elasticsearch-audit

Configure Elasticsearch audit logs through the cluster settings API to enable security event recording. You can dynamically select specific event types such as authentication failures and access denials to monitor for incident investigation.

You can filter Elasticsearch audit events by creating filter policies via cluster settings. This allows you to ignore specific events from designated users, realms, or indices to reduce noise in your audit logs.

Yes, Elasticsearch audit logging supports dynamic configuration of output destinations. You can route your security audit events to either a standard logfile or an Elasticsearch index using the cluster settings API.

Query Elasticsearch audit logs for authentication_failed events to investigate failed login attempts. You can filter these security events by specific time frames and IP addresses for targeted incident investigation.

You can correlate Elasticsearch and Kibana audit logs using trace.id. This shared identifier links security events across both platforms to provide a comprehensive view of security incidents.