This document describes security settings you may need to configure in self-managed deployments of Kibana. These settings help secure access, manage connections, and ensure consistent behavior across multiple instances.

Additional Kibana security features that apply to all deployment types, such as session management, saved objects encryption, and audit logging, are covered in a separate sectionat the end of this document.

Set an encryption key so that sessions are not invalidated. You can optionally configure additional security settings and authentication.

1. Set thexpack.security.encryptionKey property in thekibana.yml configuration file. You can use any text string that is 32 characters or longer as the encryption key. Refer toxpack.security.encryptionKey.

   xpack.security.encryptionKey: "something_at_least_32_characters"

   Kibana's reporting and saved objects features also have encryption key settings. Refer toxpack.reporting.encryptionKey andxpack.encryptedSavedObjects.encryptionKey respectively.

2. Optional:Configure Kibana's session expiration settings.

3. Restart Kibana.

The Kibana server can instruct browsers to enable additional security controls using HTTP headers.

1. EnableHTTP Strict Transport Security (HSTS).

   UsestrictTransportSecurity to ensure that browsers will only attempt to accessKibana with SSL/TLS encryption. This is designed to prevent manipulator-in-the-middle attacks. To configure this with a lifetime of one year in yourkibana.yml:

   server.securityResponseHeaders.strictTransportSecurity: "max-age=31536000"

   Warning

   This header will block unencrypted connections for the entire domain. If you host more than one web application on the same domain using different ports or paths, all of them will be affected.

2. Disable embedding.

   UsedisableEmbedding to ensure that Kibana cannot be embedded in other websites. To configure this in yourkibana.yml:

   server.securityResponseHeaders.disableEmbedding: true

Kibana uses a Content Security Policy (CSP) to prevent the browser from allowing unsafe scripting, but older browsers will silently ignore this policy. If your organization does not need to support very old versions of our supported browsers, we recommend that you enable Kibana'sstrict mode for the CSP. This will block access to Kibana for any browser that does not enforce even a rudimentary set of CSP protections.

To do this, setcsp.strict totrue in yourkibana.yml:

csp.strict: true

For guidance on managing user access to Kibana, refer toKibana privileges andCluster or deployment users.

For TLS encryption configuration, refer toSet up HTTPS > Encrypt traffic between your browser and Kibana.

The following Kibana security features are not covered in this document because they apply to all deployment types, not just self-managed ones. However, they’re also important to consider:

• Session management
• Saved objects encryption
• Secure settings
• Security events audit logging

For a complete overview of available security features, refer toSecure your cluster, deployment, or project.