CIS Kibana Benchmark

This recommendation verifies that Kibana is running the latest stable version on the Kibana visualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kibana visualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Kibana version
/usr/share/kibana/bin/kibana --version 2>/dev/null
curl -sk https://localhost:5601/api/status | python3 -m json.tool | grep version

# Update Kibana
apt-get update && apt-get install -y kibana
# or
yum update kibana
systemctl restart kibana

This recommendation verifies that Kibana runs as a dedicated non-root user on the Kibana visualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kibana visualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Kibana service user
ps -eo user,pid,args | grep kibana | grep -v grep
grep '^kibana' /etc/passwd

# Run as dedicated user
useradd -r -s /usr/sbin/nologin kibana 2>/dev/null
chown -R kibana:kibana /etc/kibana /var/log/kibana /var/lib/kibana

This recommendation verifies that authentication providers and session limits are configured on the Kibana visualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kibana visualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check authentication providers
grep -A10 'xpack.security' /etc/kibana/kibana.yml
curl -sk https://localhost:5601/api/security/me 2>&1 | head -5

# Configure authentication
# In /etc/kibana/kibana.yml:
xpack.security.authc.providers:
  basic.basic1:
    order: 0
  saml.saml1:
    order: 1
    realm: saml1
xpack.security.session.idleTimeout: "30m"
xpack.security.session.lifespan: "8h"

This recommendation verifies that spaces-based access control is configured on the Kibana visualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kibana visualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Kibana spaces and roles
curl -sk -u admin:pass https://localhost:5601/api/spaces/space | python3 -m json.tool | head -20

# Configure spaces and role-based access
# Create restricted spaces:
curl -sk -X POST https://localhost:5601/api/spaces/space \
  -H 'kbn-xsrf: true' \
  -H 'Content-Type: application/json' \
  -u admin:pass \
  -d '{"id":"production","name":"Production","disabledFeatures":["dev_tools","advancedSettings"]}'
# Assign roles to spaces via Elasticsearch role API

This recommendation verifies that HTTPS is enabled with strong TLS settings on the Kibana visualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kibana visualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check TLS configuration
grep -E 'server.ssl|elasticsearch.ssl' /etc/kibana/kibana.yml

# Enable HTTPS
# In /etc/kibana/kibana.yml:
server.ssl.enabled: true
server.ssl.certificate: /etc/kibana/certs/kibana.crt
server.ssl.key: /etc/kibana/certs/kibana.key
server.ssl.supportedProtocols: ["TLSv1.2", "TLSv1.3"]
server.ssl.cipherSuites:
  - TLS_AES_256_GCM_SHA384
  - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

This recommendation verifies that TLS is configured for Elasticsearch connection on the Kibana visualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kibana visualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Elasticsearch connection TLS
grep 'elasticsearch.hosts\|elasticsearch.ssl' /etc/kibana/kibana.yml

# Configure TLS to Elasticsearch
# In /etc/kibana/kibana.yml:
elasticsearch.hosts: ["https://es-node1:9200"]
elasticsearch.ssl.certificateAuthorities: ["/etc/kibana/certs/ca.crt"]
elasticsearch.ssl.certificate: /etc/kibana/certs/kibana-client.crt
elasticsearch.ssl.key: /etc/kibana/certs/kibana-client.key
elasticsearch.ssl.verificationMode: full

This recommendation verifies that audit logging is enabled on the Kibana visualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kibana visualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check audit logging
grep 'xpack.security.audit' /etc/kibana/kibana.yml
ls -la /var/log/kibana/audit.log 2>/dev/null

# Enable audit logging
# In /etc/kibana/kibana.yml:
xpack.security.audit.enabled: true
xpack.security.audit.appender:
  type: file
  fileName: /var/log/kibana/audit.log
  layout:
    type: json
logging.root.level: info

This recommendation verifies that structured logging with rotation is configured on the Kibana visualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kibana visualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check logging configuration
grep -A5 'logging' /etc/kibana/kibana.yml
ls -la /var/log/kibana/

# Configure structured logging
# In /etc/kibana/kibana.yml:
logging:
  appenders:
    file:
      type: file
      fileName: /var/log/kibana/kibana.log
      layout:
        type: json
  root:
    appenders: [file]
    level: info
# Configure rotation:
cat > /etc/logrotate.d/kibana << 'EOF'
/var/log/kibana/*.log {
    daily
    rotate 30
    compress
    missingok
}
EOF

This recommendation verifies that server is bound to localhost or behind a reverse proxy on the Kibana visualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kibana visualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check server binding
grep 'server.host\|server.port' /etc/kibana/kibana.yml
ss -tlnp | grep 5601

# Restrict server binding
# In /etc/kibana/kibana.yml:
server.host: "127.0.0.1"
server.port: 5601
# Use a reverse proxy (nginx/traefik) for external access
# with authentication and rate limiting

This recommendation verifies that strict CSP and security headers are configured on the Kibana visualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kibana visualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check CSP and security headers
grep 'csp\|server.customResponseHeaders\|xsrf' /etc/kibana/kibana.yml

# Configure security headers
# In /etc/kibana/kibana.yml:
csp.strict: true
csp.warnLegacyBrowsers: false
server.customResponseHeaders:
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  Strict-Transport-Security: "max-age=31536000; includeSubDomains"
  Referrer-Policy: strict-origin-when-cross-origin

This setting ensures that configuration file permissions are restricted on the Kibana visualization platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Kibana visualization platform is essential for defense in depth.

# Check config and key file permissions
stat -c '%a %U %G' /etc/kibana/kibana.yml
find /etc/kibana -type f -exec stat -c '%a %U %G %n' {} \;

# Restrict configuration permissions
chown root:kibana /etc/kibana/kibana.yml
chmod 640 /etc/kibana/kibana.yml
chmod 700 /etc/kibana/certs
chmod 600 /etc/kibana/certs/*.key

This recommendation verifies that saved objects encryption keys are configured on the Kibana visualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kibana visualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check encrypted saved objects
grep 'xpack.encryptedSavedObjects' /etc/kibana/kibana.yml

# Configure saved objects encryption
# In /etc/kibana/kibana.yml:
xpack.encryptedSavedObjects.encryptionKey: "min-32-chars-long-encryption-key!!"
xpack.reporting.encryptionKey: "min-32-chars-long-reporting-key!!"
xpack.security.encryptionKey: "min-32-chars-long-security-key!!"
# Generate keys:
/usr/share/kibana/bin/kibana-encryption-keys generate

This recommendation verifies that the Kibana keystore is used for sensitive settings on the Kibana visualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kibana visualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Kibana keystore
/usr/share/kibana/bin/kibana-keystore list 2>/dev/null

# Use keystore for secrets
/usr/share/kibana/bin/kibana-keystore create
/usr/share/kibana/bin/kibana-keystore add elasticsearch.password
/usr/share/kibana/bin/kibana-keystore add xpack.encryptedSavedObjects.encryptionKey
# Never store secrets in plain text in kibana.yml

This recommendation verifies that unnecessary features are disabled in production on the Kibana visualization platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Kibana visualization platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check disabled features
grep 'map.includeElasticMapsService\|telemetry\|newsfeed' /etc/kibana/kibana.yml

# Disable unnecessary features
# In /etc/kibana/kibana.yml:
telemetry.enabled: false
newsfeed.enabled: false
map.includeElasticMapsService: false
# Restrict Dev Tools in production spaces:
# disabledFeatures: ["dev_tools", "stackAlerts"]