Commit graph

77610 commits

Author SHA1 Message Date
Umberto Pepato
bc4c6d7eac
[ResponseOps][Alerts] Add missing featureIds to AlertsClient find (#190486)
## Summary

Forwards `featureIds` from `AlertsClient.find()` to
`AlertsClient.searchAlerts()`

### References

Fixes #190424

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2024-08-20 03:16:04 -05:00
Julia Rechkunova
e66098a0a4
[Discover] Unskip search alert tests (#190519)
- Closes https://github.com/elastic/kibana/issues/190090
2024-08-20 08:56:08 +02:00
Kibana Machine
854f7279da
[api-docs] 2024-08-20 Daily api_docs build (#190758)
Generated by
https://buildkite.com/elastic/kibana-api-docs-daily/builds/805
2024-08-20 05:02:46 +00:00
Kevin Delemme
201c9d3268
chore(rca): notes management without investigation store (#190623) 2024-08-19 18:34:28 -05:00
Søren Louv-Jansen
e9f23aa98e
[Obs AI Assistant] Add KB user instructions (#187607)
Related to: https://github.com/elastic/obs-ai-assistant-team/issues/157

This adds a top-level property `type: 'user_instruction' | 'contextual'`
to the knowledge base.

The description given to the LLM:

> The type can be: "user_instruction" or "contextual". A
"user_instruction" entry will be included in the system message if it
fits within the token budget and it will be marked as a user
instruction. A "contextual" entry will be included as part of the
context function response (and not the system message) if it
semantically matches the user's prompt.


# Screenshots

**"Edit system prompt" button**

![image](36cd8571-2c21-4b69-8c17-98a0d53e9452)


**"Edit system prompt" flyout**

![image](ed802390-71d8-448d-964c-04afdbecc0ae)




cc781d46-3966-4530-8036-dd44506ec771
2024-08-19 18:30:03 -05:00
elastic-renovate-prod[bot]
3ff9f920cc
Update docker.elastic.co/wolfi/chainguard-base:latest Docker digest to c16d3ad (main) (#190745)
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| docker.elastic.co/wolfi/chainguard-base | digest | `e11c691` ->
`c16d3ad` |

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://togithub.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40MjUuMSIsInVwZGF0ZWRJblZlciI6IjM3LjQyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJUZWFtOk9wZXJhdGlvbnMiLCJyZWxlYXNlX25vdGU6c2tpcCJdfQ==-->

Co-authored-by: elastic-renovate-prod[bot] <174716857+elastic-renovate-prod[bot]@users.noreply.github.com>
2024-08-19 18:02:49 -05:00
Lukas Olson
22dc10c7d0
[UnifiedDataTable] Add density configuration (#188495)
## Summary

Resolves https://github.com/elastic/kibana/issues/186007.

Adds a density configuration for the `UnifiedDataTable`. By default,
this configuration will not be shown unless an
`onUpdateDataGridDensity`handler is passed to the `UnifiedDataTable`. It
defaults to `compact`. It persists to `localStorage` when updated.


https://github.com/user-attachments/assets/8523301c-7cf5-4854-bbbc-b6767d996c32

### Checklist

Delete any items that are not applicable to this PR.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Bhavya RM <bhavya@elastic.co>
2024-08-19 15:54:13 -07:00
Stratoula Kalafateli
a0474aec39
[ES|QL] Adds a help menu popover (#190579)
## Summary

Closes https://github.com/elastic/kibana/issues/190539

Adds a help menu button for the ES|QL mode

<img width="1548" alt="image"
src="https://github.com/user-attachments/assets/f8dde898-a1bf-4441-ae21-053e8290a5a6">


### Checklist

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)

---------

Co-authored-by: Marta Bondyra <4283304+mbondyra@users.noreply.github.com>
Co-authored-by: Drew Tate <andrew.tate@elastic.co>
2024-08-19 16:33:57 -05:00
Tomasz Ciecierski
9524bbcdc7
[EDR Workflows] Fix small CrowdStrike connector issues (#190689) 2024-08-19 16:20:36 -05:00
Bhavya RM
5be73216a3
Update axe-core config to 4.10.0 (#190557)
Updating axe-core config to latest 4.10.0
2024-08-19 16:44:14 -04:00
Jon
7f4b5389f0
[renovate] Label chainguard updates (#190719) 2024-08-19 12:55:46 -07:00
elastic-renovate-prod[bot]
2d6e0c53e3
Update dependency eslint-plugin-depend to ^0.10.0 (main) (#190669)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[eslint-plugin-depend](https://togithub.com/es-tooling/eslint-plugin-depend)
| devDependencies | minor | [`^0.9.0` ->
`^0.10.0`](https://renovatebot.com/diffs/npm/eslint-plugin-depend/0.9.0/0.10.0)
|

---

### Release Notes

<details>
<summary>es-tooling/eslint-plugin-depend
(eslint-plugin-depend)</summary>

###
[`v0.10.0`](https://togithub.com/es-tooling/eslint-plugin-depend/releases/tag/0.10.0)

[Compare
Source](https://togithub.com/es-tooling/eslint-plugin-depend/compare/0.9.0...0.10.0)

#### What's Changed

- chore: upgrade module-replacements by
[@&#8203;43081j](https://togithub.com/43081j) in
[https://github.com/es-tooling/eslint-plugin-depend/pull/30](https://togithub.com/es-tooling/eslint-plugin-depend/pull/30)
- feat: add eslint 9 support by
[@&#8203;43081j](https://togithub.com/43081j) in
[https://github.com/es-tooling/eslint-plugin-depend/pull/31](https://togithub.com/es-tooling/eslint-plugin-depend/pull/31)
- chore: upgrade dev dependencies by
[@&#8203;43081j](https://togithub.com/43081j) in
[https://github.com/es-tooling/eslint-plugin-depend/pull/32](https://togithub.com/es-tooling/eslint-plugin-depend/pull/32)

**Full Changelog**:
https://github.com/es-tooling/eslint-plugin-depend/compare/0.9.0...0.10.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://togithub.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40MjUuMSIsInVwZGF0ZWRJblZlciI6IjM3LjQyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJUZWFtOk9wZXJhdGlvbnMiLCJyZWxlYXNlX25vdGU6c2tpcCJdfQ==-->

Co-authored-by: elastic-renovate-prod[bot] <174716857+elastic-renovate-prod[bot]@users.noreply.github.com>
2024-08-19 14:44:03 -05:00
Gabriel Landau
6eaa6e4ecc
Defend Hardware Callstacks => Production (#190553)
## Summary

Defend Hardware Callstacks are going GA in 8.16.0. This PR will let
users opt out via Advanced Policy.

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
2024-08-19 21:34:50 +02:00
Alexi Doak
cbaa3a8aa0
[ResponseOps] Lazy load dataViews and wrappedSearchSourceClient services when running alerting rules (#189929)
Resolves https://github.com/elastic/kibana/issues/184322

## Summary

This PR updates `getExecutorServices` to allow alerting rules to only
load the dataViews and wrappedSearchSourceClient services when needed. I
updated the rule types dependent on dataViews and/or
wrappedSearchSourceClient.


### Checklist

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### To verify

- Verify that the dataviews and searchsource are only loaded when
needed. I think the best way to verify this is create an Index threshold
rule and make sure that the `dataViews` and `searchSourceClient`
services are not created.
- Verify that the updated rules work correctly. I updated the following
rule types:
Custom threshold
SLO burn rate
ES query
Indicator match
2024-08-19 14:04:10 -05:00
Jon
1d5a0e1a44
[workflows] Remove fix-version-gaps (#190721)
This workflow was intended to automatically update labels if a pull
requests version targets were out of date at the time of merge (i.e. a a
pull request labeled with 8.14 as a target branch, is now out of date
after the global version is bumped to 8.16, will add the 8.15 label)

We don't add target versions anymore pre-merge except in rare cases like
documentation updates. This last time this workflow was run was 2.5
years ago.
2024-08-19 13:31:39 -05:00
Kibana Machine
62f9698524
[ES|QL] Update function metadata (#190667)
This PR updates the function definitions and inline docs based on the
latest metadata from Elasticsearch.

---------

Co-authored-by: Drew Tate <andrew.tate@elastic.co>
2024-08-19 13:24:25 -05:00
Tom Myers
e9c913dcb0
Add OpenAPI specs for EEM APIs (#190203) 2024-08-19 20:05:25 +02:00
elastic-renovate-prod[bot]
846ebb290f
Update docker.elastic.co/wolfi/chainguard-base:latest Docker digest to e11c691 (main) (#190665)
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| docker.elastic.co/wolfi/chainguard-base | digest | `dcbcd19` ->
`e11c691` |

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://togithub.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40MjUuMSIsInVwZGF0ZWRJblZlciI6IjM3LjQyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: elastic-renovate-prod[bot] <174716857+elastic-renovate-prod[bot]@users.noreply.github.com>
Co-authored-by: Jon <jon@elastic.co>
2024-08-19 13:01:34 -05:00
Drew Tate
452fd88e05
[ES|QL] Support replacement range (#190465)
## Summary

Fix https://github.com/elastic/kibana/issues/187184

### Field names
**Before**


https://github.com/user-attachments/assets/5fd829df-3764-482c-b006-6700ac9808d1


**After**


https://github.com/user-attachments/assets/59b43d55-4f5a-4c7f-987a-0a8f21c80313



### Functions with spaces
**Before**


https://github.com/user-attachments/assets/003a5c35-5741-4214-9608-e4a49f6d8602



**After**


https://github.com/user-attachments/assets/f043ad10-5e83-43ea-ab79-4ed2fc2e0500



### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-08-19 12:45:54 -05:00
Jordan
d0c1349122
[Cloud Security] Removing license gate keeping and displaying the table when there are findings (#190285) 2024-08-19 12:13:34 -05:00
Tomasz Ciecierski
4e31c9b976
[EDR Workflows] Add Telemetry to JAMF Analyzer schema (#190704) 2024-08-19 11:48:29 -05:00
Tiago Costa
754595b123
skip flaky suite (#189794) 2024-08-19 17:14:20 +01:00
Tiago Costa
6920cc13de
skip flaky suite (#189793) 2024-08-19 17:13:45 +01:00
Tiago Costa
a9e8d4a37a
skip flaky suite (#189792) 2024-08-19 17:13:20 +01:00
Tiago Costa
f64392f32f
skip flaky suite (#189791) 2024-08-19 17:12:09 +01:00
Kevin Lacabane
b82c49f825
[kbn-data-forge] fix mongodb duplicate component name (#190660)
Noticed this error during data forge resources cleanup caused by
duplicated name

```
info Deleteing components for logs-mongodb@template (mongodb_8.0.0_base,mongodb_8.0.0_log,mongodb_8.0.0_host,mongodb_8.0.0_host)
ERROR Failed to delete {"options":{"redaction":{"type":"replace","additionalKeys":[]}},"name":"ResponseError","meta":{"body":{"error":{"root_cause":[{"type":"resource_not_found_exception","reason":"mongodb_8.0.0_host"}],"type":"resource_not_found_exception","reason":"mongodb_8.0.0_host"},
```
2024-08-19 18:01:22 +02:00
Philippe Oberti
6d1426acd8
[Security Solution][Entity details] - move code to get url link to flyout folder (#190111) 2024-08-19 10:59:43 -05:00
Kyle Pollich
439c7fa84c
[Fleet] Replace all references to unsafe YML load/dump methods in Fleet codebase (#190659)
## Summary

Replaces any unsafe YML operations with their safe alternatives.

`load` -> `safeLoad`
`dump` -> `safeDump`
2024-08-19 10:35:25 -05:00
Ryan Keairns
4eeb35d21b
Slim down popover panels (#190472)
## Summary

These couple of popover panels contain more padding than desired or
intended by the design system.

**Before**
_Discover alerts popover_
<img
src="https://github.com/user-attachments/assets/495d7641-eab4-4b95-845b-90d2a121ad43"
width="470" />

_Nav deployments popover_
<img
src="https://github.com/user-attachments/assets/3bc05146-d03b-4b72-be39-edf4dd2ffa24"
width="340" />

**After**
_Discover alerts popover_
<img
src="https://github.com/user-attachments/assets/5fd1b025-d74e-4318-b6de-ce5c7988ee14"
width="420" />

_Nav deployments popover_
<img
src="https://github.com/user-attachments/assets/a3ce65c5-bc12-41bb-97de-4d7d6997591f"
width="390" />

### Checklist

Delete any items that are not applicable to this PR.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)


### Risk Matrix

Delete this section if it is not applicable to this PR.

Before closing this PR, invite QA, stakeholders, and other developers to
identify risks that should be tested prior to the change/feature
release.

When forming the risk matrix, consider some of the following examples
and how they may potentially impact the change:

| Risk | Probability | Severity | Mitigation/Notes |

|---------------------------|-------------|----------|-------------------------|
| Multiple Spaces&mdash;unexpected behavior in non-default Kibana Space.
| Low | High | Integration tests will verify that all features are still
supported in non-default Kibana Space and when user switches between
spaces. |
| Multiple nodes&mdash;Elasticsearch polling might have race conditions
when multiple Kibana nodes are polling for the same tasks. | High | Low
| Tasks are idempotent, so executing them multiple times will not result
in logical error, but will degrade performance. To test for this case we
add plenty of unit tests around this logic and document manual testing
procedure. |
| Code should gracefully handle cases when feature X or plugin Y are
disabled. | Medium | High | Unit tests will verify that any feature flag
or plugin combination still results in our service operational. |
| [See more potential risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) |


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
2024-08-19 10:28:29 -05:00
Philippe Oberti
04503bffe9
[Security Solution][Entity details] - move osquery, response and investigation guide related hooks and components to flyout folder (#190110) 2024-08-19 10:01:07 -05:00
Philippe Oberti
35c0671414
[Security Solution][Entity details] - move prevalence related hooks to flyout folder (#190109) 2024-08-19 10:00:45 -05:00
seanrathier
c2933dee94
[Cloud Security] [Agentless] [Serverless] Enable Serverless projects to transition to using Agentless API solution in Kibana (#190371) 2024-08-19 09:22:45 -05:00
Jill Guyonnet
1e64b9e4b2
[Fleet] RBAC - Make upgrade agent APIs space aware (#190069)
## Summary

Relates to https://github.com/elastic/kibana/issues/185040

This PR makes the following Fleet agents API space aware (behind
`useSpaceAwareness` feature flag):
* `POST /agents/{agentId}/reassign`
* `POST /agents/{agentId}/upgrade`
* `POST /agents/bulk_reassign`
* `POST /agents/bulk_upgrade`
* `POST /agents/{agentId}/actions/{actionId}/cancel`

While working on that last endpoint, I noticed and fixed an error in the
documentation.

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed

---------

Co-authored-by: Nicolas Chaulet <nicolas.chaulet@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-08-19 16:22:28 +02:00
Julia Rechkunova
cf58ef9e51
[OneDiscover][UnifiedDocViewer] Add dedicated column for Pinning/Unpinning rows (#190344)
- Closes https://github.com/elastic/kibana/issues/188413

## Summary

This PR adds a dedicated column for pinning/unpinning fields inside
DocViewer.

![Aug-13-2024
15-06-25](https://github.com/user-attachments/assets/93496cdd-e730-4ee6-8597-c78d7bffe07f)



### Checklist

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [x] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)
2024-08-19 09:06:54 -05:00
Gergő Ábrahám
e7aabcdfae
[EDR Workflows] Improve event filters related cy tests (#190610)
## Summary

reducing potential flakyness in cypress tests handling event filters, by
applying same change as #189961: enter text instead of selecting from
dropdown

> [!note]
> revert da247c571d before merge - done  

flaky runner:
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/6782
2024-08-19 09:05:13 -05:00
Cristina Amico
15657536ed
[Fleet] Create task that periodically unenrolls inactive agents (#189861)
Closes https://github.com/elastic/kibana/issues/179399

## Summary

Create a new periodic task that unenrolls inactive agents based on
`unenroll_timeout` set on agent policies

In the agent policy settings there is now a new section:

![Screenshot 2024-08-06 at 12 31
37](https://github.com/user-attachments/assets/f66164c5-3eff-442d-91bc-367387cefe3d)



### Testing
- Create a policy with `unenroll_timeout` set to any value
- Enroll many agents to a policy and make them inactive - you can use
Horde or the script in `fleet/scripts/create_agents' that can directly
create inactive agents
- Leave the local env running for at least 10 minutes
- You should see logs that indicate that the task ran successfully and
remove the inactive agents
![Screenshot 2024-08-06 at 12 14
13](https://github.com/user-attachments/assets/573f32fb-eedb-4bee-918c-f26fedec9e0b)
Note that the executed unenroll action is also visible in the UI:
![Screenshot 2024-08-06 at 12 19
52](https://github.com/user-attachments/assets/942932ac-70dd-4d77-bf47-20007ac54748)
- If there are no agent policies with `unenroll_timeout` set or there
are no inactive agents on those policies, you should see logs like
these:
![Screenshot 2024-08-06 at 12 13
49](https://github.com/user-attachments/assets/8868c228-fd09-4ecf-ad02-e07a94812638)





### Checklist

- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-08-19 08:09:47 -05:00
Umberto Pepato
0299a7a3bc
[ResponseOps][Alerts] Add null-value bucket detection to alerts group aggregations endpoint (#190305)
## Summary

- Adds null-value bucket detection to server-side alerts aggregations
and marks those groups with a `--` key and `isNullGroup = true`.
- Improves alerts grouping types with default aggregations.
- Improves documentation

## To verify

1. Temporarily merge
[#189958](https://github.com/elastic/kibana/pull/189958) into this
branch
2. Create a rule that fires alerts in Observability > Alerts (i.e.
Custom Threshold, ES Query, ...)
3. Once you start to see some alerts in the Alerts page, toggle the
grouped alerts view using the dropdown at the top-right of the table
(`Group alerts by: ...`), selecting a custom field that doesn't have a
value in alert documents (to find one, open the alert flyout and look at
the fields table)
4. Check that the group based on the empty field shows `--` as a title
5. Check that the alerts table in the expanded group panel is filtered
correctly

### References

Refs [#189958](https://github.com/elastic/kibana/pull/189958)

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2024-08-19 14:50:50 +02:00
Alejandro Fernández Haro
965b0a675d
Wait between instances, but not after the last one (#190679) 2024-08-19 14:46:15 +02:00
Marta Bondyra
f8e873f87d
[TSVB] Visualization blows up when invalid color is passed (#190658)
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/6784

## Summary

Fixes https://github.com/elastic/kibana/issues/190657
Fixes https://github.com/elastic/kibana/issues/182136

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-08-19 14:27:06 +02:00
Luke Gmys
d1c4bb33fb
[Security Solution] Remove active patterns from Sourcerer (#190020)
## Summary

Another round of field removal, this time I am replacing the
`activePatterns` field with `dataView.title` based logic for active
pattern retrieval.

This is mostly about upgrade flow for sourcerer going from stack v7 to
8.
2024-08-19 07:02:36 -05:00
Alex Szabo
51df0599aa
[CI] Fix flaky anomaly detection functional test (#190673)
## Summary
There are several cases where anomaly detection tests fail (find below).
The error claims an unhandled promise rejection through a stale element.
It could be simply a check or an operation that happens after the
browser driver moves on to another test.

I originally wanted to find the tests that seem to fail, but the nature
of the failures (unhandled rejections) line up nicely with missed
`await`s - I've also added a supposed fix, verified with 50x flaky runs.

Errors:
-
https://buildkite.com/elastic/kibana-on-merge/builds/49005#01916999-a25b-4c59-8d91-99cf4b83981b
  - https://buildkite.com/elastic/kibana-on-merge/builds/49004
-
https://buildkite.com/elastic/kibana-elasticsearch-snapshot-verify/builds/4373
  - https://buildkite.com/elastic/kibana-on-merge/builds/49002
  - ...
2024-08-19 06:57:53 -05:00
elastic-renovate-prod[bot]
1f1a359461
Update dependency elastic-apm-node to ^4.7.3 (main) (#190314)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [elastic-apm-node](https://togithub.com/elastic/apm-agent-nodejs) |
dependencies | patch | [`^4.7.2` ->
`^4.7.3`](https://renovatebot.com/diffs/npm/elastic-apm-node/4.7.2/4.7.3)
|

---

### Release Notes

<details>
<summary>elastic/apm-agent-nodejs (elastic-apm-node)</summary>

###
[`v4.7.3`](https://togithub.com/elastic/apm-agent-nodejs/releases/tag/v4.7.3)

[Compare
Source](https://togithub.com/elastic/apm-agent-nodejs/compare/v4.7.2...v4.7.3)

For more information, please see the
[changelog](https://www.elastic.co/guide/en/apm/agent/nodejs/current/release-notes-4.x.html#release-notes-4.7.3).

##### Elastic APM Node.js agent layer ARNs

|Region|ARN|
|------|---|

|af-south-1|arn:aws:lambda:af-south-1:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|ap-east-1|arn:aws:lambda:ap-east-1:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|ap-northeast-1|arn:aws:lambda:ap-northeast-1:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|ap-northeast-2|arn:aws:lambda:ap-northeast-2:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|ap-northeast-3|arn:aws:lambda:ap-northeast-3:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|ap-south-1|arn:aws:lambda:ap-south-1:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|ap-southeast-1|arn:aws:lambda:ap-southeast-1:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|ap-southeast-2|arn:aws:lambda:ap-southeast-2:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|ap-southeast-3|arn:aws:lambda:ap-southeast-3:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|ca-central-1|arn:aws:lambda:ca-central-1:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|eu-central-1|arn:aws:lambda:eu-central-1:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|eu-north-1|arn:aws:lambda:eu-north-1:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|eu-south-1|arn:aws:lambda:eu-south-1:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|eu-west-1|arn:aws:lambda:eu-west-1:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|eu-west-2|arn:aws:lambda:eu-west-2:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|eu-west-3|arn:aws:lambda:eu-west-3:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|me-south-1|arn:aws:lambda:me-south-1:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|sa-east-1|arn:aws:lambda:sa-east-1:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|us-east-1|arn:aws:lambda:us-east-1:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|us-east-2|arn:aws:lambda:us-east-2:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|us-west-1|arn:aws:lambda:us-west-1:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

|us-west-2|arn:aws:lambda:us-west-2:267093732750:layer:elastic-apm-node-ver-4-7-3:1|

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://togithub.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40MjUuMSIsInVwZGF0ZWRJblZlciI6IjM3LjQyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJUZWFtOkNvcmUiLCJiYWNrcG9ydDpza2lwIiwicmVsZWFzZV9ub3RlOnNraXAiXX0=-->

Co-authored-by: elastic-renovate-prod[bot] <174716857+elastic-renovate-prod[bot]@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-08-19 05:31:56 -05:00
Julia
58af1e3855
[MX] Fix cases functional test (#190602)
## Summary

Fix flaky test suit in
`x-pack/test/functional_with_es_ssl/apps/cases/group2/attachment_framework.ts`.

Check my solution for flakiness here:


https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/6780#_

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-08-19 12:12:31 +02:00
Philippe Oberti
ac5d6921d0
[Security Solution][Alert details] - move useBasicDataFromDetailsData hook to flyout folder (#190106) 2024-08-19 05:10:25 -05:00
Marius Iversen
d971c6a10e
[Integration Assistant] Improve sample merge functionality (#190656)
## Summary

Adds a few extra checks when doing deep recursive merges, will test a
few things when it comes to the overhead it adds before merging.

### For maintainers

- [x] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
2024-08-19 12:08:53 +02:00
Carlos Crespo
d69e598e30
[Infra] Handle view in app for legacy metrics (#190295)
closes [#189625](https://github.com/elastic/kibana/issues/189625)

## Summary

This PR changes the asset details to display a call if the user comes
from the alerts page via an inventory rule created with one of the
legacy metrics.

Besides that, it changes how the link is built to use locators.

Legacy metrics example


https://github.com/user-attachments/assets/12308f4e-e269-4580-b86d-808ae9f6fe10

**Regression**

Metrics Threshold


https://github.com/user-attachments/assets/94032f51-6b2c-4760-8019-158746a1aa13

Inventory Rule (new/hosts view metrics)


https://github.com/user-attachments/assets/0f872f3a-7bdb-4fb8-a925-7ed3621fee2d

Inventory Rule (custom metric)



https://github.com/user-attachments/assets/f2e5ded5-b2e6-45ff-878d-6361c4540140

### Fix

While working on it, I discovered that alerts for containers were not
redirecting the users to the asset details page for containers. That was
fixed too

Inventory rule for containers


https://github.com/user-attachments/assets/05f20c12-6fdc-45c0-bc38-b756bfbf3658

Metrics threshold rule for containers


### How to test

- Start a local Kibana instance (easier if pointed to an oblt cluster)
- Create Inventory Rule alerts for:  
  - host: 1 legacy metric and 1 non-legacy metric
  - container
- Create Metric Threshold alerts with
  - avg on `system.cpu.total.norm.pct` grouped by `host.name` 
- avg on `kubernetes.container.cpu.usage.limit.pct` grouped by
`container.id`
- Navigate to the alerts page and click on the `view in app` button, as
shown in the recordings above
- Test if the navigation to the asset details page works
   - For a legacy metric, the callout should be displayed
- Once dismissed, the callout should not appear again for that metric
2024-08-19 11:31:16 +02:00
elastic-renovate-prod[bot]
29c5381935
Pin launchdarkly/find-code-references action to ba05c32 (main) (#190566) 2024-08-19 07:17:27 +00:00
Kibana Machine
1b3f4304b4
[api-docs] 2024-08-19 Daily api_docs build (#190668)
Generated by
https://buildkite.com/elastic/kibana-api-docs-daily/builds/804
2024-08-19 05:00:13 +00:00
Kibana Machine
598b55a724
[api-docs] 2024-08-18 Daily api_docs build (#190664)
Generated by
https://buildkite.com/elastic/kibana-api-docs-daily/builds/803
2024-08-18 05:11:20 +00:00
Kibana Machine
48c1dd251a
[api-docs] 2024-08-17 Daily api_docs build (#190662)
Generated by
https://buildkite.com/elastic/kibana-api-docs-daily/builds/802
2024-08-17 05:00:40 +00:00