# Hide Elasticsearch and Kibana version

**URL:** <https://discuss.elastic.co/t/hide-elasticsearch-and-kibana-version/195692>\
**Category:** Elasticsearch\
**Created:** [August 19, 2019, 7:52am UTC](https://discuss.elastic.co/t/hide-elasticsearch-and-kibana-version/195692 "2019-08-19T07:52:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![AdrianRyczek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrianryczek/32/52532_2.png) [@AdrianRyczek](https://discuss.elastic.co/u/AdrianRyczek)\
**Post date:** [August 19, 2019, 7:52am UTC](https://discuss.elastic.co/t/hide-elasticsearch-and-kibana-version/195692/1 "2019-08-19T07:52:38Z")

</div>

Hi,

I'm looking for a way to hide information about which version of Elasticsearch and Kibana we are currently using.  
We are using Elasticsearch and Kibana 6.4.2 version.

Thanks,  
Adrian

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [August 19, 2019, 8:08am UTC](https://discuss.elastic.co/t/hide-elasticsearch-and-kibana-version/195692/2 "2019-08-19T08:08:24Z")

</div>

Welcome!

I don't think you can do that.  
Why do you want this?

---

<div class="post-metadata">

**Author:** ![AdrianRyczek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrianryczek/32/52532_2.png) [@AdrianRyczek](https://discuss.elastic.co/u/AdrianRyczek)\
**Post date:** [August 19, 2019, 8:29am UTC](https://discuss.elastic.co/t/hide-elasticsearch-and-kibana-version/195692/3 "2019-08-19T08:29:43Z")

</div>

Hi David,

Thank you for your message.

I want to do this because lately we discuss about threats internally in our company. And one threat is when you disclosure of version or system information allows an attacker to conduct a selective search in  
vulnerability databases. The obtained information can then be used as a basis for attacks.

Thanks,  
Adrian

---

<div class="post-metadata">

**Author:** ![jasontedor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jasontedor/32/66992_2.png) [@jasontedor](https://discuss.elastic.co/u/jasontedor)\
**Post date:** [August 19, 2019, 10:18am UTC](https://discuss.elastic.co/t/hide-elasticsearch-and-kibana-version/195692/4 "2019-08-19T10:18:59Z")

</div>

Not having version information explicitly is not materially going to foil an attacker. First, there are other ways to narrow the range (what APIs are supported tells you a lot, what the responses looks like tells you more; look at the response even to `/` in Elasticsearch over various versions, it reveals a lot even if the version information is stripped). An experienced attacker will know how to fingerprint the victim to obtain this information even if it were to be made not available explicitly. In the end though, having or not having version information isn’t particularly revealing. Instead, an attacker, experienced or otherwise, can try every attack they have in their arsenal.

---

<div class="post-metadata">

**Author:** ![AdrianRyczek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrianryczek/32/52532_2.png) [@AdrianRyczek](https://discuss.elastic.co/u/AdrianRyczek)\
**Post date:** [August 20, 2019, 7:59am UTC](https://discuss.elastic.co/t/hide-elasticsearch-and-kibana-version/195692/5 "2019-08-20T07:59:20Z")

</div>

Hi Jason,

Thanks for your message.

Thanks,  
Adrian

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 17, 2019, 7:59am UTC](https://discuss.elastic.co/t/hide-elasticsearch-and-kibana-version/195692/6 "2019-09-17T07:59:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.