# What are the "Elastic security features" that are referred to in the \_cat/indices doc page? **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [November 8, 2021, 12:58am UTC](https://discuss.elastic.co/t/what-are-the-elastic-security-features-that-are-referred-to-in-the-cat-indices-doc-page/288578 "2021-11-08T00:58:46Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![astanton1978](https://avatars.discourse-cdn.com/v4/letter/a/e480ec/32.png) [@astanton1978](https://discuss.elastic.co/u/astanton1978)\ **Post date:** [November 8, 2021, 12:58am UTC](https://discuss.elastic.co/t/what-are-the-elastic-security-features-that-are-referred-to-in-the-cat-indices-doc-page/288578/1 "2021-11-08T00:58:46Z")
[cat indices API | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/cat-indices.html) says > If the Elasticsearch security features are enabled, you must have the `monitor` or `manage` [cluster privilege](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-privileges.html#privileges-list-cluster) to use this API. ... but there is no link to what these "security features" are, either generally or specifically. I can find things like "Basic Security", etc. but not the "elastic security features" that this doc page refers to. What does "elastic security features" mean, specifically? These are also mentioned in the [Exists](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-exists.html) API page ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 8, 2021, 1:01am UTC](https://discuss.elastic.co/t/what-are-the-elastic-security-features-that-are-referred-to-in-the-cat-indices-doc-page/288578/2 "2021-11-08T01:01:57Z")
Hi @astanton1978 Its is everything under this section of the documents > **[Secure the Elastic Stack | Elasticsearch Guide \[7.15\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/secure-cluster.html)** Everything from simple basic authentication.... to a fully locked down cluster using SSL, SAML and field level security... All Elastic Stack resources can be / are control by a strong and flexible RBAC (Role Based Access Control) capability. ---
**Author:** ![astanton1978](https://avatars.discourse-cdn.com/v4/letter/a/e480ec/32.png) [@astanton1978](https://discuss.elastic.co/u/astanton1978)\ **Post date:** [November 8, 2021, 1:12am UTC](https://discuss.elastic.co/t/what-are-the-elastic-security-features-that-are-referred-to-in-the-cat-indices-doc-page/288578/3 "2021-11-08T01:12:18Z")
So any single one of those things being turned on/configured will constitute "Elasticsearch security features" as being enabled for the context of the referenced docs pages? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 8, 2021, 1:14am UTC](https://discuss.elastic.co/t/what-are-the-elastic-security-features-that-are-referred-to-in-the-cat-indices-doc-page/288578/4 "2021-11-08T01:14:59Z")
Once you enable Authorization (username / password) and Authorization (Role Based Control) that user will need the correct mentioned roles to use certain APIs. Before you apply the security features your cluster and endpoints are basically unauthenticated and thus wide open... perhaps that is ok to test on your dev station but certainly not recommended for production etc. ---
**Author:** ![astanton1978](https://avatars.discourse-cdn.com/v4/letter/a/e480ec/32.png) [@astanton1978](https://discuss.elastic.co/u/astanton1978)\ **Post date:** [November 8, 2021, 3:29am UTC](https://discuss.elastic.co/t/what-are-the-elastic-security-features-that-are-referred-to-in-the-cat-indices-doc-page/288578/5 "2021-11-08T03:29:34Z")
Thanks for the info. Docs writers should really link the note in the docs to the section and detail you shared here. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 8, 2021, 3:40am UTC](https://discuss.elastic.co/t/what-are-the-elastic-security-features-that-are-referred-to-in-the-cat-indices-doc-page/288578/6 "2021-11-08T03:40:40Z")
We'd end up with tonnes of cross links if we did that every time, so while I can appreciate your confusion here, I am not sure doing that would be any better. The best approach might be to step back and look at the top level of the set of features - ie [Secure the Elastic Stack | Elasticsearch Guide [7.15] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/secure-cluster.html) as @stephenb linked - to get an idea of the context of that set of features/configuration that is being worked on? ---
**Author:** ![astanton1978](https://avatars.discourse-cdn.com/v4/letter/a/e480ec/32.png) [@astanton1978](https://discuss.elastic.co/u/astanton1978)\ **Post date:** [November 8, 2021, 4:27pm UTC](https://discuss.elastic.co/t/what-are-the-elastic-security-features-that-are-referred-to-in-the-cat-indices-doc-page/288578/7 "2021-11-08T16:27:42Z")
The point was that the API pages were vaguely referring to "Elasticsearch security features enabled", and that phrase/text does not specifically identify or match a specific page or section anywhere else in the rest of the documentation. Besides, the web was designed for linking. Why is there any hesitation to using hyperlinks? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 6, 2021, 4:27pm UTC](https://discuss.elastic.co/t/what-are-the-elastic-security-features-that-are-referred-to-in-the-cat-indices-doc-page/288578/8 "2021-12-06T16:27:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.