Merge pull request #10078 from Security-Onion-Solutions/2.4/fix-elasticsearch-roles

FIX: SOC only displaying data for users assigned the superuser role #10068

salt/elasticsearch/roles/analyst.json

@@ -18,6 +18,7 @@
   "indices": [
     {
       "names": [
+        "logs-*",
         "so-*"
       ],
       "privileges": [
@@ -60,4 +61,4 @@
     }
   ],
   "run_as": []
-}
+}

salt/elasticsearch/roles/auditor.json

@@ -16,6 +16,7 @@
   "indices": [
     {
       "names": [
+        "logs-*",
         "so-*"
       ],
       "privileges": [
@@ -56,4 +57,4 @@
     }
   ],  
   "run_as": []
-}
+}

salt/elasticsearch/roles/limited-analyst.json

@@ -4,6 +4,7 @@
   "indices": [
     {
       "names": [
+        "logs-*",
         "so-*"
       ],
       "privileges": [
@@ -46,4 +47,4 @@
     }
   ],
   "run_as": []
-}
+}

salt/elasticsearch/roles/limited-auditor.json

@@ -4,6 +4,7 @@
   "indices": [
     {
       "names": [
+        "logs-*",
         "so-*"
       ],
       "privileges": [
@@ -44,4 +45,4 @@
     }
   ],  
   "run_as": []
-}
+}