[role="xpack"]
[[security-settings-kb]]
=== Security settings in Kibana
++++
Security settings
++++
You do not need to configure any additional settings to use the
{security-features} in {kib}. They are enabled by default.
[float]
[[general-security-settings]]
==== General security settings
`xpack.security.enabled`::
By default, {kib} automatically detects whether to enable the
{security-features} based on the license and whether {es} {security-features}
are enabled.
+
Do not set this to `false`; it disables the login form, user and role management
screens, and authorization using <>. To disable
{security-features} entirely, see
{ref}/security-settings.html[{es} security settings].
`xpack.security.audit.enabled`::
Set to `true` to enable audit logging for security events. By default, it is set
to `false`. For more details see <>.
[float]
[[security-ui-settings]]
==== User interface security settings
You can configure the following settings in the `kibana.yml` file:
`xpack.security.cookieName`::
Sets the name of the cookie used for the session. The default value is `"sid"`.
`xpack.security.encryptionKey`::
An arbitrary string of 32 characters or more that is used to encrypt credentials
in a cookie. It is crucial that this key is not exposed to users of {kib}. By
default, a value is automatically generated in memory. If you use that default
behavior, all sessions are invalidated when {kib} restarts.
`xpack.security.secureCookies`::
Sets the `secure` flag of the session cookie. The default value is `false`. It
is set to `true` if `server.ssl.certificate` and `server.ssl.key` are set. Set
this to `true` if SSL is configured outside of {kib} (for example, you are
routing requests through a load balancer or proxy).
`xpack.security.sessionTimeout`::
Sets the session duration (in milliseconds). By default, sessions stay active
until the browser is closed. When this is set to an explicit timeout, closing the
browser still requires the user to log back in to {kib}.