Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

user accounts manipulation audit example #8158

Merged
merged 6 commits into from
Sep 6, 2024
Merged

user accounts manipulation audit example #8158

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
f5e2afc
user accounts manipulation audit example
jazzl0ver Sep 3, 2024
bf48030
Merge branch 'opensearch-project:main' into patch-1
jazzl0ver Sep 5, 2024
c44b9dc
user accounts manipulation audit example
jazzl0ver Sep 5, 2024
dab9b55
user accounts manipulation audit example
jazzl0ver Sep 5, 2024
058810d
Update _security/audit-logs/index.md
jazzl0ver Sep 6, 2024
ad3bfa6
Update _security/audit-logs/index.md
Naarcha-AWS Sep 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 53 additions & 0 deletions _security/audit-logs/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,3 +224,56 @@ plugins.security.audit.config.threadpool.max_queue_len: 100000

To disable audit logs after they've been enabled, remove the `plugins.security.audit.type: internal_opensearch` setting from `opensearch.yml`, or switch off the **Enable audit logging** check box in OpenSearch Dashboards.

## Audit user account manipulation

By default, audit of user account creation/removal is off (`AUTHENTICATED` audit events disabled). To enable it, issue a similar request:
Copy link
Member

@cwperks cwperks Sep 3, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think AUTHENTICATED is the right event here. An AUTHENTICATED event is audit logged every time a request is sent with valid credentials.

To monitor changes to the security index, I think you would use the compliance: section of the audit log config. Specifically, the write_watched_indices: [] here.

The security index is .opendistro_security. If you add it into this list, you should be able to track changes to internalusers, roles, roles_mappings, etc.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, Craig. I've just tried to put AUTHENTICATED event back to the list of the disabled categories and added the .opendistro_security index to the write_watched_indices list. And it didn't seem to be enough to get the details like the created or deleted user account name. To get that details, I had to disable write_metadata_only and enable write_log_diffs options as well.
Please, confirm this is the right way to go and I'll update my PR

Copy link
Member

@cwperks cwperks Sep 4, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, that's correct. Does the section below look correct to you? Is there anything else that needs to be added?

_meta:
  type: "audit"
  config_version: 2

config:
  # enable/disable audit logging
  enabled: true

  ...


  compliance:
    # enable/disable compliance
    enabled: true

    # Log updates to internal security changes
    internal_config: true

    # Log only metadata of the document for write events
    write_metadata_only: false

    # Log only diffs for document updates
    write_log_diffs: true

    # List of indices to watch for write events. Wildcard patterns are supported
    # write_watched_indices: ["twitter", "logs-*"]
    write_watched_indices: [".opendistro_security"]

Copy link
Contributor Author

@jazzl0ver jazzl0ver Sep 4, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, looks just fine, thank you! i'd just add a comment regarding the specified .opendistro_security index to make people aware why it's added by default

would you like me to update my PR? or i can simply delete it if you're going to update the docs by yourself

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes please update this PR. Thank you @jazzl0ver ! This will be a great addition to the documentation.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@cwperks updated

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wdyt including the entire section from the above comment?

In general, the audit logs documentation on the documentation website looks like it could be updated to describe all potential settings in the audit.yml file in a table and the compliance portion of the audit log needs to be expanded upon.

For this PR, I think including the blurb from above would be an improvement on the existing docs.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

```
PUT /_opendistro/_security/api/audit/config
{
"compliance": {
"enabled": true,
"write_log_diffs": false,
"read_watched_fields": {},
"read_ignore_users": [
"elastiflow",
"filebeats",
"kibanaserver",
"nagios"
],
"write_watched_indices": [],
"write_ignore_users": [
"elastiflow",
"filebeats",
"kibanaserver",
"nagios"
],
"read_metadata_only": true,
"write_metadata_only": true,
"external_config": false,
"internal_config": true
},
"enabled": true,
"audit": {
"ignore_users": [
"elastiflow",
"filebeats",
"kibanaserver",
"nagios"
],
"ignore_requests": [],
"disabled_rest_categories": [
"GRANTED_PRIVILEGES"
],
"disabled_transport_categories": [
"GRANTED_PRIVILEGES"
],
"log_request_body": true,
"resolve_indices": true,
"resolve_bulk_requests": false,
"exclude_sensitive_headers": true,
"enable_transport": true,
"enable_rest": true
}
}
```
The provided request enables all `AUTHENTICATED` events for all users besides the ones specified in the `*ignore_users` blocks
Loading