[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-kibana-audit":3,"mdc--thz2x4-key":34,"related-repo-elastic-kibana-audit":2433,"related-org-elastic-kibana-audit":2523},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"kibana-audit","configure Kibana audit logging","Enable and configure Kibana audit logging for saved object access, logins, and space operations. Use when setting up Kibana audit, filtering events, or correlating Kibana and ES audit logs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,20],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Audit","audit",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"Kibana","kibana",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:53.815333",null,41,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],"Official Elastic Skills","https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fkibana\u002Fkibana-audit","---\nname: kibana-audit\ndescription: >\n Enable and configure Kibana audit logging for saved object access, logins, and space\n operations. Use when setting up Kibana audit, filtering events, or correlating Kibana\n and ES audit logs.\nmetadata:\n author: elastic\n version: 0.1.0\n---\n\n# Kibana Audit Logging\n\nEnable and configure audit logging for Kibana via `kibana.yml`. Kibana audit logs cover application-layer security\nevents that Elasticsearch does not see: saved object CRUD (dashboards, visualizations, index patterns, rules, cases),\nlogin\u002Flogout, session expiry, space operations, and Kibana-level RBAC enforcement.\n\nFor Elasticsearch audit logging (authentication failures, access grants\u002Fdenials, security config changes), see\n**elasticsearch-audit**. For authentication and API key management, see **elasticsearch-authn**. For roles and user\nmanagement, see **elasticsearch-authz**.\n\nFor detailed event types, schema, and correlation queries, see\n[references\u002Fapi-reference.md](references\u002Fapi-reference.md).\n\n> **Deployment note:** Kibana audit configuration differs across deployment types. See\n> [Deployment Compatibility](#deployment-compatibility) for details.\n\n## Jobs to Be Done\n\n- Enable or disable Kibana audit logging\n- Configure audit log output (rolling file, console)\n- Filter out noisy events (e.g. `saved_object_find`)\n- Investigate saved object access or deletion events\n- Track Kibana login\u002Flogout and session activity\n- Monitor space creation, modification, and deletion\n- Correlate Kibana audit events with Elasticsearch audit logs via `trace.id`\n- Ship Kibana audit logs to Elasticsearch for unified querying\n\n## Prerequisites\n\n| Item | Description |\n| --------------------- | ------------------------------------------------------------------------------ |\n| **Kibana access** | Filesystem access to `kibana.yml` (self-managed) or Cloud console access (ECH) |\n| **License** | Audit logging requires a gold, platinum, enterprise, or trial license |\n| **Elasticsearch URL** | Cluster endpoint for correlation queries against `.security-audit-*` |\n\nPrompt the user for any missing values.\n\n## Enable Kibana Audit Logging\n\nKibana audit is configured statically in `kibana.yml` (not via API). A Kibana restart is required after changes.\n\n```yaml\nxpack.security.audit.enabled: true\nxpack.security.audit.appender:\n type: rolling-file\n fileName: \u002Fpath\u002Fto\u002Fkibana\u002Fdata\u002Faudit.log\n policy:\n type: time-interval\n interval: 24h\n strategy:\n type: numeric\n max: 10\n```\n\nTo disable, set `xpack.security.audit.enabled` to `false` and restart Kibana.\n\n### Appender types\n\n| Type | Description |\n| -------------- | ------------------------------------------------------- |\n| `rolling-file` | Writes to a file with rotation policy. Recommended. |\n| `console` | Writes to stdout. Useful for containerized deployments. |\n\n## Event Types\n\nKibana audit events use ECS format with the same core fields as ES audit (`event.action`, `event.outcome`, `user.name`,\n`trace.id`, `@timestamp`) plus Kibana-specific fields like `kibana.saved_object.type`, `kibana.saved_object.id`, and\n`kibana.space_id`.\n\nKey event actions:\n\n| Event action | Description | Category |\n| ---------------------------------- | -------------------------------------------- | -------------- |\n| `saved_object_create` | A saved object was created | database |\n| `saved_object_get` | A saved object was read | database |\n| `saved_object_update` | A saved object was updated | database |\n| `saved_object_delete` | A saved object was deleted | database |\n| `saved_object_find` | A saved object search was performed | database |\n| `saved_object_open_point_in_time` | A PIT was opened on saved objects | database |\n| `saved_object_close_point_in_time` | A PIT was closed on saved objects | database |\n| `saved_object_resolve` | A saved object was resolved (alias redirect) | database |\n| `login` | A user logged in (success or failure) | authentication |\n| `logout` | A user logged out | authentication |\n| `session_cleanup` | An expired session was cleaned up | authentication |\n| `access_agreement_acknowledged` | A user accepted the access agreement | authentication |\n| `space_create` | A Kibana space was created | web |\n| `space_update` | A Kibana space was updated | web |\n| `space_delete` | A Kibana space was deleted | web |\n| `space_get` | A Kibana space was retrieved | web |\n\nSee [references\u002Fapi-reference.md](references\u002Fapi-reference.md) for the complete event schema.\n\n## Filter Policies\n\nSuppress noisy events using `ignore_filters` in `kibana.yml`:\n\n```yaml\nxpack.security.audit.ignore_filters:\n - actions: [saved_object_find]\n categories: [database]\n```\n\n| Filter field | Type | Description |\n| ------------ | ---- | -------------------------- |\n| `actions` | list | Event actions to ignore |\n| `categories` | list | Event categories to ignore |\n\nAn event is filtered out if it matches **all** specified fields within a single filter entry.\n\n## Correlate with Elasticsearch Audit Logs\n\nWhen Kibana makes requests to Elasticsearch on behalf of a user, both systems record the same `trace.id` (passed via the\n`X-Opaque-Id` header). This is the primary key for correlating events across the two audit logs.\n\n> **Prerequisite:** Elasticsearch audit must be enabled via the cluster settings API. See the **elasticsearch-audit**\n> skill for setup instructions, event types, and ES-specific filter policies.\n\n### Correlation workflow\n\n1. Find the suspicious event in the Kibana audit log.\n2. Extract its `trace.id` value.\n3. Search the ES audit index (`.security-audit-*`) for all events with the same `trace.id`.\n4. Review the combined timeline to understand what ES-level operations the Kibana action triggered.\n\nThe **elasticsearch-audit** skill also documents this workflow from the ES side — use it when starting from an ES audit\nevent and looking for the originating Kibana action.\n\n### Search ES audit by trace ID\n\nGiven a suspicious Kibana event (e.g. a saved object deletion), extract its `trace.id` and search the ES audit index:\n\n```bash\ncurl -X POST \"${ELASTICSEARCH_URL}\u002F.security-audit-*\u002F_search\" \\\n \u003Cauth_flags> \\\n -H \"Content-Type: application\u002Fjson\" \\\n -d '{\n \"query\": {\n \"bool\": {\n \"filter\": [\n { \"term\": { \"trace.id\": \"'\"${TRACE_ID}\"'\" } },\n { \"range\": { \"@timestamp\": { \"gte\": \"now-24h\" } } }\n ]\n }\n },\n \"sort\": [{ \"@timestamp\": { \"order\": \"asc\" } }]\n }'\n```\n\nSecondary correlation fields: `user.name`, `source.ip`, and `@timestamp` (time-window joins).\n\n### Ship Kibana audit logs to Elasticsearch\n\nTo query Kibana audit events alongside ES audit events, ship the Kibana audit log file to an Elasticsearch index using\nFilebeat:\n\n```yaml\nfilebeat.inputs:\n - type: log\n paths: [\"\u002Fpath\u002Fto\u002Fkibana\u002Fdata\u002Faudit.log\"]\n json.keys_under_root: true\n json.add_error_key: true\n\noutput.elasticsearch:\n hosts: [\"https:\u002F\u002Flocalhost:9200\"]\n index: \"kibana-audit-%{+yyyy.MM.dd}\"\n```\n\nOnce indexed, both `.security-audit-*` (ES) and `kibana-audit-*` (Kibana) can be searched together using a multi-index\nquery filtered by `trace.id`.\n\n## Examples\n\n### Enable Kibana audit for compliance\n\n**Request:** \"Enable Kibana audit logging and keep 10 rotated log files.\"\n\n```yaml\nxpack.security.audit.enabled: true\nxpack.security.audit.appender:\n type: rolling-file\n fileName: \u002Fvar\u002Flog\u002Fkibana\u002Faudit.log\n policy:\n type: time-interval\n interval: 24h\n strategy:\n type: numeric\n max: 10\n```\n\nRestart Kibana after applying.\n\n### Investigate a deleted dashboard\n\n**Request:** \"Someone deleted a dashboard. Check the Kibana audit log.\"\n\nSearch the Kibana audit log (or the indexed `kibana-audit-*` data) for `saved_object_delete` events with\n`kibana.saved_object.type: dashboard`. Extract the `trace.id` and cross-reference with the ES audit index to see the\nunderlying Elasticsearch operations.\n\n### Reduce audit noise from saved object searches\n\n**Request:** \"Kibana audit logs are too large because of constant saved_object_find events.\"\n\n```yaml\nxpack.security.audit.ignore_filters:\n - actions: [saved_object_find]\n categories: [database]\n```\n\nThis suppresses high-volume read operations while preserving create, update, and delete events.\n\n## Guidelines\n\n### Always enable alongside Elasticsearch audit\n\nFor full coverage, enable audit in both `kibana.yml` and Elasticsearch. Without Kibana audit, saved object access and\nKibana login events are invisible. Without ES audit, cluster-level operations are invisible. See the\n**elasticsearch-audit** skill for ES-side setup.\n\n### Use trace.id for correlation\n\nWhen investigating a Kibana event, always extract `trace.id` and search the ES audit index (`.security-audit-*`). This\nreveals the full chain of operations triggered by a single Kibana action. See\n[Correlate with Elasticsearch Audit Logs](#correlate-with-elasticsearch-audit-logs) above for queries.\n\n### Filter noisy read events\n\n`saved_object_find` generates very high volume on busy Kibana instances. Suppress it unless you specifically need to\naudit read access.\n\n### Ship logs to Elasticsearch for unified querying\n\nKibana audit logs are written to files by default. Ship them to Elasticsearch via Filebeat for programmatic querying\nalongside ES audit events.\n\n### Rotate and retain appropriately\n\nConfigure rolling-file rotation to avoid filling the disk. A 30-90 day retention is typical for compliance.\n\n## Deployment Compatibility\n\n| Capability | Self-managed | ECH | Serverless |\n| --------------------------- | ------------ | ------------ | ------------- |\n| Kibana audit (`kibana.yml`) | Yes | Via Cloud UI | Not available |\n| Rolling-file appender | Yes | Via Cloud UI | Not available |\n| Console appender | Yes | Yes | Not available |\n| Ignore filters | Yes | Via Cloud UI | Not available |\n| Correlate via `trace.id` | Yes | Yes | Not available |\n| Ship to ES via Filebeat | Yes | Yes | Not available |\n\n**ECH notes:** Kibana audit is enabled via the deployment edit page in the Cloud console. Log files are accessible\nthrough the Cloud console deployment logs.\n\n**Serverless notes:**\n\n- Kibana audit logging is not user-configurable on Serverless. Security events are managed by Elastic as part of the\n platform.\n- If a user asks about Kibana auditing on Serverless, direct them to the Elastic Cloud console or their account team.\n",{"data":35,"body":38},{"name":4,"description":6,"metadata":36},{"author":8,"version":37},"0.1.0",{"type":39,"children":40},"root",[41,50,65,92,104,126,133,192,198,287,292,298,310,494,514,521,576,582,646,651,1015,1026,1032,1051,1125,1193,1205,1211,1231,1250,1256,1300,1311,1317,1329,1568,1594,1600,1605,1790,1816,1822,1828,1838,1984,1989,1995,2004,2038,2044,2053,2120,2125,2131,2137,2155,2161,2187,2193,2203,2209,2214,2220,2225,2230,2396,2406,2414,2427],{"type":42,"tag":43,"props":44,"children":46},"element","h1",{"id":45},"kibana-audit-logging",[47],{"type":48,"value":49},"text","Kibana Audit Logging",{"type":42,"tag":51,"props":52,"children":53},"p",{},[54,56,63],{"type":48,"value":55},"Enable and configure audit logging for Kibana via ",{"type":42,"tag":57,"props":58,"children":60},"code",{"className":59},[],[61],{"type":48,"value":62},"kibana.yml",{"type":48,"value":64},". Kibana audit logs cover application-layer security\nevents that Elasticsearch does not see: saved object CRUD (dashboards, visualizations, index patterns, rules, cases),\nlogin\u002Flogout, session expiry, space operations, and Kibana-level RBAC enforcement.",{"type":42,"tag":51,"props":66,"children":67},{},[68,70,76,78,83,85,90],{"type":48,"value":69},"For Elasticsearch audit logging (authentication failures, access grants\u002Fdenials, security config changes), see\n",{"type":42,"tag":71,"props":72,"children":73},"strong",{},[74],{"type":48,"value":75},"elasticsearch-audit",{"type":48,"value":77},". For authentication and API key management, see ",{"type":42,"tag":71,"props":79,"children":80},{},[81],{"type":48,"value":82},"elasticsearch-authn",{"type":48,"value":84},". For roles and user\nmanagement, see ",{"type":42,"tag":71,"props":86,"children":87},{},[88],{"type":48,"value":89},"elasticsearch-authz",{"type":48,"value":91},".",{"type":42,"tag":51,"props":93,"children":94},{},[95,97,103],{"type":48,"value":96},"For detailed event types, schema, and correlation queries, see\n",{"type":42,"tag":98,"props":99,"children":101},"a",{"href":100},"references\u002Fapi-reference.md",[102],{"type":48,"value":100},{"type":48,"value":91},{"type":42,"tag":105,"props":106,"children":107},"blockquote",{},[108],{"type":42,"tag":51,"props":109,"children":110},{},[111,116,118,124],{"type":42,"tag":71,"props":112,"children":113},{},[114],{"type":48,"value":115},"Deployment note:",{"type":48,"value":117}," Kibana audit configuration differs across deployment types. See\n",{"type":42,"tag":98,"props":119,"children":121},{"href":120},"#deployment-compatibility",[122],{"type":48,"value":123},"Deployment Compatibility",{"type":48,"value":125}," for details.",{"type":42,"tag":127,"props":128,"children":130},"h2",{"id":129},"jobs-to-be-done",[131],{"type":48,"value":132},"Jobs to Be Done",{"type":42,"tag":134,"props":135,"children":136},"ul",{},[137,143,148,161,166,171,176,187],{"type":42,"tag":138,"props":139,"children":140},"li",{},[141],{"type":48,"value":142},"Enable or disable Kibana audit logging",{"type":42,"tag":138,"props":144,"children":145},{},[146],{"type":48,"value":147},"Configure audit log output (rolling file, console)",{"type":42,"tag":138,"props":149,"children":150},{},[151,153,159],{"type":48,"value":152},"Filter out noisy events (e.g. ",{"type":42,"tag":57,"props":154,"children":156},{"className":155},[],[157],{"type":48,"value":158},"saved_object_find",{"type":48,"value":160},")",{"type":42,"tag":138,"props":162,"children":163},{},[164],{"type":48,"value":165},"Investigate saved object access or deletion events",{"type":42,"tag":138,"props":167,"children":168},{},[169],{"type":48,"value":170},"Track Kibana login\u002Flogout and session activity",{"type":42,"tag":138,"props":172,"children":173},{},[174],{"type":48,"value":175},"Monitor space creation, modification, and deletion",{"type":42,"tag":138,"props":177,"children":178},{},[179,181],{"type":48,"value":180},"Correlate Kibana audit events with Elasticsearch audit logs via ",{"type":42,"tag":57,"props":182,"children":184},{"className":183},[],[185],{"type":48,"value":186},"trace.id",{"type":42,"tag":138,"props":188,"children":189},{},[190],{"type":48,"value":191},"Ship Kibana audit logs to Elasticsearch for unified querying",{"type":42,"tag":127,"props":193,"children":195},{"id":194},"prerequisites",[196],{"type":48,"value":197},"Prerequisites",{"type":42,"tag":199,"props":200,"children":201},"table",{},[202,221],{"type":42,"tag":203,"props":204,"children":205},"thead",{},[206],{"type":42,"tag":207,"props":208,"children":209},"tr",{},[210,216],{"type":42,"tag":211,"props":212,"children":213},"th",{},[214],{"type":48,"value":215},"Item",{"type":42,"tag":211,"props":217,"children":218},{},[219],{"type":48,"value":220},"Description",{"type":42,"tag":222,"props":223,"children":224},"tbody",{},[225,249,265],{"type":42,"tag":207,"props":226,"children":227},{},[228,237],{"type":42,"tag":229,"props":230,"children":231},"td",{},[232],{"type":42,"tag":71,"props":233,"children":234},{},[235],{"type":48,"value":236},"Kibana access",{"type":42,"tag":229,"props":238,"children":239},{},[240,242,247],{"type":48,"value":241},"Filesystem access to ",{"type":42,"tag":57,"props":243,"children":245},{"className":244},[],[246],{"type":48,"value":62},{"type":48,"value":248}," (self-managed) or Cloud console access (ECH)",{"type":42,"tag":207,"props":250,"children":251},{},[252,260],{"type":42,"tag":229,"props":253,"children":254},{},[255],{"type":42,"tag":71,"props":256,"children":257},{},[258],{"type":48,"value":259},"License",{"type":42,"tag":229,"props":261,"children":262},{},[263],{"type":48,"value":264},"Audit logging requires a gold, platinum, enterprise, or trial license",{"type":42,"tag":207,"props":266,"children":267},{},[268,276],{"type":42,"tag":229,"props":269,"children":270},{},[271],{"type":42,"tag":71,"props":272,"children":273},{},[274],{"type":48,"value":275},"Elasticsearch URL",{"type":42,"tag":229,"props":277,"children":278},{},[279,281],{"type":48,"value":280},"Cluster endpoint for correlation queries against ",{"type":42,"tag":57,"props":282,"children":284},{"className":283},[],[285],{"type":48,"value":286},".security-audit-*",{"type":42,"tag":51,"props":288,"children":289},{},[290],{"type":48,"value":291},"Prompt the user for any missing values.",{"type":42,"tag":127,"props":293,"children":295},{"id":294},"enable-kibana-audit-logging",[296],{"type":48,"value":297},"Enable Kibana Audit Logging",{"type":42,"tag":51,"props":299,"children":300},{},[301,303,308],{"type":48,"value":302},"Kibana audit is configured statically in ",{"type":42,"tag":57,"props":304,"children":306},{"className":305},[],[307],{"type":48,"value":62},{"type":48,"value":309}," (not via API). A Kibana restart is required after changes.",{"type":42,"tag":311,"props":312,"children":317},"pre",{"className":313,"code":314,"language":315,"meta":316,"style":316},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","xpack.security.audit.enabled: true\nxpack.security.audit.appender:\n type: rolling-file\n fileName: \u002Fpath\u002Fto\u002Fkibana\u002Fdata\u002Faudit.log\n policy:\n type: time-interval\n interval: 24h\n strategy:\n type: numeric\n max: 10\n","yaml","",[318],{"type":42,"tag":57,"props":319,"children":320},{"__ignoreMap":316},[321,345,359,378,396,409,427,445,458,475],{"type":42,"tag":322,"props":323,"children":326},"span",{"class":324,"line":325},"line",1,[327,333,339],{"type":42,"tag":322,"props":328,"children":330},{"style":329},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[331],{"type":48,"value":332},"xpack.security.audit.enabled",{"type":42,"tag":322,"props":334,"children":336},{"style":335},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[337],{"type":48,"value":338},":",{"type":42,"tag":322,"props":340,"children":342},{"style":341},"--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC",[343],{"type":48,"value":344}," true\n",{"type":42,"tag":322,"props":346,"children":348},{"class":324,"line":347},2,[349,354],{"type":42,"tag":322,"props":350,"children":351},{"style":329},[352],{"type":48,"value":353},"xpack.security.audit.appender",{"type":42,"tag":322,"props":355,"children":356},{"style":335},[357],{"type":48,"value":358},":\n",{"type":42,"tag":322,"props":360,"children":362},{"class":324,"line":361},3,[363,368,372],{"type":42,"tag":322,"props":364,"children":365},{"style":329},[366],{"type":48,"value":367}," type",{"type":42,"tag":322,"props":369,"children":370},{"style":335},[371],{"type":48,"value":338},{"type":42,"tag":322,"props":373,"children":375},{"style":374},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[376],{"type":48,"value":377}," rolling-file\n",{"type":42,"tag":322,"props":379,"children":381},{"class":324,"line":380},4,[382,387,391],{"type":42,"tag":322,"props":383,"children":384},{"style":329},[385],{"type":48,"value":386}," fileName",{"type":42,"tag":322,"props":388,"children":389},{"style":335},[390],{"type":48,"value":338},{"type":42,"tag":322,"props":392,"children":393},{"style":374},[394],{"type":48,"value":395}," \u002Fpath\u002Fto\u002Fkibana\u002Fdata\u002Faudit.log\n",{"type":42,"tag":322,"props":397,"children":399},{"class":324,"line":398},5,[400,405],{"type":42,"tag":322,"props":401,"children":402},{"style":329},[403],{"type":48,"value":404}," policy",{"type":42,"tag":322,"props":406,"children":407},{"style":335},[408],{"type":48,"value":358},{"type":42,"tag":322,"props":410,"children":412},{"class":324,"line":411},6,[413,418,422],{"type":42,"tag":322,"props":414,"children":415},{"style":329},[416],{"type":48,"value":417}," type",{"type":42,"tag":322,"props":419,"children":420},{"style":335},[421],{"type":48,"value":338},{"type":42,"tag":322,"props":423,"children":424},{"style":374},[425],{"type":48,"value":426}," time-interval\n",{"type":42,"tag":322,"props":428,"children":430},{"class":324,"line":429},7,[431,436,440],{"type":42,"tag":322,"props":432,"children":433},{"style":329},[434],{"type":48,"value":435}," interval",{"type":42,"tag":322,"props":437,"children":438},{"style":335},[439],{"type":48,"value":338},{"type":42,"tag":322,"props":441,"children":442},{"style":374},[443],{"type":48,"value":444}," 24h\n",{"type":42,"tag":322,"props":446,"children":448},{"class":324,"line":447},8,[449,454],{"type":42,"tag":322,"props":450,"children":451},{"style":329},[452],{"type":48,"value":453}," strategy",{"type":42,"tag":322,"props":455,"children":456},{"style":335},[457],{"type":48,"value":358},{"type":42,"tag":322,"props":459,"children":461},{"class":324,"line":460},9,[462,466,470],{"type":42,"tag":322,"props":463,"children":464},{"style":329},[465],{"type":48,"value":417},{"type":42,"tag":322,"props":467,"children":468},{"style":335},[469],{"type":48,"value":338},{"type":42,"tag":322,"props":471,"children":472},{"style":374},[473],{"type":48,"value":474}," numeric\n",{"type":42,"tag":322,"props":476,"children":478},{"class":324,"line":477},10,[479,484,488],{"type":42,"tag":322,"props":480,"children":481},{"style":329},[482],{"type":48,"value":483}," max",{"type":42,"tag":322,"props":485,"children":486},{"style":335},[487],{"type":48,"value":338},{"type":42,"tag":322,"props":489,"children":491},{"style":490},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[492],{"type":48,"value":493}," 10\n",{"type":42,"tag":51,"props":495,"children":496},{},[497,499,504,506,512],{"type":48,"value":498},"To disable, set ",{"type":42,"tag":57,"props":500,"children":502},{"className":501},[],[503],{"type":48,"value":332},{"type":48,"value":505}," to ",{"type":42,"tag":57,"props":507,"children":509},{"className":508},[],[510],{"type":48,"value":511},"false",{"type":48,"value":513}," and restart Kibana.",{"type":42,"tag":515,"props":516,"children":518},"h3",{"id":517},"appender-types",[519],{"type":48,"value":520},"Appender types",{"type":42,"tag":199,"props":522,"children":523},{},[524,539],{"type":42,"tag":203,"props":525,"children":526},{},[527],{"type":42,"tag":207,"props":528,"children":529},{},[530,535],{"type":42,"tag":211,"props":531,"children":532},{},[533],{"type":48,"value":534},"Type",{"type":42,"tag":211,"props":536,"children":537},{},[538],{"type":48,"value":220},{"type":42,"tag":222,"props":540,"children":541},{},[542,559],{"type":42,"tag":207,"props":543,"children":544},{},[545,554],{"type":42,"tag":229,"props":546,"children":547},{},[548],{"type":42,"tag":57,"props":549,"children":551},{"className":550},[],[552],{"type":48,"value":553},"rolling-file",{"type":42,"tag":229,"props":555,"children":556},{},[557],{"type":48,"value":558},"Writes to a file with rotation policy. Recommended.",{"type":42,"tag":207,"props":560,"children":561},{},[562,571],{"type":42,"tag":229,"props":563,"children":564},{},[565],{"type":42,"tag":57,"props":566,"children":568},{"className":567},[],[569],{"type":48,"value":570},"console",{"type":42,"tag":229,"props":572,"children":573},{},[574],{"type":48,"value":575},"Writes to stdout. Useful for containerized deployments.",{"type":42,"tag":127,"props":577,"children":579},{"id":578},"event-types",[580],{"type":48,"value":581},"Event Types",{"type":42,"tag":51,"props":583,"children":584},{},[585,587,593,595,601,602,608,610,615,616,622,624,630,631,637,639,645],{"type":48,"value":586},"Kibana audit events use ECS format with the same core fields as ES audit (",{"type":42,"tag":57,"props":588,"children":590},{"className":589},[],[591],{"type":48,"value":592},"event.action",{"type":48,"value":594},", ",{"type":42,"tag":57,"props":596,"children":598},{"className":597},[],[599],{"type":48,"value":600},"event.outcome",{"type":48,"value":594},{"type":42,"tag":57,"props":603,"children":605},{"className":604},[],[606],{"type":48,"value":607},"user.name",{"type":48,"value":609},",\n",{"type":42,"tag":57,"props":611,"children":613},{"className":612},[],[614],{"type":48,"value":186},{"type":48,"value":594},{"type":42,"tag":57,"props":617,"children":619},{"className":618},[],[620],{"type":48,"value":621},"@timestamp",{"type":48,"value":623},") plus Kibana-specific fields like ",{"type":42,"tag":57,"props":625,"children":627},{"className":626},[],[628],{"type":48,"value":629},"kibana.saved_object.type",{"type":48,"value":594},{"type":42,"tag":57,"props":632,"children":634},{"className":633},[],[635],{"type":48,"value":636},"kibana.saved_object.id",{"type":48,"value":638},", and\n",{"type":42,"tag":57,"props":640,"children":642},{"className":641},[],[643],{"type":48,"value":644},"kibana.space_id",{"type":48,"value":91},{"type":42,"tag":51,"props":647,"children":648},{},[649],{"type":48,"value":650},"Key event actions:",{"type":42,"tag":199,"props":652,"children":653},{},[654,674],{"type":42,"tag":203,"props":655,"children":656},{},[657],{"type":42,"tag":207,"props":658,"children":659},{},[660,665,669],{"type":42,"tag":211,"props":661,"children":662},{},[663],{"type":48,"value":664},"Event action",{"type":42,"tag":211,"props":666,"children":667},{},[668],{"type":48,"value":220},{"type":42,"tag":211,"props":670,"children":671},{},[672],{"type":48,"value":673},"Category",{"type":42,"tag":222,"props":675,"children":676},{},[677,699,720,741,762,782,803,824,845,867,888,909,930,952,973,994],{"type":42,"tag":207,"props":678,"children":679},{},[680,689,694],{"type":42,"tag":229,"props":681,"children":682},{},[683],{"type":42,"tag":57,"props":684,"children":686},{"className":685},[],[687],{"type":48,"value":688},"saved_object_create",{"type":42,"tag":229,"props":690,"children":691},{},[692],{"type":48,"value":693},"A saved object was created",{"type":42,"tag":229,"props":695,"children":696},{},[697],{"type":48,"value":698},"database",{"type":42,"tag":207,"props":700,"children":701},{},[702,711,716],{"type":42,"tag":229,"props":703,"children":704},{},[705],{"type":42,"tag":57,"props":706,"children":708},{"className":707},[],[709],{"type":48,"value":710},"saved_object_get",{"type":42,"tag":229,"props":712,"children":713},{},[714],{"type":48,"value":715},"A saved object was read",{"type":42,"tag":229,"props":717,"children":718},{},[719],{"type":48,"value":698},{"type":42,"tag":207,"props":721,"children":722},{},[723,732,737],{"type":42,"tag":229,"props":724,"children":725},{},[726],{"type":42,"tag":57,"props":727,"children":729},{"className":728},[],[730],{"type":48,"value":731},"saved_object_update",{"type":42,"tag":229,"props":733,"children":734},{},[735],{"type":48,"value":736},"A saved object was updated",{"type":42,"tag":229,"props":738,"children":739},{},[740],{"type":48,"value":698},{"type":42,"tag":207,"props":742,"children":743},{},[744,753,758],{"type":42,"tag":229,"props":745,"children":746},{},[747],{"type":42,"tag":57,"props":748,"children":750},{"className":749},[],[751],{"type":48,"value":752},"saved_object_delete",{"type":42,"tag":229,"props":754,"children":755},{},[756],{"type":48,"value":757},"A saved object was deleted",{"type":42,"tag":229,"props":759,"children":760},{},[761],{"type":48,"value":698},{"type":42,"tag":207,"props":763,"children":764},{},[765,773,778],{"type":42,"tag":229,"props":766,"children":767},{},[768],{"type":42,"tag":57,"props":769,"children":771},{"className":770},[],[772],{"type":48,"value":158},{"type":42,"tag":229,"props":774,"children":775},{},[776],{"type":48,"value":777},"A saved object search was performed",{"type":42,"tag":229,"props":779,"children":780},{},[781],{"type":48,"value":698},{"type":42,"tag":207,"props":783,"children":784},{},[785,794,799],{"type":42,"tag":229,"props":786,"children":787},{},[788],{"type":42,"tag":57,"props":789,"children":791},{"className":790},[],[792],{"type":48,"value":793},"saved_object_open_point_in_time",{"type":42,"tag":229,"props":795,"children":796},{},[797],{"type":48,"value":798},"A PIT was opened on saved objects",{"type":42,"tag":229,"props":800,"children":801},{},[802],{"type":48,"value":698},{"type":42,"tag":207,"props":804,"children":805},{},[806,815,820],{"type":42,"tag":229,"props":807,"children":808},{},[809],{"type":42,"tag":57,"props":810,"children":812},{"className":811},[],[813],{"type":48,"value":814},"saved_object_close_point_in_time",{"type":42,"tag":229,"props":816,"children":817},{},[818],{"type":48,"value":819},"A PIT was closed on saved objects",{"type":42,"tag":229,"props":821,"children":822},{},[823],{"type":48,"value":698},{"type":42,"tag":207,"props":825,"children":826},{},[827,836,841],{"type":42,"tag":229,"props":828,"children":829},{},[830],{"type":42,"tag":57,"props":831,"children":833},{"className":832},[],[834],{"type":48,"value":835},"saved_object_resolve",{"type":42,"tag":229,"props":837,"children":838},{},[839],{"type":48,"value":840},"A saved object was resolved (alias redirect)",{"type":42,"tag":229,"props":842,"children":843},{},[844],{"type":48,"value":698},{"type":42,"tag":207,"props":846,"children":847},{},[848,857,862],{"type":42,"tag":229,"props":849,"children":850},{},[851],{"type":42,"tag":57,"props":852,"children":854},{"className":853},[],[855],{"type":48,"value":856},"login",{"type":42,"tag":229,"props":858,"children":859},{},[860],{"type":48,"value":861},"A user logged in (success or failure)",{"type":42,"tag":229,"props":863,"children":864},{},[865],{"type":48,"value":866},"authentication",{"type":42,"tag":207,"props":868,"children":869},{},[870,879,884],{"type":42,"tag":229,"props":871,"children":872},{},[873],{"type":42,"tag":57,"props":874,"children":876},{"className":875},[],[877],{"type":48,"value":878},"logout",{"type":42,"tag":229,"props":880,"children":881},{},[882],{"type":48,"value":883},"A user logged out",{"type":42,"tag":229,"props":885,"children":886},{},[887],{"type":48,"value":866},{"type":42,"tag":207,"props":889,"children":890},{},[891,900,905],{"type":42,"tag":229,"props":892,"children":893},{},[894],{"type":42,"tag":57,"props":895,"children":897},{"className":896},[],[898],{"type":48,"value":899},"session_cleanup",{"type":42,"tag":229,"props":901,"children":902},{},[903],{"type":48,"value":904},"An expired session was cleaned up",{"type":42,"tag":229,"props":906,"children":907},{},[908],{"type":48,"value":866},{"type":42,"tag":207,"props":910,"children":911},{},[912,921,926],{"type":42,"tag":229,"props":913,"children":914},{},[915],{"type":42,"tag":57,"props":916,"children":918},{"className":917},[],[919],{"type":48,"value":920},"access_agreement_acknowledged",{"type":42,"tag":229,"props":922,"children":923},{},[924],{"type":48,"value":925},"A user accepted the access agreement",{"type":42,"tag":229,"props":927,"children":928},{},[929],{"type":48,"value":866},{"type":42,"tag":207,"props":931,"children":932},{},[933,942,947],{"type":42,"tag":229,"props":934,"children":935},{},[936],{"type":42,"tag":57,"props":937,"children":939},{"className":938},[],[940],{"type":48,"value":941},"space_create",{"type":42,"tag":229,"props":943,"children":944},{},[945],{"type":48,"value":946},"A Kibana space was created",{"type":42,"tag":229,"props":948,"children":949},{},[950],{"type":48,"value":951},"web",{"type":42,"tag":207,"props":953,"children":954},{},[955,964,969],{"type":42,"tag":229,"props":956,"children":957},{},[958],{"type":42,"tag":57,"props":959,"children":961},{"className":960},[],[962],{"type":48,"value":963},"space_update",{"type":42,"tag":229,"props":965,"children":966},{},[967],{"type":48,"value":968},"A Kibana space was updated",{"type":42,"tag":229,"props":970,"children":971},{},[972],{"type":48,"value":951},{"type":42,"tag":207,"props":974,"children":975},{},[976,985,990],{"type":42,"tag":229,"props":977,"children":978},{},[979],{"type":42,"tag":57,"props":980,"children":982},{"className":981},[],[983],{"type":48,"value":984},"space_delete",{"type":42,"tag":229,"props":986,"children":987},{},[988],{"type":48,"value":989},"A Kibana space was deleted",{"type":42,"tag":229,"props":991,"children":992},{},[993],{"type":48,"value":951},{"type":42,"tag":207,"props":995,"children":996},{},[997,1006,1011],{"type":42,"tag":229,"props":998,"children":999},{},[1000],{"type":42,"tag":57,"props":1001,"children":1003},{"className":1002},[],[1004],{"type":48,"value":1005},"space_get",{"type":42,"tag":229,"props":1007,"children":1008},{},[1009],{"type":48,"value":1010},"A Kibana space was retrieved",{"type":42,"tag":229,"props":1012,"children":1013},{},[1014],{"type":48,"value":951},{"type":42,"tag":51,"props":1016,"children":1017},{},[1018,1020,1024],{"type":48,"value":1019},"See ",{"type":42,"tag":98,"props":1021,"children":1022},{"href":100},[1023],{"type":48,"value":100},{"type":48,"value":1025}," for the complete event schema.",{"type":42,"tag":127,"props":1027,"children":1029},{"id":1028},"filter-policies",[1030],{"type":48,"value":1031},"Filter Policies",{"type":42,"tag":51,"props":1033,"children":1034},{},[1035,1037,1043,1045,1050],{"type":48,"value":1036},"Suppress noisy events using ",{"type":42,"tag":57,"props":1038,"children":1040},{"className":1039},[],[1041],{"type":48,"value":1042},"ignore_filters",{"type":48,"value":1044}," in ",{"type":42,"tag":57,"props":1046,"children":1048},{"className":1047},[],[1049],{"type":48,"value":62},{"type":48,"value":338},{"type":42,"tag":311,"props":1052,"children":1054},{"className":313,"code":1053,"language":315,"meta":316,"style":316},"xpack.security.audit.ignore_filters:\n - actions: [saved_object_find]\n categories: [database]\n",[1055],{"type":42,"tag":57,"props":1056,"children":1057},{"__ignoreMap":316},[1058,1070,1101],{"type":42,"tag":322,"props":1059,"children":1060},{"class":324,"line":325},[1061,1066],{"type":42,"tag":322,"props":1062,"children":1063},{"style":329},[1064],{"type":48,"value":1065},"xpack.security.audit.ignore_filters",{"type":42,"tag":322,"props":1067,"children":1068},{"style":335},[1069],{"type":48,"value":358},{"type":42,"tag":322,"props":1071,"children":1072},{"class":324,"line":347},[1073,1078,1083,1087,1092,1096],{"type":42,"tag":322,"props":1074,"children":1075},{"style":335},[1076],{"type":48,"value":1077}," -",{"type":42,"tag":322,"props":1079,"children":1080},{"style":329},[1081],{"type":48,"value":1082}," actions",{"type":42,"tag":322,"props":1084,"children":1085},{"style":335},[1086],{"type":48,"value":338},{"type":42,"tag":322,"props":1088,"children":1089},{"style":335},[1090],{"type":48,"value":1091}," [",{"type":42,"tag":322,"props":1093,"children":1094},{"style":374},[1095],{"type":48,"value":158},{"type":42,"tag":322,"props":1097,"children":1098},{"style":335},[1099],{"type":48,"value":1100},"]\n",{"type":42,"tag":322,"props":1102,"children":1103},{"class":324,"line":361},[1104,1109,1113,1117,1121],{"type":42,"tag":322,"props":1105,"children":1106},{"style":329},[1107],{"type":48,"value":1108}," categories",{"type":42,"tag":322,"props":1110,"children":1111},{"style":335},[1112],{"type":48,"value":338},{"type":42,"tag":322,"props":1114,"children":1115},{"style":335},[1116],{"type":48,"value":1091},{"type":42,"tag":322,"props":1118,"children":1119},{"style":374},[1120],{"type":48,"value":698},{"type":42,"tag":322,"props":1122,"children":1123},{"style":335},[1124],{"type":48,"value":1100},{"type":42,"tag":199,"props":1126,"children":1127},{},[1128,1147],{"type":42,"tag":203,"props":1129,"children":1130},{},[1131],{"type":42,"tag":207,"props":1132,"children":1133},{},[1134,1139,1143],{"type":42,"tag":211,"props":1135,"children":1136},{},[1137],{"type":48,"value":1138},"Filter field",{"type":42,"tag":211,"props":1140,"children":1141},{},[1142],{"type":48,"value":534},{"type":42,"tag":211,"props":1144,"children":1145},{},[1146],{"type":48,"value":220},{"type":42,"tag":222,"props":1148,"children":1149},{},[1150,1172],{"type":42,"tag":207,"props":1151,"children":1152},{},[1153,1162,1167],{"type":42,"tag":229,"props":1154,"children":1155},{},[1156],{"type":42,"tag":57,"props":1157,"children":1159},{"className":1158},[],[1160],{"type":48,"value":1161},"actions",{"type":42,"tag":229,"props":1163,"children":1164},{},[1165],{"type":48,"value":1166},"list",{"type":42,"tag":229,"props":1168,"children":1169},{},[1170],{"type":48,"value":1171},"Event actions to ignore",{"type":42,"tag":207,"props":1173,"children":1174},{},[1175,1184,1188],{"type":42,"tag":229,"props":1176,"children":1177},{},[1178],{"type":42,"tag":57,"props":1179,"children":1181},{"className":1180},[],[1182],{"type":48,"value":1183},"categories",{"type":42,"tag":229,"props":1185,"children":1186},{},[1187],{"type":48,"value":1166},{"type":42,"tag":229,"props":1189,"children":1190},{},[1191],{"type":48,"value":1192},"Event categories to ignore",{"type":42,"tag":51,"props":1194,"children":1195},{},[1196,1198,1203],{"type":48,"value":1197},"An event is filtered out if it matches ",{"type":42,"tag":71,"props":1199,"children":1200},{},[1201],{"type":48,"value":1202},"all",{"type":48,"value":1204}," specified fields within a single filter entry.",{"type":42,"tag":127,"props":1206,"children":1208},{"id":1207},"correlate-with-elasticsearch-audit-logs",[1209],{"type":48,"value":1210},"Correlate with Elasticsearch Audit Logs",{"type":42,"tag":51,"props":1212,"children":1213},{},[1214,1216,1221,1223,1229],{"type":48,"value":1215},"When Kibana makes requests to Elasticsearch on behalf of a user, both systems record the same ",{"type":42,"tag":57,"props":1217,"children":1219},{"className":1218},[],[1220],{"type":48,"value":186},{"type":48,"value":1222}," (passed via the\n",{"type":42,"tag":57,"props":1224,"children":1226},{"className":1225},[],[1227],{"type":48,"value":1228},"X-Opaque-Id",{"type":48,"value":1230}," header). This is the primary key for correlating events across the two audit logs.",{"type":42,"tag":105,"props":1232,"children":1233},{},[1234],{"type":42,"tag":51,"props":1235,"children":1236},{},[1237,1242,1244,1248],{"type":42,"tag":71,"props":1238,"children":1239},{},[1240],{"type":48,"value":1241},"Prerequisite:",{"type":48,"value":1243}," Elasticsearch audit must be enabled via the cluster settings API. See the ",{"type":42,"tag":71,"props":1245,"children":1246},{},[1247],{"type":48,"value":75},{"type":48,"value":1249},"\nskill for setup instructions, event types, and ES-specific filter policies.",{"type":42,"tag":515,"props":1251,"children":1253},{"id":1252},"correlation-workflow",[1254],{"type":48,"value":1255},"Correlation workflow",{"type":42,"tag":1257,"props":1258,"children":1259},"ol",{},[1260,1265,1277,1295],{"type":42,"tag":138,"props":1261,"children":1262},{},[1263],{"type":48,"value":1264},"Find the suspicious event in the Kibana audit log.",{"type":42,"tag":138,"props":1266,"children":1267},{},[1268,1270,1275],{"type":48,"value":1269},"Extract its ",{"type":42,"tag":57,"props":1271,"children":1273},{"className":1272},[],[1274],{"type":48,"value":186},{"type":48,"value":1276}," value.",{"type":42,"tag":138,"props":1278,"children":1279},{},[1280,1282,1287,1289,1294],{"type":48,"value":1281},"Search the ES audit index (",{"type":42,"tag":57,"props":1283,"children":1285},{"className":1284},[],[1286],{"type":48,"value":286},{"type":48,"value":1288},") for all events with the same ",{"type":42,"tag":57,"props":1290,"children":1292},{"className":1291},[],[1293],{"type":48,"value":186},{"type":48,"value":91},{"type":42,"tag":138,"props":1296,"children":1297},{},[1298],{"type":48,"value":1299},"Review the combined timeline to understand what ES-level operations the Kibana action triggered.",{"type":42,"tag":51,"props":1301,"children":1302},{},[1303,1305,1309],{"type":48,"value":1304},"The ",{"type":42,"tag":71,"props":1306,"children":1307},{},[1308],{"type":48,"value":75},{"type":48,"value":1310}," skill also documents this workflow from the ES side — use it when starting from an ES audit\nevent and looking for the originating Kibana action.",{"type":42,"tag":515,"props":1312,"children":1314},{"id":1313},"search-es-audit-by-trace-id",[1315],{"type":48,"value":1316},"Search ES audit by trace ID",{"type":42,"tag":51,"props":1318,"children":1319},{},[1320,1322,1327],{"type":48,"value":1321},"Given a suspicious Kibana event (e.g. a saved object deletion), extract its ",{"type":42,"tag":57,"props":1323,"children":1325},{"className":1324},[],[1326],{"type":48,"value":186},{"type":48,"value":1328}," and search the ES audit index:",{"type":42,"tag":311,"props":1330,"children":1334},{"className":1331,"code":1332,"language":1333,"meta":316,"style":316},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","curl -X POST \"${ELASTICSEARCH_URL}\u002F.security-audit-*\u002F_search\" \\\n \u003Cauth_flags> \\\n -H \"Content-Type: application\u002Fjson\" \\\n -d '{\n \"query\": {\n \"bool\": {\n \"filter\": [\n { \"term\": { \"trace.id\": \"'\"${TRACE_ID}\"'\" } },\n { \"range\": { \"@timestamp\": { \"gte\": \"now-24h\" } } }\n ]\n }\n },\n \"sort\": [{ \"@timestamp\": { \"order\": \"asc\" } }]\n }'\n","bash",[1335],{"type":42,"tag":57,"props":1336,"children":1337},{"__ignoreMap":316},[1338,1388,1415,1441,1459,1467,1475,1483,1511,1519,1527,1536,1545,1554],{"type":42,"tag":322,"props":1339,"children":1340},{"class":324,"line":325},[1341,1347,1352,1357,1362,1368,1373,1378,1383],{"type":42,"tag":322,"props":1342,"children":1344},{"style":1343},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[1345],{"type":48,"value":1346},"curl",{"type":42,"tag":322,"props":1348,"children":1349},{"style":374},[1350],{"type":48,"value":1351}," -X",{"type":42,"tag":322,"props":1353,"children":1354},{"style":374},[1355],{"type":48,"value":1356}," POST",{"type":42,"tag":322,"props":1358,"children":1359},{"style":335},[1360],{"type":48,"value":1361}," \"${",{"type":42,"tag":322,"props":1363,"children":1365},{"style":1364},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1366],{"type":48,"value":1367},"ELASTICSEARCH_URL",{"type":42,"tag":322,"props":1369,"children":1370},{"style":335},[1371],{"type":48,"value":1372},"}",{"type":42,"tag":322,"props":1374,"children":1375},{"style":374},[1376],{"type":48,"value":1377},"\u002F.security-audit-*\u002F_search",{"type":42,"tag":322,"props":1379,"children":1380},{"style":335},[1381],{"type":48,"value":1382},"\"",{"type":42,"tag":322,"props":1384,"children":1385},{"style":1364},[1386],{"type":48,"value":1387}," \\\n",{"type":42,"tag":322,"props":1389,"children":1390},{"class":324,"line":347},[1391,1396,1401,1406,1411],{"type":42,"tag":322,"props":1392,"children":1393},{"style":335},[1394],{"type":48,"value":1395}," \u003C",{"type":42,"tag":322,"props":1397,"children":1398},{"style":374},[1399],{"type":48,"value":1400},"auth_flag",{"type":42,"tag":322,"props":1402,"children":1403},{"style":1364},[1404],{"type":48,"value":1405},"s",{"type":42,"tag":322,"props":1407,"children":1408},{"style":335},[1409],{"type":48,"value":1410},">",{"type":42,"tag":322,"props":1412,"children":1413},{"style":1364},[1414],{"type":48,"value":1387},{"type":42,"tag":322,"props":1416,"children":1417},{"class":324,"line":361},[1418,1423,1428,1433,1437],{"type":42,"tag":322,"props":1419,"children":1420},{"style":374},[1421],{"type":48,"value":1422}," -H",{"type":42,"tag":322,"props":1424,"children":1425},{"style":335},[1426],{"type":48,"value":1427}," \"",{"type":42,"tag":322,"props":1429,"children":1430},{"style":374},[1431],{"type":48,"value":1432},"Content-Type: application\u002Fjson",{"type":42,"tag":322,"props":1434,"children":1435},{"style":335},[1436],{"type":48,"value":1382},{"type":42,"tag":322,"props":1438,"children":1439},{"style":1364},[1440],{"type":48,"value":1387},{"type":42,"tag":322,"props":1442,"children":1443},{"class":324,"line":380},[1444,1449,1454],{"type":42,"tag":322,"props":1445,"children":1446},{"style":374},[1447],{"type":48,"value":1448}," -d",{"type":42,"tag":322,"props":1450,"children":1451},{"style":335},[1452],{"type":48,"value":1453}," '",{"type":42,"tag":322,"props":1455,"children":1456},{"style":374},[1457],{"type":48,"value":1458},"{\n",{"type":42,"tag":322,"props":1460,"children":1461},{"class":324,"line":398},[1462],{"type":42,"tag":322,"props":1463,"children":1464},{"style":374},[1465],{"type":48,"value":1466}," \"query\": {\n",{"type":42,"tag":322,"props":1468,"children":1469},{"class":324,"line":411},[1470],{"type":42,"tag":322,"props":1471,"children":1472},{"style":374},[1473],{"type":48,"value":1474}," \"bool\": {\n",{"type":42,"tag":322,"props":1476,"children":1477},{"class":324,"line":429},[1478],{"type":42,"tag":322,"props":1479,"children":1480},{"style":374},[1481],{"type":48,"value":1482}," \"filter\": [\n",{"type":42,"tag":322,"props":1484,"children":1485},{"class":324,"line":447},[1486,1491,1496,1501,1506],{"type":42,"tag":322,"props":1487,"children":1488},{"style":374},[1489],{"type":48,"value":1490}," { \"term\": { \"trace.id\": \"",{"type":42,"tag":322,"props":1492,"children":1493},{"style":335},[1494],{"type":48,"value":1495},"'\"${",{"type":42,"tag":322,"props":1497,"children":1498},{"style":1364},[1499],{"type":48,"value":1500},"TRACE_ID",{"type":42,"tag":322,"props":1502,"children":1503},{"style":335},[1504],{"type":48,"value":1505},"}\"'",{"type":42,"tag":322,"props":1507,"children":1508},{"style":374},[1509],{"type":48,"value":1510},"\" } },\n",{"type":42,"tag":322,"props":1512,"children":1513},{"class":324,"line":460},[1514],{"type":42,"tag":322,"props":1515,"children":1516},{"style":374},[1517],{"type":48,"value":1518}," { \"range\": { \"@timestamp\": { \"gte\": \"now-24h\" } } }\n",{"type":42,"tag":322,"props":1520,"children":1521},{"class":324,"line":477},[1522],{"type":42,"tag":322,"props":1523,"children":1524},{"style":374},[1525],{"type":48,"value":1526}," ]\n",{"type":42,"tag":322,"props":1528,"children":1530},{"class":324,"line":1529},11,[1531],{"type":42,"tag":322,"props":1532,"children":1533},{"style":374},[1534],{"type":48,"value":1535}," }\n",{"type":42,"tag":322,"props":1537,"children":1539},{"class":324,"line":1538},12,[1540],{"type":42,"tag":322,"props":1541,"children":1542},{"style":374},[1543],{"type":48,"value":1544}," },\n",{"type":42,"tag":322,"props":1546,"children":1548},{"class":324,"line":1547},13,[1549],{"type":42,"tag":322,"props":1550,"children":1551},{"style":374},[1552],{"type":48,"value":1553}," \"sort\": [{ \"@timestamp\": { \"order\": \"asc\" } }]\n",{"type":42,"tag":322,"props":1555,"children":1557},{"class":324,"line":1556},14,[1558,1563],{"type":42,"tag":322,"props":1559,"children":1560},{"style":374},[1561],{"type":48,"value":1562}," }",{"type":42,"tag":322,"props":1564,"children":1565},{"style":335},[1566],{"type":48,"value":1567},"'\n",{"type":42,"tag":51,"props":1569,"children":1570},{},[1571,1573,1578,1579,1585,1587,1592],{"type":48,"value":1572},"Secondary correlation fields: ",{"type":42,"tag":57,"props":1574,"children":1576},{"className":1575},[],[1577],{"type":48,"value":607},{"type":48,"value":594},{"type":42,"tag":57,"props":1580,"children":1582},{"className":1581},[],[1583],{"type":48,"value":1584},"source.ip",{"type":48,"value":1586},", and ",{"type":42,"tag":57,"props":1588,"children":1590},{"className":1589},[],[1591],{"type":48,"value":621},{"type":48,"value":1593}," (time-window joins).",{"type":42,"tag":515,"props":1595,"children":1597},{"id":1596},"ship-kibana-audit-logs-to-elasticsearch",[1598],{"type":48,"value":1599},"Ship Kibana audit logs to Elasticsearch",{"type":42,"tag":51,"props":1601,"children":1602},{},[1603],{"type":48,"value":1604},"To query Kibana audit events alongside ES audit events, ship the Kibana audit log file to an Elasticsearch index using\nFilebeat:",{"type":42,"tag":311,"props":1606,"children":1608},{"className":313,"code":1607,"language":315,"meta":316,"style":316},"filebeat.inputs:\n - type: log\n paths: [\"\u002Fpath\u002Fto\u002Fkibana\u002Fdata\u002Faudit.log\"]\n json.keys_under_root: true\n json.add_error_key: true\n\noutput.elasticsearch:\n hosts: [\"https:\u002F\u002Flocalhost:9200\"]\n index: \"kibana-audit-%{+yyyy.MM.dd}\"\n",[1609],{"type":42,"tag":57,"props":1610,"children":1611},{"__ignoreMap":316},[1612,1624,1645,1678,1694,1710,1719,1731,1764],{"type":42,"tag":322,"props":1613,"children":1614},{"class":324,"line":325},[1615,1620],{"type":42,"tag":322,"props":1616,"children":1617},{"style":329},[1618],{"type":48,"value":1619},"filebeat.inputs",{"type":42,"tag":322,"props":1621,"children":1622},{"style":335},[1623],{"type":48,"value":358},{"type":42,"tag":322,"props":1625,"children":1626},{"class":324,"line":347},[1627,1631,1636,1640],{"type":42,"tag":322,"props":1628,"children":1629},{"style":335},[1630],{"type":48,"value":1077},{"type":42,"tag":322,"props":1632,"children":1633},{"style":329},[1634],{"type":48,"value":1635}," type",{"type":42,"tag":322,"props":1637,"children":1638},{"style":335},[1639],{"type":48,"value":338},{"type":42,"tag":322,"props":1641,"children":1642},{"style":374},[1643],{"type":48,"value":1644}," log\n",{"type":42,"tag":322,"props":1646,"children":1647},{"class":324,"line":361},[1648,1653,1657,1661,1665,1670,1674],{"type":42,"tag":322,"props":1649,"children":1650},{"style":329},[1651],{"type":48,"value":1652}," paths",{"type":42,"tag":322,"props":1654,"children":1655},{"style":335},[1656],{"type":48,"value":338},{"type":42,"tag":322,"props":1658,"children":1659},{"style":335},[1660],{"type":48,"value":1091},{"type":42,"tag":322,"props":1662,"children":1663},{"style":335},[1664],{"type":48,"value":1382},{"type":42,"tag":322,"props":1666,"children":1667},{"style":374},[1668],{"type":48,"value":1669},"\u002Fpath\u002Fto\u002Fkibana\u002Fdata\u002Faudit.log",{"type":42,"tag":322,"props":1671,"children":1672},{"style":335},[1673],{"type":48,"value":1382},{"type":42,"tag":322,"props":1675,"children":1676},{"style":335},[1677],{"type":48,"value":1100},{"type":42,"tag":322,"props":1679,"children":1680},{"class":324,"line":380},[1681,1686,1690],{"type":42,"tag":322,"props":1682,"children":1683},{"style":329},[1684],{"type":48,"value":1685}," json.keys_under_root",{"type":42,"tag":322,"props":1687,"children":1688},{"style":335},[1689],{"type":48,"value":338},{"type":42,"tag":322,"props":1691,"children":1692},{"style":341},[1693],{"type":48,"value":344},{"type":42,"tag":322,"props":1695,"children":1696},{"class":324,"line":398},[1697,1702,1706],{"type":42,"tag":322,"props":1698,"children":1699},{"style":329},[1700],{"type":48,"value":1701}," json.add_error_key",{"type":42,"tag":322,"props":1703,"children":1704},{"style":335},[1705],{"type":48,"value":338},{"type":42,"tag":322,"props":1707,"children":1708},{"style":341},[1709],{"type":48,"value":344},{"type":42,"tag":322,"props":1711,"children":1712},{"class":324,"line":411},[1713],{"type":42,"tag":322,"props":1714,"children":1716},{"emptyLinePlaceholder":1715},true,[1717],{"type":48,"value":1718},"\n",{"type":42,"tag":322,"props":1720,"children":1721},{"class":324,"line":429},[1722,1727],{"type":42,"tag":322,"props":1723,"children":1724},{"style":329},[1725],{"type":48,"value":1726},"output.elasticsearch",{"type":42,"tag":322,"props":1728,"children":1729},{"style":335},[1730],{"type":48,"value":358},{"type":42,"tag":322,"props":1732,"children":1733},{"class":324,"line":447},[1734,1739,1743,1747,1751,1756,1760],{"type":42,"tag":322,"props":1735,"children":1736},{"style":329},[1737],{"type":48,"value":1738}," hosts",{"type":42,"tag":322,"props":1740,"children":1741},{"style":335},[1742],{"type":48,"value":338},{"type":42,"tag":322,"props":1744,"children":1745},{"style":335},[1746],{"type":48,"value":1091},{"type":42,"tag":322,"props":1748,"children":1749},{"style":335},[1750],{"type":48,"value":1382},{"type":42,"tag":322,"props":1752,"children":1753},{"style":374},[1754],{"type":48,"value":1755},"https:\u002F\u002Flocalhost:9200",{"type":42,"tag":322,"props":1757,"children":1758},{"style":335},[1759],{"type":48,"value":1382},{"type":42,"tag":322,"props":1761,"children":1762},{"style":335},[1763],{"type":48,"value":1100},{"type":42,"tag":322,"props":1765,"children":1766},{"class":324,"line":460},[1767,1772,1776,1780,1785],{"type":42,"tag":322,"props":1768,"children":1769},{"style":329},[1770],{"type":48,"value":1771}," index",{"type":42,"tag":322,"props":1773,"children":1774},{"style":335},[1775],{"type":48,"value":338},{"type":42,"tag":322,"props":1777,"children":1778},{"style":335},[1779],{"type":48,"value":1427},{"type":42,"tag":322,"props":1781,"children":1782},{"style":374},[1783],{"type":48,"value":1784},"kibana-audit-%{+yyyy.MM.dd}",{"type":42,"tag":322,"props":1786,"children":1787},{"style":335},[1788],{"type":48,"value":1789},"\"\n",{"type":42,"tag":51,"props":1791,"children":1792},{},[1793,1795,1800,1802,1808,1810,1815],{"type":48,"value":1794},"Once indexed, both ",{"type":42,"tag":57,"props":1796,"children":1798},{"className":1797},[],[1799],{"type":48,"value":286},{"type":48,"value":1801}," (ES) and ",{"type":42,"tag":57,"props":1803,"children":1805},{"className":1804},[],[1806],{"type":48,"value":1807},"kibana-audit-*",{"type":48,"value":1809}," (Kibana) can be searched together using a multi-index\nquery filtered by ",{"type":42,"tag":57,"props":1811,"children":1813},{"className":1812},[],[1814],{"type":48,"value":186},{"type":48,"value":91},{"type":42,"tag":127,"props":1817,"children":1819},{"id":1818},"examples",[1820],{"type":48,"value":1821},"Examples",{"type":42,"tag":515,"props":1823,"children":1825},{"id":1824},"enable-kibana-audit-for-compliance",[1826],{"type":48,"value":1827},"Enable Kibana audit for compliance",{"type":42,"tag":51,"props":1829,"children":1830},{},[1831,1836],{"type":42,"tag":71,"props":1832,"children":1833},{},[1834],{"type":48,"value":1835},"Request:",{"type":48,"value":1837}," \"Enable Kibana audit logging and keep 10 rotated log files.\"",{"type":42,"tag":311,"props":1839,"children":1841},{"className":313,"code":1840,"language":315,"meta":316,"style":316},"xpack.security.audit.enabled: true\nxpack.security.audit.appender:\n type: rolling-file\n fileName: \u002Fvar\u002Flog\u002Fkibana\u002Faudit.log\n policy:\n type: time-interval\n interval: 24h\n strategy:\n type: numeric\n max: 10\n",[1842],{"type":42,"tag":57,"props":1843,"children":1844},{"__ignoreMap":316},[1845,1860,1871,1886,1902,1913,1928,1943,1954,1969],{"type":42,"tag":322,"props":1846,"children":1847},{"class":324,"line":325},[1848,1852,1856],{"type":42,"tag":322,"props":1849,"children":1850},{"style":329},[1851],{"type":48,"value":332},{"type":42,"tag":322,"props":1853,"children":1854},{"style":335},[1855],{"type":48,"value":338},{"type":42,"tag":322,"props":1857,"children":1858},{"style":341},[1859],{"type":48,"value":344},{"type":42,"tag":322,"props":1861,"children":1862},{"class":324,"line":347},[1863,1867],{"type":42,"tag":322,"props":1864,"children":1865},{"style":329},[1866],{"type":48,"value":353},{"type":42,"tag":322,"props":1868,"children":1869},{"style":335},[1870],{"type":48,"value":358},{"type":42,"tag":322,"props":1872,"children":1873},{"class":324,"line":361},[1874,1878,1882],{"type":42,"tag":322,"props":1875,"children":1876},{"style":329},[1877],{"type":48,"value":367},{"type":42,"tag":322,"props":1879,"children":1880},{"style":335},[1881],{"type":48,"value":338},{"type":42,"tag":322,"props":1883,"children":1884},{"style":374},[1885],{"type":48,"value":377},{"type":42,"tag":322,"props":1887,"children":1888},{"class":324,"line":380},[1889,1893,1897],{"type":42,"tag":322,"props":1890,"children":1891},{"style":329},[1892],{"type":48,"value":386},{"type":42,"tag":322,"props":1894,"children":1895},{"style":335},[1896],{"type":48,"value":338},{"type":42,"tag":322,"props":1898,"children":1899},{"style":374},[1900],{"type":48,"value":1901}," \u002Fvar\u002Flog\u002Fkibana\u002Faudit.log\n",{"type":42,"tag":322,"props":1903,"children":1904},{"class":324,"line":398},[1905,1909],{"type":42,"tag":322,"props":1906,"children":1907},{"style":329},[1908],{"type":48,"value":404},{"type":42,"tag":322,"props":1910,"children":1911},{"style":335},[1912],{"type":48,"value":358},{"type":42,"tag":322,"props":1914,"children":1915},{"class":324,"line":411},[1916,1920,1924],{"type":42,"tag":322,"props":1917,"children":1918},{"style":329},[1919],{"type":48,"value":417},{"type":42,"tag":322,"props":1921,"children":1922},{"style":335},[1923],{"type":48,"value":338},{"type":42,"tag":322,"props":1925,"children":1926},{"style":374},[1927],{"type":48,"value":426},{"type":42,"tag":322,"props":1929,"children":1930},{"class":324,"line":429},[1931,1935,1939],{"type":42,"tag":322,"props":1932,"children":1933},{"style":329},[1934],{"type":48,"value":435},{"type":42,"tag":322,"props":1936,"children":1937},{"style":335},[1938],{"type":48,"value":338},{"type":42,"tag":322,"props":1940,"children":1941},{"style":374},[1942],{"type":48,"value":444},{"type":42,"tag":322,"props":1944,"children":1945},{"class":324,"line":447},[1946,1950],{"type":42,"tag":322,"props":1947,"children":1948},{"style":329},[1949],{"type":48,"value":453},{"type":42,"tag":322,"props":1951,"children":1952},{"style":335},[1953],{"type":48,"value":358},{"type":42,"tag":322,"props":1955,"children":1956},{"class":324,"line":460},[1957,1961,1965],{"type":42,"tag":322,"props":1958,"children":1959},{"style":329},[1960],{"type":48,"value":417},{"type":42,"tag":322,"props":1962,"children":1963},{"style":335},[1964],{"type":48,"value":338},{"type":42,"tag":322,"props":1966,"children":1967},{"style":374},[1968],{"type":48,"value":474},{"type":42,"tag":322,"props":1970,"children":1971},{"class":324,"line":477},[1972,1976,1980],{"type":42,"tag":322,"props":1973,"children":1974},{"style":329},[1975],{"type":48,"value":483},{"type":42,"tag":322,"props":1977,"children":1978},{"style":335},[1979],{"type":48,"value":338},{"type":42,"tag":322,"props":1981,"children":1982},{"style":490},[1983],{"type":48,"value":493},{"type":42,"tag":51,"props":1985,"children":1986},{},[1987],{"type":48,"value":1988},"Restart Kibana after applying.",{"type":42,"tag":515,"props":1990,"children":1992},{"id":1991},"investigate-a-deleted-dashboard",[1993],{"type":48,"value":1994},"Investigate a deleted dashboard",{"type":42,"tag":51,"props":1996,"children":1997},{},[1998,2002],{"type":42,"tag":71,"props":1999,"children":2000},{},[2001],{"type":48,"value":1835},{"type":48,"value":2003}," \"Someone deleted a dashboard. Check the Kibana audit log.\"",{"type":42,"tag":51,"props":2005,"children":2006},{},[2007,2009,2014,2016,2021,2023,2029,2031,2036],{"type":48,"value":2008},"Search the Kibana audit log (or the indexed ",{"type":42,"tag":57,"props":2010,"children":2012},{"className":2011},[],[2013],{"type":48,"value":1807},{"type":48,"value":2015}," data) for ",{"type":42,"tag":57,"props":2017,"children":2019},{"className":2018},[],[2020],{"type":48,"value":752},{"type":48,"value":2022}," events with\n",{"type":42,"tag":57,"props":2024,"children":2026},{"className":2025},[],[2027],{"type":48,"value":2028},"kibana.saved_object.type: dashboard",{"type":48,"value":2030},". Extract the ",{"type":42,"tag":57,"props":2032,"children":2034},{"className":2033},[],[2035],{"type":48,"value":186},{"type":48,"value":2037}," and cross-reference with the ES audit index to see the\nunderlying Elasticsearch operations.",{"type":42,"tag":515,"props":2039,"children":2041},{"id":2040},"reduce-audit-noise-from-saved-object-searches",[2042],{"type":48,"value":2043},"Reduce audit noise from saved object searches",{"type":42,"tag":51,"props":2045,"children":2046},{},[2047,2051],{"type":42,"tag":71,"props":2048,"children":2049},{},[2050],{"type":48,"value":1835},{"type":48,"value":2052}," \"Kibana audit logs are too large because of constant saved_object_find events.\"",{"type":42,"tag":311,"props":2054,"children":2055},{"className":313,"code":1053,"language":315,"meta":316,"style":316},[2056],{"type":42,"tag":57,"props":2057,"children":2058},{"__ignoreMap":316},[2059,2070,2097],{"type":42,"tag":322,"props":2060,"children":2061},{"class":324,"line":325},[2062,2066],{"type":42,"tag":322,"props":2063,"children":2064},{"style":329},[2065],{"type":48,"value":1065},{"type":42,"tag":322,"props":2067,"children":2068},{"style":335},[2069],{"type":48,"value":358},{"type":42,"tag":322,"props":2071,"children":2072},{"class":324,"line":347},[2073,2077,2081,2085,2089,2093],{"type":42,"tag":322,"props":2074,"children":2075},{"style":335},[2076],{"type":48,"value":1077},{"type":42,"tag":322,"props":2078,"children":2079},{"style":329},[2080],{"type":48,"value":1082},{"type":42,"tag":322,"props":2082,"children":2083},{"style":335},[2084],{"type":48,"value":338},{"type":42,"tag":322,"props":2086,"children":2087},{"style":335},[2088],{"type":48,"value":1091},{"type":42,"tag":322,"props":2090,"children":2091},{"style":374},[2092],{"type":48,"value":158},{"type":42,"tag":322,"props":2094,"children":2095},{"style":335},[2096],{"type":48,"value":1100},{"type":42,"tag":322,"props":2098,"children":2099},{"class":324,"line":361},[2100,2104,2108,2112,2116],{"type":42,"tag":322,"props":2101,"children":2102},{"style":329},[2103],{"type":48,"value":1108},{"type":42,"tag":322,"props":2105,"children":2106},{"style":335},[2107],{"type":48,"value":338},{"type":42,"tag":322,"props":2109,"children":2110},{"style":335},[2111],{"type":48,"value":1091},{"type":42,"tag":322,"props":2113,"children":2114},{"style":374},[2115],{"type":48,"value":698},{"type":42,"tag":322,"props":2117,"children":2118},{"style":335},[2119],{"type":48,"value":1100},{"type":42,"tag":51,"props":2121,"children":2122},{},[2123],{"type":48,"value":2124},"This suppresses high-volume read operations while preserving create, update, and delete events.",{"type":42,"tag":127,"props":2126,"children":2128},{"id":2127},"guidelines",[2129],{"type":48,"value":2130},"Guidelines",{"type":42,"tag":515,"props":2132,"children":2134},{"id":2133},"always-enable-alongside-elasticsearch-audit",[2135],{"type":48,"value":2136},"Always enable alongside Elasticsearch audit",{"type":42,"tag":51,"props":2138,"children":2139},{},[2140,2142,2147,2149,2153],{"type":48,"value":2141},"For full coverage, enable audit in both ",{"type":42,"tag":57,"props":2143,"children":2145},{"className":2144},[],[2146],{"type":48,"value":62},{"type":48,"value":2148}," and Elasticsearch. Without Kibana audit, saved object access and\nKibana login events are invisible. Without ES audit, cluster-level operations are invisible. See the\n",{"type":42,"tag":71,"props":2150,"children":2151},{},[2152],{"type":48,"value":75},{"type":48,"value":2154}," skill for ES-side setup.",{"type":42,"tag":515,"props":2156,"children":2158},{"id":2157},"use-traceid-for-correlation",[2159],{"type":48,"value":2160},"Use trace.id for correlation",{"type":42,"tag":51,"props":2162,"children":2163},{},[2164,2166,2171,2173,2178,2180,2185],{"type":48,"value":2165},"When investigating a Kibana event, always extract ",{"type":42,"tag":57,"props":2167,"children":2169},{"className":2168},[],[2170],{"type":48,"value":186},{"type":48,"value":2172}," and search the ES audit index (",{"type":42,"tag":57,"props":2174,"children":2176},{"className":2175},[],[2177],{"type":48,"value":286},{"type":48,"value":2179},"). This\nreveals the full chain of operations triggered by a single Kibana action. See\n",{"type":42,"tag":98,"props":2181,"children":2183},{"href":2182},"#correlate-with-elasticsearch-audit-logs",[2184],{"type":48,"value":1210},{"type":48,"value":2186}," above for queries.",{"type":42,"tag":515,"props":2188,"children":2190},{"id":2189},"filter-noisy-read-events",[2191],{"type":48,"value":2192},"Filter noisy read events",{"type":42,"tag":51,"props":2194,"children":2195},{},[2196,2201],{"type":42,"tag":57,"props":2197,"children":2199},{"className":2198},[],[2200],{"type":48,"value":158},{"type":48,"value":2202}," generates very high volume on busy Kibana instances. Suppress it unless you specifically need to\naudit read access.",{"type":42,"tag":515,"props":2204,"children":2206},{"id":2205},"ship-logs-to-elasticsearch-for-unified-querying",[2207],{"type":48,"value":2208},"Ship logs to Elasticsearch for unified querying",{"type":42,"tag":51,"props":2210,"children":2211},{},[2212],{"type":48,"value":2213},"Kibana audit logs are written to files by default. Ship them to Elasticsearch via Filebeat for programmatic querying\nalongside ES audit events.",{"type":42,"tag":515,"props":2215,"children":2217},{"id":2216},"rotate-and-retain-appropriately",[2218],{"type":48,"value":2219},"Rotate and retain appropriately",{"type":42,"tag":51,"props":2221,"children":2222},{},[2223],{"type":48,"value":2224},"Configure rolling-file rotation to avoid filling the disk. A 30-90 day retention is typical for compliance.",{"type":42,"tag":127,"props":2226,"children":2228},{"id":2227},"deployment-compatibility",[2229],{"type":48,"value":123},{"type":42,"tag":199,"props":2231,"children":2232},{},[2233,2259],{"type":42,"tag":203,"props":2234,"children":2235},{},[2236],{"type":42,"tag":207,"props":2237,"children":2238},{},[2239,2244,2249,2254],{"type":42,"tag":211,"props":2240,"children":2241},{},[2242],{"type":48,"value":2243},"Capability",{"type":42,"tag":211,"props":2245,"children":2246},{},[2247],{"type":48,"value":2248},"Self-managed",{"type":42,"tag":211,"props":2250,"children":2251},{},[2252],{"type":48,"value":2253},"ECH",{"type":42,"tag":211,"props":2255,"children":2256},{},[2257],{"type":48,"value":2258},"Serverless",{"type":42,"tag":222,"props":2260,"children":2261},{},[2262,2291,2311,2331,2351,2376],{"type":42,"tag":207,"props":2263,"children":2264},{},[2265,2276,2281,2286],{"type":42,"tag":229,"props":2266,"children":2267},{},[2268,2270,2275],{"type":48,"value":2269},"Kibana audit (",{"type":42,"tag":57,"props":2271,"children":2273},{"className":2272},[],[2274],{"type":48,"value":62},{"type":48,"value":160},{"type":42,"tag":229,"props":2277,"children":2278},{},[2279],{"type":48,"value":2280},"Yes",{"type":42,"tag":229,"props":2282,"children":2283},{},[2284],{"type":48,"value":2285},"Via Cloud UI",{"type":42,"tag":229,"props":2287,"children":2288},{},[2289],{"type":48,"value":2290},"Not available",{"type":42,"tag":207,"props":2292,"children":2293},{},[2294,2299,2303,2307],{"type":42,"tag":229,"props":2295,"children":2296},{},[2297],{"type":48,"value":2298},"Rolling-file appender",{"type":42,"tag":229,"props":2300,"children":2301},{},[2302],{"type":48,"value":2280},{"type":42,"tag":229,"props":2304,"children":2305},{},[2306],{"type":48,"value":2285},{"type":42,"tag":229,"props":2308,"children":2309},{},[2310],{"type":48,"value":2290},{"type":42,"tag":207,"props":2312,"children":2313},{},[2314,2319,2323,2327],{"type":42,"tag":229,"props":2315,"children":2316},{},[2317],{"type":48,"value":2318},"Console appender",{"type":42,"tag":229,"props":2320,"children":2321},{},[2322],{"type":48,"value":2280},{"type":42,"tag":229,"props":2324,"children":2325},{},[2326],{"type":48,"value":2280},{"type":42,"tag":229,"props":2328,"children":2329},{},[2330],{"type":48,"value":2290},{"type":42,"tag":207,"props":2332,"children":2333},{},[2334,2339,2343,2347],{"type":42,"tag":229,"props":2335,"children":2336},{},[2337],{"type":48,"value":2338},"Ignore filters",{"type":42,"tag":229,"props":2340,"children":2341},{},[2342],{"type":48,"value":2280},{"type":42,"tag":229,"props":2344,"children":2345},{},[2346],{"type":48,"value":2285},{"type":42,"tag":229,"props":2348,"children":2349},{},[2350],{"type":48,"value":2290},{"type":42,"tag":207,"props":2352,"children":2353},{},[2354,2364,2368,2372],{"type":42,"tag":229,"props":2355,"children":2356},{},[2357,2359],{"type":48,"value":2358},"Correlate via ",{"type":42,"tag":57,"props":2360,"children":2362},{"className":2361},[],[2363],{"type":48,"value":186},{"type":42,"tag":229,"props":2365,"children":2366},{},[2367],{"type":48,"value":2280},{"type":42,"tag":229,"props":2369,"children":2370},{},[2371],{"type":48,"value":2280},{"type":42,"tag":229,"props":2373,"children":2374},{},[2375],{"type":48,"value":2290},{"type":42,"tag":207,"props":2377,"children":2378},{},[2379,2384,2388,2392],{"type":42,"tag":229,"props":2380,"children":2381},{},[2382],{"type":48,"value":2383},"Ship to ES via Filebeat",{"type":42,"tag":229,"props":2385,"children":2386},{},[2387],{"type":48,"value":2280},{"type":42,"tag":229,"props":2389,"children":2390},{},[2391],{"type":48,"value":2280},{"type":42,"tag":229,"props":2393,"children":2394},{},[2395],{"type":48,"value":2290},{"type":42,"tag":51,"props":2397,"children":2398},{},[2399,2404],{"type":42,"tag":71,"props":2400,"children":2401},{},[2402],{"type":48,"value":2403},"ECH notes:",{"type":48,"value":2405}," Kibana audit is enabled via the deployment edit page in the Cloud console. Log files are accessible\nthrough the Cloud console deployment logs.",{"type":42,"tag":51,"props":2407,"children":2408},{},[2409],{"type":42,"tag":71,"props":2410,"children":2411},{},[2412],{"type":48,"value":2413},"Serverless notes:",{"type":42,"tag":134,"props":2415,"children":2416},{},[2417,2422],{"type":42,"tag":138,"props":2418,"children":2419},{},[2420],{"type":48,"value":2421},"Kibana audit logging is not user-configurable on Serverless. Security events are managed by Elastic as part of the\nplatform.",{"type":42,"tag":138,"props":2423,"children":2424},{},[2425],{"type":48,"value":2426},"If a user asks about Kibana auditing on Serverless, direct them to the Elastic Cloud console or their account team.",{"type":42,"tag":2428,"props":2429,"children":2430},"style",{},[2431],{"type":48,"value":2432},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2434,"total":2522},[2435,2452,2466,2476,2489,2500,2512],{"slug":2436,"name":2436,"fn":2437,"description":2438,"org":2439,"tags":2440,"stars":23,"repoUrl":24,"updatedAt":2451},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2441,2444,2445,2448],{"name":2442,"slug":2443,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":2446,"slug":2447,"type":15},"Operations","operations",{"name":2449,"slug":2450,"type":15},"Permissions","permissions","2026-07-12T07:46:44.946285",{"slug":2453,"name":2453,"fn":2454,"description":2455,"org":2456,"tags":2457,"stars":23,"repoUrl":24,"updatedAt":2465},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2458,2459,2462],{"name":2442,"slug":2443,"type":15},{"name":2460,"slug":2461,"type":15},"Deployment","deployment",{"name":2463,"slug":2464,"type":15},"Elasticsearch","elasticsearch","2026-07-12T07:46:42.353362",{"slug":2467,"name":2467,"fn":2468,"description":2469,"org":2470,"tags":2471,"stars":23,"repoUrl":24,"updatedAt":2475},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2472,2473,2474],{"name":2442,"slug":2443,"type":15},{"name":2463,"slug":2464,"type":15},{"name":2446,"slug":2447,"type":15},"2026-07-12T07:46:41.097412",{"slug":2477,"name":2477,"fn":2478,"description":2479,"org":2480,"tags":2481,"stars":23,"repoUrl":24,"updatedAt":2488},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2482,2483,2484,2487],{"name":2442,"slug":2443,"type":15},{"name":2463,"slug":2464,"type":15},{"name":2485,"slug":2486,"type":15},"Networking","networking",{"name":13,"slug":14,"type":15},"2026-07-12T07:46:43.675992",{"slug":2490,"name":2490,"fn":2491,"description":2492,"org":2493,"tags":2494,"stars":23,"repoUrl":24,"updatedAt":2499},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2495,2497,2498],{"name":2496,"slug":866,"type":15},"Authentication",{"name":2442,"slug":2443,"type":15},{"name":2463,"slug":2464,"type":15},"2026-07-12T07:46:39.783105",{"slug":75,"name":75,"fn":2501,"description":2502,"org":2503,"tags":2504,"stars":23,"repoUrl":24,"updatedAt":2511},"configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2505,2506,2507,2510],{"name":17,"slug":18,"type":15},{"name":2463,"slug":2464,"type":15},{"name":2508,"slug":2509,"type":15},"Logs","logs",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:35.092599",{"slug":82,"name":82,"fn":2513,"description":2514,"org":2515,"tags":2516,"stars":23,"repoUrl":24,"updatedAt":2521},"configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2517,2518,2519,2520],{"name":2496,"slug":866,"type":15},{"name":9,"slug":8,"type":15},{"name":2463,"slug":2464,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:47:41.474547",35,{"items":2524,"total":2645},[2525,2544,2561,2574,2581,2587,2593,2600,2606,2613,2620,2632],{"slug":2526,"name":2526,"fn":2527,"description":2528,"org":2529,"tags":2530,"stars":2541,"repoUrl":2542,"updatedAt":2543},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2531,2534,2537,2538],{"name":2532,"slug":2533,"type":15},"Analytics","analytics",{"name":2535,"slug":2536,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":2539,"slug":2540,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":2545,"name":2545,"fn":2546,"description":2547,"org":2548,"tags":2549,"stars":2541,"repoUrl":2542,"updatedAt":2560},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2550,2553,2554,2557],{"name":2551,"slug":2552,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":2555,"slug":2556,"type":15},"Engineering","engineering",{"name":2558,"slug":2559,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":2562,"name":2562,"fn":2563,"description":2564,"org":2565,"tags":2566,"stars":2541,"repoUrl":2542,"updatedAt":2573},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2567,2568,2569,2570],{"name":9,"slug":8,"type":15},{"name":2463,"slug":2464,"type":15},{"name":2539,"slug":2540,"type":15},{"name":2571,"slug":2572,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":2436,"name":2436,"fn":2437,"description":2438,"org":2575,"tags":2576,"stars":23,"repoUrl":24,"updatedAt":2451},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2577,2578,2579,2580],{"name":2442,"slug":2443,"type":15},{"name":9,"slug":8,"type":15},{"name":2446,"slug":2447,"type":15},{"name":2449,"slug":2450,"type":15},{"slug":2453,"name":2453,"fn":2454,"description":2455,"org":2582,"tags":2583,"stars":23,"repoUrl":24,"updatedAt":2465},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2584,2585,2586],{"name":2442,"slug":2443,"type":15},{"name":2460,"slug":2461,"type":15},{"name":2463,"slug":2464,"type":15},{"slug":2467,"name":2467,"fn":2468,"description":2469,"org":2588,"tags":2589,"stars":23,"repoUrl":24,"updatedAt":2475},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2590,2591,2592],{"name":2442,"slug":2443,"type":15},{"name":2463,"slug":2464,"type":15},{"name":2446,"slug":2447,"type":15},{"slug":2477,"name":2477,"fn":2478,"description":2479,"org":2594,"tags":2595,"stars":23,"repoUrl":24,"updatedAt":2488},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2596,2597,2598,2599],{"name":2442,"slug":2443,"type":15},{"name":2463,"slug":2464,"type":15},{"name":2485,"slug":2486,"type":15},{"name":13,"slug":14,"type":15},{"slug":2490,"name":2490,"fn":2491,"description":2492,"org":2601,"tags":2602,"stars":23,"repoUrl":24,"updatedAt":2499},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2603,2604,2605],{"name":2496,"slug":866,"type":15},{"name":2442,"slug":2443,"type":15},{"name":2463,"slug":2464,"type":15},{"slug":75,"name":75,"fn":2501,"description":2502,"org":2607,"tags":2608,"stars":23,"repoUrl":24,"updatedAt":2511},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2609,2610,2611,2612],{"name":17,"slug":18,"type":15},{"name":2463,"slug":2464,"type":15},{"name":2508,"slug":2509,"type":15},{"name":13,"slug":14,"type":15},{"slug":82,"name":82,"fn":2513,"description":2514,"org":2614,"tags":2615,"stars":23,"repoUrl":24,"updatedAt":2521},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2616,2617,2618,2619],{"name":2496,"slug":866,"type":15},{"name":9,"slug":8,"type":15},{"name":2463,"slug":2464,"type":15},{"name":13,"slug":14,"type":15},{"slug":89,"name":89,"fn":2621,"description":2622,"org":2623,"tags":2624,"stars":23,"repoUrl":24,"updatedAt":2631},"manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2625,2626,2627,2630],{"name":9,"slug":8,"type":15},{"name":2463,"slug":2464,"type":15},{"name":2628,"slug":2629,"type":15},"RBAC","rbac",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:36.394177",{"slug":2633,"name":2633,"fn":2634,"description":2635,"org":2636,"tags":2637,"stars":23,"repoUrl":24,"updatedAt":2644},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2638,2639,2640,2641],{"name":2532,"slug":2533,"type":15},{"name":2535,"slug":2536,"type":15},{"name":2463,"slug":2464,"type":15},{"name":2642,"slug":2643,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86]