# Role to provide access to SIEM?

**URL:** <https://discuss.elastic.co/t/role-to-provide-access-to-siem/188629>\
**Category:** SIEM\
**Created:** [July 3, 2019, 7:15am UTC](https://discuss.elastic.co/t/role-to-provide-access-to-siem/188629 "2019-07-03T07:15:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kmohd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmohd/32/49090_2.png) [@kmohd](https://discuss.elastic.co/u/kmohd)\
**Post date:** [July 3, 2019, 7:15am UTC](https://discuss.elastic.co/t/role-to-provide-access-to-siem/188629/1 "2019-07-03T07:15:55Z")

</div>

Is there any role to provide read only access to SIEM? Its working for superusers however i cannot find a specific role just for that.

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [July 3, 2019, 10:24am UTC](https://discuss.elastic.co/t/role-to-provide-access-to-siem/188629/2 "2019-07-03T10:24:06Z")

</div>

To make sure I understand, you want to give some Kibana users only Read only access to the SIEM data?

The data itself lives in Beats indexes (`filebeat-*`, `auditbeat-*`, `packetbeat-*`, `winlogbeat-*` and you can add more index patterns from the Kibana advanced settings). We don't have a role that gives only read-only access to these indices, but you should be able to create one.

---

<div class="post-metadata">

**Author:** ![kmohd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kmohd/32/49090_2.png) [@kmohd](https://discuss.elastic.co/u/kmohd)\
**Post date:** [July 4, 2019, 4:11am UTC](https://discuss.elastic.co/t/role-to-provide-access-to-siem/188629/3 "2019-07-04T04:11:49Z")

</div>

Thank you, i got the idea 🙂 .. works now

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 1, 2019, 4:11am UTC](https://discuss.elastic.co/t/role-to-provide-access-to-siem/188629/4 "2019-08-01T04:11:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.