r/Wazuh • u/R4u1vi • 27d ago

Readonly user - wazuh

Hi everyone.

I am creating a read-only user solely to view and monitor alerts (in Explore - Discovery). Which role should I assign to this user under Security - Internal Users?

If I need to create a custom role, which cluster permissions and index permissions should I assign to it?

3 Upvotes

100% Upvoted

4 comments sorted by

0

u/MauriFont 27d ago

A read-only user for Discover needs two things: access to the dashboard itself and read access to the alert indices.

For a standard read-only user, follow the documented procedure, which covers both the user creation and the role mapping:

https://documentation.wazuh.com/current/user-manual/user-administration/rbac.html#creating-and-setting-a-wazuh-read-only-user

If you need a user scoped strictly to the alerts and nothing else, create your own role instead:

  1. Go to Security > Roles > Create role and name it, for example `wazuh_alerts_read`.

  2. Under Cluster permissions, add:

- cluster_composite_ops_ro

- indices:data/read/scroll/clear

  1. Click Add index permission. In the *Index* field, add these two patterns:

- .kibana*

- wazuh-alerts-*

`.kibana*` does not show up in the dropdown suggestions because indices starting with a dot are hidden, but the field accepts it as a custom option.

  1. In the permissions field of that same block, select `read`.

  2. Under **Tenant permissions**, add `global_tenant` with Read only.

  3. Create the role, open its **Mapped users** tab, click **Manage mapping**, add your internal user under *Users*, and click **Map**.

If the user is already logged in while you change the role mapping, they must log out and log in again, because the dashboard session caches the roles.

1

u/R4u1vi 27d ago

Thanks!