# Permission to read SIEM signal index **URL:** \ **Category:** SIEM\ **Tags:** elastic-stack-security\ **Created:** [June 9, 2020, 9:57am UTC](https://discuss.elastic.co/t/permission-to-read-siem-signal-index/236308 "2020-06-09T09:57:30Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [June 9, 2020, 9:57am UTC](https://discuss.elastic.co/t/permission-to-read-siem-signal-index/236308/1 "2020-06-09T09:57:30Z")
Attempting to adjust our read-only role for SIEM viewers, but users fails to get permission to the signal index, wondering how to allow read/search access to this? When Users access the SIEM app thay get this error: ``` [security_exception] action [indices:data/read/search] is unauthorized for user [X] ``` Signal indicies are named .siem-signal-\-\* have tried to allow read, monitor, view-index-metadata for these indicies to role, but no luck. ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [June 10, 2020, 9:33am UTC](https://discuss.elastic.co/t/permission-to-read-siem-signal-index/236308/2 "2020-06-10T09:33:21Z")
Why do I get the above permission error when user got a custom role assgn which does what's required accoridng to [the doc](https://www.elastic.co/guide/en/siem/guide/7.7/detection-engine-overview.html#detections-permissions). Puzzles me... ![Screenshot 2020-06-10 at 11.31.42](https://us1.discourse-cdn.com/elastic/original/3X/4/9/49f38b3f16099c7f73b6d879d7b051ff9d909cd5.png) ![Screenshot 2020-06-10 at 11.31.59](https://us1.discourse-cdn.com/elastic/original/3X/7/e/7eb030296f8a08ca1c8312c81c056c984f96b708.png) ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [June 10, 2020, 10:01am UTC](https://discuss.elastic.co/t/permission-to-read-siem-signal-index/236308/3 "2020-06-10T10:01:33Z")
Or rather user fails to fetch the signal index name and where this be read of? ![Screenshot 2020-06-10 at 11.48.56](https://us1.discourse-cdn.com/elastic/original/3X/8/f/8f2bed7eda5881ecfa33e81f72f3ca62444f7243.png) ---
**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\ **Post date:** [June 10, 2020, 12:58pm UTC](https://discuss.elastic.co/t/permission-to-read-siem-signal-index/236308/4 "2020-06-10T12:58:10Z")
The siem signals data indexes are conventioned as: ```auto .siem-signal- ``` without any extra dash's or globs needed at the end. Is that possibly why? ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [June 10, 2020, 2:10pm UTC](https://discuss.elastic.co/t/permission-to-read-siem-signal-index/236308/5 "2020-06-10T14:10:37Z")
Possibly not as I'm having these indices for this space: ![Screenshot 2020-06-10 at 16.09.01](https://us1.discourse-cdn.com/elastic/original/3X/6/9/6984f8156614adc6219da12617e01c67f9ac36bf.png) Needless to say but as admin with full access I've got Detection Signals just fine in this Space. ---
**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\ **Post date:** [June 10, 2020, 2:18pm UTC](https://discuss.elastic.co/t/permission-to-read-siem-signal-index/236308/6 "2020-06-10T14:18:45Z")
Well it turns out it was as the alias is without dash's or globs 😉 ![Screenshot 2020-06-10 at 16.15.14](https://us1.discourse-cdn.com/elastic/original/3X/2/5/25764210e895e7682d50c408b3788f7fedb05274.png) Thank U for hinting me, adding both with read access to the role fixed access for users. ![Screenshot 2020-06-10 at 16.18.04](https://us1.discourse-cdn.com/elastic/original/3X/d/1/d1f1fcbf49e4bdeeadb19bcc5862a53099ec2cd7.png) ---
**Author:** ![Frank\_Hassanabad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frank_hassanabad/32/49255_2.png) [@Frank\_Hassanabad](https://discuss.elastic.co/u/Frank_Hassanabad)\ **Post date:** [June 10, 2020, 4:02pm UTC](https://discuss.elastic.co/t/permission-to-read-siem-signal-index/236308/7 "2020-06-10T16:02:55Z")
Awesome news! Yeah, it is using life cycle management for the index: [https://www.elastic.co/guide/en/elasticsearch/reference/current/index-lifecycle-management.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-lifecycle-management.html) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 8, 2020, 4:03pm UTC](https://discuss.elastic.co/t/permission-to-read-siem-signal-index/236308/8 "2020-07-08T16:03:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.