update readme's for each role and remove create_index from lists priv…

…ilege for the soc manager role
elastic · Nov 10, 2020 · 75b148f · 75b148f
1 parent b73e3af
commit 75b148f
Show file tree

Hide file tree

Showing 8 changed files with 30 additions and 33 deletions.
diff --git a/...ins/security_solution/server/lib/detection_engine/scripts/roles_users/README.md b/...ins/security_solution/server/lib/detection_engine/scripts/roles_users/README.md
@@ -2,13 +2,12 @@
 2. The T1 and T2 Analyst roles do not seem to have much of a functional difference but I created them as is.
 3. I gave the Hunter role "all" privileges for saved objects management and builtInAlerts so that they can create rules.
 4. Rule Author has the ability to create rules and create value lists
-5. SOC Manager and Platform Engineer roles do not have much of a distinctive difference. However, when going through these roles and testing them out I noticed we require "manage" privileges. I'm not sure we need "manage" and could possibly remove it as a requirement but does anyone remember why we needed manage as a privilege for these indices?
 
-|                     Role                     | Data Sources | SIEM ML Jobs/Results |               Lists               | Rules/Exceptions |          Signals/Alerts           |
-| :------------------------------------------: | :----------: | :------------------: | :-------------------------------: | :--------------: | :-------------------------------: |
-|                  T1 Analyst                  |     read     |         read         |               read                |       read       |               read                |
-|                  T2 Analyst                  |     read     |         read         |               read                |       read       |         read, create_doc          |
-|             Hunter / T3 Analyst              | read, write  |         read         |               read                |   read, write    |         read, create_doc          |
-| Rule Author / Manager / Detections Engineer  | read, write  |         read         |            read, write            |   read, write    |            read, write            |
-|                 SOC Manager                  | read, write  |         read         | read, write, create_index, manage |   read, write    | read, write, create_index, manage |
-| Platform Engineer (data ingest, cluster ops) | read, write  |         all          |                all                |   read, write    |                all                |
+|                     Role                     | Data Sources | SIEM ML Jobs/Results |    Lists    | Rules/Exceptions | Acction Connectors |          Signals/Alerts          |
+| :------------------------------------------: | :----------: | :------------------: | :---------: | :--------------: | :----------------: | :------------------------------: |
+|                  T1 Analyst                  |     read     |         read         |    none     |       read       |        read        |           read, write            |
+|                  T2 Analyst                  |     read     |         read         |    read     |       read       |        read        |           read, write            |
+|             Hunter / T3 Analyst              | read, write  |         read         |    read     |   read, write    |        read        |           read, write            |
+| Rule Author / Manager / Detections Engineer  | read, write  |         read         | read, write |   read, write    |        read        | read, write, view_index_metadata |
+|                 SOC Manager                  | read, write  |         read         | read, write |   read, write    |        all         |       read, write, manage        |
+| Platform Engineer (data ingest, cluster ops) | read, write  |         all          |     all     |   read, write    |        all         |               all                |
diff --git a/...urity_solution/server/lib/detection_engine/scripts/roles_users/hunter/README.md b/...urity_solution/server/lib/detection_engine/scripts/roles_users/hunter/README.md
@@ -7,6 +7,6 @@ This user can CRUD rules and signals. The main difference here is the user has
 
 privileges whereas the T1 and T2 have "read" privileges which prevents them from creating rules
 
-|        Role         | Data Sources | SIEM ML Jobs/Results | Lists | Rules/Exceptions |  Signals/Alerts  |
-| :-----------------: | :----------: | :------------------: | :---: | :--------------: | :--------------: |
-| Hunter / T3 Analyst | read, write  |         read         | read  |   read, write    | read, create_doc |
+|        Role         | Data Sources | SIEM ML Jobs/Results | Lists | Rules/Exceptions | Action Connectors | Signals/Alerts |
+| :-----------------: | :----------: | :------------------: | :---: | :--------------: | :---------------: | :------------: |
+| Hunter / T3 Analyst | read, write  |         read         | read  |   read, write    |       read        |  read, write   |
diff --git a/...ion/server/lib/detection_engine/scripts/roles_users/platform_engineer/README.md b/...ion/server/lib/detection_engine/scripts/roles_users/platform_engineer/README.md
@@ -1,4 +1,5 @@
 essentially a superuser for security solution
-|                     Role                     | Data Sources | SIEM ML Jobs/Results | Lists | Rules/Exceptions | Signals/Alerts |
-| :------------------------------------------: | :----------: | :------------------: | :---: | :--------------: | :------------: |
-| Platform Engineer (data ingest, cluster ops) | read, write  |         all          |  all  |   read, write    |      all       |
+
+|                     Role                     | Data Sources | SIEM ML Jobs/Results | Lists | Rules/Exceptions | Action Connectors | Signals/Alerts |
+| :------------------------------------------: | :----------: | :------------------: | :---: | :--------------: | :---------------: | :------------: |
+| Platform Engineer (data ingest, cluster ops) |     all      |         all          |  all  |   read, write    |        all        |      all       |
diff --git a/..._solution/server/lib/detection_engine/scripts/roles_users/rule_author/README.md b/..._solution/server/lib/detection_engine/scripts/roles_users/rule_author/README.md
@@ -1,5 +1,5 @@
 rule author has the same privileges as hunter with the additional privileges of uploading value lists
 
-|                    Role                     | Data Sources | SIEM ML Jobs/Results |    Lists    | Rules/Exceptions | Signals/Alerts |
-| :-----------------------------------------: | :----------: | :------------------: | :---------: | :--------------: | :------------: |
-| Rule Author / Manager / Detections Engineer | read, write  |         read         | read, write |   read, write    |  read, write   |
+|                    Role                     | Data Sources | SIEM ML Jobs/Results |    Lists    | Rules/Exceptions | Action Connectors |          Signals/Alerts          |
+| :-----------------------------------------: | :----------: | :------------------: | :---------: | :--------------: | :---------------: | :------------------------------: |
+| Rule Author / Manager / Detections Engineer | read, write  |         read         | read, write |   read, write    |       read        | read, write, view_index_metadata |
diff --git a/..._solution/server/lib/detection_engine/scripts/roles_users/soc_manager/README.md b/..._solution/server/lib/detection_engine/scripts/roles_users/soc_manager/README.md
@@ -1,5 +1,5 @@
 SOC Manager has all of the privileges of a rule author role with the additional privilege of creating the signals index and lists indices upon initial visit
 
-|    Role     | Data Sources | SIEM ML Jobs/Results |               Lists               | Rules/Exceptions |          Signals/Alerts           |
-| :---------: | :----------: | :------------------: | :-------------------------------: | :--------------: | :-------------------------------: |
-| SOC Manager | read, write  |         read         | read, write, create_index, manage |   read, write    | read, write, create_index, manage |
+|    Role     | Data Sources | SIEM ML Jobs/Results |    Lists    | Rules/Exceptions | Action Connectors |   Signals/Alerts    |
+| :---------: | :----------: | :------------------: | :---------: | :--------------: | :---------------: | :-----------------: |
+| SOC Manager | read, write  |         read         | read, write |   read, write    |        all        | read, write, manage |
diff --git a/...solution/server/lib/detection_engine/scripts/roles_users/soc_manager/detections_role.json b/...solution/server/lib/detection_engine/scripts/roles_users/soc_manager/detections_role.json
@@ -10,14 +10,12 @@
           "filebeat-*",
           "logs-*",
           "packetbeat-*",
-          "winlogbeat-*"
+          "winlogbeat-*",
+          ".lists*",
+          ".items*"
         ],
         "privileges": ["read", "write"]
       },
-      {
-        "names": [".lists*", ".items*"],
-        "privileges": ["read", "write", "create_index", "manage"]
-      },
       {
         "names": [".siem-signals-*"],
         "privileges": ["read", "write", "create_index", "manage"]

diff --git a/...y_solution/server/lib/detection_engine/scripts/roles_users/t1_analyst/README.md b/...y_solution/server/lib/detection_engine/scripts/roles_users/t1_analyst/README.md
@@ -1,3 +1,3 @@
-|    Role    | Data Sources | SIEM ML Jobs/Results | Lists | Rules/Exceptions | Signals/Alerts |
-| :--------: | :----------: | :------------------: | :---: | :--------------: | :------------: |
-| T1 Analyst |     read     |         read         | read  |       read       |      read      |
+|    Role    | Data Sources | SIEM ML Jobs/Results | Lists | Rules/Exceptions | Actions Connectors | Signals/Alerts |
+| :--------: | :----------: | :------------------: | :---: | :--------------: | :----------------: | :------------: |
+| T1 Analyst |     read     |         read         | none  |       read       |        read        |  read, write   |
diff --git a/...y_solution/server/lib/detection_engine/scripts/roles_users/t2_analyst/README.md b/...y_solution/server/lib/detection_engine/scripts/roles_users/t2_analyst/README.md
@@ -1,6 +1,5 @@
 This role can view rules. Essentially there is no difference between a T1 and T2 analyst.
 
-
-|    Role    | Data Sources | SIEM ML Jobs/Results | Lists | Rules/Exceptions |  Signals/Alerts  |
-| :--------: | :----------: | :------------------: | :---: | :--------------: | :--------------: |
-| T2 Analyst |     read     |         read         | read  |       read       | read, create_doc |
+|    Role    | Data Sources | SIEM ML Jobs/Results | Lists | Rules/Exceptions | Action Connectors | Signals/Alerts |
+| :--------: | :----------: | :------------------: | :---: | :--------------: | :---------------: | :------------: |
+| T2 Analyst |     read     |         read         | read  |       read       |       read        |  read, write   |