Security settings in Kibanaedit

You do not need to configure any additional settings to use the security features in Kibana. They are enabled by default.

General security settingsedit

xpack.security.enabled

By default, Kibana automatically detects whether to enable the security features based on the license and whether Elasticsearch security features are enabled.

Do not set this to false; it disables the login form, user and role management screens, and authorization using Kibana privileges. To disable security features entirely, see Elasticsearch security settings.

Authentication security settingsedit

You configure authentication settings in the xpack.security.authc namespace in kibana.yml.

For example:

xpack.security.authc:
    providers:
      basic.basic1: 
          order: 0 
          ...

      saml.saml1: 
          order: 1
          ...

      saml.saml2: 
          order: 2
          ...

      pki.realm3:
          order: 3
          ...
    ...

Specifies the type of authentication provider (for example, basic, token, saml, oidc, kerberos, pki) and the provider name. This setting is mandatory.

Specifies the order of the provider in the authentication chain and on the Login Selector UI. This setting is mandatory.

Specifies the settings for the SAML authentication provider with a saml1 name.

Specifies the settings for the SAML authentication provider with a saml2 name.

The valid settings in the xpack.security.authc.providers namespace vary depending on the authentication provider type. For more information, refer to Authentication.

Valid settings for all authentication providersedit

xpack.security.authc.providers. <provider-type>.<provider-name>.enabled logo cloud

Determines if the authentication provider should be enabled. By default, Kibana enables the provider as soon as you configure any of its properties.

xpack.security.authc.providers. <provider-type>.<provider-name>.order logo cloud

Order of the provider in the authentication chain and on the Login Selector UI.

xpack.security.authc.providers. <provider-type>.<provider-name>.description logo cloud

Custom description of the provider entry displayed on the Login Selector UI.

xpack.security.authc.providers. <provider-type>.<provider-name>.hint logo cloud

Custom hint for the provider entry displayed on the Login Selector UI.

xpack.security.authc.providers. <provider-type>.<provider-name>.icon logo cloud

Custom icon for the provider entry displayed on the Login Selector UI.

xpack.security.authc.providers.<provider-type>. <provider-name>.showInSelector logo cloud

Flag that indicates if the provider should have an entry on the Login Selector UI. Setting this to false doesn’t remove the provider from the authentication chain.

You are unable to set this setting to false for basic and token authentication providers.

xpack.security.authc.providers.<provider-type>. <provider-name>.accessAgreement.message logo cloud

Access agreement text in Markdown format. For more information, refer to Access agreement.

xpack.security.authc.providers.<provider-type>. <provider-name>.session.idleTimeout logo cloud

Ensures that user sessions will expire after a period of inactivity. Setting this to 0 will prevent sessions from expiring because of inactivity. By default, this setting is equal to xpack.security.session.idleTimeout.

Use a string of <count>[ms|s|m|h|d|w|M|Y] (e.g. 20m, 24h, 7d, 1w).

xpack.security.authc.providers.<provider-type>. <provider-name>.session.lifespan logo cloud

Ensures that user sessions will expire after the defined time period. This behavior is also known as an "absolute timeout". If this is set to 0, user sessions could stay active indefinitely. By default, this setting is equal to xpack.security.session.lifespan.

Use a string of <count>[ms|s|m|h|d|w|M|Y] (e.g. 20m, 24h, 7d, 1w).

SAML authentication provider settingsedit

In addition to the settings that are valid for all providers, you can specify the following settings:

xpack.security.authc.providers. saml.<provider-name>.realm logo cloud

SAML realm in Elasticsearch that provider should use.

xpack.security.authc.providers. saml.<provider-name>.useRelayStateDeepLink logo cloud

Determines if the provider should treat the RelayState parameter as a deep link in Kibana during Identity Provider initiated log in. By default, this setting is set to false. The link specified in RelayState should be a relative, URL-encoded Kibana URL. For example, the /app/dashboards#/list link in RelayState parameter would look like this: RelayState=%2Fapp%2Fdashboards%23%2Flist.

OpenID Connect authentication provider settingsedit

In addition to the settings that are valid for all providers, you can specify the following settings:

xpack.security.authc.providers. oidc.<provider-name>.realm logo cloud

OpenID Connect realm in Elasticsearch that the provider should use.

Anonymous authentication provider settingsedit

In addition to the settings that are valid for all providers, you can specify the following settings:

You can configure only one anonymous provider per Kibana instance.

xpack.security.authc.providers. anonymous.<provider-name>.credentials logo cloud

Credentials that Kibana should use internally to authenticate anonymous requests to Elasticsearch. Possible values are: username and password, API key, or the constant elasticsearch_anonymous_user if you want to leverage Elasticsearch anonymous access.

For example:

# Username and password credentials
xpack.security.authc.providers.anonymous.anonymous1:
  credentials:
    username: "anonymous_service_account"
    password: "anonymous_service_account_password"

# API key (concatenated and base64-encoded)
xpack.security.authc.providers.anonymous.anonymous1:
  credentials:
    apiKey: "VnVhQ2ZHY0JDZGJrUW0tZTVhT3g6dWkybHAyYXhUTm1zeWFrdzl0dk5udw=="

# API key (as returned from Elasticsearch API)
xpack.security.authc.providers.anonymous.anonymous1:
  credentials:
    apiKey.id: "VuaCfGcBCdbkQm-e5aOx"
    apiKey.key: "ui2lp2axTNmsyakw9tvNnw"

# Elasticsearch anonymous access
xpack.security.authc.providers.anonymous.anonymous1:
  credentials: "elasticsearch_anonymous_user"
HTTP authentication settingsedit

There is a very limited set of cases when you’d want to change these settings. For more information, refer to HTTP authentication.

xpack.security.authc.http.enabled

Determines if HTTP authentication should be enabled. By default, this setting is set to true.

xpack.security.authc.http.autoSchemesEnabled

Determines if HTTP authentication schemes used by the enabled authentication providers should be automatically supported during HTTP authentication. By default, this setting is set to true.

xpack.security.authc.http.schemes[]

List of HTTP authentication schemes that Kibana HTTP authentication should support. By default, this setting is set to ['apikey'] to support HTTP authentication with ApiKey scheme.

Login user interface settingsedit

You can configure the following settings in the kibana.yml file.

xpack.security.loginAssistanceMessage logo cloud

Adds a message to the login UI. Useful for displaying information about maintenance windows, links to corporate sign up pages, and so on.

xpack.security.loginHelp logo cloud

Adds a message accessible at the login UI with additional help information for the login process.

xpack.security.authc.selector.enabled logo cloud

Determines if the login selector UI should be enabled. By default, this setting is set to true if more than one authentication provider is configured.

Session and cookie security settingsedit

You can configure the following settings in the kibana.yml file.

xpack.security.cookieName

Sets the name of the cookie used for the session. The default value is "sid".

xpack.security.encryptionKey

An arbitrary string of 32 characters or more that is used to encrypt session information. Do not expose this key to users of Kibana. By default, a value is automatically generated in memory. If you use that default behavior, all sessions are invalidated when Kibana restarts. In addition, high-availability deployments of Kibana will behave unexpectedly if this setting isn’t the same for all instances of Kibana.

xpack.security.secureCookies

Sets the secure flag of the session cookie. The default value is false. It is automatically set to true if server.ssl.enabled is set to true. Set this to true if SSL is configured outside of Kibana (for example, you are routing requests through a load balancer or proxy).

xpack.security.sameSiteCookies logo cloud

Sets the SameSite attribute of the session cookie. This allows you to declare whether your cookie should be restricted to a first-party or same-site context. Valid values are Strict, Lax, None. This is not set by default, which modern browsers will treat as Lax. If you use Kibana embedded in an iframe in modern browsers, you might need to set it to None. Setting this value to None requires cookies to be sent over a secure connection by setting xpack.security.secureCookies: true`. Some old versions of IE11 do not support SameSite: None.

xpack.security.session.idleTimeout logo cloud

Ensures that user sessions will expire after a period of inactivity. This and xpack.security.session.lifespan are both highly recommended. You can also specify this setting for every provider separately. If this is not set or set to 0, then sessions will never expire due to inactivity. By default, this setting is not set.

Use a string of <count>[ms|s|m|h|d|w|M|Y] (e.g. 20m, 24h, 7d, 1w).

xpack.security.session.lifespan logo cloud

Ensures that user sessions will expire after the defined time period. This behavior is also known as an "absolute timeout". If this is not set or set to 0, user sessions could stay active indefinitely. This and xpack.security.session.idleTimeout are both highly recommended. You can also specify this setting for every provider separately. By default, this setting is not set.

Use a string of <count>[ms|s|m|h|d|w|M|Y] (e.g. 20m, 24h, 7d, 1w).

xpack.security.session.cleanupInterval logo cloud

Sets the interval at which Kibana tries to remove expired and invalid sessions from the session index. By default, this value is 1 hour. The minimum value is 10 seconds.

Use a string of <count>[ms|s|m|h|d|w|M|Y] (e.g. 20m, 24h, 7d, 1w).

Encrypted saved objects settingsedit

These settings control the encryption of saved objects with sensitive data. For more details, refer to Secure saved objects.

In high-availability deployments, make sure you use the same encryption and decryption keys for all instances of Kibana. Although the keys can be specified in clear text in kibana.yml, it’s recommended to store them securely in the Kibana Keystore.

xpack.encryptedSavedObjects. encryptionKey

An arbitrary string of at least 32 characters that is used to encrypt sensitive properties of saved objects before they’re stored in Elasticsearch. If not set, Kibana will generate a random key on startup, but certain features won’t be available until you set the encryption key explicitly.

xpack.encryptedSavedObjects. keyRotation.decryptionOnlyKeys

An optional list of previously used encryption keys. Like xpack.encryptedSavedObjects.encryptionKey, these must be at least 32 characters in length. Kibana doesn’t use these keys for encryption, but may still require them to decrypt some existing saved objects. Use this setting if you wish to change your encryption key, but don’t want to lose access to saved objects that were previously encrypted with a different key.

Audit logging settingsedit

You can enable audit logging to support compliance, accountability, and security. When enabled, Kibana will capture:

  • Who performed an action
  • What action was performed
  • When the action occurred

For more details and a reference of audit events, refer to Audit logs.

xpack.security.audit.enabled logo cloud

Set to true and configure an appender with xpack.security.audit.appender to enable ECS audit logging`. Default: false

For example:

xpack.security.audit.enabled: true
xpack.security.audit.appender:
  type: rolling-file
  fileName: ./audit.log
  policy:
    type: time-interval
    interval: 24h 
  strategy:
    type: numeric
    max: 10 
  layout:
    type: json

Rotates log files every 24 hours.

Keeps maximum of 10 log files before deleting older ones.

Elasticsearch Service does not support custom log file policies. To enable audit logging on Elasticsearch Service only specify:

xpack.security.audit.enabled: true
xpack.security.audit.appender.type: rolling-file

[7.15.0] Deprecated in 7.15.0. In 8.0 and later, the legacy audit logger will be removed, and this setting will enable the ECS audit logger with a default appender. To enable the legacy audit logger only specify:

xpack.security.audit.enabled: true

xpack.security.audit.appender logo cloud

Optional. Specifies where audit logs should be written to and how they should be formatted.

xpack.security.audit.appender.type logo cloud

Required. Specifies where audit logs should be written to. Allowed values are console, file, or rolling-file.

Refer to file appender and rolling file appender for appender specific settings.

xpack.security.audit.appender.layout.type

Required. Specifies how audit logs should be formatted. Allowed values are json or pattern.

Refer to pattern layout for layout specific settings.

We recommend using json format to allow ingesting Kibana audit logs into Elasticsearch using Filebeat.

File appenderedit

The file appender writes to a file and can be configured using the following settings:

xpack.security.audit.appender.fileName

Required. Full file path the log file should be written to.

Rolling file appenderedit

The rolling-file appender writes to a file and rotates it using a rolling strategy, when a particular policy is triggered:

xpack.security.audit.appender.fileName

Required. Full file path the log file should be written to.

xpack.security.audit.appender.policy.type

Specifies when a rollover should occur. Allowed values are size-limit and time-interval. Default: time-interval.

Refer to size limit policy and time interval policy for policy specific settings.

xpack.security.audit.appender.strategy.type

Specifies how the rollover should occur. Only allowed value is currently numeric. Default: numeric

Refer to numeric strategy for strategy specific settings.

Size limit triggering policyedit

The size-limit triggering policy will rotate the file when it reaches a certain size:

xpack.security.audit.appender.policy.size

Maximum size the log file should reach before a rollover should be performed. Default: 100mb

Time interval triggering policyedit

The time-interval triggering policy will rotate the file every given interval of time:

xpack.security.audit.appender.policy.interval

How often a rollover should occur. Default: 24h

xpack.security.audit.appender.policy.modulate

Whether the interval should be adjusted to cause the next rollover to occur on the interval boundary. Default: true

Numeric rolling strategyedit

The numeric rolling strategy will suffix the log file with a given pattern when rolling over, and will retain a fixed number of rolled files:

xpack.security.audit.appender.strategy.pattern

Suffix to append to the file name when rolling over. Must include %i. Default: -%i

xpack.security.audit.appender.strategy.max

Maximum number of files to keep. Once this number is reached, oldest files will be deleted. Default: 7

Pattern layoutedit

The pattern layout outputs a string, formatted using a pattern with special placeholders, which will be replaced with data from the actual log message:

xpack.security.audit.appender.layout.pattern

Optional. Specifies how the log line should be formatted. Default: [%date][%level][%logger]%meta %message

xpack.security.audit.appender.layout.highlight

Optional. Set to true to enable highlighting log messages with colors.

Ignore filtersedit

xpack.security.audit.ignore_filters[] logo cloud

List of filters that determine which events should be excluded from the audit log. An event will get filtered out if at least one of the provided filters matches.

For example:

xpack.security.audit.ignore_filters:
- actions: [http_request] 
- categories: [database]
  types: [creation, change, deletion] 

Filters out HTTP request events

Filters out any data write events

xpack.security.audit.ignore_filters[].actions[] logo cloud

List of values matched against the event.action field of an audit event. Refer to Audit logs for a list of available events.

xpack.security.audit.ignore_filters[].categories[] logo cloud

List of values matched against the event.category field of an audit event. Refer to ECS categorization field for allowed values.

xpack.security.audit.ignore_filters[].types[] logo cloud

List of values matched against the event.type field of an audit event. Refer to ECS type field for allowed values.

xpack.security.audit.ignore_filters[].outcomes[] logo cloud

List of values matched against the event.outcome field of an audit event. Refer to ECS outcome field for allowed values.