_audit log keeps track of over a million actions daily, but does it audit export (e.g. CSV) and share?

[greich]

Sharing a search, which makes the results public if I am not mistaken, and exports e.g. to CSV seem two security risks.
I cannot find an action/capability under which it is recorded in the audit log.

[David · Accepted solution]

Not in the audit log, but this is tracked in the web access log. Try doing a search for export in _internal to find exports. Sharing is a bit more complicated, but the UI will hit the acl endpoint to adjust the permissions, which effectively shares it (though it doesn't tell you that the user actually sent out the link, or tell you that anyone looked at it).

Alternatively, you can leverage the app that I wrote to track exactly these types of questions. The app is called Search Activity, and is here: https://apps.splunk.com/app/2632/. The app tracks all of the above in an accelerated data store (allowing you to query those millions of messages over months in a fraction of a second), and I'm also going to create a method in an upcoming release to allow you to find when multiple users view the same search results -- I.e., not just that I shared my results but that you actually viewed them.

[greich]

The app looks interesting, and I will follow up on this.
In the meanwhile, accepting this answer as the hint was relevant and allowed me to complete the immediate stats gathering exercise.