القائمة
Enable and configure Kibana audit logging for saved object access, logins, and space operations. Use when setting up Kibana audit, filtering events, or correlating Kibana and ES audit logs.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | kibana-audit |
| description | Enable and configure Kibana audit logging for saved object access, logins, and space operations. Use when setting up Kibana audit, filtering events, or correlating Kibana and ES audit logs. |
| metadata | {"author":"elastic","version":"0.1.0","source":"elastic/agent-skills//skills/kibana/kibana-audit"} |
Enable and configure audit logging for Kibana via kibana.yml. Covers application-layer security events: saved object
CRUD, login/logout, session expiry, and space operations.
xpack.security.audit.enabled: true
xpack.security.audit.appender:
type: rolling-file
fileName: /path/to/kibana/data/audit.log
policy:
type: time-interval
interval: 24h
strategy:
type: numeric
max: 10
A Kibana restart is required after changes.
| Event action | Description |
|---|---|
saved_object_create | A saved object was created |
saved_object_get | A saved object was read |
saved_object_update | A saved object was updated |
saved_object_delete | A saved object was deleted |
saved_object_find | A saved object search was performed |
login | A user logged in (success or failure) |
logout | A user logged out |
session_cleanup | An expired session was cleaned up |
space_create/update/delete | Space operations |
xpack.security.audit.ignore_filters:
- actions: [saved_object_find]
categories: [database]
Both Kibana and ES record the same trace.id (via X-Opaque-Id header). This is the primary correlation key.
curl -X POST "${ELASTICSEARCH_URL}/.security-audit-*/_search" \
<auth_flags> \
-H "Content-Type: application/json" \
-d '{
"query": {
"bool": {
"filter": [
{ "term": { "trace.id": "'"${TRACE_ID}"'" } },
{ "range": { "@timestamp": { "gte": "now-24h" } } }
]
}
},
"sort": [{ "@timestamp": { "order": "asc" } }]
}'
filebeat.inputs:
- type: log
paths: ["/path/to/kibana/data/audit.log"]
json.keys_under_root: true
output.elasticsearch:
hosts: ["https://localhost:9200"]
index: "kibana-audit-%{+yyyy.MM.dd}"
| Capability | Self-managed | ECH | Serverless |
|---|---|---|---|
| Kibana audit | Yes | Via Cloud UI | Not available |
Correlate via trace.id | Yes | Yes | Not available |
trace.id for correlation between Kibana and ES events.saved_object_find events to reduce volume.Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.
Authenticate to Elasticsearch using native, file-based, LDAP/AD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys.
Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP/SAML.
Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.
Ingest and transform data files (CSV/JSON/Parquet/Arrow IPC) into Elasticsearch with stream processing and custom transforms. Use when loading files or batch importing data.
Diagnose and resolve Elasticsearch security errors: 401/403 failures, TLS problems, expired API keys, role mapping mismatches, and Kibana login issues. Use when the user reports a security error.