Limit Access to Sarch Guard Signals

Search Guard
1

Hi folks,

how I am able to control user access to the Search Guard Signals?

  1. Can I hide it to some users?
  2. Am I able to prevent reading the content of the signal and action?

This is my example role:

{
  "description": "Test Example Role",
  "cluster_permissions": [],
  "index_permissions": [
    {
      "allowed_actions": [
        "SGS_INDICES_MONITOR",
        "SGS_READ",
        "SGS_SEARCH"
      ],
      "index_patterns": [
        "index1-*",
        "index2-*"
      ],
      "fls": [],
      "masked_fields": []
    }
  ],
  "tenant_permissions": [
    {
      "allowed_actions": [
        "SGS_KIBANA_ALL_WRITE",
        "SGS_SIGNALS_ALL"
      ],
      "tenant_patterns": [
        "SGS_GLOBAL_TENANT"
      ]
    }
  ],
  "exclude_cluster_permissions": [
    "SGS_SIGNALS_ACCOUNT_MANAGE",
    "SGS_SIGNALS_ACCOUNT_READ"
  ],
  "exclude_index_permissions": []
}

My testuser mapped to this role is still able to read all existing actions and even delete them all. Which permissions I need to configure to prevent my test user from doing that?

Thanks

2

Ok while creating this post i saw this:

  "tenant_permissions": [
    {
      "allowed_actions": [
        "SGS_KIBANA_ALL_WRITE",
        "SGS_SIGNALS_ALL"
      ]

I have removed it and now my testuser is not able to see any action. Is there more granular way of controling the permissions here for example: show only those signals created by the user, or only signals for which index pattern the user has access to and similar configurations? Thanks

3

@Kosmonafft
There are more granular permissions available on the signals, such as:

SGS_SIGNALS_WATCH_ACKNOWLEDGE
SGS_SIGNALS_WATCH_READ
SGS_SIGNALS_WATCH_ACTIVATE
SGS_SIGNALS_WATCH_EXECUTE
SGS_SIGNALS_WATCH_MANAGE

Further details can be found here

these are based on access level, as opposed to visibility. Meaning the user will still be able to view all.

The workaround would be to use tenants to segregate different watchers on separate tenants that the user either has access to or not.

Also important to note, the signals run with the same security privilege as the last user that updated the job. therefore if signal was created by user A, the job will run with permissions assigned to user A, however if user B later amends the signal, the job will now run with user B’s permissions.

Hope this helps.

1 Like
4

Thank you. This is very valuable information

5

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.