Elastic Defend sub-feature privileges
Access to Elastic Defend features is controlled by sub-feature privileges that sit under the Security privilege, and you grant each one separately. This lets you apply the principle of least privilege, giving a role access to the endpoint management pages and response actions it needs.
To grant these privileges, create or edit a role and add Kibana privileges to open the Assign role to spaces flyout. Expand the Security group of features, select All for the Security privilege, then turn on Customize sub-feature privileges. For instructions on creating and editing roles, refer to Role management using Kibana for Elastic Stack, or to Custom roles for Serverless.
Selecting All for Security doesn't grant any sub-feature privileges. You must turn on Customize sub-feature privileges and grant each one individually.
For each of the following sub-feature privileges, select the type of access you want to allow:
- All: Users have full access to the feature, which includes performing all available actions and managing configuration.
- Read: Users can view the feature, but can't perform any actions or manage configuration.
- None: Users can't access or view the feature.
Some sub-features don't have a Read privilege.
These privileges control access to different parts of endpoint management.
| Privilege | What it allows |
|---|---|
| Endpoint List | Access the Endpoints page, which lists all hosts running Elastic Defend, and associated integration details. |
| Automatic Troubleshooting | Access Automatic Troubleshooting to check if your hosts have third-party AV software installed. Note: In Elastic Stack 9.0.0, this privilege is called Endpoint Insights. |
| Global Artifact Management
|
Manage global assignment of endpoint artifacts (such as trusted applications and event filters) across all spaces and policies. This privilege controls global assignment rights only; privileges for each artifact type are required for full artifact management. |
| Trusted Applications | Access the Trusted applications page to remediate conflicts with other software, such as antivirus or endpoint security applications. |
| Trusted Devices
|
Access the Trusted devices page to specify which trusted devices can connect to hosts with Device Control enabled. |
| Host Isolation Exceptions | Access the Host isolation exceptions page to add specific IP addresses that isolated hosts can still communicate with. |
| Blocklist | Access the Blocklist page to prevent specified applications from running on hosts, extending the list of processes that Elastic Defend considers malicious. |
| Event Filters | Access the Event Filters page to filter out endpoint events that you don’t want stored in Elasticsearch. |
| Endpoint Exceptions
|
Add and use endpoint exceptions. Note: In Elastic Stack 9.1.0 and earlier, this privilege is included within the Security privilege. |
| Elastic Defend Policy Management | Access the Policies page and Elastic Defend integration policies to configure protections, event collection, and advanced policy features. |
| Elastic Defend Scripts Management
|
Access the script library to upload and manage scripts for Elastic Defend runscript response actions. |
These privileges control access to different response actions and their history.
| Privilege | What it allows |
|---|---|
| Response Actions History | Access the response actions history for endpoints, and view command output and status in the response console. Grant this privilege whenever you grant a response-action privilege (such as Host Isolation, Process Operations, and so on). If this privilege is None, running a response action still creates the action request, but the user can't monitor its completion or view its results. |
| Host Isolation | Isolate and release hosts. |
| Process Operations | Perform host process-related response actions, including processes, kill-process, and suspend-process. |
| File Operations | Perform file-related response actions in the response console. |
| Execute Operations | Perform shell commands and script-related response actions in the response console. The commands are run on the host using the same user account running the Elastic Defend integration, which normally has full control over the system. Only grant this feature privilege to Elastic Security users who require this level of access. |
| Scan Operations | Perform folder scan response actions in the response console. |
After upgrading from Elastic Security 8.6 or earlier, existing user roles will be assigned None by default for any new endpoint management sub-feature privileges, and you'll need to explicitly assign them. However, many features previously required the built-in superuser role, and users who previously had this role will still have it after upgrading.
You’ll probably want to replace the broadly permissive superuser role with more focused feature-based privileges to ensure that users have access to only the specific features that they need. Refer to Kibana role management for more details on assigning roles and privileges.