Search Guard Classic overview

Search Guard Classic is the original security and authentication plugin for Elasticsearch, providing access control, authentication, authorization, and TLS encryption. This section documents the setup and integration process for Search Guard Classic with Siren Investigate, as it was prior to the introduction of Search Guard FLX.

Search Guard Classic is not supported on Elasticsearch 8 and later. For new installations or upgrades to Elasticsearch 8+, use Search Guard FLX or Elastic Stack security instead.

In this section

Setting up security certificates for Classic

Integrating Search Guard Classic

Configuring Investigate with Search Guard Classic

Overview

Search Guard Classic secures Elasticsearch clusters by enforcing authentication and authorization for all requests. It supports multiple authentication backends (LDAP, Active Directory, Kerberos, proxy, etc.), role-based access control, and audit logging. TLS encryption is required for all node-to-node and client-to-node communication.

Typical steps to secure a cluster with Search Guard Classic:

  1. Install the Classic plugin on every Elasticsearch node (version must match Elasticsearch).

  2. Generate or provide a certificate authority (CA) and issue:

    1. Node certificates (with required OID for Classic)

    2. Admin certificate (for the sgadmin tool)

    3. Optional client certificates (if using mutual TLS)

  3. Enable TLS on both transport and HTTP layers in elasticsearch.yml.

  4. Prepare Classic configuration files (sg_config.yml, sg_roles.yml, sg_roles_mapping.yml, sg_action_groups.yml, sg_internal_users.yml, etc.) and upload them with the sgadmin tool.

  5. Configure Siren Investigate:

    1. Set elasticsearch.url to the HTTPS endpoint.

    2. Add CA certificate paths so the TLS handshake validates the cluster.

    3. Configure credentials or client certificate depending on chosen auth backend.

  6. Validate by logging in and running queries.

For detailed steps, see the integration and configuration sections above.