Skip to content

Commit 1253dfa

Browse files
Merge branch 'main' into ts-obs-applies
2 parents 676ea21 + 1700917 commit 1253dfa

File tree

109 files changed

+823
-4445
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

109 files changed

+823
-4445
lines changed

deploy-manage/deploy/cloud-enterprise/configure.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ Other sections of the documentation describe important ECE features to consider:
3333
* [Configure allocator affinity](configure-allocator-affinity.md) - Determine how ECE distributes your Elastic Stack deployments across allocators.
3434
* [Change allocator disconnect timeout](change-allocator-disconnect-timeout.md) - Configure how long ECE waits before considering allocators to be disconnected.
3535
* [Migrate ECE to Podman hosts](./migrate-ece-to-podman-hosts.md) - If you are running a Docker based installation and you need to migrate to Podman.
36-
* [Migrate ECE on Podman hosts to SELinux in enforcing mode](migrate-ece-on-podman-hosts-to-selinux-enforce.md) - Migrate ECE to SELinux in `enforcing` mode using Podman.
36+
* [Migrate ECE on Podman hosts to SELinux in enforcing mode](../../security/secure-your-elastic-cloud-enterprise-installation/migrate-ece-on-podman-hosts-to-selinux-enforce.md) - Migrate ECE to SELinux in `enforcing` mode using Podman.
3737

3838
## Maintenance activities
3939

deploy-manage/deploy/cloud-enterprise/deploy-an-orchestrator.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,5 +52,5 @@ To start orchestrating your {{es}} clusters, refer to [](./working-with-deployme
5252
The following tasks are only needed on certain circumstances:
5353

5454
* [Migrate ECE to Podman hosts](./migrate-ece-to-podman-hosts.md)
55-
* [Migrate ECE on Podman hosts to SELinux enforce](./migrate-ece-on-podman-hosts-to-selinux-enforce.md)
55+
* [Migrate ECE on Podman hosts to SELinux enforce](./../../security/secure-your-elastic-cloud-enterprise-installation/migrate-ece-on-podman-hosts-to-selinux-enforce.md)
5656
* [Change allocator disconnect timeout](./change-allocator-disconnect-timeout.md)

deploy-manage/deploy/cloud-enterprise/enable-custom-endpoint-aliases.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ After installing or upgrading to version 2.10 or later:
2929
* For Kibana, the certificate needs to allow for ***.kb.<your-domain>**
3030
* For APM, the certificate needs to allow for ***.apm.<your-domain>**
3131
* For Fleet, the certificate needs to allow for ***.fleet.<your-domain>**
32+
* For Universal Profiling, the certificate needs to allow for ***.profiling.<your-domain>** and ***.symbols.<your-domain>**
3233

3334
3. In the **Platform** menu, select **Settings**.
3435
4. Under the **Enable custom endpoint alias naming**, toggle the setting to allow platform administrators and deployment managers to choose a simplified, unique URL for the endpoint.

deploy-manage/deploy/cloud-on-k8s.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -80,11 +80,11 @@ Alpha, beta, and stable API versions follow the same [conventions used by Kubern
8080

8181
ECK is compatible with the following Elastic Stack applications:
8282

83-
* Elasticsearch, Kibana, APM Server: 6.8+, 7.1+, 8+
84-
* Enterprise Search: 7.7+, 8+
85-
* Beats: 7.0+, 8+
86-
* Elastic Agent: 7.10+ (standalone), 7.14+ (Fleet), 8+
87-
* Elastic Maps Server: 7.11+, 8+
83+
* Elasticsearch, Kibana, APM Server: 7.17+, 8+
84+
* Enterprise Search: 7.17+, 8+
85+
* Beats: 7.17+, 8+
86+
* Elastic Agent: 7.10+ (standalone), 7.17+ (Fleet), 8+
87+
* Elastic Maps Server: 7.17+, 8+
8888
* Logstash: 8.7+
8989

9090
Elastic Stack application images for the OpenShift-certified Elasticsearch (ECK) Operator are only available from version 7.10 and later.

deploy-manage/deploy/deployment-comparison.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ For more details about feature availability in Serverless, check [](elastic-clou
1212
| [Security configurations](/deploy-manage/security.md) | Full control | Limited control | Limited control |
1313
| [Authentication realms](/deploy-manage/users-roles.md) | Available | Available | Available, through Elastic Cloud only |
1414
| [Custom roles](/deploy-manage/users-roles.md) | Available | Available | Available |
15-
| [Audit logging](/deploy-manage/monitor/logging-configuration/configuring-audit-logs.md) | Available | Available | No |
15+
| [Audit logging](/deploy-manage/security/logging-configuration/security-event-audit-logging.md) | Available | Available | No |
1616

1717
## Infrastructure and cluster management
1818

deploy-manage/monitor/stack-monitoring/collecting-log-data-with-filebeat.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ If you’re using {{agent}}, do not deploy {{filebeat}} for log collection. Inst
2727

2828
2. Identify which logs you want to monitor.
2929

30-
The {{filebeat}} {{es}} module can handle [audit logs](../logging-configuration/logfile-audit-output.md), [deprecation logs](../logging-configuration/elasticsearch-log4j-configuration-self-managed.md#deprecation-logging), [gc logs](elasticsearch://reference/elasticsearch/jvm-settings.md#gc-logging), [server logs](../logging-configuration/elasticsearch-log4j-configuration-self-managed.md), and [slow logs](elasticsearch://reference/elasticsearch/index-settings/slow-log.md). For more information about the location of your {{es}} logs, see the [path.logs](../../deploy/self-managed/important-settings-configuration.md#path-settings) setting.
30+
The {{filebeat}} {{es}} module can handle [audit logs](../../security/logging-configuration/logfile-audit-output.md), [deprecation logs](../logging-configuration/elasticsearch-log4j-configuration-self-managed.md#deprecation-logging), [gc logs](elasticsearch://reference/elasticsearch/jvm-settings.md#gc-logging), [server logs](../logging-configuration/elasticsearch-log4j-configuration-self-managed.md), and [slow logs](elasticsearch://reference/elasticsearch/index-settings/slow-log.md). For more information about the location of your {{es}} logs, see the [path.logs](../../deploy/self-managed/important-settings-configuration.md#path-settings) setting.
3131

3232
::::{important}
3333
If there are both structured (`*.json`) and unstructured (plain text) versions of the logs, you must use the structured logs. Otherwise, they might not appear in the appropriate context in {{kib}}.

deploy-manage/monitor/stack-monitoring/ece-stack-monitoring.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -181,7 +181,7 @@ When shipping logs to a monitoring deployment there are more logging features av
181181

182182
#### For {{es}}: [ece-extra-logging-features-elasticsearch]
183183

184-
* [Audit logging](../logging-configuration/enabling-audit-logs.md) - logs security-related events on your deployment
184+
* [Audit logging](../../security/logging-configuration/enabling-audit-logs.md) - logs security-related events on your deployment
185185
* [Slow query and index logging](elasticsearch://reference/elasticsearch/index-settings/slow-log.md) - helps find and debug slow queries and indexing
186186
* Verbose logging - helps debug stack issues by increasing component logs
187187

@@ -190,7 +190,7 @@ After you’ve enabled log delivery on your deployment, you can [add the Elastic
190190

191191
#### For Kibana: [ece-extra-logging-features-kibana]
192192

193-
* [Audit logging](../logging-configuration/enabling-audit-logs.md) - logs security-related events on your deployment
193+
* [Audit logging](../../security/logging-configuration/enabling-audit-logs.md) - logs security-related events on your deployment
194194

195195
After you’ve enabled log delivery on your deployment, you can [add the Kibana user settings](../../deploy/cloud-enterprise/edit-stack-settings.md) to enable this feature.
196196

deploy-manage/security.md

Lines changed: 115 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -75,102 +75,158 @@ $$$maintaining-audit-trail$$$
7575

7676
# Security
7777

78-
This section covers how to secure your Elastic environment. Learn how to implement TLS encryption, network security controls, and data protection measures.
78+
This overview page helps you understand Elastic's security capabilities across different deployment types. You'll find:
79+
80+
- Key security features for protecting your Elastic deployment
81+
- Security capabilities specific to each deployment type
82+
- Comparison tables showing feature availability and configurability by deployment type
83+
- Links to detailed implementation guides
7984

8085
## Security overview
8186

82-
An Elastic implementation comprises many moving parts: {es} nodes forming the cluster, {kib} instances, additional stack components such as Logstash and Beats, and various clients and integrations communicating with your deployment.
87+
An Elastic implementation comprises many moving parts: {{es}} nodes forming the cluster, {{kib}} instances, additional stack components such as Logstash and Beats, and various clients and integrations communicating with your deployment.
8388

8489
To keep your data secured, Elastic offers comprehensive security features that:
8590
- Prevent unauthorized access to your deployment
8691
- Encrypt communications between components
8792
- Protect data at rest
8893
- Secure sensitive settings and saved objects
8994

90-
Security requirements and capabilities vary by deployment. Features may be managed automatically by Elastic, require configuration, or must be fully self-managed. Refer to [Security by deployment type](#security-by-deployment-type) for details.
95+
:::{note}
96+
The availability and configurability of security features vary by deployment type. Refer to [Security by deployment type](#security-features-by-deployment-type) for a comparison table.
97+
:::
9198

92-
::::{tip}
93-
See the [Deployment overview](/deploy-manage/deploy.md) to understand your options for deploying Elastic.
94-
::::
99+
## Security topics
95100

96-
### Security by deployment type
101+
The documentation is organized into three main areas.
97102

98-
Security features have one of these statuses across deployment types:
103+
On every page, you'll see deployment type indicators that show which content applies to specific deployment types. Focus on sections tagged with your deployment type and look for subsections specifically addressing your deployment model.
99104

100-
| Status | Description |
101-
|--------|-------------|
102-
| **Managed** | Handled automatically by Elastic with no user configuration needed |
103-
| **Configurable** | Built-in feature that needs your configuration (like IP filters or passwords) |
104-
| **Self-managed** | Infrastructure-level security you implement and maintain |
105-
| **N/A** | Not available for this deployment type |
105+
### 1. Secure your orchestrator
106106

107-
#### Communication security
107+
The [security of your orchestrator](security/secure-hosting-environment.md) forms the foundation of your overall security posture. This section covers environment-specific security controls:
108108

109-
| **Security feature** | Serverless | Elastic Cloud Hosted | ECE | ECK | Self-managed |
110-
|------------------|------------|--------------|-----|-----|--------------|
111-
| **TLS (HTTP Layer)** | Managed | Managed | Configurable | Configurable | Self-managed |
112-
| **TLS (Transport Layer)** | Managed | Managed | Managed | Managed | Self-managed |
109+
- [**Elastic Cloud Hosted and Serverless**](security/secure-your-elastic-cloud-organization.md)
110+
- [**Elastic Cloud Enterprise**](security/secure-your-elastic-cloud-enterprise-installation.md)
111+
- [**Elastic Cloud on Kubernetes**](security/secure-your-eck-installation.md)
113112

114-
#### Network security
113+
:::{note}
114+
There is no orchestration layer for self-managed deployments because you directly control the host environment. Refer to [](security/manually-configure-security-in-self-managed-cluster.md) to learn more about securing self-managed installations.
115+
:::
115116

116-
| **Security feature** | Serverless | Elastic Cloud Hosted | ECE | ECK | Self-managed |
117-
|------------------|------------|--------------|-----|-----|--------------|
118-
| **IP traffic filtering** | Configurable | Configurable | Configurable | Configurable | Configurable |
119-
| **Private link** | N/A | Configurable | N/A | N/A | N/A |
120-
| **Static IPs** | Configurable | Configurable | N/A | N/A | N/A |
117+
### 2. Secure your deployments and clusters
121118

122-
#### Data security
119+
[Secure your deployments](security/secure-your-cluster-deployment.md) with features available across all deployment types:
123120

124-
| **Security feature** | Serverless | Elastic Cloud Hosted | ECE | ECK | Self-managed |
125-
|------------------|------------|--------------|-----|-----|--------------|
126-
| **Encryption at rest** | Managed | Managed | Self-managed | Self-managed | Self-managed |
127-
| **Bring your own encryption key** | N/A | Configurable | N/A | N/A | N/A |
128-
| **Keystore security** | Managed | Managed | Configurable | Configurable | Configurable |
129-
| **Saved object encryption** | Managed | Managed | Configurable | Configurable | Configurable |
121+
- [**Traffic filtering**](security/traffic-filtering.md): IP filtering, private links, and static IPs
122+
- [**Secure communications**](security/secure-cluster-communications.md): TLS configuration, certificates management
123+
- [**Data protection**](security/data-security.md): Encryption at rest, secure settings, saved objects
124+
- [**Security event audit logging**](security/logging-configuration/security-event-audit-logging.md): {{es}} and {{kib}} audit logs
125+
- [**Session management**](security/kibana-session-management.md): Kibana session controls
126+
- [**FIPS 140-2 compliance**](security/fips-140-2.md): Federal security standards
130127

131-
#### User session security
128+
### 3. Secure your clients and integrations
132129

133-
| **Security feature** | Serverless | Elastic Cloud Hosted | ECE | ECK | Self-managed |
134-
|------------------|------------|--------------|-----|-----|--------------|
135-
| **Kibana Sessions** | Managed | Configurable | Configurable | Configurable | Configurable |
130+
[Secure your clients and integrations](security/secure-clients-integrations.md) to ensure secure communication between your applications and Elastic:
136131

137-
### Using this documentation
132+
- [**Client security**](security/httprest-clients-security.md): Best practices for securely connecting applications to {{es}}
133+
- **Integration security**: Secure configuration for Beats, Logstash, and other integrations
138134

139-
Throughout this security documentation, you'll see deployment type indicators that show which content applies to specific deployment types. Each section clearly identifies which deployment types it applies to, and deployment-specific details are separated within each topic.
135+
## Security features by deployment type
140136

141-
To get the most relevant information for your environment, focus on sections tagged with your deployment type and look for subsections specifically addressing your deployment model.
137+
Security feature availability varies by deployment type, with each feature having one of the following statuses:
142138

143-
## Security topics
139+
| **Status** | **Description** |
140+
|--------|-------------|
141+
| **Managed** | Handled automatically by Elastic with no user configuration needed |
142+
| **Configurable** | Built-in feature that needs your configuration (like IP filters or passwords) |
143+
| **Self-managed** | Infrastructure-level security you implement and maintain |
144+
| **N/A** | Not available for this deployment type |
144145

145-
This security documentation is organized into four main areas:
146+
Select your deployment type below to see what's available and how implementation responsibilities are distributed:
146147

147-
% TODO: Add links to the sections below
148+
::::{tab-set}
149+
:group: deployment-type
148150

149-
### 1. Secure your hosting environment
151+
:::{tab-item} Elastic Cloud Hosted
152+
:sync: cloud-hosted
150153

151-
The security of your hosting environment forms the foundation of your overall security posture. This section covers environment-specific security controls:
154+
| **Security Category** | **Security Feature** | **Status** | **Description** |
155+
|------------------|------------|--------------|-------------|
156+
| **Communication** | TLS (HTTP Layer) | Managed | Automatically configured by Elastic |
157+
| | TLS (Transport Layer) | Managed | Automatically configured by Elastic |
158+
| **Network** | IP traffic filtering | Configurable | Configure IP-based access restrictions |
159+
| | Private link | Configurable | Establish secure VPC connection |
160+
| | Static IPs | Configurable | Enable fixed IP addresses |
161+
| **Data** | Encryption at rest | Managed | Automatically encrypted by Elastic |
162+
| | Bring your own encryption key | Configurable | Implement customer-provided keys |
163+
| | Keystore security | Managed | Automatically protected by Elastic |
164+
| | Saved object encryption | Managed | Automatically encrypted by Elastic |
165+
| **User Session** | Kibana Sessions | Configurable | Customize session parameters |
152166

153-
- **Elastic Cloud Hosted and Serverless**: Organization-level SSO, role-based access control, and cloud API keys
154-
- **Elastic Cloud Enterprise**: TLS certificates, role-based access control, and cloud API keys
155-
- **Self-managed environments**: TLS certificates, HTTPS configuration
167+
:::
156168

157-
### 2. Secure your deployments and clusters
169+
:::{tab-item} Serverless
170+
:sync: serverless
171+
172+
| **Security Category** | **Security Feature** | **Status** | **Description** |
173+
|------------------|------------|--------------|-------------|
174+
| **Communication** | TLS (HTTP Layer) | Managed | Automatically configured by Elastic |
175+
| | TLS (Transport Layer) | Managed | Automatically configured by Elastic |
176+
| **Network** | IP traffic filtering | Configurable | Configure IP-based access restrictions |
177+
| | Private link | N/A | X |
178+
| | Static IPs | Configurable | Enable fixed IP addresses |
179+
| **Data** | Encryption at rest | Managed | Automatically encrypted by Elastic |
180+
| | Bring your own encryption key | N/A | X |
181+
| | Keystore security | Managed | Automatically protected by Elastic |
182+
| | Saved object encryption | Managed | Automatically encrypted by Elastic |
183+
| **User Session** | Kibana Sessions | Managed | Automatically configured by Elastic |
158184

159-
Protect your deployments with features available across all deployment types:
185+
:::
186+
187+
:::{tab-item} ECE/ECK
188+
:sync: ece-eck
189+
190+
| **Security Category** | **Security Feature** | **Status** | **Description** |
191+
|------------------|------------|--------------|-------------|
192+
| **Communication** | TLS (HTTP Layer) | Configurable | Configure custom certificates |
193+
| | TLS (Transport Layer) | Managed | Automatically configured by Elastic |
194+
| **Network** | IP traffic filtering | Configurable | Configure IP-based access restrictions |
195+
| | Private link | N/A | X |
196+
| | Static IPs | N/A | X |
197+
| **Data** | Encryption at rest | Self-managed | Implement at infrastructure level |
198+
| | Bring your own encryption key | N/A | X |
199+
| | Keystore security | Configurable | Configure secure settings storage |
200+
| | Saved object encryption | Configurable | Enable encryption for saved objects |
201+
| **User Session** | Kibana Sessions | Configurable | Customize session parameters |
160202

161-
- **Authentication and access controls**: User management, API keys, authentication protocols, and traffic filtering
162-
- **Data protection**: Encryption, sensitive settings, and document-level security
163-
- **Monitoring and compliance**: Audit logging and security best practices
203+
:::
164204

165-
### 3. Secure your user accounts
205+
:::{tab-item} Self-managed
206+
:sync: self-managed
207+
208+
| **Security Category** | **Security Feature** | **Status** | **Description** |
209+
|------------------|------------|--------------|-------------|
210+
| **Communication** | TLS (HTTP Layer) | Self-managed | Implement and maintain certificates |
211+
| | TLS (Transport Layer) | Self-managed | Implement and maintain certificates |
212+
| **Network** | IP traffic filtering | Configurable | Configure IP-based access restrictions |
213+
| | Private link | N/A | X |
214+
| | Static IPs | N/A | X |
215+
| **Data** | Encryption at rest | Self-managed | Implement at infrastructure level |
216+
| | Bring your own encryption key | N/A | X |
217+
| | Keystore security | Configurable | Configure secure settings storage |
218+
| | Saved object encryption | Configurable | Enable encryption for saved objects |
219+
| **User Session** | Kibana Sessions | Configurable | Customize session parameters |
166220

167-
Individual user security helps prevent unauthorized access:
221+
:::
168222

169-
- **Multi-factor authentication**: Add an extra layer of security to your login process
223+
::::
170224

171-
### 4. Secure your clients and integrations
225+
## Next steps
172226

173-
Ensure secure communication between your applications and Elastic:
227+
Refer to the following sections for detailed instructions about securing your hosting environment:
174228

175-
- **Client security**: Best practices for securely connecting applications to {es}
176-
- **Integration security**: Secure configuration for Beats, Logstash, and other integrations
229+
* [Elastic Cloud Hosted and Serverless security setup](/deploy-manage/security/secure-your-elastic-cloud-organization.md)
230+
* [Elastic Cloud Enterprise (ECE) security setup](/deploy-manage/security/secure-your-elastic-cloud-enterprise-installation.md)
231+
* [Elastic Cloud on Kubernetes (ECK) security setup](/deploy-manage/security/secure-your-eck-installation.md)
232+
* [Self-managed cluster security setup](/deploy-manage/security/manually-configure-security-in-self-managed-cluster.md)

0 commit comments

Comments
 (0)