Kibana Audit

If you need to track who's accessing, modifying, or deleting Kibana dashboards, visualizations, and other saved objects, this skill walks you through enabling and configuring audit logging via kibana.yml. It covers the setup for rolling file or console output, filtering out noisy events like saved_object_find, and the crucial bit about correlating Kibana events with Elasticsearch audit logs using trace.id. The skill includes practical examples for shipping Kibana audit logs to Elasticsearch with Filebeat so you can query everything in one place. It's thorough on the deployment differences between self-managed and cloud setups, and clearly distinguishes what Kibana audit captures versus what Elasticsearch audit handles.

Install to Claude Code

npx -y skills add elastic/agent-skills --skill kibana-audit --agent claude-code