ECS audit events for alerting

docs/development/core/server/kibana-plugin-core-server.generatesavedobjectid.md

@@ -0,0 +1,17 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-core-server](./kibana-plugin-core-server.md) &gt; [generateSavedObjectId](./kibana-plugin-core-server.generatesavedobjectid.md)
+
+## generateSavedObjectId() function
+
+Generates a random id for saved objects.
+
+<b>Signature:</b>
+
+```typescript
+export declare function generateSavedObjectId(): string;
+```
+<b>Returns:</b>
+
+`string`
+

docs/development/core/server/kibana-plugin-core-server.md

@@ -43,6 +43,7 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  Function | Description |
 |  --- | --- |
 |  [exportSavedObjectsToStream({ types, hasReference, objects, search, savedObjectsClient, exportSizeLimit, includeReferencesDeep, excludeExportDetails, namespace, })](./kibana-plugin-core-server.exportsavedobjectstostream.md) | Generates sorted saved object stream to be used for export. See the [options](./kibana-plugin-core-server.savedobjectsexportoptions.md) for more detailed information. |
+|  [generateSavedObjectId()](./kibana-plugin-core-server.generatesavedobjectid.md) | Generates a random id for saved objects. |
 |  [importSavedObjectsFromStream({ readStream, objectLimit, overwrite, createNewCopies, savedObjectsClient, typeRegistry, namespace, })](./kibana-plugin-core-server.importsavedobjectsfromstream.md) | Import saved objects from given stream. See the [options](./kibana-plugin-core-server.savedobjectsimportoptions.md) for more detailed information. |
 |  [resolveSavedObjectsImportErrors({ readStream, objectLimit, retries, savedObjectsClient, typeRegistry, namespace, createNewCopies, })](./kibana-plugin-core-server.resolvesavedobjectsimporterrors.md) | Resolve and return saved object import errors. See the [options](./kibana-plugin-core-server.savedobjectsresolveimporterrorsoptions.md) for more detailed informations. |
 

docs/user/security/audit-logging.asciidoc

@@ -84,6 +84,14 @@ Refer to the corresponding {es} logs for potential write errors.
 | `unknown` | User is creating a saved object.
 | `failure` | User is not authorized to create a saved object.
 
+.2+| `connector_create`
+| `unknown` | User is creating a connector.
+| `failure` | User is not authorized to create a connector.
+
+.2+| `alert_rule_create`
+| `unknown` | User is creating an alert rule.
+| `failure` | User is not authorized to create an alert rule.
+
 
 3+a|
 ====== Type: change
@@ -108,6 +116,42 @@ Refer to the corresponding {es} logs for potential write errors.
 | `unknown` | User is removing references to a saved object.
 | `failure` | User is not authorized to remove references to a saved object.
 
+.2+| `connector_update`
+| `unknown` | User is updating a connector.
+| `failure` | User is not authorized to update a connector.
+
+.2+| `alert_rule_update`
+| `unknown` | User is updating an alert rule.
+| `failure` | User is not authorized to update an alert rule.
+
+.2+| `alert_rule_update_api_key`
+| `unknown` | User is updating the API key of an alert rule.
+| `failure` | User is not authorized to update the API key of an alert rule.
+
+.2+| `alert_rule_enable`
+| `unknown` | User is enabling an alert rule.
+| `failure` | User is not authorized to enable an alert rule.
+
+.2+| `alert_rule_disable`
+| `unknown` | User is disabling an alert rule.
+| `failure` | User is not authorized to disable an alert rule.
+
+.2+| `alert_rule_mute`
+| `unknown` | User is muting an alert rule.
+| `failure` | User is not authorized to mute an alert rule.
+
+.2+| `alert_rule_unmute`
+| `unknown` | User is unmuting an alert rule.
+| `failure` | User is not authorized to unmute an alert rule.
+
+.2+| `alert_instance_mute`
+| `unknown` | User is muting an alert instance.
+| `failure` | User is not authorized to mute an alert instance.
+
+.2+| `alert_instance_unmute`
+| `unknown` | User is unmuting an alert instance.
+| `failure` | User is not authorized to unmute an alert instance.
+
 
 3+a|
 ====== Type: deletion
@@ -120,6 +164,14 @@ Refer to the corresponding {es} logs for potential write errors.
 | `unknown` | User is deleting a saved object.
 | `failure` | User is not authorized to delete a saved object.
 
+.2+| `connector_delete`
+| `unknown` | User is deleting a connector.
+| `failure` | User is not authorized to delete a connector.
+
+.2+| `alert_rule_delete`
+| `unknown` | User is deleting an alert rule.
+| `failure` | User is not authorized to delete an alert rule.
+
 3+a|
 ====== Type: access
 
@@ -135,6 +187,22 @@ Refer to the corresponding {es} logs for potential write errors.
 | `success` | User has accessed a saved object as part of a search operation.
 | `failure` | User is not authorized to search for saved objects.
 
+.2+| `connector_get`
+| `success` | User has accessed a connector.
+| `failure` | User is not authorized to access a connector.
+
+.2+| `connector_find`
+| `success` | User has accessed a connector as part of a search operation.
+| `failure` | User is not authorized to search for connectors.
+
+.2+| `alert_rule_get`
+| `success` | User has accessed an alert rule.
+| `failure` | User is not authorized to access an alert rule.
+
+.2+| `alert_rule_find`
+| `success` | User has accessed an alert rule as part of a search operation.
+| `failure` | User is not authorized to search for alert rules.
+
 
 3+a|
 ===== Category: web

src/core/server/index.ts

@@ -311,6 +311,7 @@ export {
   exportSavedObjectsToStream,
   importSavedObjectsFromStream,
   resolveSavedObjectsImportErrors,
+  generateSavedObjectId,
 } from './saved_objects';
 
 export {

src/core/server/saved_objects/index.ts

@@ -32,6 +32,7 @@ export {
   SavedObjectsRawDoc,
   SavedObjectSanitizedDoc,
   SavedObjectUnsanitizedDoc,
+  generateSavedObjectId,
 } from './serialization';
 
 export { SavedObjectsMigrationLogger } from './migrations/core/migration_logger';

src/core/server/saved_objects/serialization/index.ts

@@ -28,4 +28,4 @@ export {
   SavedObjectsRawDoc,
   SavedObjectsRawDocSource,
 } from './types';
-export { SavedObjectsSerializer } from './serializer';
+export { SavedObjectsSerializer, generateSavedObjectId } from './serializer';

src/core/server/saved_objects/serialization/serializer.ts

@@ -130,7 +130,7 @@ export class SavedObjectsSerializer {
   public generateRawId(namespace: string | undefined, type: string, id?: string) {
     const namespacePrefix =
       namespace && this.registry.isSingleNamespace(type) ? `${namespace}:` : '';
-    return `${namespacePrefix}${type}:${id || uuid.v1()}`;
+    return `${namespacePrefix}${type}:${id || generateSavedObjectId()}`;
   }
 
   private trimIdPrefix(namespace: string | undefined, type: string, id: string) {
@@ -149,6 +149,15 @@ export class SavedObjectsSerializer {
   }
 }
 
+/**
+ * Generates a random id for saved objects.
+ *
+ * @public
+ */
+export function generateSavedObjectId() {
+  return uuid.v1();
+}
+
 function assertNonEmptyString(value: string, name: string) {
   if (!value || typeof value !== 'string') {
     throw new TypeError(`Expected "${value}" to be a ${name}`);

src/core/server/server.api.md

@@ -738,6 +738,9 @@ export interface FakeRequest {
     headers: Headers;
 }
 
+// @public
+export function generateSavedObjectId(): string;
+
 // @public
 export type GetAuthHeaders = (request: KibanaRequest | LegacyRequest) => AuthHeaders | undefined;