skills.rest
elastic
elasticOFFICIAL
Explore all skills by this author →
WebsiteGitHub

kibana-audit

Configure Kibana audit logging for saved object access, logins, and space operations.

546|44|Updated Mar 6, 2026
Search Tags:#security#audit logging#kibana#saved objects#trace id#filebeat
One-click install
npx skills add https://github.com/elastic/agent-skills --skill kibana-audit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: kibana-audit
Source: https://github.com/elastic/agent-skills/tree/main/skills/kibana/kibana-audit
Command: npx skills add https://github.com/elastic/agent-skills --skill kibana-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you enable, configure, and manage Kibana's audit logging to track crucial security events like user logins, saved object access, and space operations, enhancing your security posture.

Core Features & Use Cases

  • Enable/Disable Audit Logging: Configure Kibana to start or stop recording audit events.
  • Configure Log Output: Set up where and how audit logs are stored (e.g., rolling files, console).
  • Filter Noisy Events: Reduce log volume by ignoring specific, high-frequency events like saved object searches.
  • Correlate Events: Link Kibana audit events with Elasticsearch audit logs using trace.id for comprehensive security analysis.
  • Ship Logs: Configure Filebeat to send Kibana audit logs to Elasticsearch for unified querying.
  • Use Case: Investigate unauthorized access to sensitive dashboards by enabling audit logging, filtering out routine searches, and then correlating any suspicious saved_object_delete events with corresponding Elasticsearch actions using the trace.id.

Quick Start

Enable Kibana audit logging and configure it to write to a rolling file named 'audit.log' in the Kibana data directory, retaining 10 rotated files.

Frequently Asked Questions about kibana-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enable Kibana audit logging to track saved object access?▼

Configure Kibana audit logging in kibana.yml to track saved object access and user logins by writing events to a rolling file or console for security monitoring.

What is the best way to reduce noisy audit log events in Kibana?▼

Filter noisy Kibana audit logs by configuring event filters to ignore high-frequency actions like saved object searches, reducing log volume while retaining crucial security event tracking.

Can I correlate Kibana audit logs with Elasticsearch logs using trace IDs?▼

Correlate Kibana and Elasticsearch audit logs using trace.id to link events with corresponding actions, enabling comprehensive security analysis and investigation across both platforms.

Do I need Filebeat to ship Kibana audit logs to Elasticsearch?▼

Filebeat is optionally required to ship Kibana audit logs to Elasticsearch, enabling unified querying and centralized security analysis by sending logs directly to your Elasticsearch cluster.

Does Kibana audit logging support tracking space operations and user logins?▼

Kibana audit logging tracks crucial security events including user logins, saved object access, and space operations, enhancing your security posture by monitoring sensitive activities across spaces.

Why should I configure audit logging for investigating unauthorized dashboard access?▼

Configure audit logging to investigate unauthorized dashboard access by tracking saved object events, filtering routine searches, and correlating suspicious delete events using trace.id for detailed analysis.

Related Skills

Explore More Legal & Compliance Skills→
deflosjdeflosj

setup-deploy

Detect hosting platforms and write deployment configuration to CLAUDE.md.

Official
Advanced
athal7athal7
6

observability

Correlate logs, traces, and errors to triage production incidents.

Community
Intermediate
BagelHoleBagelHole
46

audit-logging

Implement centralized audit logging with Fluentd and Elasticsearch.

Community
Intermediate
elasticelastic
546

security-case-management

Create, search, update, and attach alerts to SOC cases via the Kibana Cases API.

Official
Intermediate