{
  "_comment": [
    "Wazuh indexer security role for ONE tenant. Read-only, fenced with a",
    "document-level security (DLS) query on wazuh.agent.groups.",
    "",
    "Apply with:",
    "  PUT _plugins/_security/api/roles/tenant_acmeretail_read",
    "(remove this _comment key first; the Security API rejects unknown fields).",
    "",
    "Sources: role structure and Wazuh index patterns,",
    "https://documentation.wazuh.com/5.0-beta/user-manual/wazuh-indexer/security.html",
    "DLS semantics and the escaped-string form,",
    "https://docs.opensearch.org/latest/security/access-control/document-level-security/",
    "",
    "LAB-VERIFIED, STILL UNDOCUMENTED: Wazuh does not document DLS on its own",
    "data streams as of beta5 (Sep 2026), but this exact pattern was verified",
    "on a 5.0.0-beta5 lab on 23 Sep 2026: a role with a term query on",
    "wazuh.agent.groups restricted a tenant user to one group's documents",
    "across wazuh-events-v5-*, wazuh-findings-v5-* and wazuh-states-*, and an",
    "index the role did not name returned HTTP 403. wazuh.agent.groups is",
    "mapped as a keyword. Re-run that test on your own cluster after every",
    "upgrade; the failure mode is silent.",
    "",
    "Before using: confirm wazuh.agent.groups exists on your documents and is",
    "a keyword field. A `term` query is used on purpose. Do NOT switch it to",
    "`match`: the standard analyser splits text fields on word boundaries, so",
    "a hyphenated tenant id such as t-acme-retail would also match other",
    "values that share a token.",
    "",
    "tenant_permissions is left empty on purpose. The Wazuh security page",
    "documents the field ('permissions granted for one or more tenants') but",
    "not its sub-structure, and the documented way to assign a dashboard",
    "tenant to a role is the dashboard itself: Indexer management > Security >",
    "Tenants, after enabling multi-tenancy. Assign it there rather than",
    "guessing the API shape."
  ],
  "cluster_permissions": [
    "cluster_composite_ops_ro",
    "indices:data/read/scroll/clear"
  ],
  "index_permissions": [
    {
      "index_patterns": [
        "wazuh-findings-v5-*",
        "wazuh-events-v5-*",
        "wazuh-states-*"
      ],
      "dls": "{\"term\": {\"wazuh.agent.groups\": \"t-acmeretail\"}}",
      "allowed_actions": [
        "read"
      ]
    }
  ],
  "tenant_permissions": []
}