SECURIX Developed Product
JIT Plug In
A Kibana plugin that replaces standing privileges in Elastic with time-limited, approved access to sensitive data and admin roles, with a full audit trail of who had access, when and why.
Solution overview
JIT Plug In adds Just-in-Time role assignment to Elastic through Kibana. Users request an eligible role with a written reason and a duration of up to 48 hours. After approval, the plugin assigns the role for the approved period and removes it automatically when it expires. Every request, decision, grant and expiry is recorded in a dedicated audit index.
Your business needs
Know who had access and why
Standing access rights
Sensitive and administrative roles remain assigned after a task is complete. Access granted just in case becomes permanent unless someone removes it.
Manual administration
Creating, maintaining and removing access across users and clusters increases administrative work. Users wait for account changes when they need access for a specific task.
Disconnected approvals
Approvals in emails, tickets or chats are not linked to the role assignment itself. Answering who had access, who approved it and why requires manual evidence gathering.
Who this is for
Control temporary access to your Elastic environment
For organizations running Elastic with sensitive data, privileged functions, multiple clusters or external providers who need access to their data.
Data owners / Compliance
Grant access case by case and use audit records to see who held which role, when, for how long and for what reason.
Elastic administrators / IT operations
Use temporary elevated roles for administrative and production tasks instead of permanent privileged assignments.
SOC analysts / Incident responders / Auditors
Request the access needed for an investigation, cross-cluster analysis or external review for a defined period.
Our deliverables
Request, approve and trace access in Kibana
- Access requests and approvals — Users request a JIT-eligible role in Kibana with a written reason and duration. Approvers decide on each request. Open, approved and rejected requests and active grants are tracked in one place.
- JIT eligibility for Elastic roles — Your organization defines standard Elastic roles and identifies those eligible for JIT access through a configurable role prefix. These can cover sensitive indices, remote clusters, administrative functions or scoped read access.
- Existing authentication — The plugin works with native Elastic users and SSO through OIDC, tested with Microsoft Entra ID. Authentication stays in your existing environment.
- Time-limited role assignments — Approved roles are assigned for a defined period of up to 48 hours. Once it expires, the access is removed automatically. Approvers can revoke active access early at any time.
- A dedicated audit trail — Every request, decision, approval and expiry is written to a dedicated audit index. Reports and dashboards show who held which role, when, for how long and why.
- Configuration as code — Plugin settings live in the Kibana configuration. JIT roles and role mappings remain standard Elasticsearch security objects and can be rolled out consistently as code.
- Non-Elastic systems
- Company-wide PAM or identity governance
- Identity provider capabilities
- Elastic security audit logging configuration
- Planned extensions
How it works
From an access request to automatic expiry
-
Requesters are given access to the plugin’s Get Access feature, while approvers receive a separate admin role.
-
The user selects a JIT role in Kibana, enters a written reason and requests a duration of up to 48 hours.
-
An approver decides on the request. After approval, a dedicated plugin service account assigns the role for the approved period.
-
A scheduled Kibana Task Manager job removes expired grants automatically. Approvers can revoke access earlier. Every request, decision, grant and expiry is written to the audit index.
Access scenarios
Apply JIT access to the roles your organization defines
Sensitive internal data
Grant temporary access to indices containing HR, fraud, financial or personal data.
Elevated administrative rights
Assign administrative roles for the task and time required instead of maintaining permanent privileged access.
Remote clusters
Use Cross-Cluster Search to access remote indices from one Kibana. The remote environment retains control through the API key it issues and can revoke.
Auditors and external reviewers
Provide scoped, time-limited read access for an audit or external review.
Frequently asked questions
Before you introduce JIT access
No. Your organization continues to define Elastic roles and role mappings. The plugin controls when JIT-eligible roles are assigned and for how long. Users continue to authenticate through Elastic native users or existing SSO.
A request can specify a duration of up to 48 hours. Once approved, the role is assigned for the approved period and removed automatically when it expires. Approvers can revoke active grants earlier.
The plugin records requests, decisions, grants and expiry. Reports show who held which role, when, for how long and why. Tracing the actions taken during a grant additionally requires Elastic security audit logging.
Some managed Elastic offerings may not allow custom Kibana plugins. A separate, self-managed Kibana may be needed. Kibana plugins are built for a specific Kibana version, so the deployment type and supported version need to be checked.
Contact
Let’s discuss your next step
Tell us which Elastic roles should be available only when needed. Together, we’ll clarify your access requirements and whether the plugin fits your environment.
