elasticsearch:
  endpoint: "http://localhost:9200"
  user: "elastic"
  password: "changeme"

roles:
  siem-read:
    cluster: []
    indices: []
    applications:
      - application: "kibana-.kibana"
        privileges: ["feature_siemV5.read"]
        resources: ["space:default"]
    run_as: []
    metadata: {}
    transient_metadata:
      enabled: true
    description: "siem-read"

  siem-all:
    cluster: []
    indices: []
    applications:
      - application: "kibana-.kibana"
        privileges: ["feature_siemV5.all"]
        resources: ["space:default"]
    run_as: []
    metadata: {}
    transient_metadata:
      enabled: true
    description: ""

  rules-read:
    cluster: []
    indices:
      - names:
          - ".alerts-security.alerts-default"
          - ".internal.alerts-security.alerts-default-*"
          - ".siem-signals-default"
          - ".lists-default"
          - ".items-default"
        privileges: ["maintenance", "write", "read", "view_index_metadata"]
        field_security:
          grant: ["*"]
          except: []
        allow_restricted_indices: false
    applications:
      - application: "kibana-.kibana"
        privileges:
          [
            "feature_indexPatterns.all",
            "feature_securitySolutionRulesV1.read",
            "feature_savedObjectsManagement.all",
            "feature_siemV5.read",
          ]
        resources: ["space:default"]
    run_as: []
    metadata: {}
    transient_metadata:
      enabled: true
    description: ""

  rules-all:
    cluster: []
    indices:
      - names:
          - ".alerts-security.alerts-default"
          - ".internal.alerts-security.alerts-default-*"
          - ".siem-signals-default"
          - ".lists-default"
          - ".items-default"
        privileges: ["manage", "read", "write", "view_index_metadata"]
        field_security:
          grant: ["*"]
          except: []
        allow_restricted_indices: false
      - names:
          - ".preview.alerts-security.alerts-default"
          - ".internal.preview.alerts-security.alerts-default-*"
        privileges: ["read"]
        field_security:
          grant: ["*"]
          except: []
        allow_restricted_indices: false
    applications:
      - application: "kibana-.kibana"
        privileges:
          [
            "feature_indexPatterns.all",
            "feature_siemV5.all",
            "feature_securitySolutionRulesV1.all",
            "feature_actions.all",
            "feature_savedObjectsManagement.all",
          ]
        resources: ["space:default"]
    run_as: []
    metadata: {}
    transient_metadata:
      enabled: true
    description: ""

  rules-all-migrations:
    cluster: []
    indices:
      - names:
          - ".alerts-security.alerts-default"
          - ".siem-signals-default"
          - ".lists-default"
          - ".items-default"
        privileges: ["manage", "read", "write", "view_index_metadata"]
        field_security:
          grant: ["*"]
          except: []
        allow_restricted_indices: false
      - names:
          - ".preview.alerts-security.alerts-default"
          - ".internal.preview.alerts-security.alerts-default-*"
        privileges: ["read"]
        field_security:
          grant: ["*"]
          except: []
        allow_restricted_indices: false
      - names:
          - "lookup_default*"
        privileges: ["read"]
        field_security:
          grant: ["*"]
          except: []
        allow_restricted_indices: false
    applications:
      - application: "kibana-.kibana"
        privileges:
          [
            "feature_indexPatterns.all",
            "feature_securitySolutionRulesV1.all",
            "feature_actions.all",
            "feature_savedObjectsManagement.all",
            "feature_securitySolutionSiemMigrations.all",
          ]
        resources: ["space:default"]
    run_as: []
    metadata: {}
    transient_metadata:
      enabled: true
    description: ""

  rules-read-migrations:
    cluster: []
    indices:
      - names:
          - ".alerts-security.alerts-default"
          - ".internal.alerts-security.alerts-default-*"
          - ".siem-signals-default"
          - ".lists-default"
          - ".items-default"
        privileges: ["maintenance", "write", "read", "view_index_metadata"]
        field_security:
          grant: ["*"]
          except: []
        allow_restricted_indices: false
      - names:
          - "lookup_default*"
        privileges: ["read"]
        field_security:
          grant: ["*"]
          except: []
        allow_restricted_indices: false
    applications:
      - application: "kibana-.kibana"
        privileges:
          [
            "feature_indexPatterns.all",
            "feature_securitySolutionRulesV1.read",
            "feature_savedObjectsManagement.all",
            "feature_securitySolutionSiemMigrations.all",
          ]
        resources: ["space:default"]
    run_as: []
    metadata: {}
    transient_metadata:
      enabled: true
    description: ""

  rules-all-attack:
    cluster: []
    indices:
      - names:
          - ".alerts-security.alerts-default"
          - ".internal.alerts-security.alerts-default-*"
          - ".siem-signals-default"
          - ".lists-default"
          - ".items-default"
        privileges: ["manage", "read", "write", "view_index_metadata"]
        field_security:
          grant: ["*"]
          except: []
        allow_restricted_indices: false
      - names:
          - ".preview.alerts-security.alerts-default"
          - ".internal.preview.alerts-security.alerts-default-*"
        privileges: ["read"]
        field_security:
          grant: ["*"]
          except: []
        allow_restricted_indices: false
      - names:
          - ".alerts-security.attack.discovery.alerts-default"
          - ".internal.alerts-security.attack.discovery.alerts-default"
          - ".adhoc.alerts-security.attack.discovery.alerts-default"
          - ".internal.adhoc.alerts-security.attack.discovery.alerts-default"
        privileges: ["read", "view_index_metadata"]
        field_security:
          grant: ["*"]
          except: []
        allow_restricted_indices: false
    applications:
      - application: "kibana-.kibana"
        privileges:
          [
            "feature_indexPatterns.all",
            "feature_securitySolutionRulesV1.all",
            "feature_actions.all",
            "feature_savedObjectsManagement.all",
            "feature_securitySolutionAttackDiscovery.all",
          ]
        resources: ["space:default"]
    run_as: []
    metadata: {}
    transient_metadata:
      enabled: true
    description: ""

  rules-read-attack:
    cluster: []
    indices:
      - names:
          - ".alerts-security.alerts-default"
          - ".internal.alerts-security.alerts-default-*"
          - ".siem-signals-default"
          - ".lists-default"
          - ".items-default"
        privileges: ["maintenance", "write", "read", "view_index_metadata"]
        field_security:
          grant: ["*"]
          except: []
        allow_restricted_indices: false
      - names:
          - ".alerts-security.attack.discovery.alerts-default"
          - ".internal.alerts-security.attack.discovery.alerts-default"
          - ".adhoc.alerts-security.attack.discovery.alerts-default"
          - ".internal.adhoc.alerts-security.attack.discovery.alerts-default"
        privileges: ["read", "view_index_metadata"]
        field_security:
          grant: ["*"]
          except: []
        allow_restricted_indices: false
    applications:
      - application: "kibana-.kibana"
        privileges:
          [
            "feature_indexPatterns.all",
            "feature_securitySolutionRulesV1.read",
            "feature_savedObjectsManagement.all",
            "feature_securitySolutionAttackDiscovery.all",
          ]
        resources: ["space:default"]
    run_as: []
    metadata: {}
    transient_metadata:
      enabled: true
    description: ""

  rules-all-timeline:
    cluster: []
    indices:
      - names:
          - ".alerts-security.alerts-default"
          - ".internal.alerts-security.alerts-default-*"
          - ".siem-signals-default"
          - ".lists-default"
          - ".items-default"
        privileges: ["manage", "read", "write", "view_index_metadata"]
        field_security:
          grant: ["*"]
          except: []
        allow_restricted_indices: false
      - names:
          - ".preview.alerts-security.alerts-default"
          - ".internal.preview.alerts-security.alerts-default-*"
        privileges: ["read"]
        field_security:
          grant: ["*"]
          except: []
        allow_restricted_indices: false
    applications:
      - application: "kibana-.kibana"
        privileges:
          [
            "feature_indexPatterns.all",
            "feature_securitySolutionRulesV1.all",
            "feature_actions.all",
            "feature_savedObjectsManagement.all",
            "feature_securitySolutionTimeline.all",
          ]
        resources: ["space:default"]
    run_as: []
    metadata: {}
    transient_metadata:
      enabled: true
    description: ""

  rules-read-timeline:
    cluster: []
    indices:
      - names:
          - ".alerts-security.alerts-default"
          - ".internal.alerts-security.alerts-default-*"
          - ".siem-signals-default"
          - ".lists-default"
          - ".items-default"
        privileges: ["maintenance", "write", "read", "view_index_metadata"]
        field_security:
          grant: ["*"]
          except: []
        allow_restricted_indices: false
    applications:
      - application: "kibana-.kibana"
        privileges:
          [
            "feature_indexPatterns.all",
            "feature_securitySolutionRulesV1.read",
            "feature_savedObjectsManagement.all",
            "feature_securitySolutionTimeline.all",
          ]
        resources: ["space:default"]
    run_as: []
    metadata: {}
    transient_metadata:
      enabled: true
    description: ""
