Read-Only User Has Create and Edit Permissions for Wazuh Rules

[Jack Martin]

Dear Wazuh Support Team,

We have created a user with read-only permissions in our Wazuh environment. However, we noticed that this user is still able to edit and create rules, which should not be possible for a read-only account.

Could you please clarify why the user is being granted Create and Edit permissions despite being configured as read-only?

We would appreciate your guidance on how to properly restrict this user's access so that they can only view the required information and cannot create, modify, or delete rules.

Please let us know if any additional role, permission, or configuration needs to be changed to enforce the intended read-only access.

Regards,

Jack 

[Olamilekan Abdullateef Ajani]

Hello Jack,

Yes, a read-only user can be restricted from modifying rules. The one thing to note is that Wazuh uses two separate permission layers.

The role under Indexer management > Security controls access to indices, dashboards, and tenants. Rule management, however, is controlled by the Wazuh server RBAC under Server management > Security.

The built-in Wazuh readonly role only has read permissions for rules. Creating or editing a rule file requires rules:update, while deleting one requires rules:delete.

Please check:

Under Server management > Security > Roles mapping, confirm that the affected user is mapped to the readonly role and is not also matched by another mapping that grants administrator permissions. The read-only setup requires this server-side role mapping in addition to the Indexer read-only role.

Check /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml and confirm that the API connection has: run_as: true

If you are using a custom server role rather than the built-in readonly role, check that it does not contain a policy granting rules:update or rules:delete.

You can also check the API RBAC mode with: GET /security/config
The default is white, where only explicitly allowed permissions are granted.

One thing I would also like to confirm: when you say the user can create or edit rules, are they able to save the change successfully, or do they only see the Create/Edit options in the dashboard?

If the change can actually be saved, please share the Wazuh version, the run_as section of wazuh.yml with the credentials removed, and the role mapping assigned to the affected user. That should help identify where the additional permission is coming from.

Also note that Wazuh RBAC controls rule changes made through the dashboard/API. If the same user has SSH or operating-system access that allows them to directly modify files under /var/ossec/etc/rules/, that access would need to be restricted separately at the operating-system level.

Please see attached image for reference.

Ref: https://documentation.wazuh.com/current/user-manual/user-administration/rbac.html

Regards,