Skip to content

Commit 664a9fe

Browse files
committed
elasticsearch audit details removed and asciidocalypse temp links added
1 parent 24d1154 commit 664a9fe

9 files changed

+28
-917
lines changed

deploy-manage/monitor/logging-configuration/auditing-search-queries.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,12 @@ applies:
66
ece: all
77
eck: all
88
stack: all
9+
serverless: unavailable
910
---
1011

1112
# Audit Elasticsearch search queries [auditing-search-queries]
1213

13-
There is no [audit event type](elasticsearch-audit-events.md) specifically dedicated to search queries. Search queries are analyzed and then processed; the processing triggers authorization actions that are audited. However, the original raw query, as submitted by the client, is not accessible downstream when authorization auditing occurs.
14+
There is no [audit event type]() (asciidocalypse://elasticsearch/docs/reference/elasticsearch/elasticsearch-audit-events) specifically dedicated to search queries. Search queries are analyzed and then processed; the processing triggers authorization actions that are audited. However, the original raw query, as submitted by the client, is not accessible downstream when authorization auditing occurs.
1415

1516
Search queries are contained inside HTTP request bodies, however, and some audit events that are generated by the REST layer, on the coordinating node, can be toggled to output the request body to the audit log. Therefore, one must audit request bodies in order to audit search queries.
1617

deploy-manage/monitor/logging-configuration/configuring-audit-logs.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ When auditing security events, a single client request might generate multiple a
2424
::::
2525

2626
For a complete description of event details and format, refer to the following resources:
27-
* [{{es}} audit events details and schema](/deploy-manage/monitor/logging-configuration/elasticsearch-audit-events.md)
27+
* [{{es}} audit events details and schema]() asciidocalypse://elasticsearch/docs/reference/elasticsearch/elasticsearch-audit-events
2828
* [{{es}} log entry output format](/deploy-manage/monitor/logging-configuration/logfile-audit-output.md#audit-log-entry-format)
2929

3030
### Kibana auditing configuration

deploy-manage/monitor/logging-configuration/correlating-kibana-elasticsearch-audit-logs.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ applies:
77
ece: all
88
eck: all
99
stack: all
10+
serverless: unavailable
1011
---
1112

1213
# Correlating audit events [xpack-security-ecs-audit-correlation]
@@ -23,7 +24,7 @@ When an {{es}} request generates multiple audit events across multiple nodes, yo
2324

2425
This identifier allows you to trace the flow of a request across the {{es}} cluster and reconstruct the full context of an operation.
2526

26-
Refer to [](./elasticsearch-audit-events.md) for a complete reference of event types and attributes.
27+
Refer to [linkTBD]() asciidocalypse://elasticsearch/docs/reference/elasticsearch/elasticsearch-audit-events for a complete reference of event types and attributes.
2728

2829
## `trace.id` field in {{kib}} audit events
2930

0 commit comments

Comments
 (0)