Elasticsearch account permissions

The gateway reads log indices only and writes its own state to hidden indices under the .rst_copilot_* prefix. Create a dedicated account for it instead of using the elastic superuser.

Role privileges

Cluster privileges

Without monitor, /readyz returns not_ready with ping returned False for es, and every Platform health check shows as unknown.

Index privileges

baseline-* and eol-catalog have no .rst_copilot_ prefix, so the wildcard in the row above does not cover them. Without them the baseline page has no rules and runs return 403.

Kibana feature privileges

Without it the gateway cannot find a data view, and Open in Kibana reports "No Kibana data view matches index <index>", even when the data view exists in Kibana.

Create the account in Kibana

Steps

1. In Kibana, open Stack Management > Security > Roles and select Create role. Name it rst_copilot_gateway.
2. Under Cluster privileges, add monitor. With RST_ILM_BOOTSTRAP=true, also add manage_ilm and manage_index_templates.
3. Under Index privileges, add one row per index group from the table above.
4. If KIBANA_URL is set, select Add Kibana privilege under Kibana, choose the default space, and set Discover to Read in the feature list.
5. Under Users, select Create user with the username rst_copilot_gateway and assign the role.
6. Put the account in .env as ES_USER and ES_PASSWORD, or test the connection in Settings and save it there. To use an API key instead, see Use an API key.

Hidden indices such as .alerts-security.alerts-* are not autocompleted in the index dropdown. Type the pattern directly; you do not need the restricted-indices switch.

Create the account with the API

PUT _security/role/rst_copilot_gateway
{
  "cluster": ["monitor"],
  "indices": [
    { "names": ["logs-*", "filebeat-*", "winlogbeat-*"], "privileges": ["read", "view_index_metadata"] },
    { "names": [".rst_copilot_*", "baseline-*", "eol-catalog"], "privileges": ["create_index", "read", "write", "manage"] },
    { "names": [".alerts-security.alerts-*", ".internal.alerts-security.alerts-*", "logs-osquery_manager.result-*"], "privileges": ["read", "view_index_metadata"] }
  ]
}

PUT _security/user/rst_copilot_gateway
{ "password": "<strong password>", "roles": ["rst_copilot_gateway"] }

With RST_ILM_BOOTSTRAP=true, set cluster to ["monitor", "manage_ilm", "manage_index_templates"].

Kibana feature privileges can only be set through the Kibana role API. The request replaces the whole role, so include the cluster and index privileges above in the elasticsearch section, or they are removed:

curl -u elastic -X PUT "https://<Kibana address>/api/security/role/rst_copilot_gateway" \
  -H "kbn-xsrf: true" -H "Content-Type: application/json" -d '
{
  "elasticsearch": {
    "cluster": ["monitor"],
    "indices": [
      { "names": ["logs-*", "filebeat-*", "winlogbeat-*"], "privileges": ["read", "view_index_metadata"] },
      { "names": [".rst_copilot_*", "baseline-*", "eol-catalog"], "privileges": ["create_index", "read", "write", "manage"] },
      { "names": [".alerts-security.alerts-*", ".internal.alerts-security.alerts-*", "logs-osquery_manager.result-*"], "privileges": ["read", "view_index_metadata"] }
    ]
  },
  "kibana": [
    { "base": [], "feature": { "discover": ["read"] }, "spaces": ["default"] }
  ]
}'

Use an API key

The gateway can connect to Elasticsearch with an API key instead of a username and password. An API key has the privileges of the account it is issued for, so create the rst_copilot_gateway account and role as above first, then issue a key for that account.

Steps

1. As an administrator, issue a key for rst_copilot_gateway:

   POST _security/api_key/grant
   {
     "grant_type": "password",
     "username": "rst_copilot_gateway",
     "password": "<strong password>",
     "api_key": { "name": "rst-copilot-gateway" }
   }

   You can also sign in to Kibana as rst_copilot_gateway and create it under Stack Management > Security > API keys.

2. Put the encoded value from the response in .env as ES_API_KEY.

3. Restart the gateway.

ES_API_KEY takes precedence over ES_USER / ES_PASSWORD. When no KIBANA_* credentials are set, Kibana calls use the same key. ES_API_KEY can only be set in .env; there is no field for it in Settings.

Verify the privileges

curl -k https://<hostname>/readyz

es_write must be ok. denied means the account cannot create or write .rst_copilot_* indices, and the gateway log shows es_write_denied. not_ready with ping returned False for es means the account is missing the cluster privilege monitor, or the address, certificate or credentials are wrong.

If the connection test in Settings reports "Connected, but this account cannot list indices", the account is missing monitor or read on the target indices.

Index allowlist

Privileges decide what the gateway can read; the index allowlist (RST_INDEX_WHITELIST, or Index allowlist in Settings) decides what it actually queries. Set both: grant only the indices you need, then narrow further with the allowlist. The gateway refuses any model query outside the allowlist, and the refusal appears in the retrieval trace of an alert investigation.