Kalos Cybersecurity LLC
Field guide

Wazuh Dashboard Session Timeout Configuration

Alerts to Answers Analyst Field Guide 03 - v20

Introduction

Long lab investigations can be interrupted by short Dashboard sessions. This guide explains how to inspect, change, validate, and roll back the Dashboard cookie and session time-to-live settings in an instructor-approved environment while keeping the security tradeoff visible.

Purpose and Scope

The procedure is optional and applies only where local policy permits an eight-hour session. It changes the validated Wazuh Dashboard 4.14.5 lab configuration, not the Wazuh manager or indexer, and it must not be applied to production without authorization.

Chapter and Lab Alignment

Alignment Placement
Primary chapter alignment Chapter 9 - Operating the Platform
Supporting chapter alignment Chapter 3 - Building the Wazuh SOC Lab
Lab alignment Optional preparation for longer Labs 4-8.
Recommended point of use Apply only with instructor approval; document and validate the change and retain rollback capability.

Scope: Wazuh Dashboard 4.14.5 in the Alerts to Answers lab. Verify the installed values before changing them.

Purpose

Increase the Wazuh Dashboard session and authentication-cookie time-to-live values to eight hours for an instructor-approved lab environment.

Security impact: A longer session remains usable for longer if a workstation is left unlocked or a browser session is compromised. Use this setting only where it matches institutional policy. Lock the workstation when unattended and do not apply this change to production without approval.

1. Back Up the Configuration

sudo cp -a /etc/wazuh-dashboard/opensearch_dashboards.yml \
  /etc/wazuh-dashboard/opensearch_dashboards.yml.v20-before-session-change
sudo ls -l /etc/wazuh-dashboard/opensearch_dashboards.yml*

2. Inspect the Installed Values

sudo grep -nE '^opensearch_security\.(cookie|session)\.' \
  /etc/wazuh-dashboard/opensearch_dashboards.yml

Wazuh 4.14.x package configurations commonly contain:

opensearch_security.cookie.ttl: 900000
opensearch_security.session.ttl: 900000
opensearch_security.session.keepalive: true

Do not assume those values are present. Record the actual settings so they can be restored.

3. Set an Eight-Hour TTL

Eight hours is 28,800,000 milliseconds.

sudo nano /etc/wazuh-dashboard/opensearch_dashboards.yml

Set or update:

opensearch_security.cookie.ttl: 28800000
opensearch_security.session.ttl: 28800000
opensearch_security.session.keepalive: true

session.keepalive: true resets the session TTL when the user is active. It does not guarantee that a session will survive closing the browser or an upstream identity-provider timeout.

4. Restart and Verify the Dashboard

sudo systemctl restart wazuh-dashboard
sudo systemctl --no-pager --full status wazuh-dashboard
sudo journalctl -u wazuh-dashboard -n 50 --no-pager

The service must report active (running) and the journal must not show a configuration-parsing failure. Only the Dashboard service requires restart for this file change.

5. Validate the Result

  1. Sign in to the Wazuh Dashboard.
  2. Confirm normal navigation and searches work.
  3. Keep the browser session open and verify it remains active for the institutionally approved test period.
  4. Record the change, test time, result, and operator.

Rollback

sudo cp -a /etc/wazuh-dashboard/opensearch_dashboards.yml.v20-before-session-change \
  /etc/wazuh-dashboard/opensearch_dashboards.yml
sudo systemctl restart wazuh-dashboard
sudo systemctl --no-pager --full status wazuh-dashboard

Technical References