Enabling audit logging
Another crucial aspect of monitoring, which is closely linked to regulatory compliance, is ensuring every action performed by a user on the platform can be traced. This is the purpose of audit logs. In this recipe, we will see how you can activate them and use them to increase your visibility.
Getting ready
Make sure to have an up-and-running Elastic Cloud deployment and complete this chapter’s Setting up Stack Monitoring recipe.
The snippets for this recipe can be found at this address: https://github.com/PacktPublishing/Elastic-Stack-8.x-Cookbook/blob/main/Chapter13/snippets.md#enabling-audit-logging
How to do it…
Audit logging activation, as with many security-related configurations in the Elastic Stack, is twofold: first, we activate audit logging on Elasticsearch events, and afterward, we do this in Kibana. You can activate only the Kibana or Elasticsearch side based on your need, but generally speaking, it’s good practice...
