Kibana As a Service
You set up kibana as a service by deploying a hosted search cluster with a managed dashboard. You then link your identity provider and map user groups to index roles. Most teams start with broad read roles so developers can debug apps fast. Broad roles often expose sensitive production logs to too many people. How kibana as a service handles roles and spaces A managed dashboard sits on top of your search indices. Users log in through single sign-on or with basic database keys. Once inside, th
Authorization as a Service: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up kibana as a service by deploying a hosted search cluster with a managed dashboard. You then link your identity provider and map user groups to index roles. Most teams start with broad read roles so developers can debug apps fast. Broad roles often expose sensitive production logs to too many people.
How kibana as a service handles roles and spaces
A managed dashboard sits on top of your search indices. Users log in through single sign-on or with basic database keys. Once inside, the system checks their assigned role before loading any views. Admins group dashboards and saved queries into separate workspaces for each team.
Index permissions decide which log streams a role can read or write. You can set up rules that limit access to specific log fields. You can also filter out documents that match certain tag values. The hosted platform handles software updates, node scaling, and backups in the background.
Teams often create one space for finance and another for engineering. Each space holds its own charts, alerts, and saved search filters. Role mappings link your company directory groups to these spaces. When a developer changes teams, their directory group update changes their dashboard view.
Where native dashboard roles fall short in production
Native roles work well when log data is clean and well structured. They decide who can log in and which index patterns they can query. Still, app logs often dump raw payloads into free-text message fields. Standard field rules cannot parse sensitive text buried inside an unstructured log line.
Once a user has read rights to an index, every query runs directly. The native setup checks login permissions, not what individual requests return in flight. If an app logs emails, phone numbers, or card numbers, readers see them. Data masking that rewrites matched fields in results is hard to maintain inside indices.
Authorization as a Service: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Shared admin accounts also create blind spots during live incident response. Engineers often need temporary write rights to change index templates or fix alerts. Standing admin roles leave critical cluster settings exposed every day of the year. Teams need a way to inspect queries and mask sensitive fields in real time.
Managing direct API queries and data exports
Users do not just view charts through the web interface. Many developers run direct search queries through developer consoles or reporting scripts. Native workspace rules apply to the visual dashboard, not always to raw cluster APIs. If a user holds a valid key, they can pull large log batches.
Security teams must track who ran which search query during an audit. Built-in audit logs record every internal dashboard render and background check. Sorting through millions of system events to find one user query takes hours. Teams benefit when they capture clean logs of human queries and mask national IDs.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev sits inline in the wire protocol beside those services as an open-source proxy, a sidecar for your Postgres or API. On every query an AI agent or engineer runs against production, hoop.dev decides to pass, mask, block, or hold it for human review.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run, and hoop.dev data masking rewrites matched sensitive values in responses in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
What is the main benefit of a hosted dashboard setup?
A hosted setup removes the need to patch servers or manage storage nodes. Your team can focus on building charts and reading logs instead of running servers.
How do you restrict which logs a team can read?
You create roles bound to specific index names and assign them to workspaces. You can also apply document filters to hide log lines with certain tags.
Why do sensitive fields still leak in log searches?
Apps often write unstructured text containing emails or card numbers into one message field. Index roles grant access to the whole field rather than rewriting sensitive strings.