# Kibana use cases

**URL:** <https://discuss.elastic.co/t/kibana-use-cases/232772>\
**Category:** Kibana\
**Created:** [May 15, 2020, 8:43am UTC](https://discuss.elastic.co/t/kibana-use-cases/232772 "2020-05-15T08:43:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![fmquasi](https://avatars.discourse-cdn.com/v4/letter/f/71e660/32.png) [@fmquasi](https://discuss.elastic.co/u/fmquasi)\
**Post date:** [May 15, 2020, 8:43am UTC](https://discuss.elastic.co/t/kibana-use-cases/232772/1 "2020-05-15T08:43:45Z")

</div>

Does anyone have any example of use cases to audit user access- im new to elastic search

---

<div class="post-metadata">

**Author:** ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)\
**Post date:** [May 26, 2020, 5:09am UTC](https://discuss.elastic.co/t/kibana-use-cases/232772/2 "2020-05-26T05:09:20Z")

</div>

Almost all of our security use cases - use audit logging for auditing user access.  
You can enable auditing to keep track of security-related events such as authorization success and failures. Logging these events enables you to monitor Kibana for suspicious activity and provides evidence in the event of an attack.

Use the Kibana audit logs in conjunction with Elasticsearch’s audit logging to get a holistic view of all security related events. Kibana defers to Elasticsearch’s security model for authentication, data index authorization, and features that are driven by cluster-wide privileges. For more information on enabling audit logging in Elasticsearch, see [Auditing security events](https://www.elastic.co/guide/en/elasticsearch/reference/7.7/auditing.html).

Audit logs are **disabled** by default. To enable this functionality, you must set `xpack.security.audit.enabled` to `true` in `kibana.yml` .

You will ind it very productive to use security - try it and let us know!

Thanks  
Rashmi

---

<div class="post-metadata">

**Author:** ![fmquasi](https://avatars.discourse-cdn.com/v4/letter/f/71e660/32.png) [@fmquasi](https://discuss.elastic.co/u/fmquasi)\
**Post date:** [May 28, 2020, 1:42pm UTC](https://discuss.elastic.co/t/kibana-use-cases/232772/3 "2020-05-28T13:42:26Z")

</div>

thank you will try that.

From the set-up requriment how many servers should i have:  
thinking on 2xservers for elastic search 1x server logstash 1x server kibana

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [May 28, 2020, 1:52pm UTC](https://discuss.elastic.co/t/kibana-use-cases/232772/4 "2020-05-28T13:52:12Z")

</div>

for basic turn all five to be elastic master (this will give you HA)

2 - elastic master + data ( as I assume you only have enough disk in these two)  
1 - elasticmaster, no data, logstash  
1 - elasticmaster, no data, kibana

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 25, 2020, 1:52pm UTC](https://discuss.elastic.co/t/kibana-use-cases/232772/5 "2020-06-25T13:52:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
