kibana-audit
Kibana Audit Logging
Enable and configure audit logging for Kibana via kibana.yml. Kibana audit logs cover application-layer security
events that Elasticsearch does not see: saved object CRUD (dashboards, visualizations, index patterns, rules, cases),
login/logout, session expiry, space operations, and Kibana-level RBAC enforcement.
For Elasticsearch audit logging (authentication failures, access grants/denials, security config changes), see elasticsearch-audit. For authentication and API key management, see elasticsearch-authn. For roles and user management, see elasticsearch-authz.
For detailed event types, schema, and correlation queries, see references/api-reference.md.
Deployment note: Kibana audit configuration differs across deployment types. See Deployment Compatibility for details.