46 lines
2.1 KiB
Plaintext
46 lines
2.1 KiB
Plaintext
[role="xpack"]
|
|
[testenv="gold+"]
|
|
[[auditing-search-queries]]
|
|
=== Auditing search queries
|
|
|
|
There is no <<audit-event-types, audit event type>> specifically
|
|
dedicated to search queries. Search queries are analyzed and then processed; the
|
|
processing triggers authorization actions that are audited.
|
|
However, the original raw query, as submitted by the client, is not accessible
|
|
downstream when authorization auditing occurs.
|
|
|
|
Search queries are contained inside HTTP request bodies, however, and some
|
|
audit events that are generated by the REST layer, on the coordinating node,
|
|
can be toggled to output the request body to the audit log. Therefore, one
|
|
must audit request bodies in order to audit search queries.
|
|
|
|
To make certain audit events include the request body, edit the following
|
|
setting in the `elasticsearch.yml` file:
|
|
|
|
[source,yaml]
|
|
----------------------------
|
|
xpack.security.audit.logfile.events.emit_request_body: true
|
|
----------------------------
|
|
|
|
IMPORTANT: No filtering is performed when auditing, so sensitive data might be
|
|
audited in plain text when audit events include the request body. Also, the
|
|
request body can contain malicious content that can break a parser consuming
|
|
the audit logs.
|
|
|
|
The request body is printed as an escaped JSON string value (RFC 4627) to the `request.body`
|
|
event attribute.
|
|
|
|
Not all events contain the `request.body` attribute, even when the above setting
|
|
is toggled. The ones that do are: `authentication_success`,
|
|
`authentication_failed`, `realm_authentication_failed`, `tampered_request`, `run_as_denied`,
|
|
and `anonymous_access_denied`. The `request.body` attribute is printed on the coordinating node only
|
|
(the node that handles the REST request). Most of these event types are
|
|
<<xpack-sa-lf-events-include, not included by default>>.
|
|
|
|
A good practical piece of advice is to add `authentication_success` to the event
|
|
types that are audited (add it to the list in the `xpack.security.audit.logfile.events.include`),
|
|
as this event type is not audited by default.
|
|
|
|
NOTE: Typically, the include list contains other event types as well, such as
|
|
`access_granted` or `access_denied`.
|