kibana-audit

SKILL.md

Kibana Audit Logging

Enable and configure audit logging for Kibana via kibana.yml. Kibana audit logs cover application-layer security
events that Elasticsearch does not see: saved object CRUD (dashboards, visualizations, index patterns, rules, cases),
login/logout, session expiry, space operations, and Kibana-level RBAC enforcement.

For Elasticsearch audit logging (authentication failures, access grants/denials, security config changes), see
elasticsearch-audit. For authentication and API key management, see elasticsearch-authn. For roles and user
management, see elasticsearch-authz.

For detailed event types, schema, and correlation queries, see
references/api-reference.md.

Deployment note: Kibana audit configuration differs across deployment types. See
Deployment Compatibility for details.

Jobs to Be Done