A saved object is a persisted Kibana item, such as a dashboard, visualization, search, alert, or data view. Kibana stores these objects so users can return to the same work later, share content, and build repeatable workflows. In practice, saved objects are tied to access controls, spaces, and roles, so not every user should be able to read, edit, export, or delete every item.
Saved objects matter in cyber security because they often contain sensitive metadata: index names, queries, field names, filters, and links to operational data. If authorization is weak, an attacker or low-privileged user may view another team’s dashboards, alter content, or remove evidence used for monitoring. Defenders protect saved objects by enforcing least privilege, separating spaces, and verifying that users can only access the objects they own or are allowed to share.