When navigating to the details page of a classic stream for the first
time, it would show an error toast from the `/dashboards` endpoint. This
happened because there was a bug in `ensureStream` - it would throw if
the data stream has been found but there wouldn't be a streams
definition.
This PR fixes the bug and adds an integration test for it.
## Summary
### Fleet changes
- Fixed `GetPackagePoliciesRequest` (was missing `query` options
supported)
### Security Solution
This PR refactors the Policy Selection UI component - used mainly with
Artifact pages/forms - to remove the prior limitation of only displaying
the first 1,000 policies in the system. This new version of the
component is not connected to the API and allows a user to paginate
through the list of policies in the system, including being able to
search for policies while maintaining those that have been already
selected.
Some of the new features in this new component include:
- Page through list of available policies
- Search for policies (by default, it searches against `name`,
`description`, `policy_ids` and `package.name`)
- Ability to `select all` / `unselect all` policies currently displayed
- Ability to view the already selected list of policies
This PR moves the datepicker on the overview page into the chart panel
to claim some additional vertical screen space and to make it clearer
what the stats on top of the page mean:
<img width="1016" alt="Screenshot 2025-04-03 at 14 58 27"
src="https://github.com/user-attachments/assets/b0100a3e-e9c4-419e-9803-45558b8a0fad"
/>
It also refactors the code a bit and reduces prop drilling in some
areas.
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
## Summary
Fixes: https://github.com/elastic/security-team/issues/12233
This PR simply adds a new `migration` index to store the migration data
with `migration_id` as the only property for now.
The APIs remain unchanged.
Below are the mapping for new index
`.kibana-siem-rule-migrations-migrations-default` based on the pattern
`..kibana-siem-rule-migrations-<indexAdapterId>-<spaceName>`
```
{
".kibana-siem-rule-migrations-migrations-default": {
"mappings": {
"dynamic": "false",
"_meta": {
"namespace": "default",
"kibana": {
"version": "9.1.0"
},
"managed": true
},
"properties": {
"created_at": {
"type": "date"
},
"created_by": {
"type": "keyword"
},
"id": {
"type": "keyword"
}
}
}
}
}
```
Below is how a sample document looks like:
```json
{
"_index": ".kibana-siem-rule-migrations-migrations-default",
"_id": "C7oi15UBS6DCfB3qd4_l",
"_score": 1,
"_source": {
"created_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0",
"created_at": "2025-03-27T10:25:15.232Z"
}
}
```
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
If a managed connector is used, show a icon with a tooltip to remind
them this costs money
<img width="436" alt="Screenshot 2025-04-02 at 17 00 56"
src="https://github.com/user-attachments/assets/495fa834-a0ec-4228-802e-ea2eee7678c5"
/>
I checked on serverless prod that the numbers we report on storage size
is identical with what `/app/management/data/data_usage` based on
auto-ops reports, with some caveats:
* We were using the eui number formatter which was configured to use
megabyte (MB, 1000^2) instead of mebibyte (MiB, 1024^2) - auto ops was
using mebibyte but still formatted the number as MB. I switched it over
to use mebibyte, so the numbers are the same now, but it's rendering
`MiB`. IMHO this is OK since it's more exact, but I wanted to call it
out
<img width="141" alt="Screenshot 2025-04-02 at 17 35 03"
src="https://github.com/user-attachments/assets/6145acfb-9a84-4ba0-81d0-a32718a5fff4"
/>
* On the overview page, the refresh button would not refresh the data
stream stats, which would cause a drift of the numbers over time. Fixed
that
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
## Summary
Currently, if you'd like to test something on Kibana's VM image, you'd
have to build a VM image to -qa, then rewrite all references to
`elastic-images-qa` for the PR jobs; once done with testing, we'd undo
the changes to `elastic-images-prod`.
This is a helpful tool for us to test with WIP VM images, we'd be able
to add a label to the PR, and it would automatically grab the QA images,
without any temporary commits.
Jobs in https://buildkite.com/elastic/kibana-pull-request/builds/289599
have ran with an elastic-qa image. ✅
## Summary
Part of https://github.com/elastic/kibana/issues/213877
This PR doent introduce a new feature. It is mostly a refactoring to
allow us to give a better UX when a user during creation changes the
variable name from ??value to ?value and vice versa. The biggest change
is that we move 2 components from the individual form (value,
identifier) to index as now they can be shared and they own the same
functionality regardless the control type.
It is required to move to the next step, the creation of controls by
just typing a questionmark
### Checklist
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
Towards making AAD source of truth.
This PR creates a `trackedAlerts` object in the alertsClient and removes
the dependency on task state to fetch tracked alerts.
As fetching tracked alerts becomes a critical part, we throw an error
when it fails.
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
## Summary
This PR adds the integration section at the top of the alert summary
page. This section shows the installed AI for SOC integrations and an
`Add integration` button. Clicking on the button navigates to the
fleet's page.
In each integration card, we show the integration name, its logo as well
as the last activity time. This last activity value is retrieve as
follow:
- fetch all dataStreams (see [this api
documentation](https://www.elastic.co/docs/api/doc/kibana/operation/operation-get-fleet-data-streams))
- find all the dataStreams that are related to the installed
integrations (via the `package` property)
- from all the matching dataStreams, take the most recently updated (via
the `last_activity_ms` value
https://github.com/user-attachments/assets/7c67e629-e4d3-4ba2-b756-b9ba81e7a667
## How to test
This needs to be ran in Serverless:
- `yarn es serverless --projectType security`
- `yarn serverless-security --no-base-path`
You also need to enable the AI for SOC tier, by adding the following to
your `serverless.security.dev.yaml` file:
```
xpack.securitySolutionServerless.productTypes:
[
{ product_line: 'ai_soc', product_tier: 'search_ai_lake' },
]
```
Use one of these Serverless users:
- `platform_engineer`
- `endpoint_operations_analyst`
- `endpoint_policy_manager`
- `admin`
- `system_indices_superuser`
### Notes
You'll need to either have some AI for SOC integrations installed, or
more easily you can:
- change the `alert_summary.tsx` line `38` from `if
(installedPackages.length === 0) {` to `if (installedPackages.length >
0) {` to force the wrapper component to render
- update `42` of the same `alert_summary.tsx` file from `return <Wrapper
packages={installedPackages} />;` to `return <Wrapper
packages={availablePackages} />;` to be able to see some packages
Also you'll dataStreams if you want to be able to test the last activity
value. Easiest would probably be to mock the call return value following
[the
documentation](https://www.elastic.co/docs/api/doc/kibana/operation/operation-get-fleet-data-streams).
### Checklist
- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
https://github.com/elastic/security-team/issues/11955
## Summary
Add safer parameters when deleting by queries, and make all delete by
queries async (wait = false).
In some cases, I've parallelized the calls
## Summary
Upgrading the ES client to v9.0.0-alpha.4 to test the changes mentioned
in https://github.com/elastic/elasticsearch-js/issues/2584
This new version introduces some type changes, most notably, the
`FieldValue` is `string | number | boolean | null | undefined` instead
of `any`, leading to some new type checks to be implemented (like on
aggregation results `bucket.key`, `search_after`, and `sort` options).
On top of that, it adds the new behavior where unknown properties are
placed in the `body` (when the request has a body). If they must be in
as a query parameter, they should be placed under the `querystring`
option.
cc @JoshMock
TODO:
- [x] Stabilize the type errors
- [x] Address all the query parameters that are now placed in the body
(by wrapping them inside the option `querystring: {}`)
I will address `// @ts-expect-error elasticsearch@9.0.0
https://github.com/elastic/elasticsearch-js/issues/2584` in a separate
PR to reduce noise.
Related https://github.com/elastic/kibana/pull/208776
## Summary
Small PR to transfer ownership of the `GroupedAlertsTable` code within
the `detections/components/alerts_table` from the
@elastic/security-threat-hunting-explore team to the
@elastic/security-threat-hunting-investigations team.
While the code was originally primarily written a developer on the
Explore team, that person has moved to a different team since then. The
Investigations team has more knowledge about how the grouped table
works, and is also primary user for it.
## Summary
#### Lists plugin
- Minor change to the service that generates the summary counts to
ensure `filter` can be overwritten by server-side extension points
#### Security Solution
The following change was done in support of Endpoint space awareness
(currently behind feature flag
`endpointManagementSpaceAwarenessEnabled`)
- Updates the artifacts Summary API (`/api/exception_lists/summary`) to
ensure that it only counts artifacts that are accessible in active space
### Checklist
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
## Summary
This PR fixes some wonky request handling for particular cases. In some
cases, when the page updates with some new criteria/filters, requests
that were being managed by `ManagedTable` would fire at least twice,
with the first one getting aborted and then resent. This PR removes that
behaviour by not storing the dependent data in a `renderedItems` state
and instead depending directly on the request data itself and storing
instead the indices of the rendered items. This removes the edge-case
where `renderedItems` would cause the affected requests from firing
multiple times, due to object equality not being the same for the
rendered items array between renders.
Closes#216144
## How to test
* Go to Observability -> Applications -> Service Inventory
* Select a service with more than one environment
* Go to Errors tab and open the browser dev tools
* Change the environment on the service to update the errors tab
**Expected behaviour**: The `detailed_statistics` request should only
fire once, both on page load and on update (such as changing the service
environment).
This should apply to the Service Inventory page as well, and anything
making use of the `TransactionsTable` component.
## Summary
Same as for Playwright, this adds a custom Jest reporter that records
and uploads test events.
## Quirks
### Config file path
Jest is not including the path to the config file used to run the tests
in any information passed to the reporter, so this needs to be passed in
the `JEST_CONFIG_PATH` environment variable. If Jest is invoked with the
`scripts/jest.js` script, the `JEST_CONFIG_PATH` environment variable
will be populated with the correct value automatically.
### All the events are produced when the run has completed
This is different from the other reporters because the custom reporter
interface in Jest is giving the reporter access to necessary info at
init or when the run starts. The earliest we can start producing the
Scout events is, unfortunately, only after the test run has completed.
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Cesare de Cal <cesare.decal@elastic.co>
## Summary
Resolves [#205102](https://github.com/elastic/kibana/issues/205102).
This PR makes Fleet support having multiple values for secrets, i.e.
integrations with variables such as:
```yml
- name: connection_string
title: Connection String
type: password
secret: true
multi: true
```
When a package policy has a multi-value secret, the variable containing
references to secrets will be saved with `ids: string[]`:
```js
"connection_string": {
"type": "password",
"value": {
"ids": [
"c9A385UBLd_jDJtMILH5",
"ddA385UBLd_jDJtMILH5"
],
"isSecretRef": true
}
}
```
There is no change for secrets with single values, the reference will
still be saved with `id: string`. There is also no change to the
`secret_references` block.
The policy editor will display the multi-value secrets like this when
creating:
<img width="747" alt="image"
src="https://github.com/user-attachments/assets/1c7128b7-3716-43ec-86a8-16778d4cf30e"
/>
And when editing/replacing:
<img width="750" alt="image"
src="https://github.com/user-attachments/assets/296bed1f-d9f4-49af-a810-c23b42d77139"
/>
## Testing
1. Download and upload test package
[azure-1.20.5-next.zip](https://github.com/user-attachments/files/19574682/azure-1.20.5-next.zip),
which modifies `connection_string` to be multi-value secret and updates
associated agent handlebars templates
- You may get an error about integration name not found, I'm not sure
what that error is, but the package will still be uploaded
2. Test adding the above version of Azure package policy with multiple
connection strings
3. Check that the agent yaml compiles correctly
4. Test editing, deleting the policies etc
### Checklist
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
This PR adds 9.0 GA release notes for Kibana.
- [x] convert the [9.0.0rc1 release
notes](https://github.com/elastic/stack-docs/blob/9.0/docs/en/install-upgrade/release-notes/release-notes-kibana.asciidoc)
into markdown to prepare for the release to the new docs site
- [x] Add anchors `$$$kibana-PR$$$` to breaking changes for links from
Upgrade Assistant. cc @lcawl FYI
- [x] Run release notes tool for post-rc1 changes
- [x] Reviews
## For reviewers
Preview link:
https://docs-v3-preview.elastic.dev/elastic/kibana/pull/215772/release-notes/
Release notes are adopting a new structure from 9.0, identical across
all Elastic products. Pages are broken down as follows:
- A main page listing all new features, enhancements, and bug fixes.
Each new release gets added to the same page. (9.1 will be above 9.0,
etc.)
- Subpages for breaking changes, deprecations, and known issues.
- There is no longer a "What's new page". This is replaced with a link
to the blog's release announcement from this page, that will be the
"home page" for release notes in the new assembled docs website:
https://staging-website.elastic.co/docs/release-notes/ (not visible in
this PR)
---------
Co-authored-by: wajihaparvez <wajiha.parvez@elastic.co>
## Summary
This PR makes changes to the GroupedAlertTable code to support a
behavior in the AI for the SOC Alert summary page that the current code
cannot.
In the new Alert summary page (see
[mocks](https://www.figma.com/design/DYs7j4GQdAhg7aWTLI4R69/AI4DSOC?node-id=3284-69401&p=f&m=dev))
there are a few customization that we need to be able to do:
- we need a different set of default groups to be shown in the dropdown
- we need to be able to customize the title shown in the EuiAccordion in
a way that would conflict with the current implementation
- we need to also customize the group statistics shown in the
EuiAccordion
### Challenge
The current implementation within the GroupedAlertTable was not allowing
full customization.
- while the default groups could be changed, it was done via if/else
conditions, using the `tableId` to know where the table was being used.
This isn't a clean way to do this. The component shouldn't be aware of
where it's being used...
- regarding the title and group statistics, these were hardcoded and not
customizable. While I could also have added if/else conditions to
support the Alert summary page different behavior, this would only have
built more tech debt...
### Approach
Instead of continuing adding more if/else conditions, the approach in
the PR adds 3 new props to the GroupedAlertTable:
- `accordionButtonContent` allows to customize how the EuiAccordion
`buttonContent` (title) is rendered
- `accordionExtraActionGroupStats` allows to customize how the
EuiAccordion `extraAction` (statistics) are rendered. This actually
consists of 2 sub properties:
- `renderer` which will drive the UI
- aggregations which will be used to fetch the data
- `defaultGroupingOptions` allows to customize the default values in the
dropdown
### Notes
**_The 3 places where the GroupedAlertTable is used have been updated to
use the same default values. Their behavior should be unchanged. A
follow up PR will implement the Alert summary variation._**
In the new state, any new usage of the alerts table with no default
values will provide the following behavior:
- the EuiAccordion `buttonContent` will use [the default
component](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-grouping/src/components/accordion_panel/index.tsx#L33)
from the `kbn-grouping` package
- the EuiAccordion `extraAction` will display only the number of alerts
within the group
- the default options in the `Group alerts by` dropdown will be `None`
and `Custom field`
https://github.com/user-attachments/assets/57563735-78ee-455f-aab6-806028aec713https://github.com/user-attachments/assets/0659c74e-b4a0-4051-8fb7-25457424c06b
### Checklist
- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
Will help https://github.com/elastic/security-team/issues/11973
Related to https://github.com/elastic/kibana/pull/216399
PR
* updates `useStateFromPublishingSubject` to require `subject`, thus,
removing complexities of setting up subscription when `subject` is
optionally provided.
* Updates `useStateFromPublishingSubject` to setup subscription with
`useMemo` to avoid timing issues.
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
## Summary
Some users using the security AI assistant through the API may want to
disable content references (aka citations) programmatically. This PR
allows users to disable content references using the
`content_references_disabled` query arg in the following routes:
- POST
/internal/elastic_assistant/actions/connector/gpt4oAzure/_execute?content_references_disabled=true
- POST
/api/security_ai_assistant/chat/complete?content_references_disabled=true
## How to test:
Bellow are 2 example curl requests (with
content_references_disabled=true). When executed, you will notice that
the response stream does not contain the string `{reference(...)}`
anywhere. If you remove the query arg, the reference will be visible.
####
/internal/elastic_assistant/actions/connector/gpt4oAzure/_execute?content_references_disabled=true
```curl
curl --location 'http://localhost:5601/internal/elastic_assistant/actions/connector/gpt4oAzure/_execute?content_references_disabled=true' \
--header 'Accept: */*' \
--header 'Accept-Language: en-GB,en-US;q=0.9,en;q=0.8' \
--header 'Connection: keep-alive' \
--header 'Content-Type: application/json' \
--header 'Origin: http://localhost:5601' \
--header 'Referer: http://localhost:5601/app/security/dashboards?sourcerer=(default:(id:security-solution-default,selectedPatterns:!()))&timeline=(activeTab:query,graphEventId:%27%27,isOpen:!f)' \
--header 'Sec-Fetch-Dest: empty' \
--header 'Sec-Fetch-Mode: cors' \
--header 'Sec-Fetch-Site: same-origin' \
--header 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36' \
--header 'elastic-api-version: 1' \
--header 'kbn-build-number: 9007199254740991' \
--header 'kbn-version: 9.1.0' \
--header 'sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"' \
--header 'sec-ch-ua-mobile: ?0' \
--header 'sec-ch-ua-platform: "macOS"' \
--header 'x-elastic-internal-origin: Kibana' \
--header 'x-kbn-context: %7B%22type%22%3A%22application%22%2C%22name%22%3A%22securitySolutionUI%22%2C%22url%22%3A%22%2Fapp%2Fsecurity%2Fdashboards%22%2C%22page%22%3A%22list%22%7D' \
--header 'Authorization: Basic ZWxhc3RpYzpjaGFuZ2VtZQ==' \
--data '{
"subAction": "invokeStream",
"actionTypeId": ".gen-ai",
"replacements": {},
"message": "What is elastic security? Include citations",
"screenContext": {
"timeZone": "Asia/Calcutta"
},
"alertsIndexPattern": ".alerts-security.alerts-default",
"size": 100
}'
```
####
/api/security_ai_assistant/chat/complete?content_references_disabled=true
```curl
curl --location 'http://localhost:5601/api/security_ai_assistant/chat/complete?content_references_disabled=true' \
--header 'Content-Type: application/json' \
--header 'Accept: application/octet-stream' \
--header 'kbn-xsrf: 123' \
--header 'Authorization: Basic ZWxhc3RpYzpjaGFuZ2VtZQ==' \
--data '{
"messages": [
{
"role": "user",
"content": "what is semantic text in esql. Include references to the product documentation"
}
],
"persist": false,
"connectorId": "gpt4oAzure",
"isStream": false
}'
```
### Checklist
Check the PR satisfies following conditions.
Reviewers should verify this PR satisfies this list as well.
- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [x]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [x] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
### Identify risks
Does this PR introduce any risks? For example, consider risks like hard
to test bugs, performance regression, potential of data loss.
Describe the risk, its severity, and mitigation for each identified
risk. Invite stakeholders and evaluate how to proceed before merging.
- [ ] [See some risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)
- [ ] ...
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
## Summary
This PR improves waiting for Alerts table to be loaded.
Relying on the first alert might cause flakiness in the future test
cases, I changed the rule name to be unique for test run and search
alert based on its rule name, not the first row.
If the alert is missing or it has a wrong name, the test will fail with
clear message:
```
Error: Alert with rule 'xys' is not displayed
Timed out 10000ms waiting for expect(locator).toBeVisible()
Locator: locator('div.euiDataGridRow').filter({ hasText: 'xys' })
Expected: visible
Received: <element(s) not found>
Call log:
- Alert with rule 'xys' is not displayed with timeout 10000ms
- waiting for locator('div.euiDataGridRow').filter({ hasText: 'xys' })
```
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
## 📓 Summary
These changes update the samples filters available during a processors
simulation.
Although this is a temporary update before we get a more complete
filtering experience, it improve filtering the docs by the simulation
status.
https://github.com/user-attachments/assets/a5c4c22a-6833-4744-bee5-e90a2ac1a389
## Summary
Currently, our `requiredPrivileges` structure supports `allRequired` and
`anyRequired` for defining authorization logic. However, there is [a
need to
support](https://github.com/elastic/kibana/pull/205335#issuecomment-2569275302)
more complex scenarios as `(privilege1 AND privilege2) OR (privilege3
AND privilege4)`
To achieve `anyRequired` has been extended to allow defining multiple
AND conditions evaluated with OR logic:
```ts
security: {
authz: {
requiredPrivileges: [{
anyRequired: [
{ allOf: ['privilege1', 'privilege2'] },
{ allOf: ['privilege3', 'privilege4'] }
]
}
]
}
}
```
`allRequired` now also supports scenarios `(privilege1 OR privilege2)
AND (privilege3 OR privilege4)`
```ts
security: {
authz: {
requiredPrivileges: [{
allRequired: [
{ anyOf: ['privilege1', 'privilege2'] },
{ anyOf: ['privilege3', 'privilege4'] }
]
}
]
}
}
```
> [!IMPORTANT]
> We expect to have unique privileges in `anyOf` or `allOf` conditions,
assuming that most complex conditions can be simplified by boolean
algebra laws (OR/AND distributive etc).
### Checklist
- [x]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
__Closes: https://github.com/elastic/kibana/issues/210977__
---------
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
