Security Kibana privileges

Roles control what users can access and what actions they can perform. When you create or edit a role, you grant it Kibana privileges, which give access to individual features within one or more spaces.

When you add Kibana privileges to a role, the Assign role to spaces flyout opens. Access to Elastic Security features is controlled by the privileges in the Security group, described on this page.

For more details on creating a role, refer to Role management using Kibana for Elastic Stack, or to Serverless project custom roles for Serverless.

Access levels

For each of the feature privileges, select the type of access you want to allow:

All: Users have full access to the feature, which includes performing all available actions and managing configuration.
Read: Users can view the feature, but can't perform any actions or manage configuration.
None: Users can't access or view the feature.

Note

Some features don't have a Read privilege.

Privileges in the Security group

Each of the following privileges controls access to a different part of Elastic Security.

Privilege	What it allows
Security	Access the Elastic Security features that don't have a privilege of their own. Turn on Customize sub-feature privileges to grant individual privileges. Refer to Security sub-feature privileges. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available from 9.0 to 9.2 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Security also allows access to detection rules, alerts, and exceptions.
Cases	Access cases. Turn on Customize sub-feature privileges to grant individual case privileges. For the full list, refer to Customize sub-feature privileges for cases.
Timeline	Access Timeline.
Notes	Access Notes.
Rules and Exceptions The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.	Access detection rules and exceptions, including the Rules table, rule details, and rule monitoring. Turn on Customize sub-feature privileges to grant individual rule and exception privileges. For the full list, refer to Rules and Exceptions sub-feature privileges.
Alerts The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.	Access detection alerts.
Rules, Alerts, and Exceptions	The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available in 9.3 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Access detection rules, alerts, and exceptions. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Deprecated since 9.4 This functionality is deprecated. You can still use it, but it'll be removed in a future Elastic Stack update. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Deprecated This functionality is deprecated. You can still use it, but it'll be removed in a future Elastic Cloud Serverless update. Roles that use this privilege keep working, but the privilege is no longer available. Use Rules and Exceptions and Alerts instead.
AlertZero Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Preview This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.	Access AlertZero. Most AlertZero tasks also need other privileges, such as Proposed Actions.
Elastic AI Assistant	Access Elastic AI Assistant. Turn on Customize sub-feature privileges to grant individual AI Assistant privileges. For the full list, refer to Elastic AI Assistant sub-feature privileges.
Attack discovery	Access Attack Discovery. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.2 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. Turn on Customize sub-feature privileges to grant individual Attack discovery privileges. For details, refer to Attack discovery sub-feature privileges.
Automatic Migration	Access Automatic Migration. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available from 9.0 to 9.2 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Before 9.2.4, this privilege is called SIEM migrations.

Note

In Serverless, the Security group also includes privileges that belong to the Analytics group in Elastic Stack. Which ones appear depends on your project feature tier. For those privileges, refer to Kibana privileges.

Security sub-feature privileges

Unlike the other features in this group, selecting All for Security doesn't include its sub-feature privileges. You grant each one separately.

Most of the Security privileges control Elastic Defend features. For the full list, refer to Elastic Defend sub-feature privileges. The following table lists the rest.

Privilege	What it allows
SOC Management The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.3 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.	Access the Value report page.

Privilege

What it allows

SOC Management

Access the Value report page.

Rules and Exceptions sub-feature privileges

These privileges control specific actions on detection rules and exceptions. Selecting All includes everything in the following table.

Privilege	What it allows
Exceptions	Create and manage exceptions for rules and shared exception lists. If this privilege is cleared, users with Read for Rules and Exceptions can still view exception lists and exception items.
Investigation guides	Create and edit investigation guides on custom rules.
Custom highlighted fields	Add and edit custom highlighted fields on rules.
Enable or Disable	Enable and disable detection rules.
Manual rule run	Manually run rules for a selected time range.
Rule management settings	Change Settings above the Rules table, including options that affect gap monitoring.

Elastic AI Assistant sub-feature privileges

These privileges control changes to AI Assistant settings. Selecting All includes everything in the following table.

Privilege	What it allows
Field Selection and Anonymization	Change which alert fields Elastic AI Assistant and Attack Discovery can use, and anonymize the content of those fields.
Knowledge Base	Change global Knowledge Base entries, which apply to everyone in the space, including entries that other users created.

Attack discovery sub-feature privileges

These privileges control specific Attack Discovery actions. Selecting All includes everything in the following table.

Privilege	What it allows
Schedules	Create, edit, enable, disable, and delete Attack Discovery schedules.