---
_meta:
type: "roles"
config_version: 2
security_analyst:
reserved: false
description: "Security Analyst: read alerts/logs/dashboards, no security-config or RBAC-management access."
cluster_permissions:
- "cluster_composite_ops_ro"
index_permissions:
- index_patterns:
- "wazuh-alerts-*"
- "wazuh-archives-*"
- "wazuh-monitoring-*"
- "wazuh-statistics-*"
allowed_actions:
- "read"
- "indices:admin/mappings/get"
- "indices:admin/get"
tenant_permissions:
- tenant_patterns:
- "global_tenant"
allowed_actions:
- "kibana_all_read"
readonly_auditor:
reserved: false
description: "Read-only Auditor: read-only access to dashboards and alerts across all Wazuh indices, no agent/rule/configuration actions."
cluster_permissions:
- "cluster_composite_ops_ro"
index_permissions:
- index_patterns:
- "wazuh-*"
allowed_actions:
- "read"
tenant_permissions:
- tenant_patterns:
- "global_tenant"
allowed_actions:
- "kibana_all_read"
