From 4533c8c3386176e4163d422bd0a17e9e7c48f016 Mon Sep 17 00:00:00 2001 From: RAJ CHAKRAVARTHI <49325334+raj-chak@users.noreply.github.com> Date: Thu, 3 Nov 2022 13:53:47 -0400 Subject: [PATCH] roles yml changes for security-analytics plugin (#2192) (#2225) * roles yml changes for security-analytics plugin Signed-off-by: Raj Chakravarthi Signed-off-by: Raj Chakravarthi <49325334+raj-chak@users.noreply.github.com> (cherry picked from commit 89a11c5a165d9fc1a5412a3c2369d3b27869b305) Co-authored-by: Peter Nied --- config/roles.yml | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/config/roles.yml b/config/roles.yml index c96e8b27e9..1d081a5fd0 100644 --- a/config/roles.yml +++ b/config/roles.yml @@ -255,3 +255,38 @@ point_in_time_full_access: - '*' allowed_actions: - 'manage_point_in_time' + +# Allows users to see security analytics detectors and others +security_analytics_read_access: + reserved: true + cluster_permissions: + - 'cluster:admin/opensearch/securityanalytics/alerts/get' + - 'cluster:admin/opensearch/securityanalytics/detector/get' + - 'cluster:admin/opensearch/securityanalytics/detector/search' + - 'cluster:admin/opensearch/securityanalytics/findings/get' + - 'cluster:admin/opensearch/securityanalytics/mapping/get' + - 'cluster:admin/opensearch/securityanalytics/mapping/view/get' + - 'cluster:admin/opensearch/securityanalytics/rule/get' + - 'cluster:admin/opensearch/securityanalytics/rule/search' + +# Allows users to use all security analytics functionality +security_analytics_full_access: + reserved: true + cluster_permissions: + - 'cluster:admin/opensearch/securityanalytics/alerts/*' + - 'cluster:admin/opensearch/securityanalytics/detector/*' + - 'cluster:admin/opensearch/securityanalytics/findings/*' + - 'cluster:admin/opensearch/securityanalytics/mapping/*' + - 'cluster:admin/opensearch/securityanalytics/rule/*' + index_permissions: + - index_patterns: + - '*' + allowed_actions: + - 'indices:admin/mapping/put' + - 'indices:admin/mappings/get' + +# Allows users to view and acknowledge alerts +security_analytics_ack_alerts: + reserved: true + cluster_permissions: + - 'cluster:admin/opensearch/securityanalytics/alerts/*'