Skip to main content

How to Grant Permissions for Attack Detective in OpenSearch

S
Written by Sergey Bayrachny

To use SOC Prime's Attack Detective for querying your log data in OpenSearch, you need to grant Attack Detective certain permissions in your OpenSearch instance. To do this, first configure an internal user for Attack Detective, then create a role with required permissions, and finally map the configured user to the created role:

  1. Go to the Home page of your OpenSearch instance.

  2. Open the three bars menu in the upper left corner and select Security.

  3. Create an internal user.

    1. Go to Internal users in the Security menu.

    2. Click the Create internal user button.

    3. Under the Credentials section, set an arbitrary username (for example, user_attack_detective) and a password. Do not fill in other sections. Click Create.

  4. Create a role for the configured internal user.

    1. Go to Roles in the Security menu.

    2. Click the Create role button.

    3. Give your role an arbitrary name, for example role_attack_detective.

    4. Provide the following cluster permissions:

      • cluster_composite_ops_ro

      • cluster_monitor

    5. Select the indexes that will be available to Attack Detective. Use * to select all indexes.

      Alternatively, you can select specific indexes. In this case, also specify .kibana*.

    6. Set the following index permissions:

      • read

      • indices:data/read/get

      • indices:data/read/search*

      • manage

    7. Set the following tenant and its permission:

      • global_tenant with the Read only access

      Click Create.

  5. The details of the created role will open. Map the created role to the previously configured internal user.

    1. Open the Mapped users tab.

    2. Click the Map users button.

    3. Under the Users section, set the internal user created in step 3 for Attack Detective.

      Click the Map button.

    4. A role with set permissions and the mapped user will appear like in the example below.

Did this answer your question?