Restricting rights to detection rules

Elastic Security
1

Hello,

we would like to give our analysts the option to create detection rules, but they should not be able to activate them. The engineer should only be able to activate them after an engineer has looked at them.

However, we have not found a way to restrict a user's rights to detection rules. If you do this via the index permissions, the user is also extremely restricted when it comes to case and alarm processing.

Have we overlooked something here or is it really not possible? If it doesn't work, we would really like this feature. :slight_smile:

Best regards
Marco

2

Hey @marcou

At the moment it's not possible to restrict rights to rule in a way it can be created by one user and enabled by another.

Configured Security Feature Detections prerequisites and requirements | Elastic Security Solution [8.15] | Elastic gives permission to edit or read rules through API/UI and do not have capabilities to limit enable rule functionality.

Please create feature request in Kibana issues Issues · elastic/kibana · GitHub and I will tag appropriate teams to look into it

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.