Grant privileges and roles needed for monitoring

Elasticsearch security features provides built-in users and roles for monitoring. The privileges and roles needed depend on the method used to collect monitoring data.

• If you’re using internal collection to collect metrics about Auditbeat, Elasticsearch security features provides the beats_system built-in user and beats_system built-in role to send monitoring information. You can use the built-in user, if it’s available in your environment, or create a user who has the privileges needed to send monitoring information.

  If you use the beats_system user, make sure you set the password.

  If you don’t use the beats_system user:

  1. Create a monitoring role, called something like auditbeat_monitoring, that has the following privileges:

     Type	Privilege	Purpose
     Cluster	monitor	Retrieve cluster details (e.g. version)
     Index	create_index on .monitoring-beats-* indices	Create monitoring indices in Elasticsearch
     Index	create_doc on .monitoring-beats-* indices	Write monitoring events into Elasticsearch

  2. Assign the monitoring role, along with the following built-in roles, to users who need to monitor Auditbeat:

     Role	Purpose
     kibana_admin	Use Kibana
     monitoring_user	Use Stack Monitoring in Kibana to monitor Auditbeat

• If you’re using Metricbeat to collect metrics about Auditbeat, Elasticsearch security features provides the remote_monitoring_user built-in user, and the remote_monitoring_collector and remote_monitoring_agent built-in roles for collecting and sending monitoring information. You can use the built-in user, if it’s available in your environment, or create a user who has the privileges needed to collect and send monitoring information.

  If you use the remote_monitoring_user user, make sure you set the password.

  If you don’t use the remote_monitoring_user user:

  1. Create a user on the production cluster who will collect and send monitoring information.

  2. Assign the following roles to the user:

     Role	Purpose
     remote_monitoring_collector	Collect monitoring metrics from Auditbeat
     remote_monitoring_agent	Send monitoring data to the monitoring cluster

  3. Assign the following role to users who will view the monitoring data in Kibana:

     Role	Purpose
     monitoring_user	Use Stack Monitoring in Kibana to monitor Auditbeat