User create

[Soc Support]

Hi,

I want to create a custom dashboard access for a specific user in Wazuh. I followed the documentation, but I need a step-by-step guide to configure it correctly.
https://documentation.wazuh.com/current/user-manual/user-administration/rbac.html

[Stuti Gupta]

Hi,

Without tenants, you cannot restrict a user to a single dashboard. Dashboards are stored in the shared .kibana index, and access is controlled through OpenSearch security roles, not on a per-dashboard basis  

For restricting a user to one custom dashboard:

1. Enable multi-tenancy (if not already on). SSH into the Wazuh dashboard node and edit /etc/wazuh-dashboard/opensearch_dashboards.yml:

opensearch_security.multitenancy.enabled: true
opensearch_security.multitenancy.tenants.preferred: ["Global", "Private"]

Then systemctl restart wazuh-dashboard. 

https://documentation.wazuh.com/current/user-manual/wazuh-dashboard/multi-tenancy.html

2. Create a custom tenant just for this user
 In the dashboard, go to Indexer Management > Security > Tenants > Create tenant, give it a name (e.g. dashboard_tenant), and save.

3. Move (or rebuild) the dashboard into that tenant. Since your custom dashboard is currently in any tenant you built it in (likely Global), you need it to exist inside the new tenant instead:

4. Create a role scoping data + tenant access Go to   Indexer Management > Security  > Roles > Create role:

• Cluster permissions: cluster_composite_ops_ro.
• Index permissions: wazuh-alerts-* with read or write or any other action
• Tenant permissions: add dashboard_tenant with read (or read/write if they should be able to edit it). Leave the global_tenant out if you don't want them seeing the default dashboards.

5. Map the user to that role. Still on the role, open the Mapped users tab > Manage mapping > add the internal user (create them first under Security > Internal users if they don't exist) > Map.

Reference: Wazuh RBAC - How to create and map internal users