RBAC Reference

Active_response

The /active-response endpoint of the Wazuh server API allows users to interact with the Wazuh Active Response module.

Agent

The /agents endpoint of the Wazuh server API allows users to enroll and manage agents on the Wazuh server.

CIS-CAT

The /ciscat endpoint of the Wazuh server API enables users to retrieve specific information from the results of CIS-CAT scans carried out on the Wazuh agents.

Cluster

The /cluster endpoint of the Wazuh server API allows users to manage the configuration and health of the master node and the worker nodes in the Wazuh cluster.

Decoders

The /decoder endpoint of the Wazuh server API enables users to manage and retrieve information about the decoders included in the Wazuh server.

Events

The /event endpoint of the Wazuh server API allows users to ingest security events to the Wazuh analysis engine.

Group

The /groups endpoint of the Wazuh server API enables users to group Wazuh agents into distinct subsets for centralized configurations.

Lists

The /lists endpoint of the Wazuh server API allows users to retrieve and manage the CDB lists that are used for checking malicious files on Wazuh agents.

Logtest

The /logtest endpoint of the Wazuh server API allows users to test and verify new rules and decoders against provided log examples in the Wazuh analysis engine.

Manager

The /manager endpoint of the Wazuh server API enables users to manage and collect relevant information from the Wazuh manager.

MITRE

The /mitre endpoint of the Wazuh server API allows users to retrieve a high-level overview of the corresponding tactics and techniques from the MITRE ATT&CK database.

Rootcheck

The /rootcheck endpoint of the Wazuh server API enables users to interact with the Wazuh rootcheck module and retrieve results from the scans on the Wazuh agents.

Rules

The /rules endpoint of the Wazuh server API lets users manage and retrieve information about the Wazuh rules that are used to analyze incoming events and generate alerts.

SCA

The /sca endpoint of the Wazuh server API allows users to interact with the Wazuh SCA module and collect relevant SCA scan results from Wazuh agents.

Security

The /security endpoint of the Wazuh server API enables administrators to manage security-related aspects within the Wazuh environment.

File integrity monitoring

The /syscheck endpoint of the Wazuh server API allows users to interact with the Wazuh File Integrity Monitoring module as it initiates routine scans and retrieves syscheck results.

Syscollector

The /syscollector endpoint of the Wazuh server API allows users to collect system information from monitored endpoints and send them to the Wazuh server.

Task

The /tasks endpoint of the Wazuh server API enables users to get status information about the tasks performed by the Wazuh manager.

agents_all_*

Grant full access to all agents related functionalities.

agents_all_resourceless:
  actions:
    - agent:create
    - group:create
    - agent:uninstall
  resources:
    - '*:*:*'
  effect: allow
agents_all_agents:
  actions:
    - agent:read
    - agent:delete
    - agent:modify_group
    - agent:reconnect
    - agent:restart
    - agent:upgrade
  resources:
    - agent:id:*
    - agent:group:*
  effect: allow
agents_all_groups:
  actions:
    - group:read
    - group:delete
    - group:update_config
    - group:modify_assignments
  resources:
    - group:id:*
  effect: allow

agents_commands_*

Allow sending active response commands to Wazuh agents.

agents_commands_agents:
  actions:
    - active-response:command
  resources:
    - agent:id:*
  effect: allow

agents_read_*

Grant read access to all agents related functionalities.

agents_read_agents:
  actions:
    - agent:read
  resources:
    - agent:id:*
    - agent:group:*
  effect: allow
agents_read_groups:
  actions:
    - group:read
  resources:
    - group:id:*
  effect: allow

ciscat_read_*

Allow reading the agent ciscat results information.

ciscat_read_ciscat:
  actions:
    - ciscat:read
  resources:
    - agent:id:*
  effect: allow

cluster_all_*

Provide full access to all cluster/manager related functionalities.

cluster_all_resourceless:
  actions:
    - cluster:status
    - manager:read
    - manager:read_api_config
    - manager:update_config
    - manager:restart
  resources:
    - '*:*:*'
  effect: allow
cluster_all_nodes:
  actions:
    - cluster:read_api_config
    - cluster:read
    - cluster:restart
    - cluster:update_config
  resources:
    - node:id:*
  effect: allow

cluster_read_*

Provide read access to all cluster/manager related functionalities.

cluster_read_resourceless:
  actions:
    - cluster:status
    - manager:read
    - manager:read_api_config
  resources:
    - '*:*:*'
  effect: allow
cluster_read_nodes:
  actions:
    - cluster:read_api_config
    - cluster:read
    - cluster:read_api_config
  resources:
    - node:id:*
  effect: allow

decoders_all_*

Allow managing all decoder files in the Wazuh server.

decoders_all_files:
  actions:
    - decoders:read
    - decoders:delete
  resources:
    - decoder:file:*
  effect: allow
decoders_all_resourceless:
  actions:
    - decoders:update
  resources:
    - '*:*:*'
  effect: allow

decoders_read_*

Allow reading all decoder files in the Wazuh server.

decoders_read_decoders:
  actions:
    - decoders:read
  resources:
    - decoder:file:*
  effect: allow

events_ingest_*

Allow sending events to the Wazuh analysis engine.

events_ingest_resourceless:
  actions:
    - event:ingest
  resources:
    - '*:*:*'
  effect: allow

lists_all_*

Allow managing all CDB lists files on the Wazuh server.

lists_all_rules:
  actions:
    - lists:read
    - lists:delete
  resources:
    - list:file:*
  effect: allow
lists_all_resourceless:
  actions:
    - lists:update
  resources:
    - '*:*:*'
  effect: allow

lists_read_*

Allow reading the path of all the lists in the Wazuh server.

lists_read_rules:
  actions:
    - lists:read
  resources:
    - list:file:*
  effect: allow

logtest_all_*

Provide access to all logtest related functionalities.

logtest_all_logtest:
  actions:
    - logtest:run
  resources:
    - '*:*:*'
  effect: allow

mitre_read_*

Allow reading MITRE database information.

mitre_read_mitre:
  actions:
    - mitre:read
  resources:
    - '*:*:*'
  effect: allow

rootcheck_all_*

Allow reading, running and clearing rootcheck information.

rootcheck_all_rootcheck:
  actions:
    - rootcheck:clear
    - rootcheck:read
    - rootcheck:run
  resources:
    - agent:id:*
  effect: allow

rootcheck_read_*

Allow reading all rootcheck information.

rootcheck_read_rootcheck:
  actions:
    - rootcheck:read
  resources:
    - agent:id:*
  effect: allow

rules_all_*

Allow managing all rule files in the Wazuh server.

rules_all_files:
  actions:
    - rules:read
    - rules:delete
  resources:
    - rule:file:*
  effect: allow
rules_all_resourceless:
  actions:
    - rules:update
  resources:
    - '*:*:*'
  effect: allow

rules_read_*

Allow reading all rule files in the system.

rules_read_rules:
  actions:
    - rules:read
  resources:
    - rule:file:*
  effect: allow

sca_read_*

Allow reading the agent sca information.

sca_read_sca:
  actions:
    - sca:read
  resources:
    - agent:id:*
  effect: allow

security_all_*

Provide full access to all security related functionalities.

security_all_resourceless:
  actions:
    - security:create
    - security:create_user
    - security:edit_run_as
    - security:read_config
    - security:update_config
    - security:revoke
  resources:
    - '*:*:*'
  effect: allow
security_all_security:
  actions:
    - security:read
    - security:update
    - security:delete
  resources:
    - role:id:*
    - policy:id:*
    - user:id:*
    - rule:id:*
  effect: allow

syscheck_all_*

Allow reading, running and clearing syscheck information.

syscheck_all_syscheck:
  actions:
    - syscheck:clear
    - syscheck:read
    - syscheck:run
  resources:
    - agent:id:*
  effect: allow

syscheck_read_*

Allow reading syscheck information.

syscheck_read_syscheck:
  actions:
    - syscheck:read
  resources:
    - agent:id:*
  effect: allow

syscollector_read_*

Allow reading agents information.

syscollector_read_syscollector:
  actions:
    - syscollector:read
  resources:
    - agent:id:*
  effect: allow

task_status_*

Allow reading tasks information.

task_status_task:
  actions:
    - task:status
  resources:
    - '*:*:*'
  effect: allow

users_all_*

Provide full access to all users related functionalities.

users_all_resourceless:
  actions:
    - security:create_user
    - security:edit_run_as
    - security:revoke
  resources:
    - '*:*:*'
  effect: allow
users_all_users:
  actions:
    - security:read
    - security:update
    - security:delete
  resources:
    - user:id:*
  effect: allow

users_modify_run_as_*

Provides the capability to modify the users' run_as parameter.

users_modify_run_as_flag:
  actions:
    - security:edit_run_as
  resources:
    - '*:*:*'
  effect: allow

administrator

The administrator role has full access to all endpoints in the Wazuh server API.

Policies

• agents_all_*

• agents_commands_*

• ciscat_read_*

• cluster_all_*

• decoders_all_*

• events_ingest_*

• lists_all_*

• logtest_all_*

• mitre_read_*

• rootcheck_all_*

• rules_all_*

• sca_read_*

• security_all_*

• syscheck_all_*

• syscollector_read_*

• task_status_*

Rules

• wui_elastic_admin

• wui_opensearch_admin

agents_admin

The agent administrator role has full access to all agents related functionalities.

Policies

• agents_all_*

agents_readonly

Read only role for agents related functionalities.

Policies

• agents_read_*

cluster_admin

Manager administrator of the Wazuh server cluster, this role has full access to all manager related functionalities.

Policies

• cluster_all_*

cluster_readonly

Read only role for manager related functionalities.

Policies

• cluster_read_*

readonly

Read only role, this role can read all the information of the system.

Policies

• agents_read_*

• ciscat_read_*

• cluster_read_*

• decoders_read_*

• lists_read_*

• mitre_read_*

• rootcheck_read_*

• rules_read_*

• sca_read_*

• syscheck_read_*

• syscollector_read_*

users_admin

Users administrator of the system, this role provides full access to all users related functionalities.

Policies

• users_all_*

wui_elastic_admin

Administrator permissions for the elastic users of the Wazuh dashboard.

rule:
    FIND:
        username: "elastic"

wui_opensearch_admin

Administrator permissions for the OpenSearch users of the Wazuh dashboard.

rule:
    FIND:
        user_name: "admin"