Security Solution settings in Kibana

Configure the following Security Solution settings in the kibana.yml file:

Attack Discovery settings

xpack.discoveries.enabled The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Supported on: Elastic Cloud on Kubernetes extends Kubernetes orchestration capabilities to allow you to deploy and manage components of the Elastic Stack. Availability Generally available This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Enterprise is a self-managed orchestration platform for deploying and managing the Elastic Stack at scale. Availability Generally available This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Self-managed deployments are Elastic Stack deployments managed without the assistance of an orchestrator. Availability Generally available This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Set to false to disable Attack Discovery Workflows for the whole deployment, which Attack Discovery uses to generate discoveries from the Attacks view, from workflows, and from Agent Builder. Set to true to keep them enabled.

Datatype: bool

Default: true

xpack.discoveries.connectorTimeout The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

How long, in milliseconds, Attack Discovery Workflows wait for the large language model connector to respond before a generation step fails.

Datatype: int

Default: 600000

Cloud Security Posture settings

xpack.cloudSecurityPosture.enabled The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 8.3 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Supported on: Elastic Cloud Hosted lets you manage and configure one or more deployments of the versioned Elastic Stack, hosted on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Elastic Cloud on Kubernetes extends Kubernetes orchestration capabilities to allow you to deploy and manage components of the Elastic Stack. Availability Generally available This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Enterprise is a self-managed orchestration platform for deploying and managing the Elastic Stack at scale. Availability Generally available This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Self-managed deployments are Elastic Stack deployments managed without the assistance of an orchestrator. Availability Generally available This functionality is generally available and ready for production usage. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Set to false to disable the Kibana UI for Elastic's Cloud Security Posture solution, which provides compliance checks on Cloud and Kubernetes environments.

Datatype: bool

Default: true

Detection rules settings

xpack.securitySolution.maxRuleImportExportSize

The maximum number of detection rules that a single import or export request can contain.

Datatype: int

Default: 10000

xpack.securitySolution.maxRuleImportPayloadBytes

The maximum size, in bytes, of a detection rules import file.

Datatype: int

Default: 10485760

Elastic Defend settings

xpack.securitySolution.maxUploadResponseActionFileBytes The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 8.9 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Configure the maximum file size, in bytes, for use with the upload response action available with the Elastic Defend integration. There is no upper limit. To learn more, check Endpoint response actions.

Datatype: int

Default: 209715200

Note

In these versions, the default is 26214400 bytes (25 MB) and the maximum is 104857600 bytes (100 MB).

Warning

Setting this value too high may cause timeouts, depending on your cluster's setup and resources.

xpack.securitySolution.disableEndpointRuleAutoInstall The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.1 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Set to true to stop Kibana from automatically installing the Endpoint Security (Elastic Defend) prebuilt rule when a new Elastic Defend integration policy is created. Set to false to keep the automatic installation.

Datatype: bool

Default: false

xpack.securitySolution.maxEndpointScriptFileSize The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

The maximum file size, in bytes, for scripts uploaded to the Elastic Defend script library.

Datatype: int

Default: 26214400

xpack.securitySolution.packagerTaskInterval

How often the background task that builds Elastic Defend artifacts and their manifest runs. Specify a number followed by s for seconds or m for minutes.

Datatype: string

Default: 60s

xpack.securitySolution.packagerTaskTimeout

How long a run of the Elastic Defend artifacts task can take before it times out. Specify a number followed by s for seconds, m for minutes, h for hours, or d for days.

Datatype: string

Default: 20m

xpack.securitySolution.packagerTaskPackagePolicyUpdateBatchSize

The number of Elastic Defend integration policies that the artifacts task updates at a time when a new artifact manifest is available. Must be between 1 and 50.

Datatype: int

Default: 25

xpack.securitySolution.completeExternalResponseActionsTaskInterval

How often the background task that checks and completes response actions sent to third-party endpoint agents runs. Specify a number followed by s for seconds or m for minutes.

Datatype: string

Default: 60s

xpack.securitySolution.completeExternalResponseActionsTaskTimeout

How long a run of the third-party response actions task can take before it times out. Specify a number followed by s for seconds or m for minutes.

Datatype: string

Default: 5m

Entity analytics settings

xpack.securitySolution.entityAnalytics.riskEngine.alertSampleSizePerShard

The maximum number of alerts that the risk engine samples for each entity when calculating risk scores. A value set in the risk engine configuration takes precedence over this setting.

Datatype: int

Default: 10000

xpack.securitySolution.entityAnalytics.monitoring.privileges.users.maxPrivilegedUsersAllowed The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Deprecated since 9.4 This functionality is deprecated. You can still use it, but it'll be removed in a future Elastic Stack update. Generally available from 9.2 to 9.3 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

The maximum number of privileged users that privileged user monitoring can track.

Datatype: int

Default: 10000

Deprecation details

Deprecated since 9.4. Privileged user monitoring is replaced by watchlists.

Experimental features

xpack.securitySolution.enableExperimental

A list of experimental feature flags to enable.

Datatype: array of strings

Note

Experimental features should not be enabled in production environments. Experimental features may be changed or removed completely in future releases. Elastic will make a best effort to fix any issues, but experimental features are not supported to the same level as generally available (GA) features.

xpack.securitySolution.enableExperimental:
  - featureFlagName

Osquery settings

xpack.osquery.enabled

Set to false to disable Osquery in Kibana, including the Osquery app and Osquery response actions. Set to true to keep it enabled.

Datatype: bool

Default: true

Telemetry settings

xpack.securitySolution.telemetry.queryConfig.pageSize

The number of documents that each Elasticsearch query for Security Solution usage data retrieves per page. The maximum is 10000. If you don't set it, Kibana uses the page size from the query configuration that Elastic provides. If you do set it, also set maxResponseSize and maxCompressedResponseSize, because Kibana then takes all three values from kibana.yml and ignores the limits from the query configuration that Elastic provides.

Datatype: int

xpack.securitySolution.telemetry.queryConfig.maxResponseSize

The maximum size, in bytes, of an uncompressed Elasticsearch response to a query for Security Solution usage data. Takes effect only when pageSize is also set. If you set pageSize but omit this setting, Kibana doesn't fall back to the query configuration that Elastic provides; the Elasticsearch client's default limit applies instead.

Datatype: int

xpack.securitySolution.telemetry.queryConfig.maxCompressedResponseSize

The maximum size, in bytes, of a compressed Elasticsearch response to a query for Security Solution usage data. Takes effect only when pageSize is also set. If you set pageSize but omit this setting, Kibana doesn't fall back to the query configuration that Elastic provides; the Elasticsearch client's default limit applies instead.

Datatype: int

Timeline settings

xpack.securitySolution.maxTimelineImportExportSize

The maximum number of Timelines that a single import or export request can contain.

Datatype: int

Default: 10000

xpack.securitySolution.maxTimelineImportPayloadBytes

The maximum size, in bytes, of a Timeline import file.

Datatype: int

Default: 10485760

Value lists settings

xpack.lists.maxImportPayloadBytes

Sets the maximum number of bytes allowed for uploading Security Solution value lists. For every 10 MB, it is recommended to have an additional 1 GB of RAM reserved for Kibana.

Datatype: int

Default: 9000000

Note

On Elastic Cloud Hosted, the value must be between 1000000 and 100000000.

xpack.lists.importBufferSize

Sets the buffer size used for uploading Security Solution value lists. Increase the value to improve upload throughput at the expense of higher Kibana memory usage; decrease it to reduce memory usage at the cost of throughput.

Datatype: int

Default: 1000

Note

On Elastic Cloud Hosted, the value must be between 1 and 10000.