---
_meta:
  type: "roles"
  config_version: 2

security_analyst:
  reserved: false
  description: "Security Analyst: read alerts/logs/dashboards, no security-config or RBAC-management access."
  cluster_permissions:
    - "cluster_composite_ops_ro"
  index_permissions:
    - index_patterns:
        - "wazuh-alerts-*"
        - "wazuh-archives-*"
        - "wazuh-monitoring-*"
        - "wazuh-statistics-*"
      allowed_actions:
        - "read"
        - "indices:admin/mappings/get"
        - "indices:admin/get"
  tenant_permissions:
    - tenant_patterns:
        - "global_tenant"
      allowed_actions:
        - "kibana_all_read"

readonly_auditor:
  reserved: false
  description: "Read-only Auditor: read-only access to dashboards and alerts across all Wazuh indices, no agent/rule/configuration actions."
  cluster_permissions:
    - "cluster_composite_ops_ro"
  index_permissions:
    - index_patterns:
        - "wazuh-*"
      allowed_actions:
        - "read"
  tenant_permissions:
    - tenant_patterns:
        - "global_tenant"
      allowed_actions:
        - "kibana_all_read"