Kalos Cybersecurity LLC
Field guide

Extend the Wazuh Dashboard Session Timeout — v18

Scope: Wazuh Dashboard 4.14.5 in the Alerts to Answers lab. Verify the installed values before changing them.

Purpose

Increase the Wazuh Dashboard session and authentication-cookie time-to-live values to eight hours for an instructor-approved lab environment.

Security impact: A longer session remains usable for longer if a workstation is left unlocked or a browser session is compromised. Use this setting only where it matches institutional policy. Lock the workstation when unattended and do not apply this change to production without approval.

1. Back Up the Configuration

sudo cp -a /etc/wazuh-dashboard/opensearch_dashboards.yml \
  /etc/wazuh-dashboard/opensearch_dashboards.yml.v18-before-session-change
sudo ls -l /etc/wazuh-dashboard/opensearch_dashboards.yml*

2. Inspect the Installed Values

sudo grep -nE '^opensearch_security\.(cookie|session)\.' \
  /etc/wazuh-dashboard/opensearch_dashboards.yml

Wazuh 4.14.x package configurations commonly contain:

opensearch_security.cookie.ttl: 900000
opensearch_security.session.ttl: 900000
opensearch_security.session.keepalive: true

Do not assume those values are present. Record the actual settings so they can be restored.

3. Set an Eight-Hour TTL

Eight hours is 28,800,000 milliseconds.

sudo nano /etc/wazuh-dashboard/opensearch_dashboards.yml

Set or update:

opensearch_security.cookie.ttl: 28800000
opensearch_security.session.ttl: 28800000
opensearch_security.session.keepalive: true

session.keepalive: true resets the session TTL when the user is active. It does not guarantee that a session will survive closing the browser or an upstream identity-provider timeout.

4. Restart and Verify the Dashboard

sudo systemctl restart wazuh-dashboard
sudo systemctl --no-pager --full status wazuh-dashboard
sudo journalctl -u wazuh-dashboard -n 50 --no-pager

The service must report active (running) and the journal must not show a configuration-parsing failure. Only the Dashboard service requires restart for this file change.

5. Validate the Result

  1. Sign in to the Wazuh Dashboard.
  2. Confirm normal navigation and searches work.
  3. Keep the browser session open and verify it remains active for the institutionally approved test period.
  4. Record the change, test time, result, and operator.

Rollback

sudo cp -a /etc/wazuh-dashboard/opensearch_dashboards.yml.v18-before-session-change \
  /etc/wazuh-dashboard/opensearch_dashboards.yml
sudo systemctl restart wazuh-dashboard
sudo systemctl --no-pager --full status wazuh-dashboard

Technical References