---
title: Security Solution settings in Kibana
description: 
url: https://www.elastic.co/elastic/docs-builder/docs/4492/reference/kibana/configuration-reference/security-solution-settings
products:
  - Kibana
applies_to:
  - Elastic Cloud on Kubernetes: Generally available
  - Elastic Cloud Enterprise: Generally available
  - Self-managed Elastic deployments: Generally available
---

# Security Solution settings in Kibana
Configure the following Security Solution settings in the `kibana.yml` file:

## Attack Discovery settings
<definitions>
  <definition term="xpack.discoveries.enabled">
    <stack-availability>Elastic Stack: Generally available since 9.5</stack-availability>
    <supported-on>Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Set to `false` to disable Attack Discovery Workflows for the whole deployment, which [Attack Discovery](https://www.elastic.co/docs/solutions/security/ai/attack-discovery/run-attack-discovery) uses to generate discoveries from the **Attacks** view, from workflows, and from Agent Builder. Set to `true` to keep them enabled.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="xpack.discoveries.connectorTimeout">
    <stack-availability>Elastic Stack: Generally available since 9.5</stack-availability>
    <supported-on>Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

How long, in milliseconds, Attack Discovery Workflows wait for the large language model connector to respond before a generation step fails.
Datatype: `int`
Default: `600000`
  </definition>
</definitions>

## Cloud Security Posture settings
<definitions>
  <definition term="xpack.cloudSecurityPosture.enabled">
    <stack-availability>Elastic Stack: Generally available since 8.3</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Set to `false` to disable the Kibana UI for Elastic's Cloud Security Posture solution, which provides compliance checks on Cloud and Kubernetes environments.
Datatype: `bool`
Default: `true`
  </definition>
</definitions>

## Detection rules settings
<definitions>
  <definition term="xpack.securitySolution.maxRuleImportExportSize">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The maximum number of detection rules that a single [import or export](https://www.elastic.co/docs/solutions/security/detect-and-alert/manage-detection-rules#import-export-rules-ui) request can contain.
Datatype: `int`
Default: `10000`
  </definition>
  <definition term="xpack.securitySolution.maxRuleImportPayloadBytes">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The maximum size, in bytes, of a detection rules [import](https://www.elastic.co/docs/solutions/security/detect-and-alert/manage-detection-rules#import-rules-ui) file.
Datatype: `int`
Default: `10485760`
  </definition>
</definitions>

## Elastic Defend settings
<definitions>
  <definition term="xpack.securitySolution.maxUploadResponseActionFileBytes">
    <stack-availability>Elastic Stack: Generally available since 8.9</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Configure the maximum file size, in bytes, for use with the `upload` response action available with the Elastic Defend integration. There is no upper limit. To learn more, check [Endpoint response actions](https://www.elastic.co/docs/solutions/security/endpoint-response-actions#_upload).
Datatype: `int`
Default: `209715200`

<note applies-to="Elastic Stack: Generally available from 8.9 to 9.4">
  In these versions, the default is `26214400` bytes (25 MB) and the maximum is `104857600` bytes (100 MB).
</note>


<warning applies-to="Elastic Stack: Generally available since 9.5">
  Setting this value too high may cause timeouts, depending on your cluster's setup and resources.
</warning>

  </definition>
  <definition term="xpack.securitySolution.disableEndpointRuleAutoInstall">
    <stack-availability>Elastic Stack: Generally available since 9.1</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Set to `true` to stop Kibana from automatically installing the **Endpoint Security (Elastic Defend)** prebuilt rule when a new Elastic Defend integration policy is created. Set to `false` to keep the automatic installation.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="xpack.securitySolution.maxEndpointScriptFileSize">
    <stack-availability>Elastic Stack: Generally available since 9.4</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The maximum file size, in bytes, for scripts uploaded to the Elastic Defend script library.
Datatype: `int`
Default: `26214400`
  </definition>
  <definition term="xpack.securitySolution.packagerTaskInterval">
    <supported-on>Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

How often the background task that builds Elastic Defend artifacts and their manifest runs. Specify a number followed by `s` for seconds or `m` for minutes.
Datatype: `string`
Default: `60s`
  </definition>
  <definition term="xpack.securitySolution.packagerTaskTimeout">
    <supported-on>Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

How long a run of the Elastic Defend artifacts task can take before it times out. Specify a number followed by `s` for seconds, `m` for minutes, `h` for hours, or `d` for days.
Datatype: `string`
Default: `20m`
  </definition>
  <definition term="xpack.securitySolution.packagerTaskPackagePolicyUpdateBatchSize">
    <supported-on>Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The number of Elastic Defend integration policies that the artifacts task updates at a time when a new artifact manifest is available. Must be between `1` and `50`.
Datatype: `int`
Default: `25`
  </definition>
  <definition term="xpack.securitySolution.completeExternalResponseActionsTaskInterval">
    <supported-on>Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

How often the background task that checks and completes response actions sent to third-party endpoint agents runs. Specify a number followed by `s` for seconds or `m` for minutes.
Datatype: `string`
Default: `60s`
  </definition>
  <definition term="xpack.securitySolution.completeExternalResponseActionsTaskTimeout">
    <supported-on>Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

How long a run of the third-party response actions task can take before it times out. Specify a number followed by `s` for seconds or `m` for minutes.
Datatype: `string`
Default: `5m`
  </definition>
</definitions>

## Entity analytics settings
<definitions>
  <definition term="xpack.securitySolution.entityAnalytics.riskEngine.alertSampleSizePerShard">
    <supported-on>Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The maximum number of alerts that the risk engine samples for each entity when calculating risk scores. A value set in the risk engine configuration takes precedence over this setting.
Datatype: `int`
Default: `10000`
  </definition>
  <definition term="xpack.securitySolution.entityAnalytics.monitoring.privileges.users.maxPrivilegedUsersAllowed">
    <stack-availability>Elastic Stack: Deprecated since 9.4, Elastic Stack: Generally available from 9.2 to 9.3</stack-availability>
    <supported-on>Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The maximum number of privileged users that [privileged user monitoring](https://www.elastic.co/docs/solutions/security/advanced-entity-analytics/privileged-user-monitoring) can track.
Datatype: `int`
Default: `10000`

<admonition title="Deprecation details">
  Deprecated since 9.4. Privileged user monitoring is replaced by [watchlists](https://www.elastic.co/docs/solutions/security/advanced-entity-analytics/watchlists).
</admonition>

  </definition>
</definitions>

## Experimental features
<definitions>
  <definition term="xpack.securitySolution.enableExperimental">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

A list of experimental feature flags to enable.
Datatype: `array of strings`

<note>
  Experimental features should not be enabled in production environments. Experimental features may be changed or removed completely in future releases. Elastic will make a best effort to fix any issues, but experimental features are not supported to the same level as generally available (GA) features.
</note>


```yaml
xpack.securitySolution.enableExperimental:
  - featureFlagName
```

  </definition>
</definitions>

## Osquery settings
<definitions>
  <definition term="xpack.osquery.enabled">
    <supported-on>Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Set to `false` to disable [Osquery](https://www.elastic.co/docs/solutions/security/investigate/osquery) in Kibana, including the **Osquery** app and Osquery response actions. Set to `true` to keep it enabled.
Datatype: `bool`
Default: `true`
  </definition>
</definitions>

## Telemetry settings
<definitions>
  <definition term="xpack.securitySolution.telemetry.queryConfig.pageSize">
    <supported-on>Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The number of documents that each Elasticsearch query for Security Solution usage data retrieves per page. The maximum is `10000`. If you don't set it, Kibana uses the page size from the query configuration that Elastic provides. If you do set it, also set `maxResponseSize` and `maxCompressedResponseSize`, because Kibana then takes all three values from `kibana.yml` and ignores the limits from the query configuration that Elastic provides.
Datatype: `int`
  </definition>
  <definition term="xpack.securitySolution.telemetry.queryConfig.maxResponseSize">
    <supported-on>Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The maximum size, in bytes, of an uncompressed Elasticsearch response to a query for Security Solution usage data. Takes effect only when `pageSize` is also set. If you set `pageSize` but omit this setting, Kibana doesn't fall back to the query configuration that Elastic provides; the Elasticsearch client's default limit applies instead.
Datatype: `int`
  </definition>
  <definition term="xpack.securitySolution.telemetry.queryConfig.maxCompressedResponseSize">
    <supported-on>Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The maximum size, in bytes, of a compressed Elasticsearch response to a query for Security Solution usage data. Takes effect only when `pageSize` is also set. If you set `pageSize` but omit this setting, Kibana doesn't fall back to the query configuration that Elastic provides; the Elasticsearch client's default limit applies instead.
Datatype: `int`
  </definition>
</definitions>

## Timeline settings
<definitions>
  <definition term="xpack.securitySolution.maxTimelineImportExportSize">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The maximum number of [Timelines](https://www.elastic.co/docs/solutions/security/investigate/timeline) that a single import or export request can contain.
Datatype: `int`
Default: `10000`
  </definition>
  <definition term="xpack.securitySolution.maxTimelineImportPayloadBytes">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The maximum size, in bytes, of a [Timeline](https://www.elastic.co/docs/solutions/security/investigate/timeline) import file.
Datatype: `int`
Default: `10485760`
  </definition>
</definitions>

## Value lists settings
<definitions>
  <definition term="xpack.lists.maxImportPayloadBytes">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Sets the maximum number of bytes allowed for uploading Security Solution [value lists](https://www.elastic.co/docs/solutions/security/detect-and-alert/create-manage-value-lists). For every 10 MB, it is recommended to have an additional 1 GB of RAM reserved for Kibana.
Datatype: `int`
Default: `9000000`

<note applies-to="Elastic Cloud Hosted: Generally available">
  On Elastic Cloud Hosted, the value must be between `1000000` and `100000000`.
</note>

  </definition>
  <definition term="xpack.lists.importBufferSize">
    <supported-on>Elastic Cloud Hosted: Generally available, Elastic Cloud on Kubernetes: Generally available, Elastic Cloud Enterprise: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Sets the buffer size used for uploading Security Solution [value lists](https://www.elastic.co/docs/solutions/security/detect-and-alert/create-manage-value-lists). Increase the value to improve upload throughput at the expense of higher Kibana memory usage; decrease it to reduce memory usage at the cost of throughput.
Datatype: `int`
Default: `1000`

<note applies-to="Elastic Cloud Hosted: Generally available">
  On Elastic Cloud Hosted, the value must be between `1` and `10000`.
</note>

  </definition>
</definitions>