Encrypted Saved Objects (ESO)

Sensitive Data Protection: Encrypted Saved Objects protect credentials, API keys, PII, and other secrets stored in Kibana. Incorrect ESO changes can make objects permanently undecryptable.

Overview

An Encrypted Saved Object (ESO) is a Saved Object type registered with the ESO Service to specify:

• attributesToEncrypt: Attributes containing sensitive data (encrypted at rest)
• attributesToIncludeInAAD: Attributes used as Additional Authenticated Data (bound to the encrypted data, must match exactly during decryption)

The ESO Service encrypts using the xpack.encryptedSavedObjects.encryptionKey Kibana config setting. In development, a static key is auto-configured.

Definitive reference: dev_docs/key_concepts/encrypted_saved_objects.mdx

When to Use ESOs