Kibana Audit

Enable and configure Kibana audit logging for saved object access, logins, and space operations.

When your AI uses it

Enable and configure Kibana audit logging for saved object access, logins, and space operations. Use when setting up Kibana audit, filtering events, or correlating Kibana and ES audit logs.This is the skill's description: the text your AI reads to decide when the skill applies.

auditelastickibanatrusted-source

Read exactly what your AI will be told

elastic-kibana-audit/SKILL.md

Elastic · Apache-2.0 · source

---
name: kibana-audit
description: >
  Enable and configure Kibana audit logging for saved object access, logins, and space
  operations. Use when setting up Kibana audit, filtering events, or correlating Kibana
  and ES audit logs.
metadata:
  author: elastic
  version: 0.1.0
---

# Kibana Audit Logging

Enable and configure audit logging for Kibana via `kibana.yml`. Kibana audit logs cover application-layer security
events that Elasticsearch does not see: saved object CRUD (dashboards, visualizations, index patterns, rules, cases),
login/logout, session expiry, space operations, and Kibana-level RBAC enforcement.

For Elasticsearch audit logging (authentication failures, access grants/denials, security config changes), see
**elasticsearch-audit**. For authentication and API key management, see **elasticsearch-authn**. For roles and user
management, see **elasticsearch-authz**.

For detailed event types, schema, and correlation queries, see
[references/api-reference.md](references/api-reference.md).

> **Deployment note:** Kibana audit configuration differs across deployment types. See