ELK stack 8.5.2 - RoR 1.45.1 - SIEM usage

1

Hello,

i have some issue related to the use of Kibana 8.5.2, Security section (SIEM), and RoR 1.45.1.

to place the topic, the security section of kibana contains SIEM stuff
Elastic Security overview | Kibana Guide [8.5] | Elastic

with my current installations (test on linux, and also on windows) , i meet an error message when i try to use any of link of this section (dashboard, cases etc etc)

image
image1323Ă—611 84.6 KB

Any hints, or someone else met this issue ?

I have to precise that with RoR pluging at false in elasticsearch, and completely uninstalled on kibana, the result is the same.

May it be related to the elasticsearch.yml setting xpack.security.enabled: false ?

another point to precise : in kibana.yml the setting xpack.security.enabled: false is not supported (rejected when starting kibana, deprecated)

Did i miss something ?

kr

Fred

1 Like
2

Hello @ld57, unfortunately the whole security app in Kibana is not supported yet with ROR. We are slowly making progress in broadening the compatibility of the most recent sections of Kibana, but it turned out a very tough endeavour, and we are yet to find a clever solution to it.

Yes I’m aware you can’t disable xpack.security in newer Kibana, but you can hide it via ROR Enterprise ACL using the rule kibana_hide_apps: ["Security"].

1 Like
3

ouch, so bad for me as i “sold” this section to our CiSo lol…

Any way i can help ?

4

Oh no! That’s unfortunate :sob:

We will get back to you when we get something worth testing.

For now the major obstacle we are facing is that SIEM requires current user information from the xpack API which works incredibly differently from ROR’s. And it’s really messy to reconcile the two.

5

image

you are a
image

:wink:

1 Like