Audit logging in Elasticsearch - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable audit logging in Elasticsearch.

Elasticsearch

xpack.security.audit.enabled: [1]

Drag options to blanks, or click blank then click option'

Atrue

Bauto

Cfalse

Dnone

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'false' disables audit logging.

Using 'auto' or 'none' are invalid values.

Setting xpack.security.audit.enabled to true turns on audit logging in Elasticsearch.

2fill in blank

medium

Complete the code to specify the audit log output file path.

Elasticsearch

xpack.security.audit.outputs: ["logfile"]
xpack.security.audit.logfile.prefix: [1]

Drag options to blanks, or click blank then click option'

Aoutput

Bsecurity

Caudit

Dlog

Attempts:

3 left

💡 Hint

Common Mistakes

Using generic prefixes like 'log' can confuse audit logs with other logs.

Leaving prefix empty causes default naming which may be unclear.

The audit prefix is commonly used to name audit log files clearly.

3fill in blank

hard

Fix the error in the audit logging configuration to enable logging of authentication events.

Elasticsearch

xpack.security.audit.logfile.events.include: [1]

Drag options to blanks, or click blank then click option'

A["login", "fail"]

B["access_denied", "auth_failed"]

C["auth", "fail"]

D["access_denied", "authentication_failed"]

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect or partial event names causes no logs to be recorded.

Using shorthand or incomplete event names.

The correct event names for authentication issues are access_denied and authentication_failed.

4fill in blank

hard

Fill both blanks to configure audit logging to include both authentication and access events.

Elasticsearch

xpack.security.audit.logfile.events.include: [[1], [2]]

Drag options to blanks, or click blank then click option'

A"authentication_failed"

B"access_denied"

C"index_event"

D"connection_failed"

Attempts:

3 left

💡 Hint

Common Mistakes

Including unrelated event types causes noisy logs.

Missing one of the key event types reduces audit effectiveness.

Including "authentication_failed" and "access_denied" ensures audit logs capture key security events.

5fill in blank

hard

Fill all three blanks to configure audit logging to output to both logfile and index, and include all events.

Elasticsearch

xpack.security.audit.enabled: [1]
xpack.security.audit.outputs: [[2]]
xpack.security.audit.logfile.events.include: [[3]]

Drag options to blanks, or click blank then click option'

Atrue

B"logfile"

CB, C

D"*"

Attempts:

3 left

💡 Hint

Common Mistakes

Not enabling audit logging disables all audit features.

Setting outputs to only one destination limits audit data.

Not including all events misses important audit information.

Audit logging must be enabled (true), outputs set to both "logfile" and "index", and all events included with "*".

Practice

1. What is the main purpose of audit logging in Elasticsearch?

easy

A. To record user actions and security events

B. To improve search speed

C. To backup data automatically

D. To monitor cluster health

Solution

1. Step 1: Understand audit logging function

   Audit logging tracks what users do and records security-related events.

2. Step 2: Compare with other options

   Improving search speed, backing up data, or monitoring cluster health are different Elasticsearch features.

3. Final Answer:

   To record user actions and security events -> Option A

4. Quick Check:

   Audit logging = record user actions [OK]

Hint: Audit logging tracks user and security events only [OK]

Common Mistakes:

• Confusing audit logging with backup or monitoring
• Thinking it speeds up search queries
• Assuming it manages cluster health

2. Which setting enables audit logging in Elasticsearch's configuration file?

easy

A. security.audit.log: on

B. xpack.security.audit.enabled: true

C. audit.logging.enabled: yes

D. xpack.audit.security: enabled

Solution

1. Step 1: Identify correct setting syntax

   The official setting to enable audit logging is xpack.security.audit.enabled set to true.

2. Step 2: Check other options for correctness

   Other options use incorrect keys or values not recognized by Elasticsearch.

3. Final Answer:

   xpack.security.audit.enabled: true -> Option B

4. Quick Check:

   Enable audit logging = xpack.security.audit.enabled true [OK]

Hint: Look for 'xpack.security.audit.enabled' set to true [OK]

Common Mistakes:

• Using incorrect key names
• Using 'yes' or 'on' instead of true
• Mixing audit and security keys

3. Given this audit logging config snippet:

 xpack.security.audit.enabled: true
 xpack.security.audit.outputs: ["logfile", "index"] 

What does this configuration do?

medium

A. Enables audit logging and sends data to log files and Elasticsearch index

B. Disables audit logging but logs to file

C. Enables audit logging but only logs to console

D. Enables audit logging but stores data only in memory

Solution

1. Step 1: Analyze 'enabled' setting

   Setting xpack.security.audit.enabled: true turns audit logging on.

2. Step 2: Analyze 'outputs' setting

   Outputs set to ["logfile", "index"] means audit data is saved to log files and Elasticsearch indexes.

3. Final Answer:

   Enables audit logging and sends data to log files and Elasticsearch index -> Option A

4. Quick Check:

   Enabled + logfile and index outputs = Enables audit logging and sends data to log files and Elasticsearch index [OK]

Hint: Enabled true + outputs list means multiple destinations [OK]

Common Mistakes:

• Assuming logging is disabled
• Thinking output is only console
• Ignoring multiple output destinations

4. You enabled audit logging with xpack.security.audit.enabled: true but see no audit logs. What is a likely cause?

medium

A. User permissions prevent audit logging

B. Elasticsearch cluster is offline

C. Audit logging requires a restart of Kibana

D. Audit outputs are not configured, so logs have no destination

Solution

1. Step 1: Check audit logging enablement

   Audit logging is enabled, so it should produce logs if outputs are set.

2. Step 2: Verify output configuration

   If xpack.security.audit.outputs is missing or empty, logs have nowhere to go, so no logs appear.

3. Final Answer:

   Audit outputs are not configured, so logs have no destination -> Option D

4. Quick Check:

   Enabled but no outputs = no logs [OK]

Hint: Check audit outputs setting if no logs appear [OK]

Common Mistakes:

• Assuming cluster offline without checking
• Restarting Kibana instead of Elasticsearch
• Blaming user permissions without audit config check

5. You want to audit only authentication events and store them in a dedicated Elasticsearch index. Which configuration snippet achieves this?

hard

A. xpack.security.audit.enabled: true
xpack.security.audit.outputs: ["index", "logfile"]
xpack.security.audit.categories: ["access_denied"]

B. xpack.security.audit.enabled: true
xpack.security.audit.outputs: ["logfile"]
xpack.security.audit.categories: ["access_granted"]

C. xpack.security.audit.enabled: true
xpack.security.audit.outputs: ["index"]
xpack.security.audit.categories: ["authentication"]

D. xpack.security.audit.enabled: false
xpack.security.audit.outputs: ["index"]
xpack.security.audit.categories: ["authentication"]

Solution

1. Step 1: Enable audit logging

   Set xpack.security.audit.enabled: true to turn on audit logging.

2. Step 2: Set output to Elasticsearch index only

   Use xpack.security.audit.outputs: ["index"] to store logs in an index.

3. Step 3: Filter to authentication events

   Set xpack.security.audit.categories: ["authentication"] to audit only authentication events.

4. Final Answer:

   Enable audit, output to index, filter authentication events -> Option C

5. Quick Check:

   Enable + index output + authentication category = xpack.security.audit.enabled: true xpack.security.audit.outputs: ["index"] xpack.security.audit.categories: ["authentication"] [OK]

Hint: Enable true + output index + category authentication [OK]

Common Mistakes:

• Disabling audit logging by mistake
• Choosing wrong categories like access_granted
• Using logfile output instead of index only