Differences between the Wazuh users between Indexer and Manager

[Max]

Hi all!

The title basically asks my questions as to what exactly are the main differences?

Aside from Wazuh Server Users make use of the Wazuh Server API

While Wazuh Indexer Users are the ones taking care of how they can see the data

If anything comprehensive can be given that would be great.

Thank you and best regards,
Max

[Stuti Gupta]

Hi Max,

The main difference is that they relate to different Wazuh components and are used for different purposes.

• Wazuh Manager users are related to the Wazuh Server API. They are responsible for performing management operations such as managing agents, retrieving agent information, checking manager status, and accessing other API endpoints. Wazuh API RBAC system is controlled by their permissions. https://documentation.wazuh.com/current/user-manual/manager/index.html

• The Wazuh Indexer: users are used to relate to the Wazuh Indexer. They control access to the data stored in the indexer, such as alerts, archives, vulnerabilities, and other indexed information. https://documentation.wazuh.com/current/user-manual/indexer-api/index.html

The Wazuh Dashboard communicates with both services, so it requires credentials for both:

• Manager credentials to interact with the Wazuh API.

• Indexer credentials to query and display the indexed data.

Let me know if you have any other related queries.