roles.yml

# -----
# Source: project-controller/blob/main/internal/project/security/config/roles.yml
# -----
# modeled after the t1_analyst minus osquery run saved queries privilege
viewer:
  cluster: []
  indices:
    - names:
        - '.siem-signals*'
        - '.lists-*'
        - '.items-*'
      privileges:
        - 'read'
        - 'view_index_metadata'
      allow_restricted_indices: false
    - names:
        - '.alerts*'
        - '.preview.alerts*'
      privileges:
        - 'read'
        - 'view_index_metadata'
      allow_restricted_indices: false
    - names:
        - apm-*-transaction*
        - traces-apm*
        - auditbeat-*
        - endgame-*
        - filebeat-*
        - logs-*
        - packetbeat-*
        - winlogbeat-*
        - metrics-endpoint.metadata_current_*
        - logstash-*
        - '.fleet-agents*'
        - '.fleet-actions*'
        - 'risk-score.risk-score-*'
        - '.asset-criticality.asset-criticality-*'
        - '.entities.v1.latest.security_*'
        - '.ml-anomalies-*'
      privileges:
        - read
  applications:
    - application: 'kibana-.kibana'
      privileges:
        - feature_ml.read
        - feature_siem.read
        - feature_siem.read_alerts
        - feature_siem.endpoint_list_read
        - feature_securitySolutionCases.read
        - feature_securitySolutionAssistant.all
        - feature_securitySolutionAttackDiscovery.all
        - feature_actions.read
        - feature_builtInAlerts.read
        - feature_osquery.read
        - feature_discover.all
        - feature_dashboard.all
        - feature_maps.all
        - feature_visualize.all
        - feature_dataQuality.all
      resources: '*'
  run_as: []

# modeled after t3_analyst
editor:
  cluster: []
  indices:
    - names:
        - '.siem-signals*'
        - '.lists-*'
        - '.items-*'
      privileges:
        - 'read'
        - 'view_index_metadata'
        - 'write'
        - 'maintenance'
      allow_restricted_indices: false
    - names:
        - apm-*-transaction*
        - traces-apm*
        - auditbeat-*
        - endgame-*
        - filebeat-*
        - logs-*
        - packetbeat-*
        - winlogbeat-*
        - logstash-*
      privileges:
        - read
        - write
    - names:
        - '.internal.alerts*'
        - '.alerts*'
        - '.internal.preview.alerts*'
        - '.preview.alerts*'
        - 'risk-score.risk-score-*'
      privileges:
        - 'read'
        - 'view_index_metadata'
        - 'write'
        - 'maintenance'
    - names:
        - '.asset-criticality.asset-criticality-*'
        - '.entities.v1.latest.security_*'
      privileges:
        - 'read'
        - 'write'
      allow_restricted_indices: false
    - names:
        - '.ml-anomalies-*'
      privileges:
        - read
  applications:
    - application: 'kibana-.kibana'
      privileges:
        - feature_ml.read
        - feature_siem.all
        - feature_siem.read_alerts
        - feature_siem.crud_alerts
        - feature_siem.endpoint_list_all
        - feature_siem.trusted_applications_all
        - feature_siem.event_filters_all
        - feature_siem.host_isolation_exceptions_all
        - feature_siem.blocklist_all
        - feature_siem.policy_management_read # Elastic Defend Policy Management
        - feature_siem.host_isolation_all
        - feature_siem.process_operations_all
        - feature_siem.actions_log_management_all # Response actions history
        - feature_siem.file_operations_all
        - feature_securitySolutionCases.all
        - feature_securitySolutionAssistant.all
        - feature_securitySolutionAttackDiscovery.all
        - feature_actions.read
        - feature_builtInAlerts.all
        - feature_osquery.all
        - feature_discover.all
        - feature_dashboard.all
        - feature_maps.all
        - feature_visualize.all
      resources: '*'
  run_as: []

t1_analyst:
  cluster:
  indices:
    - names:
        - '.alerts-security*'
        - '.siem-signals-*'
      privileges:
        - read
        - write
        - maintenance
    - names:
        - apm-*-transaction*
        - traces-apm*
        - auditbeat-*
        - endgame-*
        - filebeat-*
        - logs-*
        - packetbeat-*
        - winlogbeat-*
        - logstash-*
        - metrics-endpoint.metadata_current_*
        - '.fleet-agents*'
        - '.fleet-actions*'
        - risk-score.risk-score-*
        - .asset-criticality.asset-criticality-*
        - .entities.v1.latest.security_*
        - '.ml-anomalies-*'
      privileges:
        - read
  applications:
    - application: 'kibana-.kibana'
      privileges:
        - feature_ml.read
        - feature_siem.read
        - feature_siem.read_alerts
        - feature_siem.endpoint_list_read
        - feature_securitySolutionCases.read
        - feature_securitySolutionAssistant.all
        - feature_securitySolutionAttackDiscovery.all
        - feature_actions.read
        - feature_builtInAlerts.read
        - feature_osquery.read
        - feature_osquery.run_saved_queries
        - feature_discover.all
        - feature_dashboard.all
        - feature_maps.all
        - feature_visualize.all
      resources: '*'

t2_analyst:
  cluster:
  indices:
    - names:
        - .alerts-security*
        - .siem-signals-*
      privileges:
        - read
        - write
        - maintenance
    - names:
        - .lists*
        - .items*
        - apm-*-transaction*
        - traces-apm*
        - auditbeat-*
        - endgame-*
        - filebeat-*
        - logs-*
        - packetbeat-*
        - winlogbeat-*
        - logstash-*
        - metrics-endpoint.metadata_current_*
        - .fleet-agents*
        - .fleet-actions*
        - risk-score.risk-score-*
        - .entities.v1.latest.security_*
        - '.ml-anomalies-*'
      privileges:
        - read
    - names:
        - .asset-criticality.asset-criticality-*
      privileges:
        - read
        - write
  applications:
    - application: 'kibana-.kibana'
      privileges:
        - feature_ml.read
        - feature_siem.read
        - feature_siem.read_alerts
        - feature_siem.endpoint_list_read
        - feature_securitySolutionCases.all
        - feature_securitySolutionAssistant.all
        - feature_securitySolutionAttackDiscovery.all
        - feature_actions.read
        - feature_builtInAlerts.read
        - feature_osquery.read
        - feature_osquery.run_saved_queries
        - feature_discover.all
        - feature_dashboard.all
        - feature_maps.all
        - feature_visualize.all
      resources: '*'

t3_analyst:
  cluster:
  indices:
    - names:
        - apm-*-transaction*
        - traces-apm*
        - auditbeat-*
        - endgame-*
        - filebeat-*
        - logs-*
        - packetbeat-*
        - winlogbeat-*
        - logstash-*
        - .asset-criticality.asset-criticality-*
      privileges:
        - read
        - write
    - names:
        - .alerts-security*
        - .siem-signals-*
      privileges:
        - read
        - write
        - maintenance
    - names:
        - .lists*
        - .items*
      privileges:
        - read
        - write
    - names:
        - metrics-endpoint.metadata_current_*
        - .fleet-agents*
        - .fleet-actions*
        - risk-score.risk-score-*
        - .entities.v1.latest.security_*
        - '.ml-anomalies-*'
      privileges:
        - read
  applications:
    - application: 'kibana-.kibana'
      privileges:
        - feature_ml.read
        - feature_siem.all
        - feature_siem.read_alerts
        - feature_siem.crud_alerts
        - feature_siem.endpoint_list_all
        - feature_siem.trusted_applications_all
        - feature_siem.event_filters_all
        - feature_siem.host_isolation_exceptions_all
        - feature_siem.blocklist_all
        - feature_siem.policy_management_read # Elastic Defend Policy Management
        - feature_siem.host_isolation_all
        - feature_siem.process_operations_all
        - feature_siem.actions_log_management_all # Response actions history
        - feature_siem.file_operations_all
        - feature_siem.scan_operations_all
        - feature_securitySolutionCases.all
        - feature_securitySolutionAssistant.all
        - feature_securitySolutionAttackDiscovery.all
        - feature_actions.read
        - feature_builtInAlerts.all
        - feature_osquery.all
        - feature_discover.all
        - feature_dashboard.all
        - feature_maps.all
        - feature_visualize.all
      resources: '*'

threat_intelligence_analyst:
  cluster:
  indices:
    - names:
        - apm-*-transaction*
        - traces-apm*
        - auditbeat-*
        - endgame-*
        - filebeat-*
        - logs-*
        - packetbeat-*
        - winlogbeat-*
        - logstash-*
      privileges:
        - read
    - names:
        - .asset-criticality.asset-criticality-*
      privileges:
        - read
        - write
    - names:
        - .lists*
        - .items*
      privileges:
        - read
        - write
        - view_index_metadata
    - names:
        - .alerts-security*
        - .siem-signals-*
      privileges:
        - read
        - write
        - maintenance
    - names:
        - metrics-endpoint.metadata_current_*
        - .fleet-agents*
        - .fleet-actions*
        - risk-score.risk-score-*
        - .entities.v1.latest.security_*
        - '.ml-anomalies-*'
      privileges:
        - read
  applications:
    - application: 'kibana-.kibana'
      privileges:
        - feature_ml.read
        - feature_siem.all
        - feature_siem.endpoint_list_read
        - feature_siem.blocklist_all
        - feature_securitySolutionCases.all
        - feature_securitySolutionAssistant.all
        - feature_securitySolutionAttackDiscovery.all
        - feature_actions.read
        - feature_builtInAlerts.read
        - feature_osquery.all
        - feature_discover.all
        - feature_dashboard.all
        - feature_maps.all
        - feature_visualize.all
      resources: '*'

rule_author:
  cluster:
  indices:
    - names:
        - apm-*-transaction*
        - traces-apm*
        - auditbeat-*
        - endgame-*
        - filebeat-*
        - logs-*
        - packetbeat-*
        - winlogbeat-*
        - logstash-*
        - .asset-criticality.asset-criticality-*
      privileges:
        - read
        - write
    - names:
        - .alerts-security*
        - .siem-signals-*
        - .internal.preview.alerts-security*
        - .preview.alerts-security*
      privileges:
        - read
        - write
        - maintenance
        - view_index_metadata
    - names:
        - .lists*
        - .items*
      privileges:
        - read
        - write
    - names:
        - metrics-endpoint.metadata_current_*
        - .fleet-agents*
        - .fleet-actions*
        - risk-score.risk-score-*
        - .entities.v1.latest.security_*
        - '.ml-anomalies-*'
      privileges:
        - read
  applications:
    - application: 'kibana-.kibana'
      privileges:
        - feature_ml.read
        - feature_siem.all
        - feature_siem.read_alerts
        - feature_siem.crud_alerts
        - feature_siem.policy_management_all
        - feature_siem.endpoint_list_all
        - feature_siem.trusted_applications_all
        - feature_siem.event_filters_all
        - feature_siem.host_isolation_exceptions_read
        - feature_siem.blocklist_all # Elastic Defend Policy Management
        - feature_siem.actions_log_management_read
        - feature_securitySolutionCases.all
        - feature_securitySolutionAssistant.all
        - feature_securitySolutionAttackDiscovery.all
        - feature_actions.read
        - feature_builtInAlerts.all
        - feature_osquery.all
        - feature_discover.all
        - feature_dashboard.all
        - feature_maps.all
        - feature_visualize.all
      resources: '*'

soc_manager:
  cluster:
  indices:
    - names:
        - apm-*-transaction*
        - traces-apm*
        - auditbeat-*
        - endgame-*
        - filebeat-*
        - logs-*
        - packetbeat-*
        - winlogbeat-*
        - logstash-*
        - .asset-criticality.asset-criticality-*
      privileges:
        - read
        - write
    - names:
        - .alerts-security*
        - .siem-signals-*
        - .preview.alerts-security*
        - .internal.preview.alerts-security*
      privileges:
        - read
        - write
        - manage
    - names:
        - .lists*
        - .items*
      privileges:
        - read
        - write
    - names:
        - metrics-endpoint.metadata_current_*
        - .fleet-agents*
        - .fleet-actions*
        - risk-score.risk-score-*
        - .entities.v1.latest.security_*
        - '.ml-anomalies-*'
      privileges:
        - read
  applications:
    - application: 'kibana-.kibana'
      privileges:
        - feature_ml.read
        - feature_siem.all
        - feature_siem.read_alerts
        - feature_siem.crud_alerts
        - feature_siem.policy_management_all
        - feature_siem.endpoint_list_all
        - feature_siem.trusted_applications_all
        - feature_siem.event_filters_all
        - feature_siem.host_isolation_exceptions_all
        - feature_siem.blocklist_all
        - feature_siem.host_isolation_all
        - feature_siem.process_operations_all
        - feature_siem.actions_log_management_all
        - feature_siem.file_operations_all
        - feature_siem.execute_operations_all
        - feature_siem.scan_operations_all
        - feature_securitySolutionCases.all
        - feature_securitySolutionAssistant.all
        - feature_securitySolutionAttackDiscovery.all
        - feature_actions.all
        - feature_builtInAlerts.all
        - feature_osquery.all
        - feature_indexPatterns.all
        - feature_discover.all
        - feature_dashboard.all
        - feature_maps.all
        - feature_visualize.all
      resources: '*'

detections_admin:
  cluster: ['manage_index_templates', 'manage_transform']
  indices:
    - names:
        - apm-*-transaction*
        - traces-apm*
        - auditbeat-*
        - endgame-*
        - filebeat-*
        - logs-*
        - packetbeat-*
        - winlogbeat-*
        - logstash-*
        - .lists*
        - .items*
        - .alerts-security*
        - .siem-signals-*
        - .preview.alerts-security*
        - .internal.preview.alerts-security*
      privileges:
        - read
        - write
        - manage
    - names:
        - metrics-endpoint.metadata_current_*
        - .fleet-agents*
        - .fleet-actions*
        - '.ml-anomalies-*'
      privileges:
        - read
    - names:
        - risk-score.risk-score-*
      privileges:
        - all
    - names:
        - .asset-criticality.asset-criticality-*
        - .entities.v1.latest.security_*
      privileges:
        - read
        - write
  applications:
    - application: 'kibana-.kibana'
      privileges:
        - feature_ml.all
        - feature_siem.all
        - feature_siem.read_alerts
        - feature_siem.crud_alerts
        - feature_securitySolutionCases.all
        - feature_securitySolutionAssistant.all
        - feature_securitySolutionAttackDiscovery.all
        - feature_actions.all
        - feature_builtInAlerts.all
        - feature_dev_tools.all
        - feature_discover.all
        - feature_dashboard.all
        - feature_maps.all
        - feature_visualize.all
      resources: '*'

platform_engineer:
  cluster:
    - manage
  indices:
    - names:
        - apm-*-transaction*
        - traces-apm*
        - auditbeat-*
        - endgame-*
        - filebeat-*
        - logs-*
        - packetbeat-*
        - winlogbeat-*
        - logstash-*
        - .lists*
        - .items*
        - .alerts-security*
        - .siem-signals-*
        - .preview.alerts-security*
        - .internal.preview.alerts-security*
        - risk-score.risk-score-*
      privileges:
        - all
    - names:
        - .asset-criticality.asset-criticality-*
        - .entities.v1.latest.security_*
      privileges:
        - read
        - write
    - names:
        - '.ml-anomalies-*'
      privileges:
        - read
  applications:
    - application: 'kibana-.kibana'
      privileges:
        - feature_ml.all
        - feature_siem.all
        - feature_siem.read_alerts
        - feature_siem.crud_alerts
        - feature_siem.policy_management_all
        - feature_siem.endpoint_list_all
        - feature_siem.trusted_applications_all
        - feature_siem.event_filters_all
        - feature_siem.host_isolation_exceptions_all
        - feature_siem.blocklist_all # Elastic Defend Policy Management
        - feature_siem.actions_log_management_read
        - feature_securitySolutionCases.all
        - feature_securitySolutionAssistant.all
        - feature_securitySolutionAttackDiscovery.all
        - feature_actions.all
        - feature_builtInAlerts.all
        - feature_fleet.all
        - feature_fleetv2.all
        - feature_osquery.all
        - feature_indexPatterns.all
        - feature_discover.all
        - feature_dashboard.all
        - feature_maps.all
        - feature_visualize.all
      resources: '*'

endpoint_operations_analyst:
  cluster:
  indices:
    - names:
        - metrics-endpoint.metadata_current_*
        - .fleet-agents*
        - .fleet-actions*
      privileges:
        - read
    - names:
        - apm-*-transaction*
        - traces-apm*
        - auditbeat-*
        - endgame-*
        - filebeat-*
        - logs-*
        - packetbeat-*
        - winlogbeat-*
        - logstash-*
        - .lists*
        - .items*
        - risk-score.risk-score-*
        - .entities.v1.latest.security_*
        - '.ml-anomalies-*'
      privileges:
        - read
    - names:
        - .alerts-security*
        - .siem-signals-*
        - .preview.alerts-security*
        - .internal.preview.alerts-security*
      privileges:
        - read
        - write
        - maintenance
    - names:
        - .asset-criticality.asset-criticality-*
      privileges:
        - read
        - write
  applications:
    - application: 'kibana-.kibana'
      privileges:
        - feature_ml.read
        - feature_siem.all
        - feature_siem.read_alerts
        - feature_siem.policy_management_all
        - feature_siem.endpoint_list_all
        - feature_siem.trusted_applications_all
        - feature_siem.event_filters_all
        - feature_siem.host_isolation_exceptions_all
        - feature_siem.blocklist_all
        - feature_siem.host_isolation_all
        - feature_siem.process_operations_all
        - feature_siem.actions_log_management_all
        - feature_siem.file_operations_all
        - feature_siem.execute_operations_all
        - feature_siem.scan_operations_all
        - feature_securitySolutionCases.all
        - feature_securitySolutionAssistant.all
        - feature_securitySolutionAttackDiscovery.all
        - feature_actions.all
        - feature_builtInAlerts.all
        - feature_osquery.all
        - feature_fleet.all
        - feature_fleetv2.all
        - feature_discover.all
        - feature_dashboard.all
        - feature_maps.all
        - feature_visualize.all
      resources: '*'

endpoint_policy_manager:
  cluster:
  indices:
    - names:
        - metrics-endpoint.metadata_current_*
        - .fleet-agents*
        - .fleet-actions*
      privileges:
        - read
    - names:
        - apm-*-transaction*
        - traces-apm*
        - auditbeat-*
        - endgame-*
        - filebeat-*
        - logs-*
        - packetbeat-*
        - winlogbeat-*
        - logstash-*
        - risk-score.risk-score-*
        - .entities.v1.latest.security_*
      privileges:
        - read
    - names:
        - .asset-criticality.asset-criticality-*
      privileges:
        - read
        - write
    - names:
        - .lists*
        - .items*
      privileges:
        - read
        - write
        - view_index_metadata
    - names:
        - .alerts-security*
        - .siem-signals-*
        - .preview.alerts-security*
        - .internal.preview.alerts-security*
      privileges:
        - read
        - write
        - manage
    - names:
        - '.ml-anomalies-*'
      privileges:
        - read
  applications:
    - application: 'kibana-.kibana'
      privileges:
        - feature_ml.all
        - feature_siem.all
        - feature_siem.read_alerts
        - feature_siem.crud_alerts
        - feature_siem.policy_management_all
        - feature_siem.endpoint_list_all
        - feature_siem.trusted_applications_all
        - feature_siem.event_filters_all
        - feature_siem.host_isolation_exceptions_all
        - feature_siem.blocklist_all # Elastic Defend Policy Management
        - feature_securitySolutionCases.all
        - feature_securitySolutionAssistant.all
        - feature_securitySolutionAttackDiscovery.all
        - feature_actions.all
        - feature_builtInAlerts.all
        - feature_osquery.all
        - feature_fleet.all
        - feature_fleetv2.all
        - feature_discover.all
        - feature_dashboard.all
        - feature_maps.all
        - feature_visualize.all
      resources: '*'

# admin role defined in elasticsearch controller
admin:
  cluster: ['all']
  indices:
    - names: ['*']
      privileges: ['all']
      allow_restricted_indices: false
  applications:
    - application: '*'
      privileges: ['*']
      resources: ['*']

# temporarily added for testing purpose
system_indices_superuser:
  cluster: ['all']
  indices:
    - names: ['*']
      privileges: ['all']
      allow_restricted_indices: true
  applications:
    - application: '*'
      privileges: ['*']
      resources: ['*']
  run_as: ['*']