[Write restricted dashboards] Audit events

[SiddharthMantri]

Closes #221755

Summary

Adds audit events on successful completion of changing object owner or access mode.

Detailed list of audit events on issue attached above.

Audit events added in this PR:

Audit Action	When Audited	Outcome	Bypass Conditions
UPDATE_OBJECTS_OWNER	• Failure: When access control enforcement fails • Success : When access control enforcement is granted	'failure'	No bypass for failure case
UPDATE_OBJECTS_ACCESS_MODE	• Failure: When access control enforcement fails • Success : When access control enforcement is granted	'failure'	No bypass for failure case

Logging scenarios

1. AccessControl is modified by owner

• Expected outcome: Auhorized
• Log example:

{"event":{"action":"saved_object_update_objects_access_mode","category":["database"],"type":["change"],"outcome":"success"},"kibana":{"space_id":"default","session_id":"ujNfHZISIOS99ANjQxxSAjxtY+D0D0/VnGBDDIJG5IE=","saved_object":{"type":"access_control_type","id":"bdceca5c-cd1e-442e-8272-55c632398cc7"}},"user":{"id":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","name":"elastic","roles":["superuser"]},"trace":{"id":"3df30168-353c-48ee-b0ee-bb671f40d9f4"},"client":{"ip":"127.0.0.1"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2025-10-29T17:26:38.099+01:00","message":"User has updated access mode of access_control_type [id=bdceca5c-cd1e-442e-8272-55c632398cc7]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":42523,"uptime":107.077655333},"span":{"id":"2bf159f3eed6e557"}}

2. AccessControl is modified by non-owner

• Expected outcome: Unauthorized
• Log example:

{"event":{"action":"saved_object_update_objects_access_mode","category":["database"],"type":["change"],"outcome":"failure"},"kibana":{"space_id":"default","session_id":"Mn8eOxtCD7MOGlCPR4tRdfDpsKNSTXzVfXIAmzFNNsc=","unauthorized_spaces":["default"],"unauthorized_types":["access_control_type"]},"error":{"code":"Error","message":"Unable to manage_access_control for types access_control_type"},"user":{"id":"u_EWATCHX9oIEsmcXj8aA1FkcaY3DE-XEpsiGTjrR2PmM_0","name":"test_user","roles":["editor"]},"trace":{"id":"c3497d4e-3a93-4d3b-8800-6062009f1b77"},"client":{"ip":"127.0.0.1"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2025-10-29T17:44:28.893+01:00","message":"Failed attempt to update access mode of saved objects","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":42523,"uptime":1177.897796208},"span":{"id":"912b67ee3b28dd14"}}

3. AccessControl is modified by admin on non-admin owned object

• Expected outcome: Authorized
• Logs:

{"event":{"action":"saved_object_update_objects_access_mode","category":["database"],"type":["change"],"outcome":"success"},"kibana":{"space_id":"default","session_id":"ujNfHZISIOS99ANjQxxSAjxtY+D0D0/VnGBDDIJG5IE=","saved_object":{"type":"access_control_type","id":"03eb9fcd-584b-4766-bfba-327a4f0f696c"}},"user":{"id":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","name":"elastic","roles":["superuser"]},"trace":{"id":"c6005951-24e4-4142-b13d-8bf101ca5468"},"client":{"ip":"127.0.0.1"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2025-10-29T18:09:28.253+01:00","message":"User has updated access mode of access_control_type [id=03eb9fcd-584b-4766-bfba-327a4f0f696c]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":61700,"uptime":596.898178917},"span":{"id":"b2b8a487b44915c8"}}

Steps to test using integration tests

You can use the existing integration tests for access control by adding the following to the config file at: x-pack/platform/test/spaces_api_integration/access_control_objects/config.ts

Config to add at kbnTestServer.serverArgs

...
'--xpack.security.audit.enabled=true',
'--xpack.security.audit.appender.type=file',
'--xpack.security.audit.appender.fileName=./kibana_audit.log',
 '--xpack.security.audit.appender.layout.type=json'

Once you run the tests as

no
de scripts/functional_tests_server --config x-pack/platform/test/spaces_api_integration/access_control_objects/config.ts

You can perform the tests as described here #224411 and verify the logs in kibana_audit.log file generated at the root level of your kibana repository.

[SiddharthMantri]

@elasticmachine merge upstream

[elena-shostak]

Verified locally, can confirm audit events are logged 🥇

{"event":{"action":"saved_object_update_objects_access_mode","category":["database"],"type":["change"],"outcome":"success"},"kibana":{"space_id":"default","session_id":"t7/G14FYLIcazDDDJJAZq1gxZWmDUEbwmcqPY5elTkw=","saved_object":{"type":"access_control_type","id":"dea18e44-35d0-4742-979d-80f648729f2d"}},"user":{"id":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","name":"elastic","roles":["superuser"]},"trace":{"id":"e7846a78-d1ae-4964-bac5-43481975047c"},"client":{"ip":"127.0.0.1"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2025-10-29T18:53:20.166+01:00","message":"User has updated access mode of access_control_type [id=dea18e44-35d0-4742-979d-80f648729f2d]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":60576,"uptime":1590.573061042},"span":{"id":"60e751cf7fdde50f"}}

---
{"event":{"action":"saved_object_update_objects_owner","category":["database"],"type":["change"],"outcome":"success"},"kibana":{"space_id":"default","session_id":"k5srR22XWFHSt/qBe6qLZ2b0aGT+ZRXUyPZhz9lfKSg=","saved_object":{"type":"access_control_type","id":"6c5fdbbb-38b8-4883-b72b-fe571672043c"}},"user":{"id":"u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0","name":"elastic","roles":["superuser"]},"trace":{"id":"f46e6d2f-94cd-4ede-9d9b-6cd8d190a26b"},"client":{"ip":"127.0.0.1"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"9.0.0"},"@timestamp":"2025-10-29T18:57:29.182+01:00","message":"User has updated owner of access_control_type [id=6c5fdbbb-38b8-4883-b72b-fe571672043c]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":60576,"uptime":1839.584627708},"span":{"id":"d0f06bcea572331b"}}

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: 03abf0c

Failed CI Steps

• FTR Configs #47
• FTR Configs #68
• Post-Build

Test Failures

• [job] [logs] FTR Configs #68 / Rules Management - Rule creation APIs @serverless @ess @serverlessQA create_rules @skipInServerless missing timestamps generates two signals with a "partial failure" status
• [job] [logs] FTR Configs #47 / serverless observability UI - ML and Discover discover/observabilitySolution/context_awareness extension getRecommendedFields data view mode should show recommended fields section for matching profile

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [a13cfa2]

History

• 💔 Build #356283 failed ddce10d
• 💔 Build #356131 failed d0f5e42