Skip to content

feat(opensearch): add SIEM audit users and fix service naming conflict #1324

Merged
joluc merged 5 commits intomainfrom
feat/add-audit-users-opensearch
Dec 5, 2025
Merged

feat(opensearch): add SIEM audit users and fix service naming conflict #1324
joluc merged 5 commits intomainfrom
feat/add-audit-users-opensearch

Conversation

@joluc
Copy link
Contributor

@joluc joluc commented Dec 5, 2025

Pull Request Details

  • Renamed dashboard services to -dashboards-ui suffix to avoid conflicts with operator-created services
    • opensearch-logs-dashboards-ui
    • opensearch-siem-dashboards-ui
  • Added siemaudit and siemaudit2 users for SIEM audit logs
  • Created siem-audit-write-role with write permissions for siem-audit* indices
  • Updated siem-write-role to only access siem-logs* indices (changed from siem*)
  • Separated SIEM into two data streams:
    • siem-logs* for regular SIEM logs
    • siem-audit* for audit logs
  • Created separate index templates and ISM policies for each stream
  • Updated SIEM retention to 7 days (matching logs cluster)
  • Added test credentials for audit users in ci/test-values.yaml

@joluc joluc requested a review from a team as a code owner December 5, 2025 10:17
@joluc joluc merged commit e866930 into main Dec 5, 2025
9 checks passed
@joluc joluc deleted the feat/add-audit-users-opensearch branch December 5, 2025 10:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants