Commit graph

32202 commits

Author SHA1 Message Date
Dima Arnautov
1a8bacc547
[ML] Transform: Fix transform stats API call in the transform health alerting rule (#187586)
## Summary

In rare cases when the list of continuous transform exceeds the allowed
URL length, we fetch stats for all transforms.

The elasticsearch client has `transform-id` param as optional, but we
actually have to pass `_all` or `*`. This PR sets the `transform_id`
param explicitly in this case.

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2024-07-05 10:08:08 +03:00
seanrathier
2d877d67ba
[Cloud Security] [Fleet] Allow agentless deployment on ess integrations that support agentless option setup technology picker (#186439) 2024-07-05 11:07:13 +10:00
Tiago Costa
9a123c657e
skip flaky suite (#187554) 2024-07-05 00:53:26 +01:00
Kibana Machine
e758852af3 skip failing test suite (#187083) 2024-07-05 01:49:58 +02:00
Joe Reuter
322248b496
[Otel Onboarding] Adjust snippet and switch to proper release (#187480)
This PR does three things:
* Try to download agent from the central repository (expected to fail
for now as 8.15.0 agent isn't released yet
* Adjust snippet to also set up local data dir correctly
* Update k8s manifest via
https://github.com/elastic/opentelemetry-dev/pull/299
2024-07-05 01:20:44 +02:00
Gloria Hornero
3065d56a96
[Security Solution] Readme files update (#187596)
## Summary

We have been asked to stop using the `second quality gate` terminology
in favor of `kibana QA quality gate`. This PR updates the readmes to
reflect the new changes.
2024-07-04 23:28:51 +03:00
Jen Huang
75259f09f3
[UII] Allow free-form text in KQL searches (again) (#187041)
**‼️ DO NOT MERGE UNTIL 8.15 IS CUT**

## Summary

Part of https://github.com/elastic/kibana/issues/171425.

This PR allows parsed KQL expressions that don't have a key/field. For
example, the follow query expressions are now allowed when searching
agents:

```
last_checkin_message.keyword : "Running" and Development
```

```
macbook
```

```
"8.15.0" and tags : "Development" 
```

This PR also:
* Enables the flag `enableStrictKQLValidation` now that both free-form
text expressions are allowed and validation remains on expressions which
specify a field
* Syncs the maintained agent mappings used for populating suggestions
with the [real mappings in
ES](248b045d70/x-pack/plugin/core/template-resources/src/main/resources/fleet-agents.json)

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2024-07-04 13:22:22 -07:00
Ignacio Rivas
077d1e0ed3
[Upgrade Assistant] Fix small issue with unknown indicators (#187326) 2024-07-04 19:09:17 +02:00
Umberto Pepato
52ccd1728f
[ResponseOps][Alerts] Add alerts grouping aggregations endpoint (#186475)
## Summary

Adds an endpoint dedicated to fetching alerts group aggregations to
avoid adding runtime mappings and client-side controlled scripts to the
`internal/rac/alerts/find` endpoint.
The new endpoint injects a `groupByField` runtime field used to
normalize the values of the field used for grouping, to account for null
and multi-element arrays.

#184635 depends on this

Closes #186383

## To verify

Review the added
[tests](x-pack/plugins/rule_registry/server/routes/get_alerts_group_aggregations.test.ts).
Use the Kibana Dev Console to test various body params and aggregations:

1. Create any type of rule that fire alerts
2. Wait for the alerts to be created
3. Call the `_group_aggregations` endpoint, using the feature id(s) that
cover the type of rules you used:
```
POST kbn:internal/rac/alerts/_group_aggregations
{
   "featureIds": [...],
  ...
}
```
See
[here](https://github.com/elastic/kibana/pull/186475/files#diff-0780f60b57fdaa96eda1ab2853064033477617430a17cdb87750cef42c6e8668R22)
and
[here](https://github.com/elastic/kibana/pull/186475/files#diff-0780f60b57fdaa96eda1ab2853064033477617430a17cdb87750cef42c6e8668R37)
to know the available params and pre-defined aggregations.

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2024-07-04 18:55:24 +02:00
Mark Hopkin
7810507d4a
[Entity Analytics] Add public list asset criticality API (#186568)
## Summary

Add an API which allows paginated kuery search through asset criticality
records, example request:

```
curl http://elastic:changeme@localhost:5601/mark/api/asset_criticality/list?per_page=100&page=1&sort_field=criticality_level&sort_direction=asc&kuery=id_value:%20Host-1%20OR%20id_value:Host-2 \
--header "kbn-xsrf: true" \
--header "elastic-api-version: 2023-10-31"
```

Params:
- **page**  must be greater than 1
- **per_page** must be greater than 1 and less than 10k
- **sort_field** must be one of `@timestamp`, criticality_level,
id_field or id_value
- **sort_order** asc or desc
- **kuery** any
[KQL](https://www.elastic.co/guide/en/kibana/current/kuery-query.html)
kuery, not currently validated

API integration tests have been added

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-07-05 02:30:02 +10:00
Felix Stürmer
c3c4dca289
[Logs UI] Fix fly-out link to the legacy Uptime app (#186328) 2024-07-04 18:28:25 +02:00
Luke G
d823d5deef
[Security Solution] Reduce BrowserField to field spec (#187263)
## Summary

BrowserField is now FieldSpec, with an exception of one field. ("format")
2024-07-05 02:25:07 +10:00
Tom Myers
fac236e567
[EEM] add additional validations for entity definition IDs (#187555)
add additional validations for entity definition IDs
2024-07-04 15:17:55 +01:00
Antonio
05c7a19ea6
[ResponseOps][Cases]Add the no template selected option (#187552)
## Summary

This PR adds a "No template selected" option in the Template Selection
component in the Case Creation Page
2024-07-04 16:12:23 +02:00
Elena Stoeva
4e31327291
[Data View Editor] Add rollup deprecation warning (#187505)
## Summary

This PR replaces the Beta callout in the Data view create form with a
deprecation callout.

Before:
<img width="1356" alt="Screenshot 2024-07-03 at 17 28 35"
src="bd9f4ca5-6d96-486f-9ac6-76116035bbd3">


Now:
<img width="1356" alt="Screenshot 2024-07-03 at 17 28 11"
src="196c1c26-8398-4532-8c41-b6f579dffab1">

**How to test:**
1. Start Es and Kibana
2. Add the sample data "Sample web logs"
3. Elasticsearch only allows creating a rollup job if there is an
existing rollup usage in the cluster. To simulate rollup usage, create a
mock rollup index through Console:

```
PUT /mock_rollup_index
{
  "mappings": {
    "_meta": {
      "_rollup": {
        "id": "logs_job"
      }
    }
  }
}
```


4. Create a sample rollup job through Console:

```
PUT _rollup/job/logs_job
{
  "id": "logs_job",
  "index_pattern": "kibana_sample_data_logs",
  "rollup_index": "rollup_logstash",
  "cron": "* * * * * ?",
  "page_size": 1000,
  "groups": {
    "date_histogram": {
      "interval": "60m",
      "delay": "7d",
      "time_zone": "UTC",
      "field": "@timestamp"
    },
    "terms": {
      "fields": [
        "geo.src",
        "machine.os.keyword"
      ]
    },
    "histogram": {
      "interval": "1003",
      "fields": [
        "bytes",
        "memory"
      ]
    }
  }
}
```


5. Delete the mock rollup index since it causes issues for the rollup
API that we use to fetch rollup indices:
`DELETE /mock_rollup_index`
6. Navigate to Stack Management -> Data Views and start creating a new
data view.
7. Select the Rollup type.
8. Verify that the rollup callout is updated.



<!--
### Checklist

Delete any items that are not applicable to this PR.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)
-->
2024-07-05 00:04:10 +10:00
Nicolas Chaulet
c27ca409a4
[Fleet] Disable selecting standalone instructions for user without agent policies READ permissions (#187517) 2024-07-04 23:45:20 +10:00
Cristina Amico
015fd398d0
[Fleet] Allow preconfigured agent policy only with name and id (#187542)
Fixes https://github.com/elastic/kibana/issues/182213

## Summary
Allow creating a preconfigured agent policy only with `name` and `id`.
Previously this way Fleet wouldn't start.
Note that this was already defined this way in the docs, but the schema
wasn't respecting it.

### Testing

- Create a preconfigured fleet policy with just the id and name:
```
xpack.fleet.agentPolicies:
  - name: agent-policy
    id: agent-default-policy
```
- Verify that Fleet starts correctly


### Checklist
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2024-07-04 14:31:13 +02:00
Katerina
372f99b213
[APM] Logs only service details view (#187221)
closes https://github.com/elastic/kibana/issues/183013 

- Introduce`logs-services` route for the logs only entities with the
tabs
   - overview page
   - Logs 
   - Dashboard
-  Log error rate and Log rate charts
- Add 2 services in the logs access plugin to fetch the timeseries for
the above charts



6969b373-6710-44ab-8a2c-3e6c0e365004

### How to test

2. Enable `observability:apmEnableMultiSignal` in advansted settings
 
<details>


<summary>3. Run the entities definition in the dev tools</summary>


```
POST kbn:/internal/api/entities/definition
{
  "id": "apm-services-with-metadata",
  "name": "Services from logs and metrics",
  "displayNameTemplate": "test",
  "history": {
    "timestampField": "@timestamp",
    "interval": "5m"
  },
  "type": "service",
  "indexPatterns": [
    "logs-*",
    "metrics-*"
  ],
  "timestampField": "@timestamp",
  "lookback": "5m",
  "identityFields": [
    {
      "field": "service.name",
      "optional": false
    },
    {
      "field": "service.environment",
      "optional": true
    }
  ],
  "identityTemplate": "{{service.name}}:{{service.environment}}",
  "metadata": [
    "tags",
    "host.name",
    "data_stream.type",
    "service.name", 
    "service.instance.id",
    "service.namespace",
    "service.environment",
    "service.version",
    "service.runtime.name",
    "service.runtime.version",
    "service.node.name",
    "service.language.name",
    "agent.name",
    "cloud.provider",
    "cloud.instance.id",
    "cloud.availability_zone",
    "cloud.instance.name",
    "cloud.machine.type",
    "container.id"
  ],
  "metrics": [
    {
      "name": "latency",
      "equation": "A",
      "metrics": [
        {
          "name": "A",
          "aggregation": "avg",
          "field": "transaction.duration.histogram"
           
          
        }
      ]
    },
    {
      "name": "throughput",
      "equation": "A / 5",
      "metrics": [
        {
          "name": "A",
          "aggregation": "doc_count",
          "filter": "transaction.duration.histogram:*"
        }
      ]
    },
    {
      "name": "failedTransactionRate",
      "equation": "A / B",
      "metrics": [
        {
          "name": "A",
          "aggregation": "doc_count",
          "filter": "event.outcome: \"failure\""
        },
        {
          "name": "B",
          "aggregation": "doc_count",
          "filter": "event.outcome: *"
        }
      ]
    },
    {
      "name": "logErrorRate",
      "equation": "A / B",
      "metrics": [
        {
          "name": "A",
          "aggregation": "doc_count",
          "filter": "log.level: \"error\""
        },
        {
          "name": "B",
          "aggregation": "doc_count",
          "filter": "log.level: *"
        }
      ]
    },
     {
      "name": "logRatePerMinute",
      "equation": "A / 5",
      "metrics": [
        {
          "name": "A",
          "aggregation": "doc_count",
          "filter": "log.level: \"error\""
        }
      ]
    }
  ]
}
```

</details>

4. Generate data with synthrace

    1. logs only: `node scripts/synthtrace simple_logs.ts`
    2. APM only: `node scripts/synthtrace simple_trace.ts`

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: jennypavlova <jennypavlova94@gmail.com>
Co-authored-by: jennypavlova <dzheni.pavlova@elastic.co>
2024-07-04 14:20:49 +03:00
Achyut Jhunjhunwala
c4837014c5
[Dataset Quality] Refactor integrations in DQ Flyout to not depend on main DQ Page page (#187450)
## Summary

This PR is a prerequisite to the Locator Implementation for Logs
Explorer - https://github.com/elastic/kibana/pull/186287

## Problem Statement

- Integrations were fetched when the main DQ page loads and stored in
the State Machine. This means when the Flyout Opens, it was referencing
already fetched data from the main page, updating the URL and then that
was used to render certain sections on the Flyout. This causes issues as
when a Locator is used to directly open the Flyout from some other page.
In that case everything happen asynchronously causing the data to be not
present when the flyout open thus those integration sections were not
present.

## Solution

- Now when the flyout is opened or is already open, it reads the basic
params from the URL like `DataStream`. With this information, it make
API call to fetch Integration information and thus making it
independent.
- Does this means you duplicated the Logic to fetch Integrations ? Yes
and No. Logic has to be duplicated as Flyout is moving to its own page
very soon. This means it would anyhow not be able to re-use that
Integration Information available. Secondly the duplication is not one
to one, its more catered towards Flyout logic
- Split the state machine to make Integration Calls only when the opened
Dataset is actually an integration. This is done by chaining the
respective states after the `DataStreamSettings` state confirms presence
of Integration.

## What else has been done

- Type cleaning: A lot of types has to be refactored to make this
change. Also simplified some duplicate types. We were using
  - Runtime types
  - Types Derived from Runtime Types
  - Inferred Types from API Responses
  We don't need the 3rd one. 1 and 2 and sufficient.
2024-07-04 20:49:46 +10:00
Christos Nasikas
358dececd3
[Cases] Fix template bugs (#187493)
## Summary

This PR fixes the following bugs in templates:

1. Remove duplicate template tags
2. Set the connector to `none` if the connect is deleted when editing or
selecting a template

## Testing

### Scenario 1

1. Create a couple of templates with the same template tags.
2. Create a template and click to select template tags. In the list of
available template tags, you should not see duplicates.

### Scenario 2

1. Create a template with a connector.
2. Delete the connector.
3. Edit the template and verify that the `none` connector is shown.
4. Go to the create case form and select the template created in step 1.
5. The selected connector should be the `none` connector.

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### For maintainers

- [x] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-07-04 13:32:25 +03:00
Cristina Amico
ef52a4bfee
[Fleet] Bugfix - Show warning callout in configs tab when an error occurs (#187487)
Fixes https://github.com/elastic/kibana/issues/181168

## Summary
Show warning callout in configs tab when an error occurs. GSCC has an
issue with the template (see
[comment](https://github.com/elastic/kibana/issues/181168#issuecomment-2203291945))
so I'm showing a warning in a case like this, instead of sticking with
the broken page.


![Screenshot 2024-07-03 at 15 17
32](322f8e5f-3c67-4c6d-9871-d080447c67ed)



### Checklist
- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-07-04 20:20:01 +10:00
Tom Myers
6ca9fec2e7
remove 'spaceId' from entity APIs (#187502)
remove 'spaceId' from entity APIs
2024-07-04 11:03:24 +01:00
Maryam Saeidi
c9e6e7e9b1
Fix x-axis timezone on alertSummaryWidget full size (#187468)
Fixes #184850

## Summary

Now: 12:20 UTC
 

![image](78d36a21-1e39-445c-a6f4-e58262ac7e86)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2024-07-04 11:59:26 +02:00
Julia Bardi
3b229f3360
[Fleet] fix telemetry errors (#187541)
## Summary

Small fix to address telemetry related errors.

Closes https://github.com/elastic/kibana/issues/186983

Make `avg_number_global_data_tags_per_policy` optional as it can be
undefined.

Filter out nulls or undefined values in `output_types`.
2024-07-04 19:53:20 +10:00
elena-shostak
cc50c8dc94
Permissions Policy Reporting (#186892)
## Summary

1. Added top-level `permissionsPolicy` configuration setting.
2. Added support for `report_to` directive.
3. Added support for `Permissions-Policy-Report-Only` header to enable
reporting mode.
4. The [spec](https://www.w3.org/TR/permissions-policy/#reporting)
mentions `featureId` in the reporting body, however the field is
`policyId` in Chromium.

## How to test

- Add in your `kibana.dev.yml`.
```
server.customResponseHeaders.Reporting-Endpoints: violations-endpoint="https://localhost:5601/kibana/internal/security/analytics/_record_violations"
server.securityResponseHeaders.permissionsPolicy: 'microphone=()'
server.securityResponseHeaders.permissionsPolicyReportOnly: 'camera=()'
```
- Make sure you have [dev tools configured for Reporting
API](https://developer.chrome.com/docs/capabilities/web-apis/reporting-api#use_devtools).
- In the browser console invoke `navigator.mediaDevices.getUserMedia({
audio: true, video: true }).catch((e) => {});`
- Open Dev Tools -> Application -> Reporting API. 
You should see 2 reports for permissions violation, one with `report`
disposition and another with `enforce` disposition.

<img width="1285" alt="Screenshot 2024-06-27 at 13 36 12"
src="3f3da7f6-f6b0-4f33-9a81-dff3db0ac2b8">


### Checklist

- [x]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

### Related Issue(s)
https://github.com/elastic/kibana/issues/175113,
https://github.com/elastic/kibana/issues/184939

### Release Note
Added support for Permissions Policy reporting.
2024-07-04 11:06:33 +02:00
Ido Cohen
3e9ad41cee
[Cloud Security][Metering] Report all assets details 2024-07-04 11:54:42 +03:00
James Gowdy
ea0bbf76be
[ML] API test for ml_node_count (#187484)
We can't be sure of the node count when running tests, so we just make
sure the counts are above expected values.

Also updates the route access tags to be `access:ml:canGetMlInfo` rather
than `access:ml:canGetJobs` and `access:ml:canGetDatafeeds`.
In serverless, AD can be disabled and these tags would be false.
2024-07-04 09:48:37 +01:00
Jen Huang
3dfcb859c4
[UII] Only show beta integrations setting for settings write privilege (#187513)
## Summary

Resolves [#184639](https://github.com/elastic/kibana/issues/184639).

This PR hides the beta integrations toggle if user does not have
sufficient privileges to write this to Fleet settings SO. The real fix
should be handled with #187511.
2024-07-04 10:07:31 +02:00
jennypavlova
f0edaa103b
[Infra] Fix: Processes tab shows toast with a 500 error when performing a full page refresh (#187459)
Closes #187385 
## Summary

This PR fixes the issue with the processes tab showing a 500 error in a
toast when performing a full page refresh.

## Testing
Go to asset details and open the processes tab. Refresh the page: there
should not be any error visible.


8998d141-8841-4138-8c76-7f555f6c44f0
2024-07-04 09:38:24 +02:00
Julia Bardi
d8614569e0
[Fleet] fix edit package policy navigation (#187463)
## Summary

Closes https://github.com/elastic/kibana/issues/187336

Fix navigating back to Integration policies list after
Cancelling/Submitting the Edit integration policy page.

See steps to verify in the linked issue.

<img width="1119" alt="image"
src="f89028a6-ef71-4b25-aabc-4f80cb36214b">
<img width="1123" alt="image"
src="e844344c-caff-45ee-9ce7-772ba672e328">
2024-07-04 08:17:51 +02:00
Kylie Meli
27d280893c
[Integration-Assistant] Fix categorization ECS types and categories (#187516)
## Summary

This PR corrects the ECS type and categories constants used in the
categorization chain.

I double checked everything against the ECS docs for
[categories](https://www.elastic.co/guide/en/ecs/current/ecs-allowed-values-event-category.html)
and
[types](https://www.elastic.co/guide/en/ecs/current/ecs-allowed-values-event-type.html).
2024-07-04 07:47:54 +02:00
Rachel Shen
cd134c70fb
[a11y][Obs Alert Rules] Keyboard focusable (#183693)
## Summary

Closes https://github.com/elastic/observability-dev/issues/3373 and
https://github.com/elastic/observability-dev/issues/3360

Adding the check `viewInAppUrl !== ''` allows the More Action Alerts
Cell to be navigatable by keyboard. The user can now arrow into the cell
and click enter to interact with the actions in the cell. The href prop
was changed to an onClick because the href was blocking the keyboard
accessibility.



![Jun-13-2024
12-48-43](f8123200-0101-4594-9a5a-722abe1409da)

---------

Co-authored-by: Dominique Clarke <dominique.clarke@elastic.co>
2024-07-04 13:59:05 +10:00
Jiawei Wu
762f4cd14f
[Response Ops][Rule Form V2] Rule Form V2: Rule Form Page and State Management (#184892)
## Summary
Issue: https://github.com/elastic/kibana/issues/179105
Related PR: https://github.com/elastic/kibana/pull/180539

Part 3/3 PRs of the new rule form. This PR adds the create and edit rule
page as well as the state management using react reducers.

I have also created a example plugin to demonstrate this PR. To access:

1. Run the branch with yarn start --run-examples
2. Navigate to
`http://localhost:5601/app/triggersActionsUiExample/rule/create/<ruleTypeId>`
(I use `.es-query`)
3. Create a rule
4. Navigate to
`http://localhost:5601/app/triggersActionsUiExample/rule/edit/<ruleId>`
with the rule you just created to edit the rule

<img width="1196" alt="Screenshot 2024-05-14 at 8 27 00 PM"
src="576fecdd-bd7b-4cad-a3db-aab3163abc46">


### Checklist
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-07-03 20:34:31 -07:00
Joey F. Poon
2c7b381089
[Security Solution] unskip endpoint metering tests (#187431)
## Summary

unskip endpoint metering integration tests. passed 100/100 flaky test
runs.


### Checklist

- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
2024-07-04 09:39:01 +10:00
Jatin Kathuria
18c5f83e64
Unified Timeline - Fix - Docs for Event renderers (#187457)
## Summary

This PR incorporates docs feedback as per :
https://github.com/elastic/security-docs/issues/5341#issuecomment-2205602709
2024-07-04 08:51:49 +10:00
Kevin Qualters
0ec428bf9c
[Security Solution] [Timelines] Refresh notes table in thunk when deleting (#187428)
## Summary

Fixes an issue where the table was not being properly updated upon
deletion.

![delete_count_update](efd1e463-266a-4ce3-b34b-2a963ce44ae4)


### Checklist


- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2024-07-03 17:16:58 -04:00
Paulo Henrique
7ae1f7a7df
[CloudSecurity] Converting Findings DistributionBar FTR into integration test (#186938)
## Summary

It closes #176700

This PR converts the DistributionBar FTR test on the Findings page into
an integration test using MSW. It also closes #176700as it was once
triggering an error in the past

Also, it adds the following changes:
- Added a `generateMultipleCspFindings` helper to help with the writing
of future tests and generating batch data.
- Removed DistributionBar FTR test
- Removed the extra layer of sub-components on the DistributionBar
component to be simpler and added an aria-label on the distribution bar
buttons.

## Screenshots


![image](ee4abc0e-1f60-46d0-afe7-48bce93bf24a)



![image](bf443121-eb14-4ae5-b9aa-dea662410da4)
2024-07-03 14:00:44 -07:00
Philippe Oberti
e4a44fd23e
[Security Solution][Notes] - add telemetry (#187362) 2024-07-03 22:36:11 +02:00
Jen Huang
f03fa06d5e
[UII] Fix unsupported input callout not showing for Cloud Defend (#187518)
## Summary

Resolves #186785

This PR:
- Fixes unsupported input callout in data tagging UI not showing for
Cloud Defend
- Simplifies the constants list for unsupported inputs
- Tweaks copy and UI for empty state to match closer to
[designs](https://github.com/elastic/kibana/issues/179915#issuecomment-2034365557)

<img width="1406" alt="image"
src="d34ca840-901f-4770-b7c2-1cae7fcb0e53">

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2024-07-04 06:19:10 +10:00
Luke G
adc9310845
[SecuritySolution] remove "fields" from the BrowserField (#187066)
## Summary

This is part 1/n of a wider effort:)

BrowserField used to be some kind of field dictionary (!) which is
obviously wrong:). Added FieldCategory type for that as an intermediate
step as I dont know if it will hold up after the changes I am doing are
complete.
2024-07-04 06:03:02 +10:00
Ryland Herrick
184b6e2ad4
[Security Solution][CTI] Enable rendering of CTI indicators with flattened fields (#179395)
## Summary
Our initial implementation of these components assumed a very flat,
normal structure for the indicator documents we would retrieve (because
we leverage the `fields` API). However, `flattened` fields do not quite
fit this pattern, and there is a bug where indicator documents
containing `flattened` fields with complex values would not be parsed
correctly, and we attempt to render JS objects to the DOM (which React
does not like, and throws an error).

This issue was uncovered originally in an SDH.

### How to Review
See https://github.com/elastic/kibana/issues/179483 for details on how
to repro.

### Screenshots
(Using the data described in
https://github.com/elastic/kibana/issues/179483):
<img width="820" alt="Screenshot 2024-03-26 at 3 28 00 PM"
src="af62724d-6626-4b61-91b8-48612889a109">

<img width="820" alt="Screenshot 2024-03-26 at 3 28 15 PM"
src="9208e7bd-c149-44a3-9a56-4a2813d79ad7">


Linked issue: https://github.com/elastic/kibana/issues/179483
2024-07-04 05:16:47 +10:00
Christiane (Tina) Heiligers
ee80b740fa
Reuse core-security-service createMockAuthenticatedUser mock (#187426)
Follow up to https://github.com/elastic/kibana/pull/187318

Implement core `createMockAuthenticatedUser` in the security plugin mock
to avoid divergence.

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-07-04 03:43:47 +10:00
Tim Sullivan
482f2a9503
[Logstash Plugin] Migrate authc.getCurrentUser usage to coreContext.security (#187180)
Part of https://github.com/elastic/kibana/issues/186574

## Summary

This PR migrates the Logstash Plugin's route handler for saving a
pipeline, which consumes `authc.getCurrentUser`, to use
`coreContext.security`.

Background: This PR serves as an example of a plugin migrating away from
depending on the Security plugin, which is a high priority effort for
the last release before 9.0.

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2024-07-04 03:39:37 +10:00
Yuliia Naumenko
0a0bb1498e
[Security AI Assistant] Persist prompts (#187040)
Moving prompts persistence layer from the local storage to the server
side data stream `.kibana-elastic-ai-assistant-prompts`

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2024-07-04 03:28:15 +10:00
Jan Monschke
aad2239c32
[Security] Timeline OpenAPI documentation fixes (#186458)
## Summary

- Fix issues that came up during validation with `spectral lint` running
with the [recommended
settings](https://docs.elastic.dev/content-architecture/oas#openapi-version).
- Made sure all return and request types match with the code
- Fixed incorrect descriptions and links to documenation

Fixes https://github.com/elastic/kibana/issues/183812.

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2024-07-03 13:25:24 -04:00
Alexey Antonov
0ead26a742
fix: [Obs Synthetics > Monitor detail][KEYBOARD]: Test run screenshots (in modal) need more comprehensive alt text (#187363)
Closes: https://github.com/elastic/observability-dev/issues/3688

## Description

The synthetics monitors include thumbnail screenshots that open a larger
preview window. The alt text on these larger screenshots is very generic
and could be improved by concatenating more information. Screenshot and
suggested copy attached below.

### Steps to recreate

1. Open the
[Synthetics](https://keep-serverless-fyzdg-f07c50.kb.eu-west-1.aws.qa.elastic.cloud/app/synthetics)
view
2. Create a monitor if none exist
3. Click on that monitor and navigate to the [full monitor
detail](8b88e937-f917-4f12-9325-8ab005cffea5?locationId=us_central_qa)
view
4. Click on a thumbnail and verify the modal opens
5. Turn on the screen reader of your choosing
6. Navigate to the image and verify the generic alt text

### What was changed?: 

1. The `label` attribute for `ScreenshotImage` calling was changed to a
unified version in all places. Now it's always follow next rule:
`"{stepName}", {stepNumber} of {totalSteps}`

### Screen: 

<img width="1256" alt="image"
src="dad6d098-8c29-4310-9988-784d227e30e1">
2024-07-03 20:22:49 +03:00
Tim Sullivan
78fa3c36c3
[APM Plugin - Browser] Migrate authc.getCurrentUser usage to coreStart.security (#187192)
Part of https://github.com/elastic/kibana/issues/186574

## Summary

This PR migrates the method to access an APM Plugin view model field,
which consumes `authc.getCurrentUser`, to use `coreStart.security`.

Background: This PR serves as an example of a plugin migrating away from
depending on the Security plugin, which is a high priority effort for
the last release before 9.0.

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2024-07-03 09:10:27 -07:00
Tim Sullivan
69c1533916
[Serverless Search Plugin] Migrate browser-side authc.getCurrentUser usage to coreStart.security (#187189)
Part of https://github.com/elastic/kibana/issues/186574

## Summary

This PR migrates the method to access a Serverless Search view model
field, which consumes `authc.getCurrentUser`, to use
`coreStart.security`.

Background: This PR serves as an example of a plugin migrating away from
depending on the Security plugin, which is a high priority effort for
the last release before 9.0.

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2024-07-03 09:10:12 -07:00
Tom Myers
15e62a0b4c
validate that entity definition IDs do not overflow transform ID max length before installing them (#187458)
validate that entity definition IDs do not overflow transform ID max
length before installing them
2024-07-03 16:56:33 +01:00
Tiago Costa
34d0ce7dfa
skip flaky suite (#187364) 2024-07-03 16:21:57 +01:00