Audit logging in Elasticsearch - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is audit logging in Elasticsearch?

Audit logging in Elasticsearch records security-related events like user access and changes to help track and review system activity.

beginner

Which Elasticsearch feature enables audit logging?

The Elasticsearch Security Audit Logging feature enables capturing detailed logs of security events such as authentication, authorization, and system changes.

intermediate

How do you enable audit logging in Elasticsearch?

You enable audit logging by setting 'xpack.security.audit.enabled: true' in the elasticsearch.yml configuration file.

intermediate

What types of events can Elasticsearch audit logging capture?

It can capture authentication attempts, access granted or denied, configuration changes, and system events related to security.

intermediate

Where are audit logs stored in Elasticsearch by default?

By default, audit logs are stored in the Elasticsearch logs directory as part of the main log files or can be configured to a separate file.

How do you enable audit logging in Elasticsearch?

A Set 'xpack.security.audit.enabled: true' in elasticsearch.yml

B Install a separate audit plugin

C Enable audit in Kibana settings

D Run 'audit-enable' command in terminal

Audit logging is enabled by setting 'xpack.security.audit.enabled: true' in the elasticsearch.yml file.

What kind of events does Elasticsearch audit logging NOT capture by default?

A User authentication attempts

B Access granted or denied

C Application error logs

D System security configuration changes

Audit logging focuses on security events, not general application error logs.

Where are audit logs typically stored in Elasticsearch?

A In the Elasticsearch logs directory

B In a separate database

C Only in Kibana dashboards

D In the system's /tmp folder

Audit logs are stored in the Elasticsearch logs directory by default.

Which Elasticsearch component is responsible for audit logging?

A Beats

B Logstash

C Kibana

D X-Pack Security

X-Pack Security includes the audit logging feature in Elasticsearch.

Why is audit logging important in Elasticsearch?

A To improve search speed

B To track security events and user actions

C To backup data automatically

D To monitor CPU usage

Audit logging helps track security events and user actions for compliance and troubleshooting.

Explain how to enable and configure audit logging in Elasticsearch.

Think about the configuration file and what events you want to track.

Describe the benefits of using audit logging in Elasticsearch.

Consider why knowing who did what and when is useful.