RBAC reference

RBAC policies consist of three elements: actions, resources, and effect. Each API endpoint involves one or more actions and can be performed on specific resources.

For example, the GET /agents endpoint is used to obtain the information of one or all Wazuh agents. This endpoint applies the action agent:read on the resource agent:id or agent:group. For example, agent:id:001 (agent 001) or agent:id:* (all agents). All the existing resources, available actions, and the endpoints affected by each one can be found on this reference page.

To list the RBAC actions and resources that your Wazuh manager supports, use the GET /security/actions and GET /security/resources endpoints. GET /security/actions also returns the endpoints related to each action. These endpoints require the security:read_config action.

The Wazuh manager API also includes default policies, roles, and rules that you can use immediately instead of creating new ones. The defaults listed here are those of Wazuh 5.0.0.

Resources

Actions

Agent

Cluster

Group

MITRE

Security

Default policies

Default roles

Default rules

Resources

Resources

Description

Example

*:*

References "any" or "all" resources across all scopes. Actions using these resources are called resourceless.

agent:group

Reference agents through group name. This resource is disaggregated into the agent's IDs belonging to the specified group.

agent:group:web

agent:id

Reference agents through agent ID

agent:id:001

group:id

Reference agent groups through group ID

group:id:default

node:id

Reference cluster node by node ID

node:id:worker1

policy:id

Reference security policy through its ID

policy:id:1

role:id

Reference security role through its ID

role:id:1

rule:id

Reference security rule through its ID

rule:id:1

user:id

Reference security user through its ID

user:id:1

Actions

In each action, the affected endpoints are specified along with the necessary resources, following this structure: <METHOD> <ENDPOINT> (<RESOURCE>).

Agent

The /agents endpoint of the Wazuh manager API allows users to enroll and manage Wazuh agents on the Wazuh manager.

agent:create

agent:delete

agent:modify_group

agent:read

agent:read_secrets

agent:reload

agent:restart

agent:scan_vulnerability

agent:upgrade

agent:uninstall

Cluster

The /cluster endpoint of the Wazuh manager API allows users to manage the configuration and health of every node in the Wazuh cluster.

cluster:read_api_config

cluster:read

cluster:read_secrets

Without this action, the Wazuh manager API returns the enrollment password, the cluster key, and other credential values as ***** in node and group configuration responses. PUT /cluster/{node_id}/configuration also requires this action to change the cluster key or the indexer section.

cluster:restart

cluster:status

cluster:update_config

Enrollment token

The /agents/enrollment-tokens endpoint of the Wazuh manager API allows users to create, list, and revoke the tokens that new Wazuh agents use to enroll.

enrollment_token:create

enrollment_token:delete

enrollment_token:read

Group

The /groups endpoint of the Wazuh manager API enables users to group Wazuh agents into distinct subsets for centralized configurations.

group:create

group:delete

group:modify_assignments

group:read

group:update_config

MITRE

The /mitre endpoint of the Wazuh manager API allows users to retrieve high-level overview about the corresponding tactics and techniques from the MITRE ATT&CK database.

mitre:read

Security

The /security endpoint of the Wazuh manager API enables administrators to manage security-related aspects within the Wazuh environment.

security:create_user

security:create

security:delete

security:edit_run_as

security:read_config

security:read

security:revoke

security:update_config

security:update

Default policies

agents_all_*

Grant full access to all Wazuh agent-related functionalities.

agents_all_resourceless:
  actions:
    - agent:create
    - group:create
    - agent:uninstall
    - enrollment_token:create
    - enrollment_token:read
    - enrollment_token:delete
  resources:
    - '*:*:*'
  effect: allow
agents_all_agents:
  actions:
    - agent:read
    - agent:delete
    - agent:modify_group
    - agent:restart
    - agent:reload
    - agent:upgrade
    - agent:scan_vulnerability
  resources:
    - agent:id:*
    - agent:group:*
  effect: allow
agents_all_groups:
  actions:
    - group:read
    - group:delete
    - group:update_config
    - group:modify_assignments
  resources:
    - group:id:*
  effect: allow

agents_read_*

Grant read access to all Wazuh agent-related functionalities.

agents_read_resourceless:
  actions:
    - enrollment_token:read
  resources:
    - '*:*:*'
  effect: allow
agents_read_agents:
  actions:
    - agent:read
  resources:
    - agent:id:*
    - agent:group:*
  effect: allow
agents_read_groups:
  actions:
    - group:read
  resources:
    - group:id:*
  effect: allow

cluster_all_*

Provide full access to all cluster-related functionalities.

cluster_all_resourceless:
  actions:
    - cluster:status
    - cluster:update_config
    - cluster:restart
  resources:
    - '*:*:*'
  effect: allow
cluster_all_nodes:
  actions:
    - cluster:read_api_config
    - cluster:read
    - cluster:restart
    - cluster:update_config
  resources:
    - node:id:*
  effect: allow

cluster_read_*

Provide read access to all cluster-related functionalities.

cluster_read_resourceless:
  actions:
    - cluster:status
    - cluster:read
    - cluster:read_api_config
  resources:
    - '*:*:*'
  effect: allow
cluster_read_nodes:
  actions:
    - cluster:read_api_config
    - cluster:read
  resources:
    - node:id:*
  effect: allow

mitre_read_*

Allow reading MITRE database information.

mitre_read_mitre:
  actions:
    - mitre:read
  resources:
    - '*:*:*'
  effect: allow

security_all_*

Provide full access to all security-related functionalities.

security_all_resourceless:
  actions:
    - security:create
    - security:create_user
    - security:edit_run_as
    - security:read_config
    - security:update_config
    - security:revoke
  resources:
    - '*:*:*'
  effect: allow
security_all_security:
  actions:
    - security:read
    - security:update
    - security:delete
  resources:
    - role:id:*
    - policy:id:*
    - user:id:*
    - rule:id:*
  effect: allow

users_all_*

Provide full access to all user-related functionalities.

users_all_resourceless:
  actions:
    - security:create_user
    - security:edit_run_as
    - security:revoke
  resources:
    - '*:*:*'
  effect: allow
users_all_users:
  actions:
    - security:read
    - security:update
    - security:delete
  resources:
    - user:id:*
  effect: allow

users_modify_run_as_*

Allow changing the allow_run_as parameter of users. On its own, this policy only allows disabling the parameter. Enabling it also requires security:update on role:id:*.

users_modify_run_as_flag:
  actions:
    - security:edit_run_as
  resources:
    - '*:*:*'
  effect: allow

secrets_read_*

Allow reading the enrollment password, the cluster key, and the agents' pre-shared keys in clear instead of masked.

secrets_read_nodes:
  actions:
    - cluster:read_secrets
  resources:
    - node:id:*
  effect: allow
secrets_read_agents:
  actions:
    - agent:read_secrets
  resources:
    - agent:id:*
  effect: allow

security_read_*

Provide read-only access to all security-related functionalities.

security_read_resourceless:
  actions:
    - security:read_config
  resources:
    - '*:*:*'
  effect: allow
security_read_security:
  actions:
    - security:read
  resources:
    - role:id:*
    - policy:id:*
    - user:id:*
    - rule:id:*
  effect: allow

Default roles

administrator

The administrator role has full access to all endpoints in the Wazuh manager API.

Policies

Rules

agents_admin

The agent administrator role has full access to all Wazuh agent-related functionalities.

Policies

agents_readonly

Read only role for Wazuh agent-related functionalities.

Policies

cluster_admin

Manager administrator of the Wazuh manager cluster; this role has full access to all Wazuh manager-related functionalities.

Policies

cluster_readonly

Read-only role for Wazuh manager-related functionalities.

Policies

readonly

Read-only role for Wazuh agent, cluster, and MITRE information. It has no access to security resources.

Policies

Rules

users_admin

System user administrator; this role provides full access to all user-related functionalities.

Policies

wazuh_indexer_admin

The Wazuh indexer administrator role has full access to agent and cluster functionalities, and read-only access to security resources.

Policies

Rules

Default rules

Note

Only the wazuh-internal-client user (ID 2) can obtain run_as permissions through these mapping rules. These rules never match an authorization context for any other Wazuh manager API user. Rules that you create apply to any user with allow_run_as enabled.

wui_elastic_admin

Administrator permissions for the elastic users of the Wazuh dashboard.

rule:
    FIND:
        username: "elastic"

wui_opensearch_admin

Administrator permissions for the OpenSearch users of the Wazuh dashboard.

rule:
    FIND:
        user_name: "admin"

wazuh_indexer_demo

Read-only permissions for the wazuh-demo user of the Wazuh indexer.

rule:
    FIND:
        user_name: "wazuh-demo"

wazuh_indexer_readonly

Read-only permissions for the wazuh-readonly user of the Wazuh indexer.

rule:
    FIND:
        user_name: "wazuh-readonly"

wazuh_indexer_admin

Administrator permissions, with read-only access to security resources, for the wazuh-admin user of the Wazuh indexer.

rule:
    FIND:
        user_name: "wazuh-admin"