Skip to content

Commit b98036c

Browse files
DOCS Security audit ignore for the action event field (#83583)
Security audit ignore filter policies work on the audit event's action field.
1 parent f69485b commit b98036c

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

x-pack/docs/en/security/auditing/ignore-policy.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ accountability gaps that could render illegitimate actions undetectable.
2323
Please take time to review these policies whenever your system architecture changes.
2424

2525
A policy is a named set of filter rules. Each filter rule applies to a single event attribute,
26-
one of the `users`, `realms`, `roles` or `indices` attributes. The filter rule defines
26+
one of the `users`, `realms`, `actions`, `roles` or `indices` attributes. The filter rule defines
2727
a list of <<regexp-syntax,Lucene regexp>>, *any* of which has to match the value of the audit
2828
event attribute for the rule to match.
2929
A policy matches an event if *all* the rules comprising it match the event.

0 commit comments

Comments
 (0)