[Security Assistant] Adds audit logging to knowledge base entry changes

[stephmilovic]

Summary

Resolves https://github.com/elastic/security-team/issues/11367

Adds audit logging events for: knowledge_base_entry_create, knowledge_base_entry_update, and knowledge_base_entry_delete

knowledge_base_entry_create

{
  "@timestamp":"2024-12-06T16:43:45.958-07:00",
  "message":"User has created knowledge base entry [id=93730ccc-2e8e-4bbb-bb79-72a4b722d190, name=\"My document\"]"
  "event":{
    "action":"knowledge_base_entry_create",
    "category":[
      "database"
    ],
    "type":[
      "creation"
    ],
    "outcome":"success"
  },
  "user":{
    "id":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
    "name":"elastic",
    "roles":[
      "superuser"
    ]
  },
  "kibana":{
    "space_id":"default",
    "session_id":"pklKJi6Kkks4tjI39pDGe288z3ou//lh0FHu+Ey57kE="
  },
  "trace":{
    "id":"bb33e39e-98b0-4362-95f5-34b3aa3bdd35"
  },
  "client":{
    "ip":"127.0.0.1"
  },
  "http":{
    "request":{
      "headers":{
        "x-forwarded-for":"127.0.0.1"
      }
    }
  },
  "service":{
    "node":{
      "roles":[
        "background_tasks",
        "ui"
      ]
    }
  },
  "ecs":{
    "version":"8.11.0"
  },
  "log":{
    "level":"INFO",
    "logger":"plugins.security.audit.ecs"
  },
  "process":{
    "pid":42480,
    "uptime":29.778092292
  },
  "transaction":{
    "id":"fe1039f3c161756c"
  }
}

knowledge_base_entry_update

{
  "@timestamp":"2024-12-10T14:35:11.354-07:00",
  "message":"User has updated knowledge base entry [id=93730ccc-2e8e-4bbb-bb79-72a4b722d190, name=\"My document\"]",
  "event":{
    "action":"knowledge_base_entry_update",
    "category":[
      "database"
    ],
    "type":[
      "change"
    ],
    "outcome":"success"
  },
  "user":{
    "id":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
    "name":"elastic",
    "roles":[
      "superuser"
    ]
  },
  "kibana":{
    "space_id":"default",
    "session_id":"raBw0MluNHMgGNz1YxXHFP/Qj7ctWDPuENNWfS4n3/A="
  },
  "trace":{
    "id":"791c7a7f-a8bb-4983-9818-3ee66886181b"
  },
  "client":{
    "ip":"127.0.0.1"
  },
  "http":{
    "request":{
      "headers":{
        "x-forwarded-for":"127.0.0.1"
      }
    }
  },
  "service":{
    "node":{
      "roles":[
        "background_tasks",
        "ui"
      ]
    }
  },
  "ecs":{
    "version":"8.11.0"
  },
  "log":{
    "level":"INFO",
    "logger":"plugins.security.audit.ecs"
  },
  "process":{
    "pid":49499,
    "uptime":820.908983584
  },
  "transaction":{
    "id":"5c8741ee1b3a248a"
  }
}

knowledge_base_entry_delete

{
  "@timestamp":"2024-12-06T16:43:50.028-07:00",
  "message":"User has deleted knowledge base entry [id=52fc47fb-c0d9-418f-af50-2e4fa6610746]",
  "event":{
    "action":"knowledge_base_entry_delete",
    "category":[
      "database"
    ],
    "type":[
      "deletion"
    ],
    "outcome":"success"
  },
  "user":{
    "id":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
    "name":"elastic",
    "roles":[
      "superuser"
    ]
  },
  "kibana":{
    "space_id":"default",
    "session_id":"pklKJi6Kkks4tjI39pDGe288z3ou//lh0FHu+Ey57kE="
  },
  "trace":{
    "id":"70088508-080f-4cf6-838c-1dd9676b592f"
  },
  "client":{
    "ip":"127.0.0.1"
  },
  "http":{
    "request":{
      "headers":{
        "x-forwarded-for":"127.0.0.1"
      }
    }
  },
  "service":{
    "node":{
      "roles":[
        "background_tasks",
        "ui"
      ]
    }
  },
  "ecs":{
    "version":"8.11.0"
  },
  "log":{
    "level":"INFO",
    "logger":"plugins.security.audit.ecs"
  },
  "process":{
    "pid":42480,
    "uptime":33.848645
  },
  "transaction":{
    "id":"315d60aa8e32df91"
  }
}

To test

1. add this line to your kibana.dev.yml: xpack.security.audit.enabled: true
2. start es from snapshot and include this argument: -E xpack.security.audit.enabled=true
3. start kibana
4. Set up KB
5. Create an entry
6. Update an entry
7. Delete an entry
8. Open the file logs/audit.log
9. Search for knowledge_base_entry_create, knowledge_base_entry_update, and knowledge_base_entry_delete to ensure audit logs were added for each action you took

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 295c59d

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
elasticAssistant	41	40	-1

Unknown metric groups

API count

id	before	after	diff
elasticAssistant	56	55	-1

History

• 💔 Build #257975 failed c538f66

[patrykkopycinski]

do we also want to raport failed actions?

[kibanamachine]

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/12283023020

[kibanamachine]

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation