elastic / elastic/integrations
[Elasticsearch] The Audit ingest pipeline wrongfully populates success events with failure in event.outcome.
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
Hello,
We recently configured audit log in our cluster and the respective Elastic Agent integration, while doing some tests to create custom dashboards and alerts we saw that some actions that are performed with success in Kibana are being populate with `event.outcome: failure` by the Audit Ingest pipeline.
Looking at the ingests pipeline it seems that just a couple of events will ever be populated with `event.outcome: success`.
```
- script:
lang: painless
source: >-
def successEvents = ['authentication_success', 'access_granted', 'run_as_granted', 'connection_granted'];
if (ctx?.elasticsearch?.audit?.event_type != null && successEvents.contains(ctx.elasticsearch.audit.event_type)) {
ctx.event.outcome = 'success';
} else {
ctx.event.outcome = 'failure';
}
if (ctx?.event.action != null && successEvents.contains(ctx.event.action)) {
ctx.event.outcome = 'success';
} else {
ctx.event.outcome = 'failure';
}
```
But for example, doing a `put_role` with success, will be shown in kibana with `event.outcome: failure`, which is misleading and makes pretty hard to create any security rule on this data.
I'm not sure if this can be solved on the integration, it seems that the audit logs from elasticsearch lacks a lot of basic information about the events.
Contributor guide
Assessment
This issue has not been assessed yet.