Why doesn’t audit logging log if I delete users or change permissions? Is it not capable of doing this?
@Ibrahim Which version of edfe are you running, in the latest version (1.12.0 and 1.11.0), there is an option in the kibana GUI under Security → Audit Logs → Compliance settings → External config logging
If you enable this option, the audit log should include those changes. The details of the changes might not be what you expect however, it will not say which user/rule was deleted or added for example. Hope this helps