Security Solution settings in Kibana

Configure the following Security Solution settings in the kibana.yml file:

Attack Discovery settings

xpack.discoveries.enabled

Supported on:

Set to false to disable Attack Discovery Workflows for the whole deployment, which Attack Discovery uses to generate discoveries from the Attacks view, from workflows, and from Agent Builder. Set to true to keep them enabled.

Datatype: bool

Default: true

xpack.discoveries.connectorTimeout

Supported on:

How long, in milliseconds, Attack Discovery Workflows wait for the large language model connector to respond before a generation step fails.

Datatype: int

Default: 600000

Cloud Security Posture settings

xpack.cloudSecurityPosture.enabled

Supported on:

Set to false to disable the Kibana UI for Elastic's Cloud Security Posture solution, which provides compliance checks on Cloud and Kubernetes environments.

Datatype: bool

Default: true

Detection rules settings

xpack.securitySolution.maxRuleImportExportSize

Supported on:

The maximum number of detection rules that a single import or export request can contain.

Datatype: int

Default: 10000

xpack.securitySolution.maxRuleImportPayloadBytes

Supported on:

The maximum size, in bytes, of a detection rules import file.

Datatype: int

Default: 10485760

Elastic Defend settings

xpack.securitySolution.maxUploadResponseActionFileBytes

Supported on:

Configure the maximum file size, in bytes, for use with the upload response action available with the Elastic Defend integration. There is no upper limit. To learn more, check Endpoint response actions.

Datatype: int

Default: 209715200

Note

In these versions, the default is 26214400 bytes (25 MB) and the maximum is 104857600 bytes (100 MB).

Warning

Setting this value too high may cause timeouts, depending on your cluster's setup and resources.

xpack.securitySolution.disableEndpointRuleAutoInstall

Supported on:

Set to true to stop Kibana from automatically installing the Endpoint Security (Elastic Defend) prebuilt rule when a new Elastic Defend integration policy is created. Set to false to keep the automatic installation.

Datatype: bool

Default: false

xpack.securitySolution.maxEndpointScriptFileSize

Supported on:

The maximum file size, in bytes, for scripts uploaded to the Elastic Defend script library.

Datatype: int

Default: 26214400

xpack.securitySolution.packagerTaskInterval

Supported on:

How often the background task that builds Elastic Defend artifacts and their manifest runs. Specify a number followed by s for seconds or m for minutes.

Datatype: string

Default: 60s

xpack.securitySolution.packagerTaskTimeout

Supported on:

How long a run of the Elastic Defend artifacts task can take before it times out. Specify a number followed by s for seconds, m for minutes, h for hours, or d for days.

Datatype: string

Default: 20m

xpack.securitySolution.packagerTaskPackagePolicyUpdateBatchSize

Supported on:

The number of Elastic Defend integration policies that the artifacts task updates at a time when a new artifact manifest is available. Must be between 1 and 50.

Datatype: int

Default: 25

xpack.securitySolution.completeExternalResponseActionsTaskInterval

Supported on:

How often the background task that checks and completes response actions sent to third-party endpoint agents runs. Specify a number followed by s for seconds or m for minutes.

Datatype: string

Default: 60s

xpack.securitySolution.completeExternalResponseActionsTaskTimeout

Supported on:

How long a run of the third-party response actions task can take before it times out. Specify a number followed by s for seconds or m for minutes.

Datatype: string

Default: 5m

Entity analytics settings

xpack.securitySolution.entityAnalytics.riskEngine.alertSampleSizePerShard

Supported on:

The maximum number of alerts that the risk engine samples for each entity when calculating risk scores. A value set in the risk engine configuration takes precedence over this setting.

Datatype: int

Default: 10000

xpack.securitySolution.entityAnalytics.monitoring.privileges.users.maxPrivilegedUsersAllowed

Supported on:

The maximum number of privileged users that privileged user monitoring can track.

Datatype: int

Default: 10000

Deprecation details

Deprecated since 9.4. Privileged user monitoring is replaced by watchlists.

Experimental features

xpack.securitySolution.enableExperimental

Supported on:

A list of experimental feature flags to enable.

Datatype: array of strings

Note

Experimental features should not be enabled in production environments. Experimental features may be changed or removed completely in future releases. Elastic will make a best effort to fix any issues, but experimental features are not supported to the same level as generally available (GA) features.

xpack.securitySolution.enableExperimental:
  - featureFlagName
		

Osquery settings

xpack.osquery.enabled

Supported on:

Set to false to disable Osquery in Kibana, including the Osquery app and Osquery response actions. Set to true to keep it enabled.

Datatype: bool

Default: true

Telemetry settings

xpack.securitySolution.telemetry.queryConfig.pageSize

Supported on:

The number of documents that each Elasticsearch query for Security Solution usage data retrieves per page. The maximum is 10000. If you don't set it, Kibana uses the page size from the query configuration that Elastic provides. If you do set it, also set maxResponseSize and maxCompressedResponseSize, because Kibana then takes all three values from kibana.yml and ignores the limits from the query configuration that Elastic provides.

Datatype: int

xpack.securitySolution.telemetry.queryConfig.maxResponseSize

Supported on:

The maximum size, in bytes, of an uncompressed Elasticsearch response to a query for Security Solution usage data. Takes effect only when pageSize is also set. If you set pageSize but omit this setting, Kibana doesn't fall back to the query configuration that Elastic provides; the Elasticsearch client's default limit applies instead.

Datatype: int

xpack.securitySolution.telemetry.queryConfig.maxCompressedResponseSize

Supported on:

The maximum size, in bytes, of a compressed Elasticsearch response to a query for Security Solution usage data. Takes effect only when pageSize is also set. If you set pageSize but omit this setting, Kibana doesn't fall back to the query configuration that Elastic provides; the Elasticsearch client's default limit applies instead.

Datatype: int

Timeline settings

xpack.securitySolution.maxTimelineImportExportSize

Supported on:

The maximum number of Timelines that a single import or export request can contain.

Datatype: int

Default: 10000

xpack.securitySolution.maxTimelineImportPayloadBytes

Supported on:

The maximum size, in bytes, of a Timeline import file.

Datatype: int

Default: 10485760

Value lists settings

xpack.lists.maxImportPayloadBytes

Supported on:

Sets the maximum number of bytes allowed for uploading Security Solution value lists. For every 10 MB, it is recommended to have an additional 1 GB of RAM reserved for Kibana.

Datatype: int

Default: 9000000

Note

On Elastic Cloud Hosted, the value must be between 1000000 and 100000000.

xpack.lists.importBufferSize

Supported on:

Sets the buffer size used for uploading Security Solution value lists. Increase the value to improve upload throughput at the expense of higher Kibana memory usage; decrease it to reduce memory usage at the cost of throughput.

Datatype: int

Default: 1000

Note

On Elastic Cloud Hosted, the value must be between 1 and 10000.