CommunityProduktivität & Zusammenarbeitgithub.com

elastic/kibana-audit

Aktivieren und Konfigurieren des Kibana-Audit-Loggings für Zugriffe auf gespeicherte Objekte, Anmeldungen und Bereichsoperationen. Verwenden Sie dies beim Einrichten des Kibana-Audits, Filtern von Ereignissen oder Korrelieren von Kibana- und ES-Audit-Logs.

Was ist kibana-audit?

Diese Fähigkeit ermöglicht es, das Kibana-Audit-Logging zu aktivieren und zu konfigurieren, um wichtige Ereignisse wie Zugriffe auf gespeicherte Objekte, Benutzeranmeldungen und Bereichsoperationen zu überwachen. Sie ist besonders nützlich für Sicherheits- und Compliance-Anforderungen, da sie eine detaillierte Nachverfolgung von Benutzeraktivitäten innerhalb von Kibana ermöglicht. Die Konfiguration kann über die `kibana.yml`-Datei oder über die Kibana-UI erfolgen und unterstützt das Filtern von Ereignissen sowie die Korrelation mit Elasticsearch-Audit-Logs. Entwickler und Administratoren können damit gezielt bestimmte Aktionen überwachen und Audit-Trails für die Einhaltung von Vorschriften erstellen.

Funktioniert mit~Claude Code~Codex CLI~Cursor
Part ofAgent Workflows
npx skills add https://github.com/elastic/agent-skills/tree/main/skills/kibana-audit

Installed? Explore more Produktivität & Zusammenarbeit skills: steipete/gemini, steipete/gh-issues, steipete/skill-creator · View all 6 →

Original anzeigen→Alle Skills durchsuchen

In Ihrer bevorzugten KI fragen

Öffnet einen neuen Chat, in dem dieser Agent-Skill bereits geladen ist.

OpenAIChatGPTClaudeClaudeGeminiGeminiGrokGrokPerplexityPerplexityDeepSeekDeepSeek

Dokumentation

Was macht kibana-audit?

Aktivieren und Konfigurieren des Kibana-Audit-Loggings für Zugriffe auf gespeicherte Objekte, Anmeldungen und Bereichsoperationen. Verwenden Sie dies beim Einrichten des Kibana-Audits, Filtern von Ereignissen oder Korrelieren von Kibana- und ES-Audit-Logs.

Konfiguration

Fügen Sie die folgenden Einstellungen zu Ihrer kibana.yml-Datei hinzu:

xpack.security.audit.enabled: true
xpack.security.audit.appender.kind: rolling-file
xpack.security.audit.appender.path: /var/log/kibana/audit.log
xpack.security.audit.appender.policy.interval: 3d
xpack.security.audit.appender.policy.modulate: true
xpack.security.audit.appender.strategy.kind: numeric
xpack.security.audit.appender.strategy.max: 10

Oder konfigurieren Sie es über die Kibana-UI unter Management > Advanced Settings > Audit.

Ereignisfilterung

Sie können Audit-Ereignisse nach Typ filtern, z.B. nur saved_object_access oder login-Ereignisse protokollieren. Beispiel:

xpack.security.audit.ignore:
  - 'saved_object_access'
  - 'space_operation'

Korrelation mit ES-Audit-Logs

Um Kibana- und Elasticsearch-Audit-Logs zu korrelieren, stellen Sie sicher, dass beide Systeme auf dieselbe Audit-Log-Datei oder -Quelle verweisen. Verwenden Sie gemeinsame Felder wie user.id, timestamp und event.action, um Abfragen zu erstellen.

Individual skills in this repo

This repo contains 20 individual skills — each has its own dedicated page.

elastic/cloud-access-management

Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.

elastic/cloud-create-project

Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.

elastic/cloud-manage-project

Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.

elastic/cloud-network-security

Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.

elastic/cloud-setup

Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.

elastic/elasticsearch-audit

Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.

elastic/elasticsearch-authn

Authenticate to Elasticsearch using native, file-based, LDAP/AD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.

elastic/elasticsearch-authz

Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP/SAML.

elastic/elasticsearch-esql

Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.

elastic/elasticsearch-file-ingest

Ingest and transform data files (CSV/JSON/Parquet/Arrow IPC) into Elasticsearch with stream processing and custom transforms. Use when loading files or batch importing data — not for reindexing, general ingest pipeline design, or bulk API patterns.

elastic/elasticsearch-onboarding

Help developers new to Elasticsearch get from zero to a working search experience. Guide them through understanding their intent, mapping their data, and building a search experience with best practices baked in. Use this when the user shows intent to build search-related functionality, asks about Elasticsearch-related concepts for their use case, or expresses the need for help getting started with Elasticsearch.

elastic/elasticsearch-security-troubleshooting

Diagnose and resolve Elasticsearch security errors: 401/403 failures, TLS problems, expired API keys, role mapping mismatches, and Kibana login issues. Use when the user reports a security error.

elastic/kibana-agent-builder

Create and manage Agent Builder agents and custom tools in Kibana. Use when asked to create, update, delete, test, or inspect agents or tools in Agent Builder.

elastic/kibana-alerting-rules

Create and manage Kibana alerting rules via REST API or Terraform. Use when creating, updating, or managing rule lifecycle (enable, disable, mute, snooze) or rules-as-code workflows.

elastic/kibana-connectors

Create and manage Kibana connectors for Slack, PagerDuty, Jira, webhooks, and more via REST API or Terraform. Use when configuring third-party integrations or managing connectors as code.

elastic/kibana-dashboards

Create and manage Kibana Dashboards and visualizations. Use when you need to define dashboards and visualizations declaratively, version control them, or automate their deployment.

elastic/kibana-streams

List, inspect, enable, disable, and resync Kibana Streams via the REST API. Use when the user needs stream details, ingest/query settings, queries, significant events, or attachments.

elastic/kibana-vega

Create Vega and Vega-Lite visualizations with ES|QL data sources in Kibana. Use when building custom charts, dashboards, or programmatic panel layouts beyond standard Lens charts.

elastic/observability-edot-dotnet-instrument

Instrument a .NET application with the Elastic Distribution of OpenTelemetry (EDOT) .NET SDK for automatic tracing, metrics, and logs. Use when adding observability to a .NET service that has no existing APM agent.

elastic/observability-edot-dotnet-migrate

Migrate a .NET application from the classic Elastic APM .NET agent to the EDOT .NET SDK. Use when switching from Elastic.Apm.* packages to Elastic.OpenTelemetry.

Verwandte Skills

steipete/gemini

Gemini CLI one-shot prompts, summaries, generation, skills, hooks, MCP, or Gemma routing.

community

steipete/gh-issues

Fetch GitHub issues, select candidates, spawn background fix agents, open PRs, and optionally process PR review comments.

community

steipete/skill-creator

Create, edit, audit, tidy, validate, or restructure AgentSkills and SKILL.md files.

community

steipete/clawhub

Search, install, update, sync, or publish agent skills with the ClawHub CLI and registry.

community

steipete/coding-agent

Delegate coding work to Codex, Claude Code, or OpenCode as background workers; not simple edits or read-only code lookup.

community

steipete/mcporter

List, configure, authenticate, call, and inspect MCP servers/tools with mcporter over HTTP or stdio.

community
← More Produktivität & Zusammenarbeit skills