{
  "_comment": [
    "Read-only viewer role for the Wazuh indexer.",
    "",
    "This is the documented read-only recipe from the Wazuh RBAC page,",
    "expressed as an API body instead of dashboard form fields:",
    "  Cluster permissions: cluster_composite_ops_ro",
    "  Index: *",
    "  Index permissions: read",
    "https://documentation.wazuh.com/5.0-beta/user-manual/user-administration/rbac.html",
    "",
    "Apply with:",
    "  PUT _plugins/_security/api/roles/wazuh_viewer",
    "(remove this _comment key first).",
    "",
    "Then, on the Wazuh side, map the same user or backend role to the",
    "built-in `readonly` role under Server management > Security >",
    "Roles mapping.",
    "",
    "Note the index pattern is `*`, so this role sees every index including",
    "platform internals. That is what the documented recipe grants. For a",
    "tenant, or for anyone who should not see other customers, use a fenced",
    "role instead: see ../wazuh-multi-tenant/tenant-role.json."
  ],
  "cluster_permissions": [
    "cluster_composite_ops_ro"
  ],
  "index_permissions": [
    {
      "index_patterns": [
        "*"
      ],
      "allowed_actions": [
        "read"
      ]
    }
  ],
  "tenant_permissions": []
}