diff --git a/x-pack/plugins/security/server/audit/audit_events.test.ts b/x-pack/plugins/security/server/audit/audit_events.test.ts index 1713badede2f7..c826bb1d33f99 100644 --- a/x-pack/plugins/security/server/audit/audit_events.test.ts +++ b/x-pack/plugins/security/server/audit/audit_events.test.ts @@ -106,6 +106,63 @@ describe('#savedObjectEvent', () => { `); }); + test('does create event for read access of saved objects', () => { + expect( + savedObjectEvent({ + action: SavedObjectAction.GET, + savedObject: { type: 'dashboard', id: 'SAVED_OBJECT_ID' }, + }) + ).not.toBeUndefined(); + expect( + savedObjectEvent({ + action: SavedObjectAction.FIND, + savedObject: { type: 'dashboard', id: 'SAVED_OBJECT_ID' }, + }) + ).not.toBeUndefined(); + }); + + test('does not create event for read access of config or telemetry objects', () => { + expect( + savedObjectEvent({ + action: SavedObjectAction.GET, + savedObject: { type: 'config', id: 'SAVED_OBJECT_ID' }, + }) + ).toBeUndefined(); + expect( + savedObjectEvent({ + action: SavedObjectAction.GET, + savedObject: { type: 'telemetry', id: 'SAVED_OBJECT_ID' }, + }) + ).toBeUndefined(); + expect( + savedObjectEvent({ + action: SavedObjectAction.FIND, + savedObject: { type: 'config', id: 'SAVED_OBJECT_ID' }, + }) + ).toBeUndefined(); + expect( + savedObjectEvent({ + action: SavedObjectAction.FIND, + savedObject: { type: 'telemetry', id: 'SAVED_OBJECT_ID' }, + }) + ).toBeUndefined(); + }); + + test('does create event for write access of config or telemetry objects', () => { + expect( + savedObjectEvent({ + action: SavedObjectAction.UPDATE, + savedObject: { type: 'config', id: 'SAVED_OBJECT_ID' }, + }) + ).not.toBeUndefined(); + expect( + savedObjectEvent({ + action: SavedObjectAction.UPDATE, + savedObject: { type: 'telemetry', id: 'SAVED_OBJECT_ID' }, + }) + ).not.toBeUndefined(); + }); + test('creates event with `success` outcome for `REMOVE_REFERENCES` action', () => { expect( savedObjectEvent({ diff --git a/x-pack/plugins/security/server/audit/audit_events.ts b/x-pack/plugins/security/server/audit/audit_events.ts index e3c1f95349c92..6aba78c936071 100644 --- a/x-pack/plugins/security/server/audit/audit_events.ts +++ b/x-pack/plugins/security/server/audit/audit_events.ts @@ -220,7 +220,7 @@ export function savedObjectEvent({ deleteFromSpaces, outcome, error, -}: SavedObjectParams): AuditEvent { +}: SavedObjectParams): AuditEvent | undefined { const doc = savedObject ? `${savedObject.type} [id=${savedObject.id}]` : 'saved objects'; const [present, progressive, past] = eventVerbs[action]; const message = error @@ -230,6 +230,14 @@ export function savedObjectEvent({ : `User has ${past} ${doc}`; const type = eventTypes[action]; + if ( + type === EventType.ACCESS && + savedObject && + (savedObject.type === 'config' || savedObject.type === 'telemetry') + ) { + return; + } + return { message, event: { diff --git a/x-pack/plugins/security/server/audit/audit_service.test.ts b/x-pack/plugins/security/server/audit/audit_service.test.ts index e0dd98c7de639..9b30d4dbba456 100644 --- a/x-pack/plugins/security/server/audit/audit_service.test.ts +++ b/x-pack/plugins/security/server/audit/audit_service.test.ts @@ -130,6 +130,26 @@ describe('#asScoped', () => { audit.asScoped(request).log({ message: 'MESSAGE', event: { action: 'ACTION' } }); expect(logger.info).not.toHaveBeenCalled(); }); + + it('does not log to audit logger if no event was generated', async () => { + const audit = new AuditService(logger).setup({ + license, + config: { + enabled: true, + ignore_filters: [{ actions: ['ACTION'] }], + }, + logging, + http, + getCurrentUser, + getSpaceId, + }); + const request = httpServerMock.createKibanaRequest({ + kibanaRequestState: { requestId: 'REQUEST_ID', requestUuid: 'REQUEST_UUID' }, + }); + + audit.asScoped(request).log(undefined); + expect(logger.info).not.toHaveBeenCalled(); + }); }); describe('#createLoggingConfig', () => { diff --git a/x-pack/plugins/security/server/audit/audit_service.ts b/x-pack/plugins/security/server/audit/audit_service.ts index 31c7e28be3b8c..744e4af56c861 100644 --- a/x-pack/plugins/security/server/audit/audit_service.ts +++ b/x-pack/plugins/security/server/audit/audit_service.ts @@ -27,7 +27,7 @@ export interface LegacyAuditLogger { } export interface AuditLogger { - log: (event: AuditEvent) => void; + log: (event: AuditEvent | undefined) => void; } interface AuditLogMeta extends AuditEvent { @@ -127,7 +127,10 @@ export class AuditService { * }); * ``` */ - const log = (event: AuditEvent) => { + const log: AuditLogger['log'] = (event) => { + if (!event) { + return; + } const user = getCurrentUser(request); const spaceId = getSpaceId(request); const meta: AuditLogMeta = {