To change the Wazuh dashboard logout time, edit /etc/wazuh-dashboard/opensearch_dashboards.yml to update the opensearch_security.session.ttl setting in milliseconds, then restart the dashboard service. For a 1-hour timeout, set opensearch_security.session.ttl: 3600000 and restart with systemctl restart wazuh-dashboard.

Steps to Change Logout Time (Wazuh 4.3+)

  1. SSH into the Wazuh Manager and open the dashboard configuration file:bashvi /etc/wazuh-dashboard/opensearch_dashboards.yml  
  2. Add or modify the following settings (time is in milliseconds, e.g., 86400000 ms = 24 hours):yamlopensearch_security.session.ttl: 3600000 opensearch_security.cookie.ttl: 3600000 opensearch_security.session.keepalive: true
    • session.ttl: The maximum session duration.
    • cookie.ttl: The cookie expiration time.
    • keepalive: Extends the session if the user is active. 
  3. Restart the Wazuh dashboard to apply changes:bashsystemctl restart wazuh-dashboard

Additional Notes

  • Default Time: The default session timeout can be as short as 5 minutes in some configurations.
  • API Timeout: If you need to change the API timeout separately, edit /var/ossec/api/configuration/api.yaml