Creating Custom Roles & Users

Custom roles let you tailor access precisely. Create them in Settings > Roles or in authorize.conf. Each role can inherit from multiple parent roles.

Key settings include: search filter (srchFilter) restricts what data a role can search, imported roles determine capability inheritance, and allowed indexes control which indexes the role has access to.

Users are created in Settings > Users or via CLI. Each user needs at least one role, a default app, and a timezone setting.

[role_security_analyst]
importRoles = user
srchFilter = index=security
srchIndexesAllowed = security;main
srchIndexesDefault = security