Funktionsrollback

deploy/clickhouse/init.sql.template

@@ -80,3 +80,14 @@ CREATE MATERIALIZED VIEW IF NOT EXISTS __CLICKHOUSE_DB__.events_5m_mv TO __CLICK
 SELECT tenant_id, toStartOfInterval(event_time, INTERVAL 5 MINUTE) AS bucket, host_name, event_code, category, action, outcome, uniqExactState(event_uid) AS cnt_state
 FROM __CLICKHOUSE_DB__.events
 GROUP BY tenant_id, bucket, host_name, event_code, category, action, outcome;
+
+-- Dedicated Grafana account. It receives SELECT only. readonly=2 lets the
+-- datasource client change query settings such as max_execution_time; ClickHouse itself
+-- remains bound to localhost by default and the role has no write privileges.
+CREATE ROLE IF NOT EXISTS siem_grafana_role;
+ALTER ROLE siem_grafana_role SETTINGS readonly = 2, max_execution_time = 30, max_threads = 4, max_memory_usage = 2000000000;
+GRANT SELECT ON __CLICKHOUSE_DB__.* TO siem_grafana_role;
+CREATE USER IF NOT EXISTS grafana_reader IDENTIFIED WITH sha256_password BY '__GRAFANA_CLICKHOUSE_PASSWORD__';
+ALTER USER grafana_reader IDENTIFIED WITH sha256_password BY '__GRAFANA_CLICKHOUSE_PASSWORD__';
+GRANT siem_grafana_role TO grafana_reader;
+ALTER USER grafana_reader DEFAULT ROLE siem_grafana_role;