[FEATURE] Standalone audit logging for disabled security mode

[Taiwo435]

Description

Enable audit logging as an independent capability in disabled mode (plugins.security.disabled: true) without requiring any security features — no TLS, no authentication, no authorization.

Background

With SSL-only mode audit logging merged (#6304, #6321), users running OpenSearch with TLS-only have full audit visibility. However, users running with security completely disabled (common in development, log analytics, and internal observability clusters) still have no audit trail.

Compliance frameworks (SOC2, HIPAA, PCI-DSS, GDPR) require audit logs even when access control is not configured.

This is the second phase of the multi-phase standalone audit effort:

1. SSL-only mode (feat(audit): Implement standalone audit logging for SSL-only mode #6304)
2. Disabled mode ← This issue
3. Standalone audit plugin (extracted from security plugin) — future

Scope

All features from SSL-only mode now work in disabled mode:

• REQUEST_AUDIT category for all REST/transport actions
• Request body logging with sensitive header exclusion
• Index resolution and bulk per-item event tracking
• Ignore-users and ignore-requests filtering
• Transport-layer interception (TRANSPORT_AUDIT)
• Document-level compliance tracking (COMPLIANCE_DOC_WRITE, COMPLIANCE_DOC_READ)
• All existing sinks supported (internal_opensearch, log4j, webhook, Kafka)
• 17 settings dynamically configurable via PUT _cluster/settings

What's different from SSL-only mode

	SSL-only	Disabled
TLS on REST	Required	Not required (plain HTTP)
TLS on Transport	Required	Not required
Client cert identity (mTLS)	Available	Not available (no TLS)
User identity in events	Source IP + cert CN	Source IP only

Configuration

plugins.security.disabled: true
plugins.security.audit.type: log4j  # or internal_opensearch, webhook

Related

• SSL-only audit logging: feat(audit): Implement standalone audit logging for SSL-only mode #6304
• PR review follow-up: fix(audit): Address PR review feedback from #6304 #6321
• Broader vision: [PROPOSAL] Standalone Audit Logging Plugin for OpenSearch: #501
• Unified disabled_categories: feat(audit): Add unified disabled_categories setting (#6222) #6271