2409,2417,2425,2433,2441,2448,2456,2464,2472],{"type":44,"tag":319,"props":2292,"children":2293},{"class":321,"line":322},[2294,2298,2302,2307,2311,2315,2319,2324,2328],{"type":44,"tag":319,"props":2295,"children":2296},{"style":326},[2297],{"type":50,"value":329},{"type":44,"tag":319,"props":2299,"children":2300},{"style":332},[2301],{"type":50,"value":335},{"type":44,"tag":319,"props":2303,"children":2304},{"style":332},[2305],{"type":50,"value":2306}," POST",{"type":44,"tag":319,"props":2308,"children":2309},{"style":343},[2310],{"type":50,"value":346},{"type":44,"tag":319,"props":2312,"children":2313},{"style":349},[2314],{"type":50,"value":352},{"type":44,"tag":319,"props":2316,"children":2317},{"style":343},[2318],{"type":50,"value":357},{"type":44,"tag":319,"props":2320,"children":2321},{"style":332},[2322],{"type":50,"value":2323},"\u002F.security-audit-*\u002F_search",{"type":44,"tag":319,"props":2325,"children":2326},{"style":343},[2327],{"type":50,"value":367},{"type":44,"tag":319,"props":2329,"children":2330},{"style":349},[2331],{"type":50,"value":372},{"type":44,"tag":319,"props":2333,"children":2334},{"class":321,"line":375},[2335,2339,2343,2347,2351],{"type":44,"tag":319,"props":2336,"children":2337},{"style":343},[2338],{"type":50,"value":381},{"type":44,"tag":319,"props":2340,"children":2341},{"style":332},[2342],{"type":50,"value":386},{"type":44,"tag":319,"props":2344,"children":2345},{"style":349},[2346],{"type":50,"value":391},{"type":44,"tag":319,"props":2348,"children":2349},{"style":343},[2350],{"type":50,"value":396},{"type":44,"tag":319,"props":2352,"children":2353},{"style":349},[2354],{"type":50,"value":372},{"type":44,"tag":319,"props":2356,"children":2357},{"class":321,"line":403},[2358,2362,2366,2370,2374],{"type":44,"tag":319,"props":2359,"children":2360},{"style":332},[2361],{"type":50,"value":409},{"type":44,"tag":319,"props":2363,"children":2364},{"style":343},[2365],{"type":50,"value":414},{"type":44,"tag":319,"props":2367,"children":2368},{"style":332},[2369],{"type":50,"value":419},{"type":44,"tag":319,"props":2371,"children":2372},{"style":343},[2373],{"type":50,"value":367},{"type":44,"tag":319,"props":2375,"children":2376},{"style":349},[2377],{"type":50,"value":372},{"type":44,"tag":319,"props":2379,"children":2380},{"class":321,"line":430},[2381,2385,2389],{"type":44,"tag":319,"props":2382,"children":2383},{"style":332},[2384],{"type":50,"value":436},{"type":44,"tag":319,"props":2386,"children":2387},{"style":343},[2388],{"type":50,"value":441},{"type":44,"tag":319,"props":2390,"children":2391},{"style":332},[2392],{"type":50,"value":446},{"type":44,"tag":319,"props":2394,"children":2395},{"class":321,"line":449},[2396],{"type":44,"tag":319,"props":2397,"children":2398},{"style":332},[2399],{"type":50,"value":2400},"    \"query\": {\n",{"type":44,"tag":319,"props":2402,"children":2403},{"class":321,"line":458},[2404],{"type":44,"tag":319,"props":2405,"children":2406},{"style":332},[2407],{"type":50,"value":2408},"      \"bool\": {\n",{"type":44,"tag":319,"props":2410,"children":2411},{"class":321,"line":467},[2412],{"type":44,"tag":319,"props":2413,"children":2414},{"style":332},[2415],{"type":50,"value":2416},"        \"filter\": [\n",{"type":44,"tag":319,"props":2418,"children":2419},{"class":321,"line":476},[2420],{"type":44,"tag":319,"props":2421,"children":2422},{"style":332},[2423],{"type":50,"value":2424},"          { \"term\": { \"event.action\": \"authentication_failed\" } },\n",{"type":44,"tag":319,"props":2426,"children":2427},{"class":321,"line":836},[2428],{"type":44,"tag":319,"props":2429,"children":2430},{"style":332},[2431],{"type":50,"value":2432},"          { \"range\": { \"@timestamp\": { \"gte\": \"now-24h\" } } }\n",{"type":44,"tag":319,"props":2434,"children":2435},{"class":321,"line":1059},[2436],{"type":44,"tag":319,"props":2437,"children":2438},{"style":332},[2439],{"type":50,"value":2440},"        ]\n",{"type":44,"tag":319,"props":2442,"children":2443},{"class":321,"line":1068},[2444],{"type":44,"tag":319,"props":2445,"children":2446},{"style":332},[2447],{"type":50,"value":1706},{"type":44,"tag":319,"props":2449,"children":2450},{"class":321,"line":1077},[2451],{"type":44,"tag":319,"props":2452,"children":2453},{"style":332},[2454],{"type":50,"value":2455},"    },\n",{"type":44,"tag":319,"props":2457,"children":2458},{"class":321,"line":1086},[2459],{"type":44,"tag":319,"props":2460,"children":2461},{"style":332},[2462],{"type":50,"value":2463},"    \"sort\": [{ \"@timestamp\": { \"order\": \"desc\" } }],\n",{"type":44,"tag":319,"props":2465,"children":2466},{"class":321,"line":1095},[2467],{"type":44,"tag":319,"props":2468,"children":2469},{"style":332},[2470],{"type":50,"value":2471},"    \"size\": 50\n",{"type":44,"tag":319,"props":2473,"children":2474},{"class":321,"line":1104},[2475,2479],{"type":44,"tag":319,"props":2476,"children":2477},{"style":332},[2478],{"type":50,"value":482},{"type":44,"tag":319,"props":2480,"children":2481},{"style":343},[2482],{"type":50,"value":487},{"type":44,"tag":691,"props":2484,"children":2486},{"id":2485},"search-for-access-denied-events-on-a-specific-index",[2487],{"type":50,"value":2488},"Search for access denied events on a specific index",{"type":44,"tag":308,"props":2490,"children":2492},{"className":310,"code":2491,"language":312,"meta":313,"style":313},"curl -X POST \"${ELASTICSEARCH_URL}\u002F.security-audit-*\u002F_search\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"query\": {\n      \"bool\": {\n        \"filter\": [\n          { \"term\": { \"event.action\": \"access_denied\" } },\n          { \"term\": { \"indices\": \"logs-*\" } },\n          { \"range\": { \"@timestamp\": { \"gte\": \"now-7d\" } } }\n        ]\n      }\n    },\n    \"sort\": [{ \"@timestamp\": { \"order\": \"desc\" } }],\n    \"size\": 20\n  }'\n",[2493],{"type":44,"tag":229,"props":2494,"children":2495},{"__ignoreMap":313},[2496,2535,2558,2581,2596,2603,2610,2617,2625,2633,2641,2648,2655,2662,2669,2677],{"type":44,"tag":319,"props":2497,"children":2498},{"class":321,"line":322},[2499,2503,2507,2511,2515,2519,2523,2527,2531],{"type":44,"tag":319,"props":2500,"children":2501},{"style":326},[2502],{"type":50,"value":329},{"type":44,"tag":319,"props":2504,"children":2505},{"style":332},[2506],{"type":50,"value":335},{"type":44,"tag":319,"props":2508,"children":2509},{"style":332},[2510],{"type":50,"value":2306},{"type":44,"tag":319,"props":2512,"children":2513},{"style":343},[2514],{"type":50,"value":346},{"type":44,"tag":319,"props":2516,"children":2517},{"style":349},[2518],{"type":50,"value":352},{"type":44,"tag":319,"props":2520,"children":2521},{"style":343},[2522],{"type":50,"value":357},{"type":44,"tag":319,"props":2524,"children":2525},{"style":332},[2526],{"type":50,"value":2323},{"type":44,"tag":319,"props":2528,"children":2529},{"style":343},[2530],{"type":50,"value":367},{"type":44,"tag":319,"props":2532,"children":2533},{"style":349},[2534],{"type":50,"value":372},{"type":44,"tag":319,"props":2536,"children":2537},{"class":321,"line":375},[2538,2542,2546,2550,2554],{"type":44,"tag":319,"props":2539,"children":2540},{"style":343},[2541],{"type":50,"value":381},{"type":44,"tag":319,"props":2543,"children":2544},{"style":332},[2545],{"type":50,"value":386},{"type":44,"tag":319,"props":2547,"children":2548},{"style":349},[2549],{"type":50,"value":391},{"type":44,"tag":319,"props":2551,"children":2552},{"style":343},[2553],{"type":50,"value":396},{"type":44,"tag":319,"props":2555,"children":2556},{"style":349},[2557],{"type":50,"value":372},{"type":44,"tag":319,"props":2559,"children":2560},{"class":321,"line":403},[2561,2565,2569,2573,2577],{"type":44,"tag":319,"props":2562,"children":2563},{"style":332},[2564],{"type":50,"value":409},{"type":44,"tag":319,"props":2566,"children":2567},{"style":343},[2568],{"type":50,"value":414},{"type":44,"tag":319,"props":2570,"children":2571},{"style":332},[2572],{"type":50,"value":419},{"type":44,"tag":319,"props":2574,"children":2575},{"style":343},[2576],{"type":50,"value":367},{"type":44,"tag":319,"props":2578,"children":2579},{"style":349},[2580],{"type":50,"value":372},{"type":44,"tag":319,"props":2582,"children":2583},{"class":321,"line":430},[2584,2588,2592],{"type":44,"tag":319,"props":2585,"children":2586},{"style":332},[2587],{"type":50,"value":436},{"type":44,"tag":319,"props":2589,"children":2590},{"style":343},[2591],{"type":50,"value":441},{"type":44,"tag":319,"props":2593,"children":2594},{"style":332},[2595],{"type":50,"value":446},{"type":44,"tag":319,"props":2597,"children":2598},{"class":321,"line":449},[2599],{"type":44,"tag":319,"props":2600,"children":2601},{"style":332},[2602],{"type":50,"value":2400},{"type":44,"tag":319,"props":2604,"children":2605},{"class":321,"line":458},[2606],{"type":44,"tag":319,"props":2607,"children":2608},{"style":332},[2609],{"type":50,"value":2408},{"type":44,"tag":319,"props":2611,"children":2612},{"class":321,"line":467},[2613],{"type":44,"tag":319,"props":2614,"children":2615},{"style":332},[2616],{"type":50,"value":2416},{"type":44,"tag":319,"props":2618,"children":2619},{"class":321,"line":476},[2620],{"type":44,"tag":319,"props":2621,"children":2622},{"style":332},[2623],{"type":50,"value":2624},"          { \"term\": { \"event.action\": \"access_denied\" } },\n",{"type":44,"tag":319,"props":2626,"children":2627},{"class":321,"line":836},[2628],{"type":44,"tag":319,"props":2629,"children":2630},{"style":332},[2631],{"type":50,"value":2632},"          { \"term\": { \"indices\": \"logs-*\" } },\n",{"type":44,"tag":319,"props":2634,"children":2635},{"class":321,"line":1059},[2636],{"type":44,"tag":319,"props":2637,"children":2638},{"style":332},[2639],{"type":50,"value":2640},"          { \"range\": { \"@timestamp\": { \"gte\": \"now-7d\" } } }\n",{"type":44,"tag":319,"props":2642,"children":2643},{"class":321,"line":1068},[2644],{"type":44,"tag":319,"props":2645,"children":2646},{"style":332},[2647],{"type":50,"value":2440},{"type":44,"tag":319,"props":2649,"children":2650},{"class":321,"line":1077},[2651],{"type":44,"tag":319,"props":2652,"children":2653},{"style":332},[2654],{"type":50,"value":1706},{"type":44,"tag":319,"props":2656,"children":2657},{"class":321,"line":1086},[2658],{"type":44,"tag":319,"props":2659,"children":2660},{"style":332},[2661],{"type":50,"value":2455},{"type":44,"tag":319,"props":2663,"children":2664},{"class":321,"line":1095},[2665],{"type":44,"tag":319,"props":2666,"children":2667},{"style":332},[2668],{"type":50,"value":2463},{"type":44,"tag":319,"props":2670,"children":2671},{"class":321,"line":1104},[2672],{"type":44,"tag":319,"props":2673,"children":2674},{"style":332},[2675],{"type":50,"value":2676},"    \"size\": 20\n",{"type":44,"tag":319,"props":2678,"children":2679},{"class":321,"line":1112},[2680,2684],{"type":44,"tag":319,"props":2681,"children":2682},{"style":332},[2683],{"type":50,"value":482},{"type":44,"tag":319,"props":2685,"children":2686},{"style":343},[2687],{"type":50,"value":487},{"type":44,"tag":691,"props":2689,"children":2691},{"id":2690},"search-for-security-configuration-changes",[2692],{"type":50,"value":2693},"Search for security configuration changes",{"type":44,"tag":308,"props":2695,"children":2697},{"className":310,"code":2696,"language":312,"meta":313,"style":313},"curl -X POST \"${ELASTICSEARCH_URL}\u002F.security-audit-*\u002F_search\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"query\": {\n      \"bool\": {\n        \"filter\": [\n          { \"term\": { \"event.action\": \"security_config_change\" } },\n          { \"range\": { \"@timestamp\": { \"gte\": \"now-7d\" } } }\n        ]\n      }\n    },\n    \"sort\": [{ \"@timestamp\": { \"order\": \"desc\" } }],\n    \"size\": 50\n  }'\n",[2698],{"type":44,"tag":229,"props":2699,"children":2700},{"__ignoreMap":313},[2701,2740,2763,2786,2801,2808,2815,2822,2830,2837,2844,2851,2858,2865,2872],{"type":44,"tag":319,"props":2702,"children":2703},{"class":321,"line":322},[2704,2708,2712,2716,2720,2724,2728,2732,2736],{"type":44,"tag":319,"props":2705,"children":2706},{"style":326},[2707],{"type":50,"value":329},{"type":44,"tag":319,"props":2709,"children":2710},{"style":332},[2711],{"type":50,"value":335},{"type":44,"tag":319,"props":2713,"children":2714},{"style":332},[2715],{"type":50,"value":2306},{"type":44,"tag":319,"props":2717,"children":2718},{"style":343},[2719],{"type":50,"value":346},{"type":44,"tag":319,"props":2721,"children":2722},{"style":349},[2723],{"type":50,"value":352},{"type":44,"tag":319,"props":2725,"children":2726},{"style":343},[2727],{"type":50,"value":357},{"type":44,"tag":319,"props":2729,"children":2730},{"style":332},[2731],{"type":50,"value":2323},{"type":44,"tag":319,"props":2733,"children":2734},{"style":343},[2735],{"type":50,"value":367},{"type":44,"tag":319,"props":2737,"children":2738},{"style":349},[2739],{"type":50,"value":372},{"type":44,"tag":319,"props":2741,"children":2742},{"class":321,"line":375},[2743,2747,2751,2755,2759],{"type":44,"tag":319,"props":2744,"children":2745},{"style":343},[2746],{"type":50,"value":381},{"type":44,"tag":319,"props":2748,"children":2749},{"style":332},[2750],{"type":50,"value":386},{"type":44,"tag":319,"props":2752,"children":2753},{"style":349},[2754],{"type":50,"value":391},{"type":44,"tag":319,"props":2756,"children":2757},{"style":343},[2758],{"type":50,"value":396},{"type":44,"tag":319,"props":2760,"children":2761},{"style":349},[2762],{"type":50,"value":372},{"type":44,"tag":319,"props":2764,"children":2765},{"class":321,"line":403},[2766,2770,2774,2778,2782],{"type":44,"tag":319,"props":2767,"children":2768},{"style":332},[2769],{"type":50,"value":409},{"type":44,"tag":319,"props":2771,"children":2772},{"style":343},[2773],{"type":50,"value":414},{"type":44,"tag":319,"props":2775,"children":2776},{"style":332},[2777],{"type":50,"value":419},{"type":44,"tag":319,"props":2779,"children":2780},{"style":343},[2781],{"type":50,"value":367},{"type":44,"tag":319,"props":2783,"children":2784},{"style":349},[2785],{"type":50,"value":372},{"type":44,"tag":319,"props":2787,"children":2788},{"class":321,"line":430},[2789,2793,2797],{"type":44,"tag":319,"props":2790,"children":2791},{"style":332},[2792],{"type":50,"value":436},{"type":44,"tag":319,"props":2794,"children":2795},{"style":343},[2796],{"type":50,"value":441},{"type":44,"tag":319,"props":2798,"children":2799},{"style":332},[2800],{"type":50,"value":446},{"type":44,"tag":319,"props":2802,"children":2803},{"class":321,"line":449},[2804],{"type":44,"tag":319,"props":2805,"children":2806},{"style":332},[2807],{"type":50,"value":2400},{"type":44,"tag":319,"props":2809,"children":2810},{"class":321,"line":458},[2811],{"type":44,"tag":319,"props":2812,"children":2813},{"style":332},[2814],{"type":50,"value":2408},{"type":44,"tag":319,"props":2816,"children":2817},{"class":321,"line":467},[2818],{"type":44,"tag":319,"props":2819,"children":2820},{"style":332},[2821],{"type":50,"value":2416},{"type":44,"tag":319,"props":2823,"children":2824},{"class":321,"line":476},[2825],{"type":44,"tag":319,"props":2826,"children":2827},{"style":332},[2828],{"type":50,"value":2829},"          { \"term\": { \"event.action\": \"security_config_change\" } },\n",{"type":44,"tag":319,"props":2831,"children":2832},{"class":321,"line":836},[2833],{"type":44,"tag":319,"props":2834,"children":2835},{"style":332},[2836],{"type":50,"value":2640},{"type":44,"tag":319,"props":2838,"children":2839},{"class":321,"line":1059},[2840],{"type":44,"tag":319,"props":2841,"children":2842},{"style":332},[2843],{"type":50,"value":2440},{"type":44,"tag":319,"props":2845,"children":2846},{"class":321,"line":1068},[2847],{"type":44,"tag":319,"props":2848,"children":2849},{"style":332},[2850],{"type":50,"value":1706},{"type":44,"tag":319,"props":2852,"children":2853},{"class":321,"line":1077},[2854],{"type":44,"tag":319,"props":2855,"children":2856},{"style":332},[2857],{"type":50,"value":2455},{"type":44,"tag":319,"props":2859,"children":2860},{"class":321,"line":1086},[2861],{"type":44,"tag":319,"props":2862,"children":2863},{"style":332},[2864],{"type":50,"value":2463},{"type":44,"tag":319,"props":2866,"children":2867},{"class":321,"line":1095},[2868],{"type":44,"tag":319,"props":2869,"children":2870},{"style":332},[2871],{"type":50,"value":2471},{"type":44,"tag":319,"props":2873,"children":2874},{"class":321,"line":1104},[2875,2879],{"type":44,"tag":319,"props":2876,"children":2877},{"style":332},[2878],{"type":50,"value":482},{"type":44,"tag":319,"props":2880,"children":2881},{"style":343},[2882],{"type":50,"value":487},{"type":44,"tag":53,"props":2884,"children":2885},{},[2886],{"type":50,"value":2887},"This captures role creation\u002Fdeletion, user changes, API key operations, and role mapping updates.",{"type":44,"tag":691,"props":2889,"children":2891},{"id":2890},"count-events-by-type-and-detect-brute-force-patterns",[2892],{"type":50,"value":2893},"Count events by type and detect brute-force patterns",{"type":44,"tag":53,"props":2895,"children":2896},{},[2897,2899,2905,2907,2913,2915,2921,2923,2928,2930,2936,2938,2944,2946,2950],{"type":50,"value":2898},"Use ",{"type":44,"tag":229,"props":2900,"children":2902},{"className":2901},[],[2903],{"type":50,"value":2904},"terms",{"type":50,"value":2906}," aggregations on ",{"type":44,"tag":229,"props":2908,"children":2910},{"className":2909},[],[2911],{"type":50,"value":2912},"event.action",{"type":50,"value":2914}," (with ",{"type":44,"tag":229,"props":2916,"children":2918},{"className":2917},[],[2919],{"type":50,"value":2920},"size: 0",{"type":50,"value":2922},") to count events by type over a time window. To detect\nbrute-force attempts, aggregate ",{"type":44,"tag":229,"props":2924,"children":2926},{"className":2925},[],[2927],{"type":50,"value":1335},{"type":50,"value":2929}," events by ",{"type":44,"tag":229,"props":2931,"children":2933},{"className":2932},[],[2934],{"type":50,"value":2935},"source.ip",{"type":50,"value":2937}," with ",{"type":44,"tag":229,"props":2939,"children":2941},{"className":2940},[],[2942],{"type":50,"value":2943},"min_doc_count: 5",{"type":50,"value":2945},". See\n",{"type":44,"tag":98,"props":2947,"children":2948},{"href":100},[2949],{"type":50,"value":100},{"type":50,"value":2951}," for full aggregation query examples.",{"type":44,"tag":127,"props":2953,"children":2955},{"id":2954},"correlate-with-kibana-audit-logs",[2956],{"type":50,"value":2957},"Correlate with Kibana Audit Logs",{"type":44,"tag":53,"props":2959,"children":2960},{},[2961,2963,2969,2971,2977],{"type":50,"value":2962},"Kibana has its own audit log covering application-layer events that Elasticsearch does not see (saved object CRUD,\nKibana logins, space operations). When a user performs an action in Kibana, Kibana makes requests to Elasticsearch on\nthe user's behalf. Both systems record the same ",{"type":44,"tag":229,"props":2964,"children":2966},{"className":2965},[],[2967],{"type":50,"value":2968},"trace.id",{"type":50,"value":2970}," (passed via the ",{"type":44,"tag":229,"props":2972,"children":2974},{"className":2973},[],[2975],{"type":50,"value":2976},"X-Opaque-Id",{"type":50,"value":2978}," header), which serves as the\nprimary correlation key.",{"type":44,"tag":105,"props":2980,"children":2981},{},[2982],{"type":44,"tag":53,"props":2983,"children":2984},{},[2985,2990,2992,2998,3000,3004],{"type":44,"tag":64,"props":2986,"children":2987},{},[2988],{"type":50,"value":2989},"Prerequisite:",{"type":50,"value":2991}," Kibana audit must be enabled separately in ",{"type":44,"tag":229,"props":2993,"children":2995},{"className":2994},[],[2996],{"type":50,"value":2997},"kibana.yml",{"type":50,"value":2999},". See the ",{"type":44,"tag":64,"props":3001,"children":3002},{},[3003],{"type":50,"value":68},{"type":50,"value":3005}," skill for setup\ninstructions, event types, and Kibana-specific filter policies.",{"type":44,"tag":691,"props":3007,"children":3009},{"id":3008},"find-es-audit-events-triggered-by-a-kibana-action",[3010],{"type":50,"value":3011},"Find ES audit events triggered by a Kibana action",{"type":44,"tag":53,"props":3013,"children":3014},{},[3015,3017,3022],{"type":50,"value":3016},"Given a ",{"type":44,"tag":229,"props":3018,"children":3020},{"className":3019},[],[3021],{"type":50,"value":2968},{"type":50,"value":3023}," from a Kibana audit event, search the ES audit index to see the underlying Elasticsearch operations:",{"type":44,"tag":308,"props":3025,"children":3027},{"className":310,"code":3026,"language":312,"meta":313,"style":313},"curl -X POST \"${ELASTICSEARCH_URL}\u002F.security-audit-*\u002F_search\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"query\": {\n      \"bool\": {\n        \"filter\": [\n          { \"term\": { \"trace.id\": \"'\"${TRACE_ID}\"'\" } },\n          { \"range\": { \"@timestamp\": { \"gte\": \"now-24h\" } } }\n        ]\n      }\n    },\n    \"sort\": [{ \"@timestamp\": { \"order\": \"asc\" } }]\n  }'\n",[3028],{"type":44,"tag":229,"props":3029,"children":3030},{"__ignoreMap":313},[3031,3070,3093,3116,3131,3138,3145,3152,3180,3187,3194,3201,3208,3216],{"type":44,"tag":319,"props":3032,"children":3033},{"class":321,"line":322},[3034,3038,3042,3046,3050,3054,3058,3062,3066],{"type":44,"tag":319,"props":3035,"children":3036},{"style":326},[3037],{"type":50,"value":329},{"type":44,"tag":319,"props":3039,"children":3040},{"style":332},[3041],{"type":50,"value":335},{"type":44,"tag":319,"props":3043,"children":3044},{"style":332},[3045],{"type":50,"value":2306},{"type":44,"tag":319,"props":3047,"children":3048},{"style":343},[3049],{"type":50,"value":346},{"type":44,"tag":319,"props":3051,"children":3052},{"style":349},[3053],{"type":50,"value":352},{"type":44,"tag":319,"props":3055,"children":3056},{"style":343},[3057],{"type":50,"value":357},{"type":44,"tag":319,"props":3059,"children":3060},{"style":332},[3061],{"type":50,"value":2323},{"type":44,"tag":319,"props":3063,"children":3064},{"style":343},[3065],{"type":50,"value":367},{"type":44,"tag":319,"props":3067,"children":3068},{"style":349},[3069],{"type":50,"value":372},{"type":44,"tag":319,"props":3071,"children":3072},{"class":321,"line":375},[3073,3077,3081,3085,3089],{"type":44,"tag":319,"props":3074,"children":3075},{"style":343},[3076],{"type":50,"value":381},{"type":44,"tag":319,"props":3078,"children":3079},{"style":332},[3080],{"type":50,"value":386},{"type":44,"tag":319,"props":3082,"children":3083},{"style":349},[3084],{"type":50,"value":391},{"type":44,"tag":319,"props":3086,"children":3087},{"style":343},[3088],{"type":50,"value":396},{"type":44,"tag":319,"props":3090,"children":3091},{"style":349},[3092],{"type":50,"value":372},{"type":44,"tag":319,"props":3094,"children":3095},{"class":321,"line":403},[3096,3100,3104,3108,3112],{"type":44,"tag":319,"props":3097,"children":3098},{"style":332},[3099],{"type":50,"value":409},{"type":44,"tag":319,"props":3101,"children":3102},{"style":343},[3103],{"type":50,"value":414},{"type":44,"tag":319,"props":3105,"children":3106},{"style":332},[3107],{"type":50,"value":419},{"type":44,"tag":319,"props":3109,"children":3110},{"style":343},[3111],{"type":50,"value":367},{"type":44,"tag":319,"props":3113,"children":3114},{"style":349},[3115],{"type":50,"value":372},{"type":44,"tag":319,"props":3117,"children":3118},{"class":321,"line":430},[3119,3123,3127],{"type":44,"tag":319,"props":3120,"children":3121},{"style":332},[3122],{"type":50,"value":436},{"type":44,"tag":319,"props":3124,"children":3125},{"style":343},[3126],{"type":50,"value":441},{"type":44,"tag":319,"props":3128,"children":3129},{"style":332},[3130],{"type":50,"value":446},{"type":44,"tag":319,"props":3132,"children":3133},{"class":321,"line":449},[3134],{"type":44,"tag":319,"props":3135,"children":3136},{"style":332},[3137],{"type":50,"value":2400},{"type":44,"tag":319,"props":3139,"children":3140},{"class":321,"line":458},[3141],{"type":44,"tag":319,"props":3142,"children":3143},{"style":332},[3144],{"type":50,"value":2408},{"type":44,"tag":319,"props":3146,"children":3147},{"class":321,"line":467},[3148],{"type":44,"tag":319,"props":3149,"children":3150},{"style":332},[3151],{"type":50,"value":2416},{"type":44,"tag":319,"props":3153,"children":3154},{"class":321,"line":476},[3155,3160,3165,3170,3175],{"type":44,"tag":319,"props":3156,"children":3157},{"style":332},[3158],{"type":50,"value":3159},"          { \"term\": { \"trace.id\": \"",{"type":44,"tag":319,"props":3161,"children":3162},{"style":343},[3163],{"type":50,"value":3164},"'\"${",{"type":44,"tag":319,"props":3166,"children":3167},{"style":349},[3168],{"type":50,"value":3169},"TRACE_ID",{"type":44,"tag":319,"props":3171,"children":3172},{"style":343},[3173],{"type":50,"value":3174},"}\"'",{"type":44,"tag":319,"props":3176,"children":3177},{"style":332},[3178],{"type":50,"value":3179},"\" } },\n",{"type":44,"tag":319,"props":3181,"children":3182},{"class":321,"line":836},[3183],{"type":44,"tag":319,"props":3184,"children":3185},{"style":332},[3186],{"type":50,"value":2432},{"type":44,"tag":319,"props":3188,"children":3189},{"class":321,"line":1059},[3190],{"type":44,"tag":319,"props":3191,"children":3192},{"style":332},[3193],{"type":50,"value":2440},{"type":44,"tag":319,"props":3195,"children":3196},{"class":321,"line":1068},[3197],{"type":44,"tag":319,"props":3198,"children":3199},{"style":332},[3200],{"type":50,"value":1706},{"type":44,"tag":319,"props":3202,"children":3203},{"class":321,"line":1077},[3204],{"type":44,"tag":319,"props":3205,"children":3206},{"style":332},[3207],{"type":50,"value":2455},{"type":44,"tag":319,"props":3209,"children":3210},{"class":321,"line":1086},[3211],{"type":44,"tag":319,"props":3212,"children":3213},{"style":332},[3214],{"type":50,"value":3215},"    \"sort\": [{ \"@timestamp\": { \"order\": \"asc\" } }]\n",{"type":44,"tag":319,"props":3217,"children":3218},{"class":321,"line":1095},[3219,3223],{"type":44,"tag":319,"props":3220,"children":3221},{"style":332},[3222],{"type":50,"value":482},{"type":44,"tag":319,"props":3224,"children":3225},{"style":343},[3226],{"type":50,"value":487},{"type":44,"tag":691,"props":3228,"children":3230},{"id":3229},"correlate-by-user-and-time-window",[3231],{"type":50,"value":3232},"Correlate by user and time window",{"type":44,"tag":53,"props":3234,"children":3235},{},[3236,3238,3243],{"type":50,"value":3237},"When ",{"type":44,"tag":229,"props":3239,"children":3241},{"className":3240},[],[3242],{"type":50,"value":2968},{"type":50,"value":3244}," is unavailable (e.g. direct API calls), fall back to user + time-window correlation:",{"type":44,"tag":308,"props":3246,"children":3248},{"className":310,"code":3247,"language":312,"meta":313,"style":313},"curl -X POST \"${ELASTICSEARCH_URL}\u002F.security-audit-*\u002F_search\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"query\": {\n      \"bool\": {\n        \"filter\": [\n          { \"term\": { \"user.name\": \"'\"${USERNAME}\"'\" } },\n          { \"range\": { \"@timestamp\": { \"gte\": \"now-5m\" } } }\n        ]\n      }\n    },\n    \"sort\": [{ \"@timestamp\": { \"order\": \"asc\" } }]\n  }'\n",[3249],{"type":44,"tag":229,"props":3250,"children":3251},{"__ignoreMap":313},[3252,3291,3314,3337,3352,3359,3366,3373,3398,3406,3413,3420,3427,3434],{"type":44,"tag":319,"props":3253,"children":3254},{"class":321,"line":322},[3255,3259,3263,3267,3271,3275,3279,3283,3287],{"type":44,"tag":319,"props":3256,"children":3257},{"style":326},[3258],{"type":50,"value":329},{"type":44,"tag":319,"props":3260,"children":3261},{"style":332},[3262],{"type":50,"value":335},{"type":44,"tag":319,"props":3264,"children":3265},{"style":332},[3266],{"type":50,"value":2306},{"type":44,"tag":319,"props":3268,"children":3269},{"style":343},[3270],{"type":50,"value":346},{"type":44,"tag":319,"props":3272,"children":3273},{"style":349},[3274],{"type":50,"value":352},{"type":44,"tag":319,"props":3276,"children":3277},{"style":343},[3278],{"type":50,"value":357},{"type":44,"tag":319,"props":3280,"children":3281},{"style":332},[3282],{"type":50,"value":2323},{"type":44,"tag":319,"props":3284,"children":3285},{"style":343},[3286],{"type":50,"value":367},{"type":44,"tag":319,"props":3288,"children":3289},{"style":349},[3290],{"type":50,"value":372},{"type":44,"tag":319,"props":3292,"children":3293},{"class":321,"line":375},[3294,3298,3302,3306,3310],{"type":44,"tag":319,"props":3295,"children":3296},{"style":343},[3297],{"type":50,"value":381},{"type":44,"tag":319,"props":3299,"children":3300},{"style":332},[3301],{"type":50,"value":386},{"type":44,"tag":319,"props":3303,"children":3304},{"style":349},[3305],{"type":50,"value":391},{"type":44,"tag":319,"props":3307,"children":3308},{"style":343},[3309],{"type":50,"value":396},{"type":44,"tag":319,"props":3311,"children":3312},{"style":349},[3313],{"type":50,"value":372},{"type":44,"tag":319,"props":3315,"children":3316},{"class":321,"line":403},[3317,3321,3325,3329,3333],{"type":44,"tag":319,"props":3318,"children":3319},{"style":332},[3320],{"type":50,"value":409},{"type":44,"tag":319,"props":3322,"children":3323},{"style":343},[3324],{"type":50,"value":414},{"type":44,"tag":319,"props":3326,"children":3327},{"style":332},[3328],{"type":50,"value":419},{"type":44,"tag":319,"props":3330,"children":3331},{"style":343},[3332],{"type":50,"value":367},{"type":44,"tag":319,"props":3334,"children":3335},{"style":349},[3336],{"type":50,"value":372},{"type":44,"tag":319,"props":3338,"children":3339},{"class":321,"line":430},[3340,3344,3348],{"type":44,"tag":319,"props":3341,"children":3342},{"style":332},[3343],{"type":50,"value":436},{"type":44,"tag":319,"props":3345,"children":3346},{"style":343},[3347],{"type":50,"value":441},{"type":44,"tag":319,"props":3349,"children":3350},{"style":332},[3351],{"type":50,"value":446},{"type":44,"tag":319,"props":3353,"children":3354},{"class":321,"line":449},[3355],{"type":44,"tag":319,"props":3356,"children":3357},{"style":332},[3358],{"type":50,"value":2400},{"type":44,"tag":319,"props":3360,"children":3361},{"class":321,"line":458},[3362],{"type":44,"tag":319,"props":3363,"children":3364},{"style":332},[3365],{"type":50,"value":2408},{"type":44,"tag":319,"props":3367,"children":3368},{"class":321,"line":467},[3369],{"type":44,"tag":319,"props":3370,"children":3371},{"style":332},[3372],{"type":50,"value":2416},{"type":44,"tag":319,"props":3374,"children":3375},{"class":321,"line":476},[3376,3381,3385,3390,3394],{"type":44,"tag":319,"props":3377,"children":3378},{"style":332},[3379],{"type":50,"value":3380},"          { \"term\": { \"user.name\": \"",{"type":44,"tag":319,"props":3382,"children":3383},{"style":343},[3384],{"type":50,"value":3164},{"type":44,"tag":319,"props":3386,"children":3387},{"style":349},[3388],{"type":50,"value":3389},"USERNAME",{"type":44,"tag":319,"props":3391,"children":3392},{"style":343},[3393],{"type":50,"value":3174},{"type":44,"tag":319,"props":3395,"children":3396},{"style":332},[3397],{"type":50,"value":3179},{"type":44,"tag":319,"props":3399,"children":3400},{"class":321,"line":836},[3401],{"type":44,"tag":319,"props":3402,"children":3403},{"style":332},[3404],{"type":50,"value":3405},"          { \"range\": { \"@timestamp\": { \"gte\": \"now-5m\" } } }\n",{"type":44,"tag":319,"props":3407,"children":3408},{"class":321,"line":1059},[3409],{"type":44,"tag":319,"props":3410,"children":3411},{"style":332},[3412],{"type":50,"value":2440},{"type":44,"tag":319,"props":3414,"children":3415},{"class":321,"line":1068},[3416],{"type":44,"tag":319,"props":3417,"children":3418},{"style":332},[3419],{"type":50,"value":1706},{"type":44,"tag":319,"props":3421,"children":3422},{"class":321,"line":1077},[3423],{"type":44,"tag":319,"props":3424,"children":3425},{"style":332},[3426],{"type":50,"value":2455},{"type":44,"tag":319,"props":3428,"children":3429},{"class":321,"line":1086},[3430],{"type":44,"tag":319,"props":3431,"children":3432},{"style":332},[3433],{"type":50,"value":3215},{"type":44,"tag":319,"props":3435,"children":3436},{"class":321,"line":1095},[3437,3441],{"type":44,"tag":319,"props":3438,"children":3439},{"style":332},[3440],{"type":50,"value":482},{"type":44,"tag":319,"props":3442,"children":3443},{"style":343},[3444],{"type":50,"value":487},{"type":44,"tag":53,"props":3446,"children":3447},{},[3448,3450,3456,3458,3463,3465,3471],{"type":50,"value":3449},"Secondary correlation fields: ",{"type":44,"tag":229,"props":3451,"children":3453},{"className":3452},[],[3454],{"type":50,"value":3455},"user.name",{"type":50,"value":3457},", ",{"type":44,"tag":229,"props":3459,"children":3461},{"className":3460},[],[3462],{"type":50,"value":2935},{"type":50,"value":3464},", and ",{"type":44,"tag":229,"props":3466,"children":3468},{"className":3467},[],[3469],{"type":50,"value":3470},"@timestamp",{"type":50,"value":91},{"type":44,"tag":691,"props":3473,"children":3475},{"id":3474},"unified-querying",[3476],{"type":50,"value":3477},"Unified querying",{"type":44,"tag":53,"props":3479,"children":3480},{},[3481,3483,3487,3489,3494,3496,3502,3504,3509],{"type":50,"value":3482},"Ship Kibana audit logs to Elasticsearch via Filebeat (see ",{"type":44,"tag":64,"props":3484,"children":3485},{},[3486],{"type":50,"value":68},{"type":50,"value":3488}," for the Filebeat config) so that both\n",{"type":44,"tag":229,"props":3490,"children":3492},{"className":3491},[],[3493],{"type":50,"value":687},{"type":50,"value":3495}," (ES) and ",{"type":44,"tag":229,"props":3497,"children":3499},{"className":3498},[],[3500],{"type":50,"value":3501},"kibana-audit-*",{"type":50,"value":3503}," (Kibana) indices can be searched together in a single multi-index query\nfiltered by ",{"type":44,"tag":229,"props":3505,"children":3507},{"className":3506},[],[3508],{"type":50,"value":2968},{"type":50,"value":91},{"type":44,"tag":127,"props":3511,"children":3513},{"id":3512},"examples",[3514],{"type":50,"value":3515},"Examples",{"type":44,"tag":691,"props":3517,"children":3519},{"id":3518},"enable-audit-logging-for-compliance",[3520],{"type":50,"value":3521},"Enable audit logging for compliance",{"type":44,"tag":53,"props":3523,"children":3524},{},[3525,3530],{"type":44,"tag":64,"props":3526,"children":3527},{},[3528],{"type":50,"value":3529},"Request:",{"type":50,"value":3531}," \"Enable audit logging and record all failed access and authentication events.\"",{"type":44,"tag":308,"props":3533,"children":3535},{"className":310,"code":3534,"language":312,"meta":313,"style":313},"curl -X PUT \"${ELASTICSEARCH_URL}\u002F_cluster\u002Fsettings\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"persistent\": {\n      \"xpack.security.audit.enabled\": true,\n      \"xpack.security.audit.logfile.events.include\": [\n        \"authentication_failed\",\n        \"access_denied\",\n        \"anonymous_access_denied\",\n        \"run_as_denied\",\n        \"connection_denied\",\n        \"tampered_request\",\n        \"security_config_change\"\n      ]\n    }\n  }'\n",[3536],{"type":44,"tag":229,"props":3537,"children":3538},{"__ignoreMap":313},[3539,3578,3601,3624,3639,3646,3653,3660,3667,3674,3681,3688,3696,3703,3711,3718,3725],{"type":44,"tag":319,"props":3540,"children":3541},{"class":321,"line":322},[3542,3546,3550,3554,3558,3562,3566,3570,3574],{"type":44,"tag":319,"props":3543,"children":3544},{"style":326},[3545],{"type":50,"value":329},{"type":44,"tag":319,"props":3547,"children":3548},{"style":332},[3549],{"type":50,"value":335},{"type":44,"tag":319,"props":3551,"children":3552},{"style":332},[3553],{"type":50,"value":340},{"type":44,"tag":319,"props":3555,"children":3556},{"style":343},[3557],{"type":50,"value":346},{"type":44,"tag":319,"props":3559,"children":3560},{"style":349},[3561],{"type":50,"value":352},{"type":44,"tag":319,"props":3563,"children":3564},{"style":343},[3565],{"type":50,"value":357},{"type":44,"tag":319,"props":3567,"children":3568},{"style":332},[3569],{"type":50,"value":362},{"type":44,"tag":319,"props":3571,"children":3572},{"style":343},[3573],{"type":50,"value":367},{"type":44,"tag":319,"props":3575,"children":3576},{"style":349},[3577],{"type":50,"value":372},{"type":44,"tag":319,"props":3579,"children":3580},{"class":321,"line":375},[3581,3585,3589,3593,3597],{"type":44,"tag":319,"props":3582,"children":3583},{"style":343},[3584],{"type":50,"value":381},{"type":44,"tag":319,"props":3586,"children":3587},{"style":332},[3588],{"type":50,"value":386},{"type":44,"tag":319,"props":3590,"children":3591},{"style":349},[3592],{"type":50,"value":391},{"type":44,"tag":319,"props":3594,"children":3595},{"style":343},[3596],{"type":50,"value":396},{"type":44,"tag":319,"props":3598,"children":3599},{"style":349},[3600],{"type":50,"value":372},{"type":44,"tag":319,"props":3602,"children":3603},{"class":321,"line":403},[3604,3608,3612,3616,3620],{"type":44,"tag":319,"props":3605,"children":3606},{"style":332},[3607],{"type":50,"value":409},{"type":44,"tag":319,"props":3609,"children":3610},{"style":343},[3611],{"type":50,"value":414},{"type":44,"tag":319,"props":3613,"children":3614},{"style":332},[3615],{"type":50,"value":419},{"type":44,"tag":319,"props":3617,"children":3618},{"style":343},[3619],{"type":50,"value":367},{"type":44,"tag":319,"props":3621,"children":3622},{"style":349},[3623],{"type":50,"value":372},{"type":44,"tag":319,"props":3625,"children":3626},{"class":321,"line":430},[3627,3631,3635],{"type":44,"tag":319,"props":3628,"children":3629},{"style":332},[3630],{"type":50,"value":436},{"type":44,"tag":319,"props":3632,"children":3633},{"style":343},[3634],{"type":50,"value":441},{"type":44,"tag":319,"props":3636,"children":3637},{"style":332},[3638],{"type":50,"value":446},{"type":44,"tag":319,"props":3640,"children":3641},{"class":321,"line":449},[3642],{"type":44,"tag":319,"props":3643,"children":3644},{"style":332},[3645],{"type":50,"value":455},{"type":44,"tag":319,"props":3647,"children":3648},{"class":321,"line":458},[3649],{"type":44,"tag":319,"props":3650,"children":3651},{"style":332},[3652],{"type":50,"value":818},{"type":44,"tag":319,"props":3654,"children":3655},{"class":321,"line":467},[3656],{"type":44,"tag":319,"props":3657,"children":3658},{"style":332},[3659],{"type":50,"value":1032},{"type":44,"tag":319,"props":3661,"children":3662},{"class":321,"line":476},[3663],{"type":44,"tag":319,"props":3664,"children":3665},{"style":332},[3666],{"type":50,"value":1040},{"type":44,"tag":319,"props":3668,"children":3669},{"class":321,"line":836},[3670],{"type":44,"tag":319,"props":3671,"children":3672},{"style":332},[3673],{"type":50,"value":1048},{"type":44,"tag":319,"props":3675,"children":3676},{"class":321,"line":1059},[3677],{"type":44,"tag":319,"props":3678,"children":3679},{"style":332},[3680],{"type":50,"value":1065},{"type":44,"tag":319,"props":3682,"children":3683},{"class":321,"line":1068},[3684],{"type":44,"tag":319,"props":3685,"children":3686},{"style":332},[3687],{"type":50,"value":1083},{"type":44,"tag":319,"props":3689,"children":3690},{"class":321,"line":1077},[3691],{"type":44,"tag":319,"props":3692,"children":3693},{"style":332},[3694],{"type":50,"value":3695},"        \"connection_denied\",\n",{"type":44,"tag":319,"props":3697,"children":3698},{"class":321,"line":1086},[3699],{"type":44,"tag":319,"props":3700,"children":3701},{"style":332},[3702],{"type":50,"value":1074},{"type":44,"tag":319,"props":3704,"children":3705},{"class":321,"line":1095},[3706],{"type":44,"tag":319,"props":3707,"children":3708},{"style":332},[3709],{"type":50,"value":3710},"        \"security_config_change\"\n",{"type":44,"tag":319,"props":3712,"children":3713},{"class":321,"line":1104},[3714],{"type":44,"tag":319,"props":3715,"children":3716},{"style":332},[3717],{"type":50,"value":1101},{"type":44,"tag":319,"props":3719,"children":3720},{"class":321,"line":1112},[3721],{"type":44,"tag":319,"props":3722,"children":3723},{"style":332},[3724],{"type":50,"value":473},{"type":44,"tag":319,"props":3726,"children":3728},{"class":321,"line":3727},17,[3729,3733],{"type":44,"tag":319,"props":3730,"children":3731},{"style":332},[3732],{"type":50,"value":482},{"type":44,"tag":319,"props":3734,"children":3735},{"style":343},[3736],{"type":50,"value":487},{"type":44,"tag":53,"props":3738,"children":3739},{},[3740],{"type":50,"value":3741},"This captures all denial and security change events while excluding high-volume success events.",{"type":44,"tag":691,"props":3743,"children":3745},{"id":3744},"investigate-a-suspected-unauthorized-access-attempt",[3746],{"type":50,"value":3747},"Investigate a suspected unauthorized access attempt",{"type":44,"tag":53,"props":3749,"children":3750},{},[3751,3755,3757,3763],{"type":44,"tag":64,"props":3752,"children":3753},{},[3754],{"type":50,"value":3529},{"type":50,"value":3756}," \"Someone may have tried to access the ",{"type":44,"tag":229,"props":3758,"children":3760},{"className":3759},[],[3761],{"type":50,"value":3762},"secrets-*",{"type":50,"value":3764}," index. Check the audit logs.\"",{"type":44,"tag":308,"props":3766,"children":3768},{"className":310,"code":3767,"language":312,"meta":313,"style":313},"curl -X POST \"${ELASTICSEARCH_URL}\u002F.security-audit-*\u002F_search\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"query\": {\n      \"bool\": {\n        \"filter\": [\n          { \"terms\": { \"event.action\": [\"access_denied\", \"authentication_failed\"] } },\n          { \"wildcard\": { \"indices\": \"secrets-*\" } },\n          { \"range\": { \"@timestamp\": { \"gte\": \"now-48h\" } } }\n        ]\n      }\n    },\n    \"sort\": [{ \"@timestamp\": { \"order\": \"desc\" } }],\n    \"size\": 100\n  }'\n",[3769],{"type":44,"tag":229,"props":3770,"children":3771},{"__ignoreMap":313},[3772,3811,3834,3857,3872,3879,3886,3893,3901,3909,3917,3924,3931,3938,3945,3953],{"type":44,"tag":319,"props":3773,"children":3774},{"class":321,"line":322},[3775,3779,3783,3787,3791,3795,3799,3803,3807],{"type":44,"tag":319,"props":3776,"children":3777},{"style":326},[3778],{"type":50,"value":329},{"type":44,"tag":319,"props":3780,"children":3781},{"style":332},[3782],{"type":50,"value":335},{"type":44,"tag":319,"props":3784,"children":3785},{"style":332},[3786],{"type":50,"value":2306},{"type":44,"tag":319,"props":3788,"children":3789},{"style":343},[3790],{"type":50,"value":346},{"type":44,"tag":319,"props":3792,"children":3793},{"style":349},[3794],{"type":50,"value":352},{"type":44,"tag":319,"props":3796,"children":3797},{"style":343},[3798],{"type":50,"value":357},{"type":44,"tag":319,"props":3800,"children":3801},{"style":332},[3802],{"type":50,"value":2323},{"type":44,"tag":319,"props":3804,"children":3805},{"style":343},[3806],{"type":50,"value":367},{"type":44,"tag":319,"props":3808,"children":3809},{"style":349},[3810],{"type":50,"value":372},{"type":44,"tag":319,"props":3812,"children":3813},{"class":321,"line":375},[3814,3818,3822,3826,3830],{"type":44,"tag":319,"props":3815,"children":3816},{"style":343},[3817],{"type":50,"value":381},{"type":44,"tag":319,"props":3819,"children":3820},{"style":332},[3821],{"type":50,"value":386},{"type":44,"tag":319,"props":3823,"children":3824},{"style":349},[3825],{"type":50,"value":391},{"type":44,"tag":319,"props":3827,"children":3828},{"style":343},[3829],{"type":50,"value":396},{"type":44,"tag":319,"props":3831,"children":3832},{"style":349},[3833],{"type":50,"value":372},{"type":44,"tag":319,"props":3835,"children":3836},{"class":321,"line":403},[3837,3841,3845,3849,3853],{"type":44,"tag":319,"props":3838,"children":3839},{"style":332},[3840],{"type":50,"value":409},{"type":44,"tag":319,"props":3842,"children":3843},{"style":343},[3844],{"type":50,"value":414},{"type":44,"tag":319,"props":3846,"children":3847},{"style":332},[3848],{"type":50,"value":419},{"type":44,"tag":319,"props":3850,"children":3851},{"style":343},[3852],{"type":50,"value":367},{"type":44,"tag":319,"props":3854,"children":3855},{"style":349},[3856],{"type":50,"value":372},{"type":44,"tag":319,"props":3858,"children":3859},{"class":321,"line":430},[3860,3864,3868],{"type":44,"tag":319,"props":3861,"children":3862},{"style":332},[3863],{"type":50,"value":436},{"type":44,"tag":319,"props":3865,"children":3866},{"style":343},[3867],{"type":50,"value":441},{"type":44,"tag":319,"props":3869,"children":3870},{"style":332},[3871],{"type":50,"value":446},{"type":44,"tag":319,"props":3873,"children":3874},{"class":321,"line":449},[3875],{"type":44,"tag":319,"props":3876,"children":3877},{"style":332},[3878],{"type":50,"value":2400},{"type":44,"tag":319,"props":3880,"children":3881},{"class":321,"line":458},[3882],{"type":44,"tag":319,"props":3883,"children":3884},{"style":332},[3885],{"type":50,"value":2408},{"type":44,"tag":319,"props":3887,"children":3888},{"class":321,"line":467},[3889],{"type":44,"tag":319,"props":3890,"children":3891},{"style":332},[3892],{"type":50,"value":2416},{"type":44,"tag":319,"props":3894,"children":3895},{"class":321,"line":476},[3896],{"type":44,"tag":319,"props":3897,"children":3898},{"style":332},[3899],{"type":50,"value":3900},"          { \"terms\": { \"event.action\": [\"access_denied\", \"authentication_failed\"] } },\n",{"type":44,"tag":319,"props":3902,"children":3903},{"class":321,"line":836},[3904],{"type":44,"tag":319,"props":3905,"children":3906},{"style":332},[3907],{"type":50,"value":3908},"          { \"wildcard\": { \"indices\": \"secrets-*\" } },\n",{"type":44,"tag":319,"props":3910,"children":3911},{"class":321,"line":1059},[3912],{"type":44,"tag":319,"props":3913,"children":3914},{"style":332},[3915],{"type":50,"value":3916},"          { \"range\": { \"@timestamp\": { \"gte\": \"now-48h\" } } }\n",{"type":44,"tag":319,"props":3918,"children":3919},{"class":321,"line":1068},[3920],{"type":44,"tag":319,"props":3921,"children":3922},{"style":332},[3923],{"type":50,"value":2440},{"type":44,"tag":319,"props":3925,"children":3926},{"class":321,"line":1077},[3927],{"type":44,"tag":319,"props":3928,"children":3929},{"style":332},[3930],{"type":50,"value":1706},{"type":44,"tag":319,"props":3932,"children":3933},{"class":321,"line":1086},[3934],{"type":44,"tag":319,"props":3935,"children":3936},{"style":332},[3937],{"type":50,"value":2455},{"type":44,"tag":319,"props":3939,"children":3940},{"class":321,"line":1095},[3941],{"type":44,"tag":319,"props":3942,"children":3943},{"style":332},[3944],{"type":50,"value":2463},{"type":44,"tag":319,"props":3946,"children":3947},{"class":321,"line":1104},[3948],{"type":44,"tag":319,"props":3949,"children":3950},{"style":332},[3951],{"type":50,"value":3952},"    \"size\": 100\n",{"type":44,"tag":319,"props":3954,"children":3955},{"class":321,"line":1112},[3956,3960],{"type":44,"tag":319,"props":3957,"children":3958},{"style":332},[3959],{"type":50,"value":482},{"type":44,"tag":319,"props":3961,"children":3962},{"style":343},[3963],{"type":50,"value":487},{"type":44,"tag":53,"props":3965,"children":3966},{},[3967,3969,3974,3975,3980,3981,3986],{"type":50,"value":3968},"Review ",{"type":44,"tag":229,"props":3970,"children":3972},{"className":3971},[],[3973],{"type":50,"value":3455},{"type":50,"value":3457},{"type":44,"tag":229,"props":3976,"children":3978},{"className":3977},[],[3979],{"type":50,"value":2935},{"type":50,"value":3464},{"type":44,"tag":229,"props":3982,"children":3984},{"className":3983},[],[3985],{"type":50,"value":2912},{"type":50,"value":3987}," in the results to identify the actor and pattern.",{"type":44,"tag":691,"props":3989,"children":3991},{"id":3990},"reduce-audit-noise-on-a-busy-cluster",[3992],{"type":50,"value":3993},"Reduce audit noise on a busy cluster",{"type":44,"tag":53,"props":3995,"children":3996},{},[3997,4001],{"type":44,"tag":64,"props":3998,"children":3999},{},[4000],{"type":50,"value":3529},{"type":50,"value":4002}," \"Audit logs are too large. Filter out monitoring traffic and successful reads.\"",{"type":44,"tag":53,"props":4004,"children":4005},{},[4006,4008,4013,4015,4020],{"type":50,"value":4007},"Exclude ",{"type":44,"tag":229,"props":4009,"children":4011},{"className":4010},[],[4012],{"type":50,"value":1293},{"type":50,"value":4014}," from event types, then add a filter policy for monitoring users and indices. See\n",{"type":44,"tag":98,"props":4016,"children":4018},{"href":4017},"#filter-policies",[4019],{"type":50,"value":1526},{"type":50,"value":4021}," for the full syntax.",{"type":44,"tag":127,"props":4023,"children":4025},{"id":4024},"guidelines",[4026],{"type":50,"value":4027},"Guidelines",{"type":44,"tag":691,"props":4029,"children":4031},{"id":4030},"prefer-index-output-for-programmatic-access",[4032],{"type":50,"value":4033},"Prefer index output for programmatic access",{"type":44,"tag":53,"props":4035,"children":4036},{},[4037,4039,4044,4046,4051],{"type":50,"value":4038},"Enable the ",{"type":44,"tag":229,"props":4040,"children":4042},{"className":4041},[],[4043],{"type":50,"value":669},{"type":50,"value":4045}," output to make audit events queryable. The ",{"type":44,"tag":229,"props":4047,"children":4049},{"className":4048},[],[4050],{"type":50,"value":637},{"type":50,"value":4052}," output is better for shipping to external SIEM\ntools via Filebeat but cannot be queried through the Elasticsearch API.",{"type":44,"tag":691,"props":4054,"children":4056},{"id":4055},"start-restrictive-then-widen",[4057],{"type":50,"value":4058},"Start restrictive, then widen",{"type":44,"tag":53,"props":4060,"children":4061},{},[4062,4064,4069,4070,4075,4076,4081],{"type":50,"value":4063},"Begin with failure events only (",{"type":44,"tag":229,"props":4065,"children":4067},{"className":4066},[],[4068],{"type":50,"value":1335},{"type":50,"value":3457},{"type":44,"tag":229,"props":4071,"children":4073},{"className":4072},[],[4074],{"type":50,"value":1385},{"type":50,"value":3457},{"type":44,"tag":229,"props":4077,"children":4079},{"className":4078},[],[4080],{"type":50,"value":1504},{"type":50,"value":4082},"). Add success events\nonly when needed — they generate high volume.",{"type":44,"tag":691,"props":4084,"children":4086},{"id":4085},"use-filter-policies-instead-of-disabling-events",[4087],{"type":50,"value":4088},"Use filter policies instead of disabling events",{"type":44,"tag":53,"props":4090,"children":4091},{},[4092],{"type":50,"value":4093},"Suppress specific users or indices with filter policies rather than excluding entire event types.",{"type":44,"tag":691,"props":4095,"children":4097},{"id":4096},"monitor-audit-index-size",[4098],{"type":50,"value":4099},"Monitor audit index size",{"type":44,"tag":53,"props":4101,"children":4102},{},[4103,4105,4110],{"type":50,"value":4104},"Set up an ILM policy to roll over and delete old ",{"type":44,"tag":229,"props":4106,"children":4108},{"className":4107},[],[4109],{"type":50,"value":687},{"type":50,"value":4111}," indices. A 30-90 day retention is typical.",{"type":44,"tag":691,"props":4113,"children":4115},{"id":4114},"enable-kibana-audit-for-full-coverage",[4116],{"type":50,"value":4117},"Enable Kibana audit for full coverage",{"type":44,"tag":53,"props":4119,"children":4120},{},[4121,4123,4127,4129,4134,4136,4141],{"type":50,"value":4122},"For application-layer events (saved object access, Kibana logins, space operations), enable Kibana audit logging as\nwell. See the ",{"type":44,"tag":64,"props":4124,"children":4125},{},[4126],{"type":50,"value":68},{"type":50,"value":4128}," skill for setup. Use ",{"type":44,"tag":229,"props":4130,"children":4132},{"className":4131},[],[4133],{"type":50,"value":2968},{"type":50,"value":4135}," to correlate — see\n",{"type":44,"tag":98,"props":4137,"children":4139},{"href":4138},"#correlate-with-kibana-audit-logs",[4140],{"type":50,"value":2957},{"type":50,"value":4142}," above.",{"type":44,"tag":691,"props":4144,"children":4146},{"id":4145},"avoid-superuser-credentials",[4147],{"type":50,"value":4148},"Avoid superuser credentials",{"type":44,"tag":53,"props":4150,"children":4151},{},[4152,4154,4159,4161,4166],{"type":50,"value":4153},"Use a dedicated admin user or API key with ",{"type":44,"tag":229,"props":4155,"children":4157},{"className":4156},[],[4158],{"type":50,"value":272},{"type":50,"value":4160}," privileges. Reserve ",{"type":44,"tag":229,"props":4162,"children":4164},{"className":4163},[],[4165],{"type":50,"value":8},{"type":50,"value":4167}," for emergency recovery only.",{"type":44,"tag":127,"props":4169,"children":4171},{"id":4170},"deployment-compatibility",[4172],{"type":50,"value":123},{"type":44,"tag":185,"props":4174,"children":4175},{},[4176,4202],{"type":44,"tag":189,"props":4177,"children":4178},{},[4179],{"type":44,"tag":193,"props":4180,"children":4181},{},[4182,4187,4192,4197],{"type":44,"tag":197,"props":4183,"children":4184},{},[4185],{"type":50,"value":4186},"Capability",{"type":44,"tag":197,"props":4188,"children":4189},{},[4190],{"type":50,"value":4191},"Self-managed",{"type":44,"tag":197,"props":4193,"children":4194},{},[4195],{"type":50,"value":4196},"ECH",{"type":44,"tag":197,"props":4198,"children":4199},{},[4200],{"type":50,"value":4201},"Serverless",{"type":44,"tag":208,"props":4203,"children":4204},{},[4205,4227,4248,4268,4288],{"type":44,"tag":193,"props":4206,"children":4207},{},[4208,4213,4218,4222],{"type":44,"tag":215,"props":4209,"children":4210},{},[4211],{"type":50,"value":4212},"ES audit via cluster settings",{"type":44,"tag":215,"props":4214,"children":4215},{},[4216],{"type":50,"value":4217},"Yes",{"type":44,"tag":215,"props":4219,"children":4220},{},[4221],{"type":50,"value":4217},{"type":44,"tag":215,"props":4223,"children":4224},{},[4225],{"type":50,"value":4226},"Not available",{"type":44,"tag":193,"props":4228,"children":4229},{},[4230,4235,4239,4244],{"type":44,"tag":215,"props":4231,"children":4232},{},[4233],{"type":50,"value":4234},"ES logfile output",{"type":44,"tag":215,"props":4236,"children":4237},{},[4238],{"type":50,"value":4217},{"type":44,"tag":215,"props":4240,"children":4241},{},[4242],{"type":50,"value":4243},"Via Cloud UI",{"type":44,"tag":215,"props":4245,"children":4246},{},[4247],{"type":50,"value":4226},{"type":44,"tag":193,"props":4249,"children":4250},{},[4251,4256,4260,4264],{"type":44,"tag":215,"props":4252,"children":4253},{},[4254],{"type":50,"value":4255},"ES index output",{"type":44,"tag":215,"props":4257,"children":4258},{},[4259],{"type":50,"value":4217},{"type":44,"tag":215,"props":4261,"children":4262},{},[4263],{"type":50,"value":4217},{"type":44,"tag":215,"props":4265,"children":4266},{},[4267],{"type":50,"value":4226},{"type":44,"tag":193,"props":4269,"children":4270},{},[4271,4276,4280,4284],{"type":44,"tag":215,"props":4272,"children":4273},{},[4274],{"type":50,"value":4275},"Filter policies via cluster settings",{"type":44,"tag":215,"props":4277,"children":4278},{},[4279],{"type":50,"value":4217},{"type":44,"tag":215,"props":4281,"children":4282},{},[4283],{"type":50,"value":4217},{"type":44,"tag":215,"props":4285,"children":4286},{},[4287],{"type":50,"value":4226},{"type":44,"tag":193,"props":4289,"children":4290},{},[4291,4301,4305,4309],{"type":44,"tag":215,"props":4292,"children":4293},{},[4294,4296],{"type":50,"value":4295},"Query ",{"type":44,"tag":229,"props":4297,"children":4299},{"className":4298},[],[4300],{"type":50,"value":687},{"type":44,"tag":215,"props":4302,"children":4303},{},[4304],{"type":50,"value":4217},{"type":44,"tag":215,"props":4306,"children":4307},{},[4308],{"type":50,"value":4217},{"type":44,"tag":215,"props":4310,"children":4311},{},[4312],{"type":50,"value":4226},{"type":44,"tag":53,"props":4314,"children":4315},{},[4316,4321],{"type":44,"tag":64,"props":4317,"children":4318},{},[4319],{"type":50,"value":4320},"ECH notes:",{"type":50,"value":4322}," ES audit is configured via the cluster settings API. Logfile output is accessible through the Cloud\nconsole deployment logs. Index output works the same as self-managed.",{"type":44,"tag":53,"props":4324,"children":4325},{},[4326],{"type":44,"tag":64,"props":4327,"children":4328},{},[4329],{"type":50,"value":4330},"Serverless notes:",{"type":44,"tag":134,"props":4332,"children":4333},{},[4334,4339],{"type":44,"tag":138,"props":4335,"children":4336},{},[4337],{"type":50,"value":4338},"Audit logging is not user-configurable on Serverless. Security events are managed by Elastic as part of the platform.",{"type":44,"tag":138,"props":4340,"children":4341},{},[4342],{"type":50,"value":4343},"If a user asks about auditing on Serverless, direct them to the Elastic Cloud console or their account team.",{"type":44,"tag":4345,"props":4346,"children":4347},"style",{},[4348],{"type":50,"value":4349},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":4351,"total":4506},[4352,4371,4388,4401,4418,4430,4440,4453,4464,4471,4481,4493],{"slug":4353,"name":4353,"fn":4354,"description":4355,"org":4356,"tags":4357,"stars":4368,"repoUrl":4369,"updatedAt":4370},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4358,4361,4364,4365],{"name":4359,"slug":4360,"type":15},"Analytics","analytics",{"name":4362,"slug":4363,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":4366,"slug":4367,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":4372,"name":4372,"fn":4373,"description":4374,"org":4375,"tags":4376,"stars":4368,"repoUrl":4369,"updatedAt":4387},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4377,4380,4381,4384],{"name":4378,"slug":4379,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":4382,"slug":4383,"type":15},"Engineering","engineering",{"name":4385,"slug":4386,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":4389,"name":4389,"fn":4390,"description":4391,"org":4392,"tags":4393,"stars":4368,"repoUrl":4369,"updatedAt":4400},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4394,4395,4396,4397],{"name":9,"slug":8,"type":15},{"name":23,"slug":24,"type":15},{"name":4366,"slug":4367,"type":15},{"name":4398,"slug":4399,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":4402,"name":4402,"fn":4403,"description":4404,"org":4405,"tags":4406,"stars":25,"repoUrl":26,"updatedAt":4417},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4407,4410,4411,4414],{"name":4408,"slug":4409,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":4412,"slug":4413,"type":15},"Operations","operations",{"name":4415,"slug":4416,"type":15},"Permissions","permissions","2026-07-12T07:46:44.946285",{"slug":4419,"name":4419,"fn":4420,"description":4421,"org":4422,"tags":4423,"stars":25,"repoUrl":26,"updatedAt":4429},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4424,4425,4428],{"name":4408,"slug":4409,"type":15},{"name":4426,"slug":4427,"type":15},"Deployment","deployment",{"name":23,"slug":24,"type":15},"2026-07-12T07:46:42.353362",{"slug":4431,"name":4431,"fn":4432,"description":4433,"org":4434,"tags":4435,"stars":25,"repoUrl":26,"updatedAt":4439},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4436,4437,4438],{"name":4408,"slug":4409,"type":15},{"name":23,"slug":24,"type":15},{"name":4412,"slug":4413,"type":15},"2026-07-12T07:46:41.097412",{"slug":4441,"name":4441,"fn":4442,"description":4443,"org":4444,"tags":4445,"stars":25,"repoUrl":26,"updatedAt":4452},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4446,4447,4448,4451],{"name":4408,"slug":4409,"type":15},{"name":23,"slug":24,"type":15},{"name":4449,"slug":4450,"type":15},"Networking","networking",{"name":13,"slug":14,"type":15},"2026-07-12T07:46:43.675992",{"slug":4454,"name":4454,"fn":4455,"description":4456,"org":4457,"tags":4458,"stars":25,"repoUrl":26,"updatedAt":4463},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4459,4461,4462],{"name":247,"slug":4460,"type":15},"authentication",{"name":4408,"slug":4409,"type":15},{"name":23,"slug":24,"type":15},"2026-07-12T07:46:39.783105",{"slug":4,"name":4,"fn":5,"description":6,"org":4465,"tags":4466,"stars":25,"repoUrl":26,"updatedAt":27},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4467,4468,4469,4470],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"slug":75,"name":75,"fn":4472,"description":4473,"org":4474,"tags":4475,"stars":25,"repoUrl":26,"updatedAt":4480},"configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4476,4477,4478,4479],{"name":247,"slug":4460,"type":15},{"name":9,"slug":8,"type":15},{"name":23,"slug":24,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:47:41.474547",{"slug":82,"name":82,"fn":4482,"description":4483,"org":4484,"tags":4485,"stars":25,"repoUrl":26,"updatedAt":4492},"manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4486,4487,4488,4491],{"name":9,"slug":8,"type":15},{"name":23,"slug":24,"type":15},{"name":4489,"slug":4490,"type":15},"RBAC","rbac",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:36.394177",{"slug":4494,"name":4494,"fn":4495,"description":4496,"org":4497,"tags":4498,"stars":25,"repoUrl":26,"updatedAt":4505},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4499,4500,4501,4502],{"name":4359,"slug":4360,"type":15},{"name":4362,"slug":4363,"type":15},{"name":23,"slug":24,"type":15},{"name":4503,"slug":4504,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86,{"items":4508,"total":4555},[4509,4516,4522,4528,4535,4541,4548],{"slug":4402,"name":4402,"fn":4403,"description":4404,"org":4510,"tags":4511,"stars":25,"repoUrl":26,"updatedAt":4417},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4512,4513,4514,4515],{"name":4408,"slug":4409,"type":15},{"name":9,"slug":8,"type":15},{"name":4412,"slug":4413,"type":15},{"name":4415,"slug":4416,"type":15},{"slug":4419,"name":4419,"fn":4420,"description":4421,"org":4517,"tags":4518,"stars":25,"repoUrl":26,"updatedAt":4429},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4519,4520,4521],{"name":4408,"slug":4409,"type":15},{"name":4426,"slug":4427,"type":15},{"name":23,"slug":24,"type":15},{"slug":4431,"name":4431,"fn":4432,"description":4433,"org":4523,"tags":4524,"stars":25,"repoUrl":26,"updatedAt":4439},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4525,4526,4527],{"name":4408,"slug":4409,"type":15},{"name":23,"slug":24,"type":15},{"name":4412,"slug":4413,"type":15},{"slug":4441,"name":4441,"fn":4442,"description":4443,"org":4529,"tags":4530,"stars":25,"repoUrl":26,"updatedAt":4452},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4531,4532,4533,4534],{"name":4408,"slug":4409,"type":15},{"name":23,"slug":24,"type":15},{"name":4449,"slug":4450,"type":15},{"name":13,"slug":14,"type":15},{"slug":4454,"name":4454,"fn":4455,"description":4456,"org":4536,"tags":4537,"stars":25,"repoUrl":26,"updatedAt":4463},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4538,4539,4540],{"name":247,"slug":4460,"type":15},{"name":4408,"slug":4409,"type":15},{"name":23,"slug":24,"type":15},{"slug":4,"name":4,"fn":5,"description":6,"org":4542,"tags":4543,"stars":25,"repoUrl":26,"updatedAt":27},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4544,4545,4546,4547],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"slug":75,"name":75,"fn":4472,"description":4473,"org":4549,"tags":4550,"stars":25,"repoUrl":26,"updatedAt":4480},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4551,4552,4553,4554],{"name":247,"slug":4460,"type":15},{"name":9,"slug":8,"type":15},{"name":23,"slug":24,"type":15},{"name":13,"slug":14,"type":15},35]