Adding name field to Audit Saved Object

packages/kibana/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.5.2"
+  changes:
+    - description: Adding SO name to audit events
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/9318
 - version: "2.5.1"
   changes:
     - description: Add memory utilization metric

packages/kibana/data_stream/audit/_dev/test/pipeline/test-kibana-audit-logs.log

@@ -1,3 +1,4 @@
 {"event":{"action":"http_request","category":["web"],"outcome":"unknown"},"http":{"request":{"method":"get"}},"url":{"domain":"kibana","path":"/api/fleet/enrollment_api_keys/e0a0d409-b22f-4cd0-b417-c934c621ce07","port":5601,"scheme":"https"},"user":{"name":"elastic","roles":["superuser"]},"kibana":{"space_id":"default"},"trace":{"id":"2eeefc09-26a2-4aea-840d-9170b0a9c95f"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.4.0"},"@timestamp":"2022-09-09T13:15:24.041+00:00","message":"User is requesting [/api/fleet/enrollment_api_keys/e0a0d409-b22f-4cd0-b417-c934c621ce07] endpoint","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":7},"transaction":{"id":"858c45e94edb1814"}}
 {"event":{"action":"user_login","category":["authentication"],"outcome":"success"},"user":{"name":"elastic","roles":["superuser"]},"kibana":{"session_id":"Bv1bSOJ7dMYoppdDmlCiPfP1v8Q7JHXDpc2mOrfoxJs=","authentication_provider":"basic","authentication_type":"basic","authentication_realm":"reserved","lookup_realm":"reserved"},"trace":{"id":"5233d304-16b6-479b-9e45-a906107a5f53"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.4.0"},"@timestamp":"2022-09-09T13:16:57.990+00:00","message":"User [elastic] has logged in using basic provider [name=basic]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":7},"transaction":{"id":"2fd40f9b4f4ca767"}}
 {"event":{"action":"space_get","category":["database"],"type":["access"],"outcome":"success"},"kibana":{"space_id":"default","session_id":"Bv1bSOJ7dMYoppdDmlCiPfP1v8Q7JHXDpc2mOrfoxJs=","saved_object":{"type":"space","id":"default"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"fbed6b3b-4e1c-4525-9597-391d5f718e89"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.4.0"},"@timestamp":"2022-09-09T13:16:58.044+00:00","message":"User has accessed space [id=default]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":7},"transaction":{"id":"256b899bfffe8b3f"}}
+{"event":{"action":"bulk_get","category":["database"],"type":["access"],"outcome":"success"},"kibana":{"space_id":"default","session_id":"Bv1bSOJ7dMYoppdDmlCiPfP1v8Q7JHXDpc2mOrfoxJs=","saved_object":{"type":"fake","id":"1","name":"so_name_1"}},"user":{"name":"elastic","roles":["superuser"]},"trace":{"id":"fbed6b3b-4e1c-4525-9597-391d5f718e89"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.4.0"},"@timestamp":"2022-09-09T13:16:58.044+00:00","message":"User has accessed space [id=default]","log":{"level":"INFO","logger":"plugins.security.audit.ecs"},"process":{"pid":7},"transaction":{"id":"256b899bfffe8b3f"}}

packages/kibana/data_stream/audit/_dev/test/pipeline/test-kibana-audit-logs.log-expected.json

@@ -163,6 +163,62 @@
                     "superuser"
                 ]
             }
+        },
+        {
+            "@timestamp": "2022-09-09T13:16:58.044+00:00",
+            "ecs": {
+                "version": "8.4.0"
+            },
+            "event": {
+                "action": "bulk_get",
+                "category": [
+                    "database"
+                ],
+                "created": "2022-09-09T13:16:58.044+00:00",
+                "ingested": "2022-09-09T13:44:23.397440547Z",
+                "kind": "event",
+                "outcome": "success",
+                "type": [
+                    "access"
+                ]
+            },
+            "kibana": {
+                "saved_object": {
+                    "id": "1",
+                    "type": "fake",
+                    "name": "so_name_1"
+                },
+                "session_id": "Bv1bSOJ7dMYoppdDmlCiPfP1v8Q7JHXDpc2mOrfoxJs=",
+                "space_id": "default"
+            },
+            "log": {
+                "level": "INFO",
+                "logger": "plugins.security.audit.ecs"
+            },
+            "message": "User has accessed space [id=default]",
+            "process": {
+                "pid": 7
+            },
+            "service": {
+                "node": {
+                    "roles": [
+                        "background_tasks",
+                        "ui"
+                    ]
+                }
+            },
+            "trace": {
+                "id": "fbed6b3b-4e1c-4525-9597-391d5f718e89"
+            },
+            "transaction": {
+                "id": "256b899bfffe8b3f"
+            },
+            "user": {
+                "name": "elastic",
+                "roles": [
+                    "superuser"
+                ]
+            }
         }
     ]
 }

packages/kibana/data_stream/audit/fields/package-fields.yml

@@ -13,6 +13,9 @@
     - name: saved_object.id
       type: keyword
       description: The id of the saved object associated with this event.
+    - name: saved_object.name
+      type: keyword
+      description: The name of the saved object associated with this event.
     - name: add_to_spaces
       type: keyword
       description: The set of space ids that a saved object was shared to.

packages/kibana/docs/README.md

@@ -47,6 +47,7 @@ UI in Kibana. To enable this usage, set `xpack.enabled: true` on the package con
 | kibana.delete_from_spaces | The set of space ids that a saved object was removed from. | keyword |
 | kibana.lookup_realm | The Elasticsearch lookup realm which fulfilled a login event. | keyword |
 | kibana.saved_object.id | The id of the saved object associated with this event. | keyword |
+| kibana.saved_object.name | The name of the saved object associated with this event. | keyword |
 | kibana.saved_object.type | The type of the saved object associated with this event. | keyword |
 | kibana.session_id | The ID of the user session associated with this event. Each login attempt results in a unique session id. | keyword |
 | kibana.space_id | The id of the space associated with this event. | keyword |

packages/kibana/manifest.yml

@@ -1,6 +1,6 @@
 name: kibana
 title: Kibana
-version: 2.5.1
+version: 2.5.2
 description: Collect logs and metrics from Kibana with Elastic Agent.
 type: integration
 icons: