Elastic Makes Serverless Audit-Log Delivery Generally Available
Summary
Elastic made audit-log delivery generally available for Elastic Cloud Serverless, with centralized project activity logs, seven dashboards, and eight alerting rules for credential attacks and unusual sign-in patterns.
Key points
- Audit logs from Serverless projects can be sent to an Observability or Security project in the same organization; Elastic says delivery is encrypted in transit and at rest.
- The logs cover Elasticsearch and Kibana project activity, including index, template, pipeline, and saved-object changes, data access, sign-ins, and denied requests.
- Eight alerting rules cover password guessing, password spraying, credential stuffing, sign-ins after repeated failures, impossible travel, new-country sign-ins, credentials used from multiple places, and first-seen identities.
- Seven dashboards support investigation, including views of saved-object changes, Elasticsearch data access, and sign-in activity.
- Ignore filters can drop selected event types before delivery, while ingestion and retention are billed on the destination project.
- The first-seen identity rule needs at least a day of audit-stream data before it can generate alerts.
Article Details
- Event Type
- Product feature general availability announcement
- Impact
- Elastic Cloud Serverless users can deliver project-level Elasticsearch and Kibana audit logs to an Observability or Security project in the same organization. The logs include alerting rules for credential-attack patterns and dashboards for investigating access, sign-ins, and changes. Ingest and retention are billed to the destination project.
Vendors
Products
Elastic Cloud ServerlessFree yourself from operations with Elastic Cloud Serverless. Scale automatically, handle load spikes, and focus on building—start a 14-day free trial to test it out yourself!Elastic Observability ServerlessCloud Serverless. This means you can ship the audit logs from any Serverless project into an Elastic Observability Serverless or Elastic Security Serverless project in the same organization. The logs include eightElastic Security Serverlessship the audit logs from any Serverless project into an Elastic Observability Serverless or Elastic Security Serverless project in the same organization. The logs include eight alerting rules and seven dashboardsElasticsearchcover saved object changes in Kibana, along with the space where each change happened, who read which Elasticsearch index, and who was denied. They also cover sign-ins and the credential behind each one. Five IgnoreKibanaThe logs include eight alerting rules and seven dashboards that cover saved object changes in Kibana, along with the space where each change happened, who read which Elasticsearch index, and who was denied.