From 86a065d77cde7f9d6957f2e52806757311028d72 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Wed, 25 Sep 2024 21:06:47 +1000
Subject: [PATCH] [8.x] [ReaponseOps] Add name property to audit logs SO
 (#193323) (#193954)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[ReaponseOps] Add name property to audit logs SO
(#193323)](https://github.com/elastic/kibana/pull/193323)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT
[{"author":{"name":"Julia","email":"iuliia.guskova@elastic.co"},"sourceCommit":{"committedDate":"2024-09-25T09:34:55Z","message":"[ReaponseOps]
Add name property to audit logs SO (#193323)\n\nIssue:
https://github.com/elastic/enhancements/issues/19823\r\n\r\nSo the
purpose of this PR is to add a rule name to each audit log
in\r\nalerting API.\r\nPreviously if with a rule was done some action
(like create, delete,\r\netc.), the user could see it in an audit log.
But this log included only\r\nrule SO id, but not name. Users wanted to
see a rule name associated\r\nwith the audit log.\r\nSo here I added
it.\r\n\r\nThe principle I follow here to accelerate development (agreed
with\r\n@cnasikas): if it is easy (name easy to extract in the code
the\r\n`savedObject`) to pass it. If it is not do not.\r\n\r\n###
Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"45b4089371f5b7694fde7d08b6a7aaeb70c4a56e","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:ResponseOps","v9.0.0","backport:prev-minor","v8.16.0"],"title":"[ReaponseOps]
Add name property to audit logs
SO","number":193323,"url":"https://github.com/elastic/kibana/pull/193323","mergeCommit":{"message":"[ReaponseOps]
Add name property to audit logs SO (#193323)\n\nIssue:
https://github.com/elastic/enhancements/issues/19823\r\n\r\nSo the
purpose of this PR is to add a rule name to each audit log
in\r\nalerting API.\r\nPreviously if with a rule was done some action
(like create, delete,\r\netc.), the user could see it in an audit log.
But this log included only\r\nrule SO id, but not name. Users wanted to
see a rule name associated\r\nwith the audit log.\r\nSo here I added
it.\r\n\r\nThe principle I follow here to accelerate development (agreed
with\r\n@cnasikas): if it is easy (name easy to extract in the code
the\r\n`savedObject`) to pass it. If it is not do not.\r\n\r\n###
Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"45b4089371f5b7694fde7d08b6a7aaeb70c4a56e"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/193323","number":193323,"mergeCommit":{"message":"[ReaponseOps]
Add name property to audit logs SO (#193323)\n\nIssue:
https://github.com/elastic/enhancements/issues/19823\r\n\r\nSo the
purpose of this PR is to add a rule name to each audit log
in\r\nalerting API.\r\nPreviously if with a rule was done some action
(like create, delete,\r\netc.), the user could see it in an audit log.
But this log included only\r\nrule SO id, but not name. Users wanted to
see a rule name associated\r\nwith the audit log.\r\nSo here I added
it.\r\n\r\nThe principle I follow here to accelerate development (agreed
with\r\n@cnasikas): if it is easy (name easy to extract in the code
the\r\n`savedObject`) to pass it. If it is not do not.\r\n\r\n###
Checklist\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"45b4089371f5b7694fde7d08b6a7aaeb70c4a56e"}},{"branch":"8.x","label":"v8.16.0","branchLabelMappingKey":"^v8.16.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Julia <iuliia.guskova@elastic.co>
---
 .../methods/delete/delete_backfill.test.ts    |  26 +++--
 .../methods/delete/delete_backfill.ts         |   6 +-
 .../methods/find/find_backfill.test.ts        |  39 ++++---
 .../backfill/methods/get/get_backfill.test.ts |  26 +++--
 .../backfill/methods/get/get_backfill.ts      |   6 +-
 .../schedule/schedule_backfill.test.ts        |  13 ++-
 .../methods/schedule/schedule_backfill.ts     |   6 +-
 .../bulk_delete/bulk_delete_rules.test.ts     |   4 +-
 .../methods/bulk_delete/bulk_delete_rules.ts  |  11 +-
 .../bulk_disable/bulk_disable_rules.test.ts   |   4 +-
 .../bulk_disable/bulk_disable_rules.ts        |  15 ++-
 .../rule/methods/bulk_edit/bulk_edit_rules.ts |   1 +
 .../bulk_enable/bulk_enable_rules.test.ts     |   4 +-
 .../methods/bulk_enable/bulk_enable_rules.ts  |  19 +++-
 .../rule/methods/clone/clone_rule.ts          |   4 +-
 .../rule/methods/create/create_rule.test.ts   |   5 +-
 .../rule/methods/create/create_rule.ts        |   2 +-
 .../rule/methods/delete/delete_rule.test.ts   |   6 +-
 .../rule/methods/delete/delete_rule.ts        |   4 +-
 .../rule/methods/disable/disable_rule.test.ts |  14 ++-
 .../rule/methods/disable/disable_rule.ts      |   4 +-
 .../methods/enable_rule/enable_rule.test.ts   |   3 +-
 .../rule/methods/enable_rule/enable_rule.ts   |   4 +-
 .../rule/methods/find/find_rules.test.ts      |   6 +-
 .../rule/methods/find/find_rules.ts           |   6 +-
 .../rule/methods/get/get_rule.test.ts         |   4 +-
 .../application/rule/methods/get/get_rule.ts  |   4 +-
 .../rule/methods/mute_alert/mute_instance.ts  |   4 +-
 .../rule/methods/resolve/resolve_rule.ts      |   4 +-
 .../rule/methods/snooze/snooze_rule.ts        |   4 +-
 .../unmute_alert/unmute_instance.test.ts      |   7 +-
 .../methods/unmute_alert/unmute_instance.ts   |   4 +-
 .../rule/methods/unsnooze/unsnooze_rule.ts    |   4 +-
 .../rule/methods/update/update_rule.test.ts   |   7 +-
 .../rule/methods/update/update_rule.ts        |   4 +-
 .../update_rule_api_key.test.ts               |  12 ++-
 .../update_api_key/update_rule_api_key.ts     |   4 +-
 .../rules_client/common/audit_events.test.ts  | 102 ++++++++++++++++--
 .../rules_client/common/audit_events.ts       |  14 ++-
 .../lib/check_authorization_and_get_total.ts  |   2 +-
 .../lib/create_rule_saved_object.ts           |   2 +-
 .../methods/get_action_error_log.ts           |   4 +-
 .../rules_client/methods/get_execution_kpi.ts |   4 +-
 .../rules_client/methods/get_execution_log.ts |   4 +-
 .../server/rules_client/methods/mute_all.ts   |   4 +-
 .../server/rules_client/methods/run_soon.ts   |   4 +-
 .../server/rules_client/methods/unmute_all.ts |   4 +-
 .../tests/get_action_error_log.test.ts        |   3 +-
 .../tests/get_execution_log.test.ts           |   3 +-
 .../rules_client/tests/mute_all.test.ts       |   7 +-
 .../rules_client/tests/run_soon.test.ts       |   3 +-
 .../rules_client/tests/unmute_all.test.ts     |   7 +-
 52 files changed, 344 insertions(+), 123 deletions(-)

diff --git a/x-pack/plugins/alerting/server/application/backfill/methods/delete/delete_backfill.test.ts b/x-pack/plugins/alerting/server/application/backfill/methods/delete/delete_backfill.test.ts
index 4a2ac84515fe9e..b0879613d069f1 100644
--- a/x-pack/plugins/alerting/server/application/backfill/methods/delete/delete_backfill.test.ts
+++ b/x-pack/plugins/alerting/server/application/backfill/methods/delete/delete_backfill.test.ts
@@ -70,6 +70,8 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   uiSettings: uiSettingsServiceMock.createStartContract(),
 };
 
+const fakeRuleName = 'fakeRuleName';
+
 const mockAdHocRunSO: SavedObject<AdHocRunSO> = {
   id: '1',
   type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
@@ -80,7 +82,7 @@ const mockAdHocRunSO: SavedObject<AdHocRunSO> = {
     duration: '12h',
     enabled: true,
     rule: {
-      name: 'my rule name',
+      name: fakeRuleName,
       tags: ['foo'],
       alertTypeId: 'myType',
       // @ts-expect-error
@@ -149,10 +151,11 @@ describe('deleteBackfill()', () => {
         saved_object: {
           id: '1',
           type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
-          name: `backfill for rule "my rule name"`,
+          name: 'backfill for rule "fakeRuleName"',
         },
       },
-      message: 'User is deleting ad hoc run for ad_hoc_run_params [id=1]',
+      message:
+        'User is deleting ad hoc run for ad_hoc_run_params [id=1] backfill for rule "fakeRuleName"',
     });
     expect(unsecuredSavedObjectsClient.delete).toHaveBeenLastCalledWith(
       AD_HOC_RUN_SAVED_OBJECT_TYPE,
@@ -212,10 +215,11 @@ describe('deleteBackfill()', () => {
           saved_object: {
             id: '1',
             type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
-            name: `backfill for rule "my rule name"`,
+            name: 'backfill for rule "fakeRuleName"',
           },
         },
-        message: 'Failed attempt to delete ad hoc run for ad_hoc_run_params [id=1]',
+        message:
+          'Failed attempt to delete ad hoc run for ad_hoc_run_params [id=1] backfill for rule "fakeRuleName"',
       });
     });
 
@@ -229,6 +233,7 @@ describe('deleteBackfill()', () => {
           message: 'Unable to get',
           statusCode: 404,
         },
+        attributes: { rule: { name: fakeRuleName } },
       });
 
       await expect(rulesClient.deleteBackfill('1')).rejects.toThrowErrorMatchingInlineSnapshot(
@@ -246,8 +251,15 @@ describe('deleteBackfill()', () => {
           outcome: 'failure',
           type: ['deletion'],
         },
-        kibana: { saved_object: { id: '1', type: AD_HOC_RUN_SAVED_OBJECT_TYPE } },
-        message: 'Failed attempt to delete ad hoc run for ad_hoc_run_params [id=1]',
+        kibana: {
+          saved_object: {
+            id: '1',
+            type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
+            name: 'backfill for rule "fakeRuleName"',
+          },
+        },
+        message:
+          'Failed attempt to delete ad hoc run for ad_hoc_run_params [id=1] backfill for rule "fakeRuleName"',
       });
     });
 
diff --git a/x-pack/plugins/alerting/server/application/backfill/methods/delete/delete_backfill.ts b/x-pack/plugins/alerting/server/application/backfill/methods/delete/delete_backfill.ts
index 3d4d0a03f44dd5..d223f944305c7f 100644
--- a/x-pack/plugins/alerting/server/application/backfill/methods/delete/delete_backfill.ts
+++ b/x-pack/plugins/alerting/server/application/backfill/methods/delete/delete_backfill.ts
@@ -37,7 +37,11 @@ async function deleteWithOCC(context: RulesClientContext, { id }: { id: string }
       context.auditLogger?.log(
         adHocRunAuditEvent({
           action: AdHocRunAuditAction.DELETE,
-          savedObject: { type: AD_HOC_RUN_SAVED_OBJECT_TYPE, id },
+          savedObject: {
+            type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
+            id,
+            name: `backfill for rule "${result.attributes.rule.name}"`,
+          },
           error: new Error(result.error.message),
         })
       );
diff --git a/x-pack/plugins/alerting/server/application/backfill/methods/find/find_backfill.test.ts b/x-pack/plugins/alerting/server/application/backfill/methods/find/find_backfill.test.ts
index e7d4ab36449100..dab9d5f38f036e 100644
--- a/x-pack/plugins/alerting/server/application/backfill/methods/find/find_backfill.test.ts
+++ b/x-pack/plugins/alerting/server/application/backfill/methods/find/find_backfill.test.ts
@@ -171,6 +171,8 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   uiSettings: uiSettingsServiceMock.createStartContract(),
 };
 
+const fakeRuleName = 'fakeRuleName';
+
 const mockAdHocRunSO: SavedObject<AdHocRunSO> = {
   id: '1',
   type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
@@ -181,7 +183,7 @@ const mockAdHocRunSO: SavedObject<AdHocRunSO> = {
     duration: '12h',
     enabled: true,
     rule: {
-      name: 'my rule name',
+      name: fakeRuleName,
       tags: ['foo'],
       alertTypeId: 'myType',
       // @ts-expect-error
@@ -266,10 +268,11 @@ describe('findBackfill()', () => {
         saved_object: {
           id: '1',
           type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
-          name: `backfill for rule "my rule name"`,
+          name: 'backfill for rule "fakeRuleName"',
         },
       },
-      message: 'User has found ad hoc run for ad_hoc_run_params [id=1]',
+      message:
+        'User has found ad hoc run for ad_hoc_run_params [id=1] backfill for rule "fakeRuleName"',
     });
 
     expect(result).toEqual({
@@ -311,10 +314,11 @@ describe('findBackfill()', () => {
         saved_object: {
           id: '1',
           type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
-          name: `backfill for rule "my rule name"`,
+          name: 'backfill for rule "fakeRuleName"',
         },
       },
-      message: 'User has found ad hoc run for ad_hoc_run_params [id=1]',
+      message:
+        'User has found ad hoc run for ad_hoc_run_params [id=1] backfill for rule "fakeRuleName"',
     });
 
     expect(result).toEqual({
@@ -374,10 +378,11 @@ describe('findBackfill()', () => {
         saved_object: {
           id: '1',
           type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
-          name: `backfill for rule "my rule name"`,
+          name: 'backfill for rule "fakeRuleName"',
         },
       },
-      message: 'User has found ad hoc run for ad_hoc_run_params [id=1]',
+      message:
+        'User has found ad hoc run for ad_hoc_run_params [id=1] backfill for rule "fakeRuleName"',
     });
 
     expect(result).toEqual({
@@ -437,10 +442,11 @@ describe('findBackfill()', () => {
         saved_object: {
           id: '1',
           type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
-          name: `backfill for rule "my rule name"`,
+          name: 'backfill for rule "fakeRuleName"',
         },
       },
-      message: 'User has found ad hoc run for ad_hoc_run_params [id=1]',
+      message:
+        'User has found ad hoc run for ad_hoc_run_params [id=1] backfill for rule "fakeRuleName"',
     });
 
     expect(result).toEqual({
@@ -516,10 +522,11 @@ describe('findBackfill()', () => {
         saved_object: {
           id: '1',
           type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
-          name: `backfill for rule "my rule name"`,
+          name: 'backfill for rule "fakeRuleName"',
         },
       },
-      message: 'User has found ad hoc run for ad_hoc_run_params [id=1]',
+      message:
+        'User has found ad hoc run for ad_hoc_run_params [id=1] backfill for rule "fakeRuleName"',
     });
 
     expect(result).toEqual({
@@ -597,10 +604,11 @@ describe('findBackfill()', () => {
         saved_object: {
           id: '1',
           type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
-          name: `backfill for rule "my rule name"`,
+          name: 'backfill for rule "fakeRuleName"',
         },
       },
-      message: 'User has found ad hoc run for ad_hoc_run_params [id=1]',
+      message:
+        'User has found ad hoc run for ad_hoc_run_params [id=1] backfill for rule "fakeRuleName"',
     });
 
     expect(result).toEqual({
@@ -648,10 +656,11 @@ describe('findBackfill()', () => {
         saved_object: {
           id: '1',
           type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
-          name: `backfill for rule "my rule name"`,
+          name: 'backfill for rule "fakeRuleName"',
         },
       },
-      message: 'User has found ad hoc run for ad_hoc_run_params [id=1]',
+      message:
+        'User has found ad hoc run for ad_hoc_run_params [id=1] backfill for rule "fakeRuleName"',
     });
 
     expect(result).toEqual({
diff --git a/x-pack/plugins/alerting/server/application/backfill/methods/get/get_backfill.test.ts b/x-pack/plugins/alerting/server/application/backfill/methods/get/get_backfill.test.ts
index 952809acaa7201..cbf516bfd446e1 100644
--- a/x-pack/plugins/alerting/server/application/backfill/methods/get/get_backfill.test.ts
+++ b/x-pack/plugins/alerting/server/application/backfill/methods/get/get_backfill.test.ts
@@ -70,6 +70,8 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   uiSettings: uiSettingsServiceMock.createStartContract(),
 };
 
+const fakeRuleName = 'fakeRuleName';
+
 const mockAdHocRunSO: SavedObject<AdHocRunSO> = {
   id: '1',
   type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
@@ -80,7 +82,7 @@ const mockAdHocRunSO: SavedObject<AdHocRunSO> = {
     duration: '12h',
     enabled: true,
     rule: {
-      name: 'my rule name',
+      name: fakeRuleName,
       tags: ['foo'],
       alertTypeId: 'myType',
       // @ts-expect-error
@@ -148,10 +150,11 @@ describe('getBackfill()', () => {
         saved_object: {
           id: '1',
           type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
-          name: `backfill for rule "my rule name"`,
+          name: `backfill for rule "fakeRuleName"`,
         },
       },
-      message: 'User has got ad hoc run for ad_hoc_run_params [id=1]',
+      message:
+        'User has got ad hoc run for ad_hoc_run_params [id=1] backfill for rule "fakeRuleName"',
     });
     expect(logger.error).not.toHaveBeenCalled();
 
@@ -194,10 +197,11 @@ describe('getBackfill()', () => {
           saved_object: {
             id: '1',
             type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
-            name: `backfill for rule "my rule name"`,
+            name: 'backfill for rule "fakeRuleName"',
           },
         },
-        message: 'Failed attempt to get ad hoc run for ad_hoc_run_params [id=1]',
+        message:
+          'Failed attempt to get ad hoc run for ad_hoc_run_params [id=1] backfill for rule "fakeRuleName"',
       });
     });
 
@@ -211,6 +215,7 @@ describe('getBackfill()', () => {
           message: 'Unable to get',
           statusCode: 404,
         },
+        attributes: { rule: { name: fakeRuleName } },
       });
 
       await expect(rulesClient.getBackfill('1')).rejects.toThrowErrorMatchingInlineSnapshot(
@@ -228,8 +233,15 @@ describe('getBackfill()', () => {
           outcome: 'failure',
           type: ['access'],
         },
-        kibana: { saved_object: { id: '1', type: AD_HOC_RUN_SAVED_OBJECT_TYPE } },
-        message: 'Failed attempt to get ad hoc run for ad_hoc_run_params [id=1]',
+        kibana: {
+          saved_object: {
+            id: '1',
+            type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
+            name: 'backfill for rule "fakeRuleName"',
+          },
+        },
+        message:
+          'Failed attempt to get ad hoc run for ad_hoc_run_params [id=1] backfill for rule "fakeRuleName"',
       });
     });
   });
diff --git a/x-pack/plugins/alerting/server/application/backfill/methods/get/get_backfill.ts b/x-pack/plugins/alerting/server/application/backfill/methods/get/get_backfill.ts
index 75116ac0b3d2d6..6f14dba88684c9 100644
--- a/x-pack/plugins/alerting/server/application/backfill/methods/get/get_backfill.ts
+++ b/x-pack/plugins/alerting/server/application/backfill/methods/get/get_backfill.ts
@@ -30,7 +30,11 @@ export async function getBackfill(context: RulesClientContext, id: string): Prom
       context.auditLogger?.log(
         adHocRunAuditEvent({
           action: AdHocRunAuditAction.GET,
-          savedObject: { type: AD_HOC_RUN_SAVED_OBJECT_TYPE, id },
+          savedObject: {
+            type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
+            id,
+            name: `backfill for rule "${result.attributes.rule.name}"`,
+          },
           error: new Error(result.error.message),
         })
       );
diff --git a/x-pack/plugins/alerting/server/application/backfill/methods/schedule/schedule_backfill.test.ts b/x-pack/plugins/alerting/server/application/backfill/methods/schedule/schedule_backfill.test.ts
index 7edcb26b9718e7..b8f1e5af9c869b 100644
--- a/x-pack/plugins/alerting/server/application/backfill/methods/schedule/schedule_backfill.test.ts
+++ b/x-pack/plugins/alerting/server/application/backfill/methods/schedule/schedule_backfill.test.ts
@@ -73,6 +73,8 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   uiSettings: uiSettingsServiceMock.createStartContract(),
 };
 
+const fakeRuleName = 'fakeRuleName';
+
 const existingRule = {
   id: '1',
   type: RULE_SAVED_OBJECT_TYPE,
@@ -99,7 +101,7 @@ const existingRule = {
     notifyWhen: null,
     actions: [],
     systemActions: [],
-    name: 'my rule name',
+    name: fakeRuleName,
     revision: 0,
   },
   references: [],
@@ -382,8 +384,8 @@ describe('scheduleBackfill()', () => {
         outcome: 'success',
         type: ['access'],
       },
-      kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE } },
-      message: 'User has scheduled backfill for rule [id=1]',
+      kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE, name: 'fakeRuleName' } },
+      message: 'User has scheduled backfill for rule [id=1] [name=fakeRuleName]',
     });
     expect(auditLogger.log).toHaveBeenNthCalledWith(2, {
       event: {
@@ -392,8 +394,8 @@ describe('scheduleBackfill()', () => {
         outcome: 'success',
         type: ['access'],
       },
-      kibana: { saved_object: { id: '2', type: RULE_SAVED_OBJECT_TYPE } },
-      message: 'User has scheduled backfill for rule [id=2]',
+      kibana: { saved_object: { id: '2', type: RULE_SAVED_OBJECT_TYPE, name: 'fakeRuleName' } },
+      message: 'User has scheduled backfill for rule [id=2] [name=fakeRuleName]',
     });
 
     expect(backfillClient.bulkQueue).toHaveBeenCalledWith({
@@ -578,6 +580,7 @@ describe('scheduleBackfill()', () => {
       await expect(
         rulesClient.scheduleBackfill(mockData)
       ).rejects.toThrowErrorMatchingInlineSnapshot(`"Unauthorized"`);
+
       expect(auditLogger?.log).toHaveBeenCalledWith({
         error: { code: 'Error', message: 'Unauthorized' },
         event: {
diff --git a/x-pack/plugins/alerting/server/application/backfill/methods/schedule/schedule_backfill.ts b/x-pack/plugins/alerting/server/application/backfill/methods/schedule/schedule_backfill.ts
index 9ff777f0108c66..d755463e9bc3ef 100644
--- a/x-pack/plugins/alerting/server/application/backfill/methods/schedule/schedule_backfill.ts
+++ b/x-pack/plugins/alerting/server/application/backfill/methods/schedule/schedule_backfill.ts
@@ -131,7 +131,11 @@ export async function scheduleBackfill(
       context.auditLogger?.log(
         ruleAuditEvent({
           action: RuleAuditAction.SCHEDULE_BACKFILL,
-          savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: rule.id },
+          savedObject: {
+            type: RULE_SAVED_OBJECT_TYPE,
+            id: rule.id,
+            name: rule.attributes.name,
+          },
         })
       );
     }
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/bulk_delete/bulk_delete_rules.test.ts b/x-pack/plugins/alerting/server/application/rule/methods/bulk_delete/bulk_delete_rules.test.ts
index b72ace206ed682..366b98fc31714d 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/bulk_delete/bulk_delete_rules.test.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/bulk_delete/bulk_delete_rules.test.ts
@@ -595,12 +595,12 @@ describe('bulkDelete', () => {
       expect(auditLogger.log.mock.calls[0][0]?.event?.action).toEqual('rule_delete');
       expect(auditLogger.log.mock.calls[0][0]?.event?.outcome).toEqual('unknown');
       expect(auditLogger.log.mock.calls[0][0]?.kibana).toEqual({
-        saved_object: { id: 'id1', type: RULE_SAVED_OBJECT_TYPE },
+        saved_object: { id: 'id1', type: RULE_SAVED_OBJECT_TYPE, name: 'fakeName' },
       });
       expect(auditLogger.log.mock.calls[1][0]?.event?.action).toEqual('rule_delete');
       expect(auditLogger.log.mock.calls[1][0]?.event?.outcome).toEqual('unknown');
       expect(auditLogger.log.mock.calls[1][0]?.kibana).toEqual({
-        saved_object: { id: 'id2', type: RULE_SAVED_OBJECT_TYPE },
+        saved_object: { id: 'id2', type: RULE_SAVED_OBJECT_TYPE, name: 'fakeName' },
       });
     });
 
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/bulk_delete/bulk_delete_rules.ts b/x-pack/plugins/alerting/server/application/rule/methods/bulk_delete/bulk_delete_rules.ts
index ab916c5f4e943a..d2d5b47a893f33 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/bulk_delete/bulk_delete_rules.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/bulk_delete/bulk_delete_rules.ts
@@ -167,8 +167,9 @@ const bulkDeleteWithOCC = async (
           if (rule.attributes.apiKey && !rule.attributes.apiKeyCreatedByUser) {
             apiKeyToRuleIdMapping[rule.id] = rule.attributes.apiKey;
           }
-          if (rule.attributes.name) {
-            ruleNameToRuleIdMapping[rule.id] = rule.attributes.name;
+          const ruleName = rule.attributes.name;
+          if (ruleName) {
+            ruleNameToRuleIdMapping[rule.id] = ruleName;
           }
           if (rule.attributes.scheduledTaskId) {
             taskIdToRuleIdMapping[rule.id] = rule.attributes.scheduledTaskId;
@@ -179,7 +180,11 @@ const bulkDeleteWithOCC = async (
             ruleAuditEvent({
               action: RuleAuditAction.DELETE,
               outcome: 'unknown',
-              savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: rule.id },
+              savedObject: {
+                type: RULE_SAVED_OBJECT_TYPE,
+                id: rule.id,
+                name: ruleName,
+              },
             })
           );
         }
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/bulk_disable/bulk_disable_rules.test.ts b/x-pack/plugins/alerting/server/application/rule/methods/bulk_disable/bulk_disable_rules.test.ts
index bfee8a94d6dd6d..949bf35361dc09 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/bulk_disable/bulk_disable_rules.test.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/bulk_disable/bulk_disable_rules.test.ts
@@ -740,12 +740,12 @@ describe('bulkDisableRules', () => {
       expect(auditLogger.log.mock.calls[0][0]?.event?.action).toEqual('rule_disable');
       expect(auditLogger.log.mock.calls[0][0]?.event?.outcome).toEqual('unknown');
       expect(auditLogger.log.mock.calls[0][0]?.kibana).toEqual({
-        saved_object: { id: 'id1', type: RULE_SAVED_OBJECT_TYPE },
+        saved_object: { id: 'id1', type: RULE_SAVED_OBJECT_TYPE, name: 'fakeName' },
       });
       expect(auditLogger.log.mock.calls[1][0]?.event?.action).toEqual('rule_disable');
       expect(auditLogger.log.mock.calls[1][0]?.event?.outcome).toEqual('unknown');
       expect(auditLogger.log.mock.calls[1][0]?.kibana).toEqual({
-        saved_object: { id: 'id2', type: RULE_SAVED_OBJECT_TYPE },
+        saved_object: { id: 'id2', type: RULE_SAVED_OBJECT_TYPE, name: 'fakeName' },
       });
     });
 
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/bulk_disable/bulk_disable_rules.ts b/x-pack/plugins/alerting/server/application/rule/methods/bulk_disable/bulk_disable_rules.ts
index 78dc98cbbe84ae..11f1d43b02b429 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/bulk_disable/bulk_disable_rules.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/bulk_disable/bulk_disable_rules.ts
@@ -159,13 +159,15 @@ const bulkDisableRulesWithOCC = async (
     async () => {
       for await (const response of rulesFinder.find()) {
         await pMap(response.saved_objects, async (rule) => {
+          const ruleName = rule.attributes.name;
+
           try {
             if (untrack) {
               await untrackRuleAlerts(context, rule.id, rule.attributes);
             }
 
-            if (rule.attributes.name) {
-              ruleNameToRuleIdMapping[rule.id] = rule.attributes.name;
+            if (ruleName) {
+              ruleNameToRuleIdMapping[rule.id] = ruleName;
             }
 
             // migrate legacy actions only for SIEM rules
@@ -212,7 +214,7 @@ const bulkDisableRulesWithOCC = async (
               ruleAuditEvent({
                 action: RuleAuditAction.DISABLE,
                 outcome: 'unknown',
-                savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: rule.id },
+                savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: rule.id, name: ruleName },
               })
             );
           } catch (error) {
@@ -220,12 +222,17 @@ const bulkDisableRulesWithOCC = async (
               message: error.message,
               rule: {
                 id: rule.id,
-                name: rule.attributes?.name,
+                name: ruleName,
               },
             });
             context.auditLogger?.log(
               ruleAuditEvent({
                 action: RuleAuditAction.DISABLE,
+                savedObject: {
+                  type: RULE_SAVED_OBJECT_TYPE,
+                  id: rule.id,
+                  name: ruleName,
+                },
                 error,
               })
             );
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/bulk_edit/bulk_edit_rules.ts b/x-pack/plugins/alerting/server/application/rule/methods/bulk_edit/bulk_edit_rules.ts
index 81dd189116949c..a9a060b99664db 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/bulk_edit/bulk_edit_rules.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/bulk_edit/bulk_edit_rules.ts
@@ -595,6 +595,7 @@ async function updateRuleAttributesAndParamsInMemory<Params extends RuleParams>(
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.BULK_EDIT,
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: rule.id, name: rule.attributes?.name },
         error,
       })
     );
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/bulk_enable/bulk_enable_rules.test.ts b/x-pack/plugins/alerting/server/application/rule/methods/bulk_enable/bulk_enable_rules.test.ts
index 78151461285227..7138c2cb3a3186 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/bulk_enable/bulk_enable_rules.test.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/bulk_enable/bulk_enable_rules.test.ts
@@ -839,12 +839,12 @@ describe('bulkEnableRules', () => {
       expect(auditLogger.log.mock.calls[0][0]?.event?.action).toEqual('rule_enable');
       expect(auditLogger.log.mock.calls[0][0]?.event?.outcome).toEqual('unknown');
       expect(auditLogger.log.mock.calls[0][0]?.kibana).toEqual({
-        saved_object: { id: 'id1', type: RULE_SAVED_OBJECT_TYPE },
+        saved_object: { id: 'id1', type: RULE_SAVED_OBJECT_TYPE, name: 'fakeName' },
       });
       expect(auditLogger.log.mock.calls[1][0]?.event?.action).toEqual('rule_enable');
       expect(auditLogger.log.mock.calls[1][0]?.event?.outcome).toEqual('unknown');
       expect(auditLogger.log.mock.calls[1][0]?.kibana).toEqual({
-        saved_object: { id: 'id2', type: RULE_SAVED_OBJECT_TYPE },
+        saved_object: { id: 'id2', type: RULE_SAVED_OBJECT_TYPE, name: 'fakeName' },
       });
     });
 
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/bulk_enable/bulk_enable_rules.ts b/x-pack/plugins/alerting/server/application/rule/methods/bulk_enable/bulk_enable_rules.ts
index 0bf346006e4f8d..ff1852d8a4d4db 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/bulk_enable/bulk_enable_rules.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/bulk_enable/bulk_enable_rules.ts
@@ -204,6 +204,8 @@ const bulkEnableRulesWithOCC = async (
       await pMap(
         rulesFinderRules,
         async (rule) => {
+          const ruleName = rule.attributes.name;
+
           try {
             if (scheduleValidationError) {
               throw Error(scheduleValidationError);
@@ -215,8 +217,8 @@ const bulkEnableRulesWithOCC = async (
                 throw Error(`Rule not authorized for bulk enable - ${error.message}`);
               }
             }
-            if (rule.attributes.name) {
-              ruleNameToRuleIdMapping[rule.id] = rule.attributes.name;
+            if (ruleName) {
+              ruleNameToRuleIdMapping[rule.id] = ruleName;
             }
 
             // TODO (http-versioning) Remove RawRuleAction and RawRule casts
@@ -232,7 +234,7 @@ const bulkEnableRulesWithOCC = async (
               ...(!rule.attributes.apiKey &&
                 (await createNewAPIKeySet(context, {
                   id: rule.attributes.alertTypeId,
-                  ruleName: rule.attributes.name,
+                  ruleName,
                   username,
                   shouldUpdateApiKey: true,
                 }))),
@@ -293,7 +295,11 @@ const bulkEnableRulesWithOCC = async (
               ruleAuditEvent({
                 action: RuleAuditAction.ENABLE,
                 outcome: 'unknown',
-                savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: rule.id },
+                savedObject: {
+                  type: RULE_SAVED_OBJECT_TYPE,
+                  id: rule.id,
+                  name: ruleName,
+                },
               })
             );
           } catch (error) {
@@ -307,6 +313,11 @@ const bulkEnableRulesWithOCC = async (
             context.auditLogger?.log(
               ruleAuditEvent({
                 action: RuleAuditAction.ENABLE,
+                savedObject: {
+                  type: RULE_SAVED_OBJECT_TYPE,
+                  id: rule.id,
+                  name: ruleName,
+                },
                 error,
               })
             );
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/clone/clone_rule.ts b/x-pack/plugins/alerting/server/application/rule/methods/clone/clone_rule.ts
index bb095103f937d4..4f83f5b8daa9ce 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/clone/clone_rule.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/clone/clone_rule.ts
@@ -104,7 +104,7 @@ export async function cloneRule<Params extends RuleParams = never>(
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.CREATE,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: ruleName },
         error,
       })
     );
@@ -152,7 +152,7 @@ export async function cloneRule<Params extends RuleParams = never>(
     ruleAuditEvent({
       action: RuleAuditAction.CREATE,
       outcome: 'unknown',
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: ruleName },
     })
   );
 
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/create/create_rule.test.ts b/x-pack/plugins/alerting/server/application/rule/methods/create/create_rule.test.ts
index 9ace9c2d8f491d..fa38c66f3b050f 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/create/create_rule.test.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/create/create_rule.test.ts
@@ -302,7 +302,9 @@ describe('create()', () => {
             action: 'rule_create',
             outcome: 'unknown',
           }),
-          kibana: { saved_object: { id: 'mock-saved-object-id', type: RULE_SAVED_OBJECT_TYPE } },
+          kibana: {
+            saved_object: { id: 'mock-saved-object-id', type: RULE_SAVED_OBJECT_TYPE, name: 'abc' },
+          },
         })
       );
     });
@@ -328,6 +330,7 @@ describe('create()', () => {
             saved_object: {
               id: 'mock-saved-object-id',
               type: RULE_SAVED_OBJECT_TYPE,
+              name: 'abc',
             },
           },
           error: {
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/create/create_rule.ts b/x-pack/plugins/alerting/server/application/rule/methods/create/create_rule.ts
index d1b41de9219523..555429d117a308 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/create/create_rule.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/create/create_rule.ts
@@ -110,7 +110,7 @@ export async function createRule<Params extends RuleParams = never>(
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.CREATE,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: data.name },
         error,
       })
     );
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/delete/delete_rule.test.ts b/x-pack/plugins/alerting/server/application/rule/methods/delete/delete_rule.test.ts
index caf61d8901d0d1..7491df9d3df196 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/delete/delete_rule.test.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/delete/delete_rule.test.ts
@@ -89,12 +89,15 @@ beforeEach(() => {
   (auditLogger.log as jest.Mock).mockClear();
 });
 
+const fakeRuleName = 'fakeRuleName';
+
 describe('delete()', () => {
   let rulesClient: RulesClient;
   const existingAlert = {
     id: '1',
     type: RULE_SAVED_OBJECT_TYPE,
     attributes: {
+      name: fakeRuleName,
       alertTypeId: 'myType',
       consumer: 'myApp',
       schedule: { interval: '10s' },
@@ -341,7 +344,7 @@ describe('delete()', () => {
             action: 'rule_delete',
             outcome: 'unknown',
           }),
-          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE } },
+          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE, name: fakeRuleName } },
         })
       );
     });
@@ -360,6 +363,7 @@ describe('delete()', () => {
             saved_object: {
               id: '1',
               type: RULE_SAVED_OBJECT_TYPE,
+              name: fakeRuleName,
             },
           },
           error: {
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/delete/delete_rule.ts b/x-pack/plugins/alerting/server/application/rule/methods/delete/delete_rule.ts
index 4f0c7810486fe9..b738bafb3d6905 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/delete/delete_rule.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/delete/delete_rule.ts
@@ -80,7 +80,7 @@ async function deleteRuleWithOCC(context: RulesClientContext, { id }: { id: stri
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.DELETE,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
         error,
       })
     );
@@ -104,7 +104,7 @@ async function deleteRuleWithOCC(context: RulesClientContext, { id }: { id: stri
     ruleAuditEvent({
       action: RuleAuditAction.DELETE,
       outcome: 'unknown',
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
     })
   );
   const removeResult = await deleteRuleSo({
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/disable/disable_rule.test.ts b/x-pack/plugins/alerting/server/application/rule/methods/disable/disable_rule.test.ts
index 85e979b183cb41..62608ed8271dae 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/disable/disable_rule.test.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/disable/disable_rule.test.ts
@@ -85,6 +85,8 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   isSystemAction: jest.fn(),
 };
 
+const fakeRuleName = 'fakeRuleName';
+
 beforeEach(() => {
   getBeforeSetup(rulesClientParams, taskManager, ruleTypeRegistry);
   taskManager.get.mockResolvedValue({
@@ -113,6 +115,7 @@ describe('disableRule()', () => {
     id: '1',
     type: RULE_SAVED_OBJECT_TYPE,
     attributes: {
+      name: fakeRuleName,
       consumer: 'myApp',
       schedule: { interval: '10s' },
       alertTypeId: 'myType',
@@ -195,7 +198,7 @@ describe('disableRule()', () => {
             action: 'rule_disable',
             outcome: 'unknown',
           }),
-          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE } },
+          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE, name: fakeRuleName } },
         })
       );
     });
@@ -214,6 +217,7 @@ describe('disableRule()', () => {
             saved_object: {
               id: '1',
               type: RULE_SAVED_OBJECT_TYPE,
+              name: fakeRuleName,
             },
           },
           error: {
@@ -239,6 +243,7 @@ describe('disableRule()', () => {
       RULE_SAVED_OBJECT_TYPE,
       '1',
       {
+        name: fakeRuleName,
         consumer: 'myApp',
         schedule: { interval: '10s' },
         alertTypeId: 'myType',
@@ -317,6 +322,7 @@ describe('disableRule()', () => {
       RULE_SAVED_OBJECT_TYPE,
       '1',
       {
+        name: fakeRuleName,
         consumer: 'myApp',
         schedule: { interval: '10s' },
         alertTypeId: 'myType',
@@ -387,6 +393,7 @@ describe('disableRule()', () => {
         id: '1',
         license: 'basic',
         ruleset: 'alerts',
+        name: fakeRuleName,
       },
     });
   });
@@ -406,6 +413,7 @@ describe('disableRule()', () => {
       RULE_SAVED_OBJECT_TYPE,
       '1',
       {
+        name: fakeRuleName,
         consumer: 'myApp',
         schedule: { interval: '10s' },
         alertTypeId: 'myType',
@@ -459,6 +467,7 @@ describe('disableRule()', () => {
       RULE_SAVED_OBJECT_TYPE,
       '1',
       {
+        name: fakeRuleName,
         consumer: 'myApp',
         schedule: { interval: '10s' },
         alertTypeId: 'myType',
@@ -509,6 +518,7 @@ describe('disableRule()', () => {
       RULE_SAVED_OBJECT_TYPE,
       '1',
       {
+        name: fakeRuleName,
         consumer: 'myApp',
         schedule: { interval: '10s' },
         alertTypeId: 'myType',
@@ -626,6 +636,7 @@ describe('disableRule()', () => {
       RULE_SAVED_OBJECT_TYPE,
       '1',
       {
+        name: fakeRuleName,
         consumer: 'myApp',
         schedule: { interval: '10s' },
         alertTypeId: 'myType',
@@ -679,6 +690,7 @@ describe('disableRule()', () => {
       RULE_SAVED_OBJECT_TYPE,
       '1',
       {
+        name: fakeRuleName,
         consumer: 'myApp',
         schedule: { interval: '10s' },
         alertTypeId: 'myType',
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/disable/disable_rule.ts b/x-pack/plugins/alerting/server/application/rule/methods/disable/disable_rule.ts
index e6002352ef65b8..3e0d3aa3c67f52 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/disable/disable_rule.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/disable/disable_rule.ts
@@ -78,7 +78,7 @@ async function disableWithOCC(
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.DISABLE,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
         error,
       })
     );
@@ -93,7 +93,7 @@ async function disableWithOCC(
     ruleAuditEvent({
       action: RuleAuditAction.DISABLE,
       outcome: 'unknown',
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
     })
   );
 
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/enable_rule/enable_rule.test.ts b/x-pack/plugins/alerting/server/application/rule/methods/enable_rule/enable_rule.test.ts
index 403b5b650f833d..fd4536db38946d 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/enable_rule/enable_rule.test.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/enable_rule/enable_rule.test.ts
@@ -202,7 +202,7 @@ describe('enable()', () => {
             action: 'rule_enable',
             outcome: 'unknown',
           }),
-          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE } },
+          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE, name: 'name' } },
         })
       );
     });
@@ -221,6 +221,7 @@ describe('enable()', () => {
             saved_object: {
               id: '1',
               type: RULE_SAVED_OBJECT_TYPE,
+              name: 'name',
             },
           },
           error: {
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/enable_rule/enable_rule.ts b/x-pack/plugins/alerting/server/application/rule/methods/enable_rule/enable_rule.ts
index 6b21269ca1d1e3..d4c2e91787aef3 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/enable_rule/enable_rule.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/enable_rule/enable_rule.ts
@@ -105,7 +105,7 @@ async function enableWithOCC(context: RulesClientContext, params: EnableRulePara
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.ENABLE,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
         error,
       })
     );
@@ -116,7 +116,7 @@ async function enableWithOCC(context: RulesClientContext, params: EnableRulePara
     ruleAuditEvent({
       action: RuleAuditAction.ENABLE,
       outcome: 'unknown',
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
     })
   );
 
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/find/find_rules.test.ts b/x-pack/plugins/alerting/server/application/rule/methods/find/find_rules.test.ts
index ee8038f2c8b6c7..e6bfd3408a538f 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/find/find_rules.test.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/find/find_rules.test.ts
@@ -125,6 +125,7 @@ describe('find()', () => {
           id: '1',
           type: RULE_SAVED_OBJECT_TYPE,
           attributes: {
+            name: 'fakeRuleName',
             alertTypeId: 'myType',
             schedule: { interval: '10s' },
             params: {
@@ -211,6 +212,7 @@ describe('find()', () => {
               "status": "pending",
             },
             "id": "1",
+            "name": "fakeRuleName",
             "notifyWhen": "onActiveAlert",
             "params": Object {
               "bar": true,
@@ -1003,7 +1005,7 @@ describe('find()', () => {
             action: 'rule_find',
             outcome: 'success',
           }),
-          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE } },
+          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE, name: 'fakeRuleName' } },
         })
       );
     });
@@ -1042,7 +1044,7 @@ describe('find()', () => {
             action: 'rule_find',
             outcome: 'failure',
           }),
-          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE } },
+          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE, name: 'fakeRuleName' } },
           error: {
             code: 'Error',
             message: 'Unauthorized',
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/find/find_rules.ts b/x-pack/plugins/alerting/server/application/rule/methods/find/find_rules.ts
index 10aef42955e741..7069000ed16a0b 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/find/find_rules.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/find/find_rules.ts
@@ -142,7 +142,7 @@ export async function findRules<Params extends RuleParams = never>(
       context.auditLogger?.log(
         ruleAuditEvent({
           action: RuleAuditAction.FIND,
-          savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+          savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
           error,
         })
       );
@@ -168,11 +168,11 @@ export async function findRules<Params extends RuleParams = never>(
     return rule;
   });
 
-  authorizedData.forEach(({ id }) =>
+  authorizedData.forEach(({ id, name }) =>
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.FIND,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name },
       })
     )
   );
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/get/get_rule.test.ts b/x-pack/plugins/alerting/server/application/rule/methods/get/get_rule.test.ts
index c0f0caeed673f9..6c51b7e25f288d 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/get/get_rule.test.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/get/get_rule.test.ts
@@ -630,6 +630,7 @@ describe('get()', () => {
         id: '1',
         type: RULE_SAVED_OBJECT_TYPE,
         attributes: {
+          name: 'fakeRuleName',
           alertTypeId: '123',
           schedule: { interval: '10s' },
           params: {
@@ -654,7 +655,7 @@ describe('get()', () => {
             action: 'rule_get',
             outcome: 'success',
           }),
-          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE } },
+          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE, name: 'fakeRuleName' } },
         })
       );
     });
@@ -674,6 +675,7 @@ describe('get()', () => {
             saved_object: {
               id: '1',
               type: RULE_SAVED_OBJECT_TYPE,
+              name: 'fakeRuleName',
             },
           },
           error: {
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/get/get_rule.ts b/x-pack/plugins/alerting/server/application/rule/methods/get/get_rule.ts
index 9577673cc97b76..548e25fad87c62 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/get/get_rule.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/get/get_rule.ts
@@ -57,7 +57,7 @@ export async function getRule<Params extends RuleParams = never>(
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.GET,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: result.attributes.name },
         error,
       })
     );
@@ -66,7 +66,7 @@ export async function getRule<Params extends RuleParams = never>(
   context.auditLogger?.log(
     ruleAuditEvent({
       action: RuleAuditAction.GET,
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: result.attributes.name },
     })
   );
 
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/mute_alert/mute_instance.ts b/x-pack/plugins/alerting/server/application/rule/methods/mute_alert/mute_instance.ts
index d49af9aba93b6d..62283bf6e111a2 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/mute_alert/mute_instance.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/mute_alert/mute_instance.ts
@@ -59,7 +59,7 @@ async function muteInstanceWithOCC(
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.MUTE_ALERT,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: ruleId },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: ruleId, name: attributes.name },
         error,
       })
     );
@@ -70,7 +70,7 @@ async function muteInstanceWithOCC(
     ruleAuditEvent({
       action: RuleAuditAction.MUTE_ALERT,
       outcome: 'unknown',
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: ruleId },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: ruleId, name: attributes.name },
     })
   );
 
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/resolve/resolve_rule.ts b/x-pack/plugins/alerting/server/application/rule/methods/resolve/resolve_rule.ts
index 359f3189958c5b..fd9ae07d7ebd2b 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/resolve/resolve_rule.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/resolve/resolve_rule.ts
@@ -53,7 +53,7 @@ Promise<ResolvedSanitizedRule<Params>> {
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.RESOLVE,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: result.attributes.name },
         error,
       })
     );
@@ -62,7 +62,7 @@ Promise<ResolvedSanitizedRule<Params>> {
   context.auditLogger?.log(
     ruleAuditEvent({
       action: RuleAuditAction.RESOLVE,
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: result.attributes.name },
     })
   );
 
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/snooze/snooze_rule.ts b/x-pack/plugins/alerting/server/application/rule/methods/snooze/snooze_rule.ts
index 162fe98d31f043..d736cf5227e4c1 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/snooze/snooze_rule.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/snooze/snooze_rule.ts
@@ -72,7 +72,7 @@ async function snoozeWithOCC(
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.SNOOZE,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
         error,
       })
     );
@@ -83,7 +83,7 @@ async function snoozeWithOCC(
     ruleAuditEvent({
       action: RuleAuditAction.SNOOZE,
       outcome: 'unknown',
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
     })
   );
 
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/unmute_alert/unmute_instance.test.ts b/x-pack/plugins/alerting/server/application/rule/methods/unmute_alert/unmute_instance.test.ts
index f88b650c322ac6..31d0e997b7ffe6 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/unmute_alert/unmute_instance.test.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/unmute_alert/unmute_instance.test.ts
@@ -223,6 +223,7 @@ describe('unmuteInstance()', () => {
         id: '1',
         type: RULE_SAVED_OBJECT_TYPE,
         attributes: {
+          name: 'fake_rule_name',
           actions: [],
           schedule: { interval: '10s' },
           alertTypeId: '2',
@@ -240,7 +241,9 @@ describe('unmuteInstance()', () => {
             action: 'rule_alert_unmute',
             outcome: 'unknown',
           }),
-          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE } },
+          kibana: {
+            saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE, name: 'fake_rule_name' },
+          },
         })
       );
     });
@@ -251,6 +254,7 @@ describe('unmuteInstance()', () => {
         id: '1',
         type: RULE_SAVED_OBJECT_TYPE,
         attributes: {
+          name: 'fake_rule_name',
           actions: [],
           schedule: { interval: '10s' },
           alertTypeId: '2',
@@ -276,6 +280,7 @@ describe('unmuteInstance()', () => {
             saved_object: {
               id: '1',
               type: RULE_SAVED_OBJECT_TYPE,
+              name: 'fake_rule_name',
             },
           },
           error: {
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/unmute_alert/unmute_instance.ts b/x-pack/plugins/alerting/server/application/rule/methods/unmute_alert/unmute_instance.ts
index 220a1b14e728c1..d3936cab1c9ae3 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/unmute_alert/unmute_instance.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/unmute_alert/unmute_instance.ts
@@ -58,7 +58,7 @@ async function unmuteInstanceWithOCC(
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.UNMUTE_ALERT,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: ruleId },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: ruleId, name: attributes.name },
         error,
       })
     );
@@ -69,7 +69,7 @@ async function unmuteInstanceWithOCC(
     ruleAuditEvent({
       action: RuleAuditAction.UNMUTE_ALERT,
       outcome: 'unknown',
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: ruleId },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: ruleId, name: attributes.name },
     })
   );
 
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/unsnooze/unsnooze_rule.ts b/x-pack/plugins/alerting/server/application/rule/methods/unsnooze/unsnooze_rule.ts
index b5cb6f8f29e335..13a9a96b53ad4e 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/unsnooze/unsnooze_rule.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/unsnooze/unsnooze_rule.ts
@@ -63,7 +63,7 @@ async function unsnoozeWithOCC(context: RulesClientContext, { id, scheduleIds }:
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.UNSNOOZE,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
         error,
       })
     );
@@ -74,7 +74,7 @@ async function unsnoozeWithOCC(context: RulesClientContext, { id, scheduleIds }:
     ruleAuditEvent({
       action: RuleAuditAction.UNSNOOZE,
       outcome: 'unknown',
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
     })
   );
 
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/update/update_rule.test.ts b/x-pack/plugins/alerting/server/application/rule/methods/update/update_rule.test.ts
index 748b41c0d2f1a3..90f797fbf4a1a3 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/update/update_rule.test.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/update/update_rule.test.ts
@@ -118,6 +118,7 @@ describe('update()', () => {
     id: '1',
     type: RULE_SAVED_OBJECT_TYPE,
     attributes: {
+      name: 'fakeRuleName',
       enabled: true,
       tags: ['foo'],
       alertTypeId: 'myType',
@@ -3001,6 +3002,7 @@ describe('update()', () => {
         id: '1',
         type: RULE_SAVED_OBJECT_TYPE,
         attributes: {
+          name: 'fakeRuleName',
           enabled: true,
           schedule: { interval: '1m' },
           params: {
@@ -3041,7 +3043,9 @@ describe('update()', () => {
             action: 'rule_update',
             outcome: 'unknown',
           }),
-          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE } },
+          kibana: {
+            saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE, name: 'fakeRuleName' },
+          },
         })
       );
     });
@@ -3075,6 +3079,7 @@ describe('update()', () => {
             saved_object: {
               id: '1',
               type: RULE_SAVED_OBJECT_TYPE,
+              name: 'fakeRuleName',
             },
           },
           error: {
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/update/update_rule.ts b/x-pack/plugins/alerting/server/application/rule/methods/update/update_rule.ts
index eef9026a14cd4c..4885882451e40e 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/update/update_rule.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/update/update_rule.ts
@@ -148,7 +148,7 @@ async function updateWithOCC<Params extends RuleParams = never>(
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.UPDATE,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name },
         error,
       })
     );
@@ -159,7 +159,7 @@ async function updateWithOCC<Params extends RuleParams = never>(
     ruleAuditEvent({
       action: RuleAuditAction.UPDATE,
       outcome: 'unknown',
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name },
     })
   );
 
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/update_api_key/update_rule_api_key.test.ts b/x-pack/plugins/alerting/server/application/rule/methods/update_api_key/update_rule_api_key.test.ts
index ef9979a8c8b883..003bae5da67bc7 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/update_api_key/update_rule_api_key.test.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/update_api_key/update_rule_api_key.test.ts
@@ -41,6 +41,8 @@ const auditLogger = auditLoggerMock.create();
 const internalSavedObjectsRepository = savedObjectsRepositoryMock.create();
 
 const kibanaVersion = 'v7.10.0';
+const ruleName = 'fakeRuleName';
+
 const rulesClientParams: jest.Mocked<ConstructorOptions> = {
   taskManager,
   ruleTypeRegistry,
@@ -83,6 +85,7 @@ describe('updateRuleApiKey()', () => {
     id: '1',
     type: RULE_SAVED_OBJECT_TYPE,
     attributes: {
+      name: ruleName,
       revision: 0,
       schedule: { interval: '10s' },
       alertTypeId: 'myType',
@@ -137,6 +140,7 @@ describe('updateRuleApiKey()', () => {
       '1',
       {
         schedule: { interval: '10s' },
+        name: ruleName,
         alertTypeId: 'myType',
         consumer: 'myApp',
         enabled: true,
@@ -198,6 +202,7 @@ describe('updateRuleApiKey()', () => {
       '1',
       {
         schedule: { interval: '10s' },
+        name: ruleName,
         alertTypeId: 'myType',
         consumer: 'myApp',
         enabled: true,
@@ -254,6 +259,7 @@ describe('updateRuleApiKey()', () => {
       '1',
       {
         schedule: { interval: '10s' },
+        name: ruleName,
         alertTypeId: 'myType',
         consumer: 'myApp',
         enabled: true,
@@ -324,6 +330,7 @@ describe('updateRuleApiKey()', () => {
       '1',
       {
         schedule: { interval: '10s' },
+        name: ruleName,
         alertTypeId: 'myType',
         consumer: 'myApp',
         enabled: true,
@@ -434,7 +441,9 @@ describe('updateRuleApiKey()', () => {
             action: 'rule_update_api_key',
             outcome: 'unknown',
           }),
-          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE } },
+          kibana: {
+            saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE, name: ruleName },
+          },
         })
       );
     });
@@ -453,6 +462,7 @@ describe('updateRuleApiKey()', () => {
             saved_object: {
               id: '1',
               type: RULE_SAVED_OBJECT_TYPE,
+              name: ruleName,
             },
           },
           error: {
diff --git a/x-pack/plugins/alerting/server/application/rule/methods/update_api_key/update_rule_api_key.ts b/x-pack/plugins/alerting/server/application/rule/methods/update_api_key/update_rule_api_key.ts
index f81dfd64f56840..955109c05bde7e 100644
--- a/x-pack/plugins/alerting/server/application/rule/methods/update_api_key/update_rule_api_key.ts
+++ b/x-pack/plugins/alerting/server/application/rule/methods/update_api_key/update_rule_api_key.ts
@@ -81,7 +81,7 @@ async function updateApiKeyWithOCC(context: RulesClientContext, { id }: UpdateAp
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.UPDATE_API_KEY,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
         error,
       })
     );
@@ -109,7 +109,7 @@ async function updateApiKeyWithOCC(context: RulesClientContext, { id }: UpdateAp
     ruleAuditEvent({
       action: RuleAuditAction.UPDATE_API_KEY,
       outcome: 'unknown',
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
     })
   );
 
diff --git a/x-pack/plugins/alerting/server/rules_client/common/audit_events.test.ts b/x-pack/plugins/alerting/server/rules_client/common/audit_events.test.ts
index 1ec08315055075..e9d9c40d0d4ab0 100644
--- a/x-pack/plugins/alerting/server/rules_client/common/audit_events.test.ts
+++ b/x-pack/plugins/alerting/server/rules_client/common/audit_events.test.ts
@@ -19,7 +19,7 @@ describe('#ruleAuditEvent', () => {
       ruleAuditEvent({
         action: RuleAuditAction.CREATE,
         outcome: 'unknown',
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: 'ALERT_ID' },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: 'ALERT_ID', name: 'fake_name' },
       })
     ).toMatchInlineSnapshot(`
       Object {
@@ -37,10 +37,11 @@ describe('#ruleAuditEvent', () => {
         "kibana": Object {
           "saved_object": Object {
             "id": "ALERT_ID",
+            "name": "fake_name",
             "type": "alert",
           },
         },
-        "message": "User is creating rule [id=ALERT_ID]",
+        "message": "User is creating rule [id=ALERT_ID] [name=fake_name]",
       }
     `);
   });
@@ -49,7 +50,7 @@ describe('#ruleAuditEvent', () => {
     expect(
       ruleAuditEvent({
         action: RuleAuditAction.CREATE,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: 'ALERT_ID' },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: 'ALERT_ID', name: 'fake_name' },
       })
     ).toMatchInlineSnapshot(`
       Object {
@@ -67,15 +68,51 @@ describe('#ruleAuditEvent', () => {
         "kibana": Object {
           "saved_object": Object {
             "id": "ALERT_ID",
+            "name": "fake_name",
             "type": "alert",
           },
         },
-        "message": "User has created rule [id=ALERT_ID]",
+        "message": "User has created rule [id=ALERT_ID] [name=fake_name]",
       }
     `);
   });
 
   test('creates event with `failure` outcome', () => {
+    expect(
+      ruleAuditEvent({
+        action: RuleAuditAction.CREATE,
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: 'ALERT_ID', name: 'fake_name' },
+        error: new Error('ERROR_MESSAGE'),
+      })
+    ).toMatchInlineSnapshot(`
+      Object {
+        "error": Object {
+          "code": "Error",
+          "message": "ERROR_MESSAGE",
+        },
+        "event": Object {
+          "action": "rule_create",
+          "category": Array [
+            "database",
+          ],
+          "outcome": "failure",
+          "type": Array [
+            "creation",
+          ],
+        },
+        "kibana": Object {
+          "saved_object": Object {
+            "id": "ALERT_ID",
+            "name": "fake_name",
+            "type": "alert",
+          },
+        },
+        "message": "Failed attempt to create rule [id=ALERT_ID] [name=fake_name]",
+      }
+    `);
+  });
+
+  test('creates event without known name', () => {
     expect(
       ruleAuditEvent({
         action: RuleAuditAction.CREATE,
@@ -116,7 +153,11 @@ describe('#adHocRunAuditEvent', () => {
       adHocRunAuditEvent({
         action: AdHocRunAuditAction.GET,
         outcome: 'unknown',
-        savedObject: { type: AD_HOC_RUN_SAVED_OBJECT_TYPE, id: 'AD_HOC_RUN_ID' },
+        savedObject: {
+          type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
+          id: 'AD_HOC_RUN_ID',
+          name: `backfill for rule "fake_name"`,
+        },
       })
     ).toMatchInlineSnapshot(`
       Object {
@@ -134,10 +175,11 @@ describe('#adHocRunAuditEvent', () => {
         "kibana": Object {
           "saved_object": Object {
             "id": "AD_HOC_RUN_ID",
+            "name": "backfill for rule \\"fake_name\\"",
             "type": "ad_hoc_run_params",
           },
         },
-        "message": "User is getting ad hoc run for ad_hoc_run_params [id=AD_HOC_RUN_ID]",
+        "message": "User is getting ad hoc run for ad_hoc_run_params [id=AD_HOC_RUN_ID] backfill for rule \\"fake_name\\"",
       }
     `);
   });
@@ -146,7 +188,11 @@ describe('#adHocRunAuditEvent', () => {
     expect(
       adHocRunAuditEvent({
         action: AdHocRunAuditAction.FIND,
-        savedObject: { type: AD_HOC_RUN_SAVED_OBJECT_TYPE, id: 'AD_HOC_RUN_ID' },
+        savedObject: {
+          type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
+          id: 'AD_HOC_RUN_ID',
+          name: `backfill for rule "fake_name"`,
+        },
       })
     ).toMatchInlineSnapshot(`
       Object {
@@ -164,10 +210,11 @@ describe('#adHocRunAuditEvent', () => {
         "kibana": Object {
           "saved_object": Object {
             "id": "AD_HOC_RUN_ID",
+            "name": "backfill for rule \\"fake_name\\"",
             "type": "ad_hoc_run_params",
           },
         },
-        "message": "User has found ad hoc run for ad_hoc_run_params [id=AD_HOC_RUN_ID]",
+        "message": "User has found ad hoc run for ad_hoc_run_params [id=AD_HOC_RUN_ID] backfill for rule \\"fake_name\\"",
       }
     `);
   });
@@ -176,7 +223,11 @@ describe('#adHocRunAuditEvent', () => {
     expect(
       adHocRunAuditEvent({
         action: AdHocRunAuditAction.DELETE,
-        savedObject: { type: AD_HOC_RUN_SAVED_OBJECT_TYPE, id: 'AD_HOC_RUN_ID' },
+        savedObject: {
+          type: AD_HOC_RUN_SAVED_OBJECT_TYPE,
+          id: 'AD_HOC_RUN_ID',
+          name: `backfill for rule "fake_name"`,
+        },
         error: new Error('ERROR_MESSAGE'),
       })
     ).toMatchInlineSnapshot(`
@@ -195,13 +246,44 @@ describe('#adHocRunAuditEvent', () => {
             "deletion",
           ],
         },
+        "kibana": Object {
+          "saved_object": Object {
+            "id": "AD_HOC_RUN_ID",
+            "name": "backfill for rule \\"fake_name\\"",
+            "type": "ad_hoc_run_params",
+          },
+        },
+        "message": "Failed attempt to delete ad hoc run for ad_hoc_run_params [id=AD_HOC_RUN_ID] backfill for rule \\"fake_name\\"",
+      }
+    `);
+  });
+
+  test('creates event without known name', () => {
+    expect(
+      adHocRunAuditEvent({
+        action: AdHocRunAuditAction.FIND,
+        savedObject: { type: AD_HOC_RUN_SAVED_OBJECT_TYPE, id: 'AD_HOC_RUN_ID' },
+      })
+    ).toMatchInlineSnapshot(`
+      Object {
+        "error": undefined,
+        "event": Object {
+          "action": "ad_hoc_run_find",
+          "category": Array [
+            "database",
+          ],
+          "outcome": "success",
+          "type": Array [
+            "access",
+          ],
+        },
         "kibana": Object {
           "saved_object": Object {
             "id": "AD_HOC_RUN_ID",
             "type": "ad_hoc_run_params",
           },
         },
-        "message": "Failed attempt to delete ad hoc run for ad_hoc_run_params [id=AD_HOC_RUN_ID]",
+        "message": "User has found ad hoc run for ad_hoc_run_params [id=AD_HOC_RUN_ID]",
       }
     `);
   });
diff --git a/x-pack/plugins/alerting/server/rules_client/common/audit_events.ts b/x-pack/plugins/alerting/server/rules_client/common/audit_events.ts
index 1ab77379cbeafc..66bba16c2805ca 100644
--- a/x-pack/plugins/alerting/server/rules_client/common/audit_events.ts
+++ b/x-pack/plugins/alerting/server/rules_client/common/audit_events.ts
@@ -161,7 +161,12 @@ export function ruleAuditEvent({
   outcome,
   error,
 }: RuleAuditEventParams): AuditEvent {
-  const doc = savedObject ? `rule [id=${savedObject.id}]` : 'a rule';
+  const doc = savedObject
+    ? [`rule [id=${savedObject.id}]`, savedObject.name && `[name=${savedObject.name}]`]
+        .filter(Boolean)
+        .join(' ')
+    : 'a rule';
+
   const [present, progressive, past] = ruleEventVerbs[action];
   const message = error
     ? `Failed attempt to ${present} ${doc}`
@@ -195,7 +200,12 @@ export function adHocRunAuditEvent({
   error,
 }: AdHocRunAuditEventParams): AuditEvent {
   const doc = savedObject
-    ? `${AD_HOC_RUN_SAVED_OBJECT_TYPE} [id=${savedObject.id}]`
+    ? [
+        `${AD_HOC_RUN_SAVED_OBJECT_TYPE} [id=${savedObject.id}]`,
+        savedObject.name && `${savedObject.name}`,
+      ]
+        .filter(Boolean)
+        .join(' ')
     : 'an ad hoc run';
   const [present, progressive, past] = adHocRunEventVerbs[action];
   const message = error
diff --git a/x-pack/plugins/alerting/server/rules_client/lib/check_authorization_and_get_total.ts b/x-pack/plugins/alerting/server/rules_client/lib/check_authorization_and_get_total.ts
index a4e75c58bde4bd..47987868d3ca84 100644
--- a/x-pack/plugins/alerting/server/rules_client/lib/check_authorization_and_get_total.ts
+++ b/x-pack/plugins/alerting/server/rules_client/lib/check_authorization_and_get_total.ts
@@ -84,7 +84,7 @@ export const checkAuthorizationAndGetTotal = async (
   await withSpan({ name: 'authorization.ensureAuthorized', type: 'rules' }, () =>
     pMap(
       buckets,
-      async ({ key: [ruleType, consumer, actions] }) => {
+      async ({ key: [ruleType, consumer] }) => {
         context.ruleTypeRegistry.ensureRuleTypeEnabled(ruleType);
         try {
           await context.authorization.ensureAuthorized({
diff --git a/x-pack/plugins/alerting/server/rules_client/lib/create_rule_saved_object.ts b/x-pack/plugins/alerting/server/rules_client/lib/create_rule_saved_object.ts
index 938d421e795543..7c40ef31cd8aee 100644
--- a/x-pack/plugins/alerting/server/rules_client/lib/create_rule_saved_object.ts
+++ b/x-pack/plugins/alerting/server/rules_client/lib/create_rule_saved_object.ts
@@ -57,7 +57,7 @@ export async function createRuleSavedObject<Params extends RuleTypeParams = neve
     ruleAuditEvent({
       action: RuleAuditAction.CREATE,
       outcome: 'unknown',
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: ruleId },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id: ruleId, name: rawRule.name },
     })
   );
 
diff --git a/x-pack/plugins/alerting/server/rules_client/methods/get_action_error_log.ts b/x-pack/plugins/alerting/server/rules_client/methods/get_action_error_log.ts
index 3640dbcf62c407..a7d60fc8f8ca48 100644
--- a/x-pack/plugins/alerting/server/rules_client/methods/get_action_error_log.ts
+++ b/x-pack/plugins/alerting/server/rules_client/methods/get_action_error_log.ts
@@ -54,7 +54,7 @@ export async function getActionErrorLog(
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.GET_ACTION_ERROR_LOG,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: rule.name },
         error,
       })
     );
@@ -64,7 +64,7 @@ export async function getActionErrorLog(
   context.auditLogger?.log(
     ruleAuditEvent({
       action: RuleAuditAction.GET_ACTION_ERROR_LOG,
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: rule.name },
     })
   );
 
diff --git a/x-pack/plugins/alerting/server/rules_client/methods/get_execution_kpi.ts b/x-pack/plugins/alerting/server/rules_client/methods/get_execution_kpi.ts
index 082071ead79e5a..fc2c1298f69ac3 100644
--- a/x-pack/plugins/alerting/server/rules_client/methods/get_execution_kpi.ts
+++ b/x-pack/plugins/alerting/server/rules_client/methods/get_execution_kpi.ts
@@ -55,7 +55,7 @@ export async function getRuleExecutionKPI(
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.GET_RULE_EXECUTION_KPI,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: rule.name },
         error,
       })
     );
@@ -65,7 +65,7 @@ export async function getRuleExecutionKPI(
   context.auditLogger?.log(
     ruleAuditEvent({
       action: RuleAuditAction.GET_RULE_EXECUTION_KPI,
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: rule.name },
     })
   );
 
diff --git a/x-pack/plugins/alerting/server/rules_client/methods/get_execution_log.ts b/x-pack/plugins/alerting/server/rules_client/methods/get_execution_log.ts
index f154a8e840be2e..18d65c28fc9bba 100644
--- a/x-pack/plugins/alerting/server/rules_client/methods/get_execution_log.ts
+++ b/x-pack/plugins/alerting/server/rules_client/methods/get_execution_log.ts
@@ -63,7 +63,7 @@ export async function getExecutionLogForRule(
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.GET_EXECUTION_LOG,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: rule.name },
         error,
       })
     );
@@ -73,7 +73,7 @@ export async function getExecutionLogForRule(
   context.auditLogger?.log(
     ruleAuditEvent({
       action: RuleAuditAction.GET_EXECUTION_LOG,
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: rule.name },
     })
   );
 
diff --git a/x-pack/plugins/alerting/server/rules_client/methods/mute_all.ts b/x-pack/plugins/alerting/server/rules_client/methods/mute_all.ts
index 273d794a52dc86..4e647ee6e58ac9 100644
--- a/x-pack/plugins/alerting/server/rules_client/methods/mute_all.ts
+++ b/x-pack/plugins/alerting/server/rules_client/methods/mute_all.ts
@@ -44,7 +44,7 @@ async function muteAllWithOCC(context: RulesClientContext, { id }: { id: string
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.MUTE,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
         error,
       })
     );
@@ -55,7 +55,7 @@ async function muteAllWithOCC(context: RulesClientContext, { id }: { id: string
     ruleAuditEvent({
       action: RuleAuditAction.MUTE,
       outcome: 'unknown',
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
     })
   );
 
diff --git a/x-pack/plugins/alerting/server/rules_client/methods/run_soon.ts b/x-pack/plugins/alerting/server/rules_client/methods/run_soon.ts
index 9fbfd94c8deaa3..9a7907178fc830 100644
--- a/x-pack/plugins/alerting/server/rules_client/methods/run_soon.ts
+++ b/x-pack/plugins/alerting/server/rules_client/methods/run_soon.ts
@@ -33,7 +33,7 @@ export async function runSoon(context: RulesClientContext, { id }: { id: string
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.RUN_SOON,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
         error,
       })
     );
@@ -44,7 +44,7 @@ export async function runSoon(context: RulesClientContext, { id }: { id: string
     ruleAuditEvent({
       action: RuleAuditAction.RUN_SOON,
       outcome: 'unknown',
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
     })
   );
 
diff --git a/x-pack/plugins/alerting/server/rules_client/methods/unmute_all.ts b/x-pack/plugins/alerting/server/rules_client/methods/unmute_all.ts
index 675387e0a600ac..e007633e4012d4 100644
--- a/x-pack/plugins/alerting/server/rules_client/methods/unmute_all.ts
+++ b/x-pack/plugins/alerting/server/rules_client/methods/unmute_all.ts
@@ -47,7 +47,7 @@ async function unmuteAllWithOCC(context: RulesClientContext, { id }: { id: strin
     context.auditLogger?.log(
       ruleAuditEvent({
         action: RuleAuditAction.UNMUTE,
-        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+        savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
         error,
       })
     );
@@ -58,7 +58,7 @@ async function unmuteAllWithOCC(context: RulesClientContext, { id }: { id: strin
     ruleAuditEvent({
       action: RuleAuditAction.UNMUTE,
       outcome: 'unknown',
-      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id },
+      savedObject: { type: RULE_SAVED_OBJECT_TYPE, id, name: attributes.name },
     })
   );
 
diff --git a/x-pack/plugins/alerting/server/rules_client/tests/get_action_error_log.test.ts b/x-pack/plugins/alerting/server/rules_client/tests/get_action_error_log.test.ts
index 532511fb313f56..152474ee9fb482 100644
--- a/x-pack/plugins/alerting/server/rules_client/tests/get_action_error_log.test.ts
+++ b/x-pack/plugins/alerting/server/rules_client/tests/get_action_error_log.test.ts
@@ -562,7 +562,7 @@ describe('getActionErrorLog()', () => {
             action: 'rule_get_action_error_log',
             outcome: 'success',
           }),
-          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE } },
+          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE, name: 'rule-name' } },
         })
       );
     });
@@ -585,6 +585,7 @@ describe('getActionErrorLog()', () => {
             saved_object: {
               id: '1',
               type: RULE_SAVED_OBJECT_TYPE,
+              name: 'rule-name',
             },
           },
           error: {
diff --git a/x-pack/plugins/alerting/server/rules_client/tests/get_execution_log.test.ts b/x-pack/plugins/alerting/server/rules_client/tests/get_execution_log.test.ts
index f8416e9cdb6b63..3a3f801dd9085b 100644
--- a/x-pack/plugins/alerting/server/rules_client/tests/get_execution_log.test.ts
+++ b/x-pack/plugins/alerting/server/rules_client/tests/get_execution_log.test.ts
@@ -672,7 +672,7 @@ describe('getExecutionLogForRule()', () => {
             action: 'rule_get_execution_log',
             outcome: 'success',
           }),
-          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE } },
+          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE, name: 'rule-name' } },
         })
       );
     });
@@ -695,6 +695,7 @@ describe('getExecutionLogForRule()', () => {
             saved_object: {
               id: '1',
               type: RULE_SAVED_OBJECT_TYPE,
+              name: 'rule-name',
             },
           },
           error: {
diff --git a/x-pack/plugins/alerting/server/rules_client/tests/mute_all.test.ts b/x-pack/plugins/alerting/server/rules_client/tests/mute_all.test.ts
index c84c860599fe2f..c79df2a4986c8a 100644
--- a/x-pack/plugins/alerting/server/rules_client/tests/mute_all.test.ts
+++ b/x-pack/plugins/alerting/server/rules_client/tests/mute_all.test.ts
@@ -181,6 +181,7 @@ describe('muteAll()', () => {
         id: '1',
         type: RULE_SAVED_OBJECT_TYPE,
         attributes: {
+          name: 'fake_rule_name',
           actions: [
             {
               group: 'default',
@@ -204,7 +205,9 @@ describe('muteAll()', () => {
             action: 'rule_mute',
             outcome: 'unknown',
           }),
-          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE } },
+          kibana: {
+            saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE, name: 'fake_rule_name' },
+          },
         })
       );
     });
@@ -215,6 +218,7 @@ describe('muteAll()', () => {
         id: '1',
         type: RULE_SAVED_OBJECT_TYPE,
         attributes: {
+          name: 'fake_rule_name',
           actions: [
             {
               group: 'default',
@@ -244,6 +248,7 @@ describe('muteAll()', () => {
             saved_object: {
               id: '1',
               type: RULE_SAVED_OBJECT_TYPE,
+              name: 'fake_rule_name',
             },
           },
           error: {
diff --git a/x-pack/plugins/alerting/server/rules_client/tests/run_soon.test.ts b/x-pack/plugins/alerting/server/rules_client/tests/run_soon.test.ts
index 026ba3450a700f..bc77cc424df8e9 100644
--- a/x-pack/plugins/alerting/server/rules_client/tests/run_soon.test.ts
+++ b/x-pack/plugins/alerting/server/rules_client/tests/run_soon.test.ts
@@ -162,7 +162,7 @@ describe('runSoon()', () => {
             action: 'rule_run_soon',
             outcome: 'unknown',
           }),
-          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE } },
+          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE, name: 'name' } },
         })
       );
     });
@@ -181,6 +181,7 @@ describe('runSoon()', () => {
             saved_object: {
               id: '1',
               type: RULE_SAVED_OBJECT_TYPE,
+              name: 'name',
             },
           },
           error: {
diff --git a/x-pack/plugins/alerting/server/rules_client/tests/unmute_all.test.ts b/x-pack/plugins/alerting/server/rules_client/tests/unmute_all.test.ts
index fd09c74d438996..d4cdb4b1b851b0 100644
--- a/x-pack/plugins/alerting/server/rules_client/tests/unmute_all.test.ts
+++ b/x-pack/plugins/alerting/server/rules_client/tests/unmute_all.test.ts
@@ -181,6 +181,7 @@ describe('unmuteAll()', () => {
         id: '1',
         type: RULE_SAVED_OBJECT_TYPE,
         attributes: {
+          name: 'fake_rule_name',
           actions: [
             {
               group: 'default',
@@ -204,7 +205,9 @@ describe('unmuteAll()', () => {
             action: 'rule_unmute',
             outcome: 'unknown',
           }),
-          kibana: { saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE } },
+          kibana: {
+            saved_object: { id: '1', type: RULE_SAVED_OBJECT_TYPE, name: 'fake_rule_name' },
+          },
         })
       );
     });
@@ -215,6 +218,7 @@ describe('unmuteAll()', () => {
         id: '1',
         type: RULE_SAVED_OBJECT_TYPE,
         attributes: {
+          name: 'fake_rule_name',
           actions: [
             {
               group: 'default',
@@ -244,6 +248,7 @@ describe('unmuteAll()', () => {
             saved_object: {
               id: '1',
               type: RULE_SAVED_OBJECT_TYPE,
+              name: 'fake_rule_name',
             },
           },
           error: {