Elastic Cloud audit trail

FedRAMP Moderate only

Elastic Cloud audit trail is available on FedRAMP Moderate environments only.

Elastic Cloud audit trail records actions that members of your organization perform through the Elastic Cloud Console, the Terraform Provider for Elastic Cloud, the Elastic CLI, or any other client that calls the Elastic Cloud API.

Using Elastic Cloud audit trail data, you can answer questions such as:

  • Which user or API key tried to authenticate, and did they succeed or fail?
  • Which user increased resources on a deployment?
  • Which resources is a given API key accessing?
  • Who modified traffic filters, and when?
  • Who upgraded, deleted, or changed the configuration of a deployment?

Elastic Cloud audit trail captures all calls to the Elastic Cloud API. Examples of audited actions include:

  • Managing hosted deployments: creation, configuration changes, scaling, upgrades, and deletion
  • Managing organization membership and invitations
  • Managing Cloud API keys
  • Managing network security configurations such as traffic filters, trust relationships, SSO, and role mappings
  • Sign-in, sign-out, and authentication attempts to the Elastic Cloud Console
Note

Elastic Cloud audit trail does not capture activity inside your deployments.

To audit Elasticsearch and Kibana activity within a deployment, enable audit logging on the deployment directly.

To use the Elastic Cloud audit trail, you need the following:

To set up Elastic Cloud audit trail, you install the integration on a destination deployment, then enable delivery through the API. After events are flowing, you can explore your audit trail in Kibana.

  1. Install the Elastic Cloud integration

    Before you enable delivery, install the Elastic Cloud integration on the destination deployment. The integration sets up everything you need to index and explore audit log events.

    To install the integration:

    1. Open Kibana on the destination deployment.
    2. Find Integrations in the navigation menu or use the global search field.
    3. Search for Elastic Cloud, and then select the card from the list.
    4. On the Elastic Cloud integration page, click Add Elastic Cloud.
    5. On the installation page, click Install assets only. No agent policy is needed because the audit service pushes logs directly to your destination deployment.
    6. Confirm the installation.

    The following resources are installed:

    • Index templates for logs-elastic_cloud.audit-*
    • An ingest pipeline for the elastic_cloud.audit data stream
    • Field mappings, including ECS fields and elastic_cloud.audit.api_key.* fields
    • The Elastic Cloud audit logs data view (logs-elastic_cloud.audit-*)
    • The [Elastic Cloud] Audit Logs dashboard

  2. Enable audit log delivery

    As an organization owner, enable delivery by calling the audit logs API.

    Events start flowing when you enable delivery. Historical cloud audit logs are not backfilled.

    1. Send a POST request to the audit logs endpoint, specifying your destination deployment and a data stream name that matches logs-elastic_cloud.audit-*. Replace the placeholders with your own values.

      curl -X POST \
  -H "Authorization: ApiKey $CLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  "https://api.elastic-cloud.com/api/v1/organizations/$ORG_ID/audit_logs" \
  -d '{
    "deployment_id": "<DESTINATION_DEPLOYMENT_ID>",
    "index": "logs-elastic_cloud.audit-default"
  }'
      1. Replace $CLOUD_API_KEY with your Elastic Cloud API key
      2. Replace $ORG_ID with your organization ID from the Elastic Cloud console
      3. Replace <DESTINATION_DEPLOYMENT_ID> with the ID of the hosted deployment that receives the logs
      4. Represents the default data stream namespace.

      To use a different data stream namespace, replace the default segment of the index name with your preferred namespace, for example logs-elastic_cloud.audit-production. The name must match the logs-elastic_cloud.audit-* pattern so that the installed index templates apply.

      The data stream is created with a configurable retention policy that defaults to 30 days, and the failure store enabled.

      Important

      If you omit the index field, events are indexed into a non-data stream index named elastic-org<ORG_ID>-audit without field standardization. The installed dashboard does not display data from this index.

    2. Verify the configuration:

      curl -X GET \
  -H "Authorization: ApiKey $CLOUD_API_KEY" \
  "https://api.elastic-cloud.com/api/v1/organizations/$ORG_ID/audit_logs"

      The response returns the configured deployment_id and index.

  3. Explore your audit trail

    After enabling delivery, explore your audit logs in the destination deployment:

    • Use the Elastic Cloud audit logs data view in Discover to browse individual events.
    • Open the [Elastic Cloud] Audit Logs dashboard to visualize and filter audit activity.

If you need to decommission the destination deployment or switch to a different one, you can stop delivery at any time.

curl -X DELETE \
  -H "Authorization: ApiKey $CLOUD_API_KEY" \
  "https://api.elastic-cloud.com/api/v1/organizations/$ORG_ID/audit_logs"

This stops the delivery stream and invalidates the writer API key, but does not delete documents that were already indexed.