Kibana privileges

Kibana privileges grant users access to features within Kibana. Roles have privileges to determine whether users have write or read access.

To learn how to assign privileges to a role, refer to Defining roles.

Assigning a base privilege applies the same access level across all feature groups instead of setting a level for each feature.

• All: Grants full read-write access.
• Read: Grants read-only access.
• Customize: Allows you to set the access level for each feature separately.

From the role management screen:

×

Using the role APIs:

PUT /api/security/role/my_kibana_role
{
  "elasticsearch": {
    "cluster" : [ ],
    "indices" : [ ]
  },
  "kibana": [
    {
      "base": ["all"],
      "feature": {},
      "spaces": ["marketing"]
    }
  ]
}
		

Assigning a feature privilege grants access to a specific feature. For each feature, select the type of access you want to allow:

• All: Users have full access to the feature, which includes performing all available actions and managing configuration.
• Read: Users can view the feature, but can't perform any actions or manage configuration.
• None: Users can't access or view the feature.

In role management, features are organized into the following groups.

Some features allow for finer access control than the All and Read privileges. This additional level of control is a subscription feature.

From the role management screen:

×

Using the role APIs:

PUT /api/security/role/my_kibana_role
{
  "elasticsearch": {
    "cluster" : [ ],
    "indices" : [ ]
  },
  "kibana": [
    {
      "base": [],
      "feature": {
        "visualize_v2": ["all"],
        "dashboard_v2": ["read", "url_create"]
      },
      "spaces": ["marketing"]
    }
  ]
}
		

Each of the following privileges controls access to a different feature.

These privileges control specific actions in Discover. Selecting All includes everything in the following table.

These privileges control specific actions on dashboards. Selecting All includes everything in the following table.

This privilege controls a specific action in Canvas. Selecting All includes everything in the following table.

These privileges control specific actions in the Visualize library. Selecting All includes everything in the following table.

These privileges control specific actions on workflows. Selecting All includes every privilege in the following table except Update managed workflows, which you grant separately.

Each of the following privileges controls access to a different feature.

These privileges control specific parts of Osquery. Selecting All includes everything in the following table.

This privilege controls a specific action on connectors. Selecting All includes everything in the following table.

These privileges control specific actions on the Data Set Quality page. Selecting All includes everything in the following table.

These privileges control the settings that apply to all rules in a space. Selecting All includes everything in the following table.