TechVault: indexer internal-users comment presents declared Wazuh accounts as backend operator credentials

[Brad-Edwards]

Finding

packs/techvault/sdl/techvault.sdl.yaml, content.wazuh-indexer-internal-users (lines 2393–2399 on main):

The admin bcrypt hash below is for the password the backend hydrates into INDEXER_PASSWORD; without this file the indexer falls back to its bundled demo users and rejects the operator credentials, so the authenticated readiness gate and every SIEM consumer (manager filebeat, dashboard) fail auth.

The file is authored scenario content. Its fixed admin hash fixes the password, so the account and its password belong to the scenario. The comment instead describes the value as something a backend hydrates into its own variable (INDEXER_PASSWORD), calls it an operator credential, and names a backend's readiness gate. That is backend implementation detail in a portable pack, and it invites a backend to treat an in-game account as its own operational identity (APTL did; see Brad-Edwards/aptl#957).

Underlying gap

The comment cannot be made accurate without deciding what the credential is. The pack declares only the hashes for admin and kibanaserver. The plaintext that the in-world consumers (manager Filebeat, dashboard) authenticate with is not declared anywhere, so a backend has to know it out of band. Compare:

• misp-administrator: declared operator_secret, "credential bytes are not pack content".
• content.wazuh-dashboard-app-config: declares the manager API credential wazuh-wui / WazuhPass123! in plaintext as scenario content.

Done when

• Decide whether the indexer admin and kibanaserver credentials are authored fixture content or operator-supplied.
• If fixture: declare them so the value the consumers use is pack content, as the dashboard's manager API credential already is.
• If operator-supplied: stop fixing their hashes in pack content, and declare them the way misp-administrator is declared.
• The comment states only scenario facts: no backend variable names, no backend readiness gates, and no "operator" wording for in-game accounts.

Related: #288, Brad-Edwards/aptl#957.