Package org.elasticsearch.xpack.security.audit

Interface AuditTrail

All Known Implementing Classes:

LoggingAuditTrail

public interface AuditTrail

Field Summary

Fields

Modifier and Type	Field	Description
static final String	X_FORWARDED_FOR_HEADER

Method Summary

Modifier and Type	Method	Description
void	accessDenied(String requestId, org.elasticsearch.xpack.core.security.authc.Authentication authentication, String action, org.elasticsearch.transport.TransportRequest transportRequest, org.elasticsearch.xpack.core.security.authz.AuthorizationEngine.AuthorizationInfo authorizationInfo)
void	accessGranted(String requestId, org.elasticsearch.xpack.core.security.authc.Authentication authentication, String action, org.elasticsearch.transport.TransportRequest transportRequest, org.elasticsearch.xpack.core.security.authz.AuthorizationEngine.AuthorizationInfo authorizationInfo)
void	anonymousAccessDenied(String requestId, String action, org.elasticsearch.transport.TransportRequest transportRequest)
void	anonymousAccessDenied(String requestId, org.elasticsearch.rest.RestRequest request)
void	authenticationFailed(String requestId, String action, org.elasticsearch.transport.TransportRequest transportRequest)
void	authenticationFailed(String requestId, String realm, org.elasticsearch.xpack.core.security.authc.AuthenticationToken token, String action, org.elasticsearch.transport.TransportRequest transportRequest)
void	authenticationFailed(String requestId, String realm, org.elasticsearch.xpack.core.security.authc.AuthenticationToken token, org.elasticsearch.rest.RestRequest request)
void	authenticationFailed(String requestId, org.elasticsearch.rest.RestRequest request)
void	authenticationFailed(String requestId, org.elasticsearch.xpack.core.security.authc.AuthenticationToken token, String action, org.elasticsearch.transport.TransportRequest transportRequest)
void	authenticationFailed(String requestId, org.elasticsearch.xpack.core.security.authc.AuthenticationToken token, org.elasticsearch.rest.RestRequest request)
void	authenticationSuccess(String requestId, org.elasticsearch.xpack.core.security.authc.Authentication authentication, String action, org.elasticsearch.transport.TransportRequest transportRequest)
void	authenticationSuccess(String requestId, org.elasticsearch.xpack.core.security.authc.Authentication authentication, org.elasticsearch.rest.RestRequest request)
void	connectionDenied(InetAddress inetAddress, String profile, SecurityIpFilterRule rule)
void	connectionGranted(InetAddress inetAddress, String profile, SecurityIpFilterRule rule)	The connectionGranted(InetAddress, String, SecurityIpFilterRule) and connectionDenied(InetAddress, String, SecurityIpFilterRule) methods do not have a requestId because they related to a potentially long-lived TCP connection, not a single request.
void	coordinatingActionResponse(String requestId, org.elasticsearch.xpack.core.security.authc.Authentication authentication, String action, org.elasticsearch.transport.TransportRequest transportRequest, org.elasticsearch.transport.TransportResponse transportResponse)
void	explicitIndexAccessEvent(String requestId, AuditLevel eventType, org.elasticsearch.xpack.core.security.authc.Authentication authentication, String action, String indices, String requestName, InetSocketAddress remoteAddress, org.elasticsearch.xpack.core.security.authz.AuthorizationEngine.AuthorizationInfo authorizationInfo)	This is a "workaround" method to log index "access_granted" and "access_denied" events for actions not tied to a TransportMessage, or when the connection is not 1:1, i.e.
String	name()
void	runAsDenied(String requestId, org.elasticsearch.xpack.core.security.authc.Authentication authentication, String action, org.elasticsearch.transport.TransportRequest transportRequest, org.elasticsearch.xpack.core.security.authz.AuthorizationEngine.AuthorizationInfo authorizationInfo)
void	runAsDenied(String requestId, org.elasticsearch.xpack.core.security.authc.Authentication authentication, org.elasticsearch.rest.RestRequest request, org.elasticsearch.xpack.core.security.authz.AuthorizationEngine.AuthorizationInfo authorizationInfo)
void	runAsGranted(String requestId, org.elasticsearch.xpack.core.security.authc.Authentication authentication, String action, org.elasticsearch.transport.TransportRequest transportRequest, org.elasticsearch.xpack.core.security.authz.AuthorizationEngine.AuthorizationInfo authorizationInfo)
void	tamperedRequest(String requestId, String action, org.elasticsearch.transport.TransportRequest transportRequest)
void	tamperedRequest(String requestId, org.elasticsearch.rest.RestRequest request)
void	tamperedRequest(String requestId, org.elasticsearch.xpack.core.security.authc.Authentication authentication, String action, org.elasticsearch.transport.TransportRequest transportRequest)

Field Details

X_FORWARDED_FOR_HEADER

static final String X_FORWARDED_FOR_HEADER

See Also:

• Constant Field Values

Method Details

name

String name()

authenticationSuccess

void authenticationSuccess(String requestId,
 org.elasticsearch.xpack.core.security.authc.Authentication authentication,
 org.elasticsearch.rest.RestRequest request)

authenticationSuccess

void authenticationSuccess(String requestId,
 org.elasticsearch.xpack.core.security.authc.Authentication authentication,
 String action,
 org.elasticsearch.transport.TransportRequest transportRequest)

anonymousAccessDenied

void anonymousAccessDenied(String requestId,
 String action,
 org.elasticsearch.transport.TransportRequest transportRequest)

anonymousAccessDenied

void anonymousAccessDenied(String requestId,
 org.elasticsearch.rest.RestRequest request)

authenticationFailed

void authenticationFailed(String requestId,
 org.elasticsearch.rest.RestRequest request)

authenticationFailed

void authenticationFailed(String requestId,
 String action,
 org.elasticsearch.transport.TransportRequest transportRequest)

authenticationFailed

void authenticationFailed(String requestId,
 org.elasticsearch.xpack.core.security.authc.AuthenticationToken token,
 String action,
 org.elasticsearch.transport.TransportRequest transportRequest)

authenticationFailed

void authenticationFailed(String requestId,
 org.elasticsearch.xpack.core.security.authc.AuthenticationToken token,
 org.elasticsearch.rest.RestRequest request)

authenticationFailed

void authenticationFailed(String requestId,
 String realm,
 org.elasticsearch.xpack.core.security.authc.AuthenticationToken token,
 String action,
 org.elasticsearch.transport.TransportRequest transportRequest)

authenticationFailed

void authenticationFailed(String requestId,
 String realm,
 org.elasticsearch.xpack.core.security.authc.AuthenticationToken token,
 org.elasticsearch.rest.RestRequest request)

accessGranted

void accessGranted(String requestId,
 org.elasticsearch.xpack.core.security.authc.Authentication authentication,
 String action,
 org.elasticsearch.transport.TransportRequest transportRequest,
 org.elasticsearch.xpack.core.security.authz.AuthorizationEngine.AuthorizationInfo authorizationInfo)

accessDenied

void accessDenied(String requestId,
 org.elasticsearch.xpack.core.security.authc.Authentication authentication,
 String action,
 org.elasticsearch.transport.TransportRequest transportRequest,
 org.elasticsearch.xpack.core.security.authz.AuthorizationEngine.AuthorizationInfo authorizationInfo)

tamperedRequest

void tamperedRequest(String requestId,
 org.elasticsearch.rest.RestRequest request)

tamperedRequest

void tamperedRequest(String requestId,
 String action,
 org.elasticsearch.transport.TransportRequest transportRequest)

tamperedRequest

void tamperedRequest(String requestId,
 org.elasticsearch.xpack.core.security.authc.Authentication authentication,
 String action,
 org.elasticsearch.transport.TransportRequest transportRequest)

connectionGranted

void connectionGranted(InetAddress inetAddress,
 String profile,
 SecurityIpFilterRule rule)

The connectionGranted(InetAddress, String, SecurityIpFilterRule) and connectionDenied(InetAddress, String, SecurityIpFilterRule) methods do not have a requestId because they related to a potentially long-lived TCP connection, not a single request. For both Transport and Rest connections, a single connection granted/denied event is generated even if that connection is used for multiple Elasticsearch actions (potentially as different users)

connectionDenied

void connectionDenied(InetAddress inetAddress,
 String profile,
 SecurityIpFilterRule rule)

runAsGranted

void runAsGranted(String requestId,
 org.elasticsearch.xpack.core.security.authc.Authentication authentication,
 String action,
 org.elasticsearch.transport.TransportRequest transportRequest,
 org.elasticsearch.xpack.core.security.authz.AuthorizationEngine.AuthorizationInfo authorizationInfo)

runAsDenied

void runAsDenied(String requestId,
 org.elasticsearch.xpack.core.security.authc.Authentication authentication,
 String action,
 org.elasticsearch.transport.TransportRequest transportRequest,
 org.elasticsearch.xpack.core.security.authz.AuthorizationEngine.AuthorizationInfo authorizationInfo)

runAsDenied

void runAsDenied(String requestId,
 org.elasticsearch.xpack.core.security.authc.Authentication authentication,
 org.elasticsearch.rest.RestRequest request,
 org.elasticsearch.xpack.core.security.authz.AuthorizationEngine.AuthorizationInfo authorizationInfo)

explicitIndexAccessEvent

void explicitIndexAccessEvent(String requestId,
 AuditLevel eventType,
 org.elasticsearch.xpack.core.security.authc.Authentication authentication,
 String action,
 String indices,
 String requestName,
 InetSocketAddress remoteAddress,
 org.elasticsearch.xpack.core.security.authz.AuthorizationEngine.AuthorizationInfo authorizationInfo)

This is a "workaround" method to log index "access_granted" and "access_denied" events for actions not tied to a TransportMessage, or when the connection is not 1:1, i.e. several audit events for an action associated with the same message. It is currently only used to audit the resolved index (alias) name for each BulkItemRequest comprised by a BulkShardRequest. We should strive to not use this and TODO refactor it out!

coordinatingActionResponse

void coordinatingActionResponse(String requestId,
 org.elasticsearch.xpack.core.security.authc.Authentication authentication,
 String action,
 org.elasticsearch.transport.TransportRequest transportRequest,
 org.elasticsearch.transport.TransportResponse transportResponse)