---
title: Elastic Cloud audit trail
description: Track organization-level actions in Elastic Cloud Hosted by delivering audit logs to a hosted deployment you own.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8382/deploy-manage/monitor/log-delivery/cloud-audit-trail
products:
  - Elastic Cloud Hosted
  - Elastic Documentation
applies_to:
  - Elastic Cloud Hosted: Generally available
---

# Elastic Cloud audit trail
<admonition title="FedRAMP Moderate only">
  Elastic Cloud audit trail is available on FedRAMP Moderate environments only.
</admonition>

Elastic Cloud audit trail records actions that members of your organization perform through the Elastic Cloud Console, the Terraform Provider for Elastic Cloud, the Elastic CLI, or any other client that calls the [Elastic Cloud API](https://www.elastic.co/docs/api/doc/cloud/).
Using Elastic Cloud audit trail data, you can answer questions such as:
- Which user or API key tried to authenticate, and did they succeed or fail?
- Which user increased resources on a deployment?
- Which resources is a given API key accessing?
- Who modified traffic filters, and when?
- Who upgraded, deleted, or changed the configuration of a deployment?


## What is audited

Elastic Cloud audit trail captures all calls to the Elastic Cloud API. Examples of audited actions include:
- Managing hosted deployments: creation, configuration changes, scaling, upgrades, and deletion
- Managing organization membership and invitations
- Managing [Cloud API keys](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8382/deploy-manage/api-keys/elastic-cloud-api-keys)
- Managing [network security configurations](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8382/deploy-manage/security/network-security) such as traffic filters, trust relationships, SSO, and role mappings
- Sign-in, sign-out, and authentication attempts to the Elastic Cloud Console

<note>
  Elastic Cloud audit trail does not capture activity inside your deployments.To audit Elasticsearch and Kibana activity within a deployment, enable [audit logging](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8382/deploy-manage/security/logging-configuration/enabling-audit-logs) on the deployment directly.
</note>


## Requirements

To use the Elastic Cloud audit trail, you need the following:
- A [FedRAMP Moderate Elastic Cloud organization](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8382/deploy-manage/cloud-organization).
- A [Platinum or Enterprise subscription](https://www.elastic.co/subscriptions).
- An [Elastic Cloud API key](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8382/deploy-manage/api-keys/elastic-cloud-api-keys) with organization owner permissions.
- A destination deployment in the same organization to store audit logs. You might choose to use a dedicated deployment to keep audit data separate from production workloads.
- Your organization ID. You can find this on the [Organization](https://cloud.elastic.co/organization/members) page under the organization name.
- The destination deployment ID. You can find this on the deployment's **Overview** page in the Elastic Cloud Console.


## Set up Elastic Cloud audit trail

To set up Elastic Cloud audit trail, you [install the integration](#install-the-ecloud-integration) on a destination deployment, then [enable delivery](#enable-audit-log-delivery) through the API. After events are flowing, you can [explore your audit trail](#explore-your-audit-trail) in Kibana.
<stepper>
  <step title="Install the {{ecloud}} integration">
    Before you enable delivery, install the **Elastic Cloud** integration on the destination deployment. The integration sets up everything you need to index and explore audit log events.To install the integration:
    1. Open Kibana on the destination deployment.
    2. Find **Integrations** in the navigation menu or use the global search field.
    3. Search for **Elastic Cloud**, and then select the card from the list.
    4. On the Elastic Cloud integration page, click **Add Elastic Cloud**.
    5. On the installation page, click **Install assets only**. No agent policy is needed because the audit service pushes logs directly to your destination deployment.
    6. Confirm the installation.
    The following resources are installed:
    - Index templates for `logs-elastic_cloud.audit-*`
    - An ingest pipeline for the `elastic_cloud.audit` data stream
    - Field mappings, including [ECS](https://www.elastic.co/docs/reference/ecs) fields and `elastic_cloud.audit.api_key.*` fields
    - The **Elastic Cloud audit logs** data view (`logs-elastic_cloud.audit-*`)
    - The **[Elastic Cloud] Audit Logs** dashboard
  </step>

  <step title="Enable audit log delivery">
    As an organization owner, enable delivery by calling the audit logs API.Events start flowing when you enable delivery. Historical cloud audit logs are not backfilled.
    1. Send a `POST` request to the audit logs endpoint, specifying your destination deployment and a data stream name that matches `logs-elastic_cloud.audit-*`. Replace the placeholders with your own values.
       ```sh
       curl -X POST \
         -H "Authorization: ApiKey $CLOUD_API_KEY" \ 
         -H "Content-Type: application/json" \
         "https://api.elastic-cloud.com/api/v1/organizations/$ORG_ID/audit_logs" \ 
         -d '{
           "deployment_id": "<DESTINATION_DEPLOYMENT_ID>", 
           "index": "logs-elastic_cloud.audit-default" 
         }'
       ```
       To use a different data stream namespace, replace the `default` segment of the index name with your preferred namespace, for example `logs-elastic_cloud.audit-production`. The name must match the `logs-elastic_cloud.audit-*` pattern so that the installed index templates apply.
       The data stream is created with a configurable retention policy that defaults to 30 days, and the failure store enabled.
       <important>
       If you omit the `index` field, events are indexed into a non-data stream index named `elastic-org<ORG_ID>-audit` without field standardization. The installed dashboard does not display data from this index.
       </important>
    2. Verify the configuration:
       ```sh
       curl -X GET \
         -H "Authorization: ApiKey $CLOUD_API_KEY" \
         "https://api.elastic-cloud.com/api/v1/organizations/$ORG_ID/audit_logs"
       ```
       The response returns the configured `deployment_id` and `index`.
  </step>

  <step title="Explore your audit trail">
    After enabling delivery, explore your audit logs in the destination deployment:
    - Use the **Elastic Cloud audit logs** data view in **Discover** to browse individual events.
    - Open the **[Elastic Cloud] Audit Logs** dashboard to visualize and filter audit activity.
  </step>
</stepper>


## Stop delivery

If you need to decommission the destination deployment or switch to a different one, you can stop delivery at any time.
```sh
curl -X DELETE \
  -H "Authorization: ApiKey $CLOUD_API_KEY" \
  "https://api.elastic-cloud.com/api/v1/organizations/$ORG_ID/audit_logs"
```

This stops the delivery stream and invalidates the writer API key, but does not delete documents that were already indexed.