Skip to content

Grafana configuration hardening security checks

Vendor-recommended secure defaults, patch levels and housekeeping settings that drift as tenants grow and admins change.

On Grafana, Black Cat runs 12 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Grafana connector needs.

Checks (12)

severity: high Direct Access Data Source fix difficulty: easy #

Switch the data source access mode from Direct (browser) to Server (proxy) to prevent credential exposure

  1. Sign in to Grafana as an Org Admin
  2. Navigate to Connections > Data sources in the left sidebar
  3. Click the data source flagged with Direct access mode
  4. In the HTTP section, change the Access field from "Browser" to "Server"
  5. Click "Save & test" to verify the data source remains reachable through the Grafana server proxy
  6. Confirm that existing dashboards continue to display data correctly

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Data Source Basic Auth fix difficulty: medium #

Replace basic authentication on the data source with a token or certificate-based method

  1. Sign in to Grafana as an Org Admin
  2. Navigate to Connections > Data sources in the left sidebar
  3. Click the data source using basic auth
  4. Disable the "Basic auth" toggle in the Auth section
  5. Enable an alternative authentication method supported by the backend (e.g. API key header, TLS client certificate, or bearer token via custom headers)
  6. Click "Save & test" to confirm the new auth method works

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Data Source TLS Skip Verify fix difficulty: medium #

Enable TLS certificate verification on the data source to prevent man-in-the-middle attacks

  1. Sign in to Grafana as an Org Admin
  2. Navigate to Connections > Data sources in the left sidebar
  3. Click the data source with TLS verification disabled
  4. Expand the TLS / SSL settings section
  5. Uncheck or disable the "Skip TLS verify" option
  6. If the backend uses a self-signed or internal CA certificate, upload the CA certificate in the CA Cert field instead
  7. Click "Save & test" to confirm the data source connects successfully with verification enabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Data Source With Credentials fix difficulty: easy #

Disable the "With Credentials" option to prevent browser cookies from being forwarded to the data source

  1. Sign in to Grafana as an Org Admin
  2. Navigate to Connections > Data sources in the left sidebar
  3. Click the data source with credentials forwarding enabled
  4. In the Auth section, locate the "With Credentials" toggle
  5. Disable the "With Credentials" option
  6. Click "Save & test" to confirm the data source still operates correctly without credential forwarding

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium No Alert Rules Configured fix difficulty: medium #

Configure Grafana alert rules to monitor critical system and security conditions

  1. Sign in to Grafana as an Org Admin or Editor
  2. Navigate to Alerting > Alert rules in the left sidebar
  3. Click "New alert rule"
  4. Define query conditions covering key metrics (e.g. error rates, latency, resource saturation)
  5. Set appropriate thresholds and evaluation intervals
  6. Assign the rule to a contact point and notification policy, then save and enable it

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium External Contact Point fix difficulty: easy #

Review and validate all external alert contact points to ensure notifications reach authorised destinations

  1. Sign in to Grafana as an Org Admin
  2. Navigate to Alerting > Contact points in the left sidebar
  3. Review each contact point that sends to an external destination (email, Slack, PagerDuty, webhook, etc.)
  4. Verify that each destination is an approved, organisation-controlled endpoint
  5. Remove or update any contact points pointing to unknown, personal, or unauthorised addresses
  6. Test each retained contact point using the "Test" button to confirm delivery

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-33.2 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Broad Mute Timing fix difficulty: easy #

Narrow alert mute timings to specific maintenance windows to prevent alerts being silenced indefinitely

  1. Sign in to Grafana as an Org Admin
  2. Navigate to Alerting > Silences or Alerting > Notification policies in the left sidebar
  3. Identify mute timings or silences that cover excessively broad time ranges (e.g. always-on or multi-week windows)
  4. Edit each broad mute timing to restrict it to the actual maintenance window (specific days and hours)
  5. Remove or expire any silences that are no longer required
  6. Save changes and verify that alerting resumes outside the defined maintenance window

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Unsigned Plugin fix difficulty: medium #

Remove or replace unsigned plugins with signed alternatives to ensure supply-chain integrity

  1. Sign in to Grafana as a Server Admin
  2. Navigate to Administration > Plugins and data in the left sidebar
  3. Filter plugins by signature status to locate unsigned plugins
  4. Assess whether each unsigned plugin has an official signed version in the Grafana plugin catalogue
  5. Replace unsigned plugins with their signed equivalents, or remove them if no longer needed
  6. In grafana.ini, ensure allow_loading_unsigned_plugins is empty or not set, then restart Grafana

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low Community Plugin fix difficulty: easy #

Review installed community plugins and prefer Grafana-signed or core alternatives where available

  1. Sign in to Grafana as a Server Admin
  2. Navigate to Administration > Plugins and data in the left sidebar
  3. Identify plugins with a "Community" signature level
  4. For each community plugin, check the Grafana plugin catalogue for a Grafana-signed or core replacement
  5. Assess the plugin's maintenance activity, last update date, and open security issues
  6. Replace with a signed alternative or remove the plugin if it is no longer necessary

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Outdated Plugin fix difficulty: easy #

Update all installed Grafana plugins to their latest available versions to receive security patches

  1. Sign in to Grafana as a Server Admin
  2. Navigate to Administration > Plugins and data in the left sidebar
  3. Look for plugins that show an available update (indicated by an "Update" badge)
  4. Click each outdated plugin and select "Update" to install the latest version
  5. Alternatively, use the Grafana CLI on the server host: grafana-cli plugins update-all
  6. Restart the Grafana service after CLI updates and verify plugins load correctly

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Paused Alert Rules fix difficulty: easy #

Review and re-enable paused alert rules to ensure continuous monitoring coverage

  1. Sign in to Grafana as an Org Admin or Editor
  2. Navigate to Alerting > Alert rules
  3. Filter for paused rules
  4. Review each paused rule to determine if it should be re-enabled or deleted
  5. Re-enable rules that are still relevant
  6. Delete rules that are no longer needed

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high Alert Rules Without Contact Points fix difficulty: easy #

Configure at least one contact point to ensure alert notifications are delivered

  1. Sign in to Grafana as an Org Admin
  2. Navigate to Alerting > Contact points
  3. Click "Add contact point"
  4. Select a delivery type (email, Slack, PagerDuty, etc.)
  5. Fill in the required configuration fields
  6. Test the contact point using the "Test" button
  7. Assign it to a notification policy

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

More Grafana checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial