This rule checks whether Kibana public network access is disabled for an Elasticsearch instance. An instance is compliant when Kibana public network access is disabled.
Scenarios
When Kibana public network access is enabled, the Kibana dashboard is reachable from all IP addresses over the public internet. Disabling public access restricts Kibana to internal network traffic only, reducing the attack surface for your Elasticsearch data.
Disable Kibana public network access unless your use case requires it.
Risk level
Default risk level: Medium.
You can change the risk level for this rule based on your requirements.
Detection logic
If Kibana public network access is disabled for an Elasticsearch instance, the instance is considered compliant.
If Kibana public network access is enabled for an Elasticsearch instance, the instance is considered non-compliant. For more information, see Remediation.
Rule details
|
Parameter |
Description |
|
Rule name |
Kibana public network access is disabled for the Elasticsearch instance |
|
Rule identifier |
elasticsearch-instance-enabled-kibana-public-check |
|
Tags |
Elasticsearch, Instance |
|
Auto-remediation |
Not supported |
|
Rule trigger mechanism |
Configuration change |
|
Supported resource types |
Elasticsearch instances |
|
Request parameters |
None |
Remediation
Disable Kibana public network access for the Elasticsearch instance. For more information, see Connect to a cluster using Kibana.