Privileged user monitoring requirements
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality was removed. You can no longer use it if you're running on this version or a later one. This functionality is generally available and ready for production usage. This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless Security
Generally available
Stack
Removed
9.4
…
Removed in 9.4
Generally available in 9.3
Preview from 9.1 to 9.2
Privileged user monitoring is removed. Use Watchlists instead.
This page covers the requirements for using the privileged user monitoring feature, as well as its known limitations.
The privileged user monitoring feature requires:
- The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. The appropriate subscription
- Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The appropriate feature tier
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.
Availability
Removed
This functionality was removed. You can no longer use it if you're running on this version or a later one.
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.
Availability
Removed in 9.3
This functionality was removed. You can no longer use it if you're running on this version or a later one.
This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
To enable this feature, turn on the securitySolution:enablePrivilegedUserMonitoring advanced setting.
To use this feature, you need:
- The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. A role with the appropriate privileges
- Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Either the appropriate predefined Security user role or a custom role with the right privileges
| Action | Index Privileges | Kibana Privileges |
|---|---|---|
| Enable privileged user monitoring | N/A | All for the Security feature |
| View Privileged user monitoring dashboard | Read for the following indices:- .entity_analytics.monitoring.users-<space-id>- risk-score.risk-score-*- .alerts-security.alerts-<space-id>- .ml-anomalies-shared- Security data view indices |
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.
Availability
Generally available since 9.4
This functionality is generally available and ready for production usage.
Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.
This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.
Availability
Generally available
This functionality is generally available and ready for production usage.
Serverless interfaces and procedures might differ from classic Elastic Stack deployments.
Read for the Security feature and at least Read for the Alerts feature to view detection alert data on the dashboard. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available in 9.3 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Read for the Security feature |
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.
Serverless
Generally available
| Action | Predefined role |
|---|---|
| Enable privileged user monitoring | - Platform engineer - Admin |
| View the Privileged user monitoring dashboard | - Tier 1 analyst - Tier 2 analyst - Tier 3 analyst - Rule author - SOC manager - Platform engineer - Detections admin - Admin |
Currently, none of the privileged user monitoring visualizations support cross-cluster search as part of the data that they query from.
You can define up to 10,000 privileged users per data source.