elastic / elastic/integrations

[Elasticsearch] The Audit ingest pipeline wrongfully populates success events with failure in event.outcome.

Open
#12,163 4 comments 0 reactions 1 assignee Claimed by @consulthys View on GitHub
Integration:elasticsearch Team:Stack Monitoring
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

Hello,

We recently configured audit log in our cluster and the respective Elastic Agent integration, while doing some tests to create custom dashboards and alerts we saw that some actions that are performed with success in Kibana are being populate with `event.outcome: failure` by the Audit Ingest pipeline.

Looking at the ingests pipeline it seems that just a couple of events will ever be populated with `event.outcome: success`.

```
- script:
lang: painless
source: >-
def successEvents = ['authentication_success', 'access_granted', 'run_as_granted', 'connection_granted'];
if (ctx?.elasticsearch?.audit?.event_type != null && successEvents.contains(ctx.elasticsearch.audit.event_type)) {
ctx.event.outcome = 'success';
} else {
ctx.event.outcome = 'failure';
}
if (ctx?.event.action != null && successEvents.contains(ctx.event.action)) {
ctx.event.outcome = 'success';
} else {
ctx.event.outcome = 'failure';
}
```
But for example, doing a `put_role` with success, will be shown in kibana with `event.outcome: failure`, which is misleading and makes pretty hard to create any security rule on this data.

I'm not sure if this can be solved on the integration, it seems that the audit logs from elasticsearch lacks a lot of basic information about the events.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.