{
  "_comment": [
    "SOC analyst role for the Wazuh indexer: read the data, read the saved",
    "objects, no security configuration, no content promotion.",
    "",
    "Apply with:",
    "  PUT _plugins/_security/api/roles/wazuh_analyst",
    "(remove this _comment key first).",
    "",
    "Shape and permission names are taken from roles Wazuh already ships:",
    "  stateless-read  -> read on wazuh-events-v5* and wazuh-findings-v5*",
    "  stateful-read   -> read on wazuh-states-*",
    "  wazuh_readonly  -> cluster_composite_ops_ro,",
    "                     indices:data/read/scroll/clear, cluster_monitor;",
    "                     get, read, indices:admin/aliases/get,",
    "                     indices:monitor/* on * and .kibana*",
    "See https://documentation.wazuh.com/5.0-beta/user-manual/wazuh-indexer/security.html",
    "and https://wazuh.github.io/wazuh-indexer-plugins/",
    "",
    "Default roles are reserved and cannot be edited. This is a duplicate to",
    "edit, which is what the documentation instructs.",
    "",
    "DELIBERATELY NOT INCLUDED: alerting, notifications, reporting and",
    "index-management permissions. The OpenSearch Security plugin already",
    "ships predefined roles for each of those plugins, and the supported way",
    "to grant them is to map the analyst to the relevant predefined role as",
    "well, rather than transcribing action strings here. Do that in",
    "Indexer management > Security > Roles.",
    "",
    "If you map a second role, remember that document-level security queries",
    "from several roles combine with a logical OR. That is harmless for an",
    "analyst role with no DLS, and it is exactly what breaks a tenant role.",
    "",
    "Detector lifecycle is intentionally absent too. Wazuh reserves creating,",
    "deleting and enabling or disabling a detector to its administrator role,",
    "because switching a detector off silently stops detection for its",
    "integration."
  ],
  "cluster_permissions": [
    "cluster_composite_ops_ro",
    "indices:data/read/scroll/clear",
    "cluster_monitor"
  ],
  "index_permissions": [
    {
      "index_patterns": [
        "wazuh-events-v5*",
        "wazuh-findings-v5*",
        "wazuh-states-*"
      ],
      "allowed_actions": [
        "read"
      ]
    },
    {
      "index_patterns": [
        ".kibana*"
      ],
      "allowed_actions": [
        "get",
        "read",
        "indices:admin/aliases/get",
        "indices:monitor/*"
      ]
    }
  ],
  "tenant_permissions": []
}