Commit graph

82520 commits

Author SHA1 Message Date
Dzmitry Lemechko
44855c5347
Merge branch 'main' into renovate/main-axe-core 2025-01-10 09:39:21 +01:00
Alejandro Fernández Haro
41a42555f9
[Cloud Experiments] Flag as private (#206121) 2025-01-10 09:17:40 +01:00
Stratoula Kalafateli
feefa77668
[ES|QL] Allows the editor suggestions to be visible when inline docs flyout is open (#206064)
## Summary

Closes https://github.com/elastic/kibana/issues/199299

Changes the flyout z-index in order the suggestions to be visible when
the docs are open.


![image
(75)](https://github.com/user-attachments/assets/e13595d0-e98c-4e7b-9673-a6e3d011fee7)
2025-01-10 08:21:32 +01:00
Kibana Machine
6a4f4ea346
[api-docs] 2025-01-10 Daily api_docs build (#206196)
Generated by
https://buildkite.com/elastic/kibana-api-docs-daily/builds/948
2025-01-10 07:17:40 +00:00
elastic-renovate-prod[bot]
f17c63b033
Update dependency axe-core to ^4.10.2 2025-01-10 02:11:25 +00:00
Davis McPhee
518e0afbde
[Discover] Format JSON messages in Observability Logs profile (#205666)
## Summary

This PR updates the Observability Logs profile to detect and auto format
JSON message values within both the Log overview doc viewer tab and the
Summary cell popover. Additionally, it enables CTRL/CMD + F find
functionality within the doc viewer JSON tab for all contexts to make it
easier for users to search the JSON output.

JSON message formatting:

![json](https://github.com/user-attachments/assets/a7c63afd-bef7-4050-b8cf-08e4f469ffa9)

JSON tab find functionality:

![find](https://github.com/user-attachments/assets/aac51e05-6126-4770-8976-0d9057bad557)

### Checklist

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
2025-01-09 20:05:18 -04:00
Nick Partridge
d96168c64f
[User] Prevent disabled input change by password manager (#204269)
Prevents username input from being edited by password manager extensions when `disabled`
2025-01-09 16:48:03 -06:00
Alex Szabo
b3b81331b5
[ci] Work around docosaurus errors (#206097)
## Summary
This workaround removes the folder that needs to be built differently
after cloning the repos.

See: https://github.com/elastic/kibana/issues/206077
2025-01-09 16:33:30 -06:00
Bharat Pasupula
668d88e19e
[Automatic Import ] Enable inference connector for Auto Import (#206111)
## Summary

Enables new inference connector in the Automatic Import.

This PR also fixes the use of `inferenceEnabled` from
`useAssistantContext` since it is not available in AutoImport.

## To test

1. Update the value for `inferenceConnectorOn` to `true` in
`x-pack/platform/plugins/shared/stack_connectors/common/experimental_features.ts`
2. Create an inference connector using [OpenAI
creds](https://p.elstc.co/paste/36VivuC+#TnP7-Z7wBKDUg8fQ/lTycSCdwUxEEbHcyQ/Q0i3oEmO).
Configure the inference endpoint for completion and name the endpoint
`openai-completion-preconfig`
3. Now that the inference endpoint is created, add a [preconfigured
connector](https://p.elstc.co/paste/tFWF3LSA#0thBRW05e6KSSkLCDjQiH8GkECQySBiHm6zRMCUThlf)
with the same credentials.
4. Select the preconfigured selector in Automatic Import.
5. Test the Auto Import flow works.

---------

Co-authored-by: Steph Milovic <stephanie.milovic@elastic.co>
2025-01-09 22:04:33 +00:00
Larry Gregory
a9f5f432ad
Dependency ownership refinements (#205937)
## Summary

This PR assigns owners for dependencies that are not yet claimed. These
assignments were a "best effort", and will likely need tweaking once
downstream teams start receiving renovate PRs.
2025-01-09 18:33:38 +00:00
Marco Vettorello
75a401ffec
[Lens] Align Lens style with Borealis (#204839)
## Summary

This PR updates the style of Lens to align it with the new Borealis
theme.
It covers the set of tasks in #203050 within the `Lens editor panels`
list.

Comments are applied in order as in the mentioned issue

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2025-01-09 19:28:37 +01:00
Jason Rhodes
d7723168a5
Adds notification settings for unsupported ftr tests (synthetics, inventory) (#206085)
## Summary

Based on [work by @v1v to notify Slack teams when there are unsupported
FTR failures](https://github.com/elastic/kibana/pull/205260), I've added
the remaining ones for synthetics and inventory tests here.
2025-01-09 13:02:16 -05:00
Ash
b25c9984bb
[SecuritySolutions][Endpoint] Microsoft defender for Endpoint response actions API (#205097)
## Summary

- Adds response actions client/APIs for isolate and release actions for
Microsoft Defender for Endpoint
- The feature is behind a feature flag
`responseActionsMSDefenderEndpointEnabled`
2025-01-09 11:59:56 -05:00
Dima Arnautov
737cf96809
[ML] Transforms: Improve messages for recovered alerts (#205721) 2025-01-09 17:53:09 +01:00
Janki Salvi
a56227bf37
[ResponseOps][Rules] Allow to set notify when and throttle at rule level (#203235)
## Summary

Fixes https://github.com/elastic/kibana/issues/199494

This PR allows to create and update rule with `notify_when` and
`throttle` attributes at rule level instead of `action.frequency` level.

### How to test
- create a rule via api where `notify_when` and `throttle` attributes
are at rule level
  <details><summary>Example</summary>
  Note: use your existing connector for action
  
  ```typescript
  POST kbn:/api/alerting/rule
  {
    "tags": [],
    "params": {
      "searchConfiguration": {
        "query": {
          "query": "",
          "language": "kuery"
        },
        "index": "ff959d40-b880-11e8-a6d9-e546fe2bba5f"
      },
      "timeField": "order_date",
      "searchType": "searchSource",
      "timeWindowSize": 5,
      "timeWindowUnit": "d",
      "threshold": [
        10
      ],
      "thresholdComparator": ">",
      "size": 100,
      "aggType": "count",
      "groupBy": "all",
      "termSize": 5,
      "excludeHitsFromPreviousRun": false,
      "sourceFields": []
    },
    "schedule": {
      "interval": "1m"
    },
    "consumer": "stackAlerts",
    "name": "ES query rule from devtools",
    "rule_type_id": ".es-query",
    "notify_when": "onThrottleInterval",
    "throttle": "1h",
    "actions": [
      {
        "group": "query matched",
        "id": "ad923c8a-d27d-41a9-8c71-d33d94db4abb",
        "params": {
          "documents": [
            {
              "name": "{{rule.name}}"
            }
          ]
        }
      }
    ],
    "alert_delay": {
      "active": 1
    }
  }
  ``` 
  </details> 

- open the created rule
- go to `settings` tab 
- verify that dropdowns reflect notify_when and throttle value correctly
- update the rule via UI and verify the same
- update the rule via API and verify the same

### Flaky test runner: 
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/7684

### Checklist

Check the PR satisfies following conditions. 

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2025-01-09 16:18:28 +00:00
wajihaparvez
fea598ea13
[Docs] Add wolfi image info (#205022)
## Summary

Adds information about using Wolfi container images to the Install with
Docker page.

Closes: [#594](https://github.com/elastic/platform-docs-team/issues/594)
2025-01-09 16:10:59 +00:00
Jedr Blaszyk
542a56b482
[Search serverless / Connectors FTRs] Update test role to developer (#206067)
## Summary

`viewer` role is not sufficient to call Connector APIs with new change
https://github.com/elastic/elasticsearch/pull/119863

Update the FTR tests to use developer role for testing
2025-01-09 15:45:30 +00:00
Viduni Wickramarachchi
37d7a5efb7
[Obs AI Assistant] Unskip user instructions test (#205656) (#205897)
Closes https://github.com/elastic/kibana/issues/205656

## Summary

### Problem
There seems to be a race condition and state contamination between tests
in the KB user instructions tests.

### Solution
- Clear knowledge base and conversations after tests
- Remove title interceptor --> we don't need title interception for
these tests

### Checklist

- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
2025-01-09 10:01:15 -05:00
Rodney Norris
75fe22b604
[Search] Remove Enterprise Search UI Apps (#205634)
## Summary

Removing app search & workplace search kibana applications from
`enterprise_search` plugin. This will be the first of many PRs to remove
code related to the enterprise search node.

### Checklist

- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2025-01-09 15:55:18 +01:00
Sergi Romeu
45f3241db0
[APM] Fix Deep Links Cypress Flaky Test (#206000)
## Summary

Closes https://github.com/elastic/kibana/issues/205936

This PR aims to solve the flakiness of deep_links.cy test.

- Instead of doing everything under 2 tests, we run a test for each
assertion and clean everything up.
- Ensures scroll div has content to be able to scroll
- scrolls to center or bottom depending on the position
2025-01-09 13:54:11 +00:00
Georgiana-Andreea Onoleață
49690d7a11
[ResponseOps][Rules]Hide number of conditions on Rule page when Rule type do not allow multiple conditions (#204385)
Closes https://github.com/elastic/kibana/issues/194809

## Summary

The "Conditions" section on the Rule page definition list is now hidden
for the rule types that don't allow multiple conditions


https://github.com/user-attachments/assets/eed1518a-91c4-453c-8294-643f86f05e30


todo: add/change tests
2025-01-09 15:51:29 +02:00
Nick Peihl
ce072268aa
[Dashboard] Add functional test for panel listing types (#205808)
Fixes #192663

## Summary

Add functional tests that verify the number of panel types registered in
the dashboards Add panel flyout. Any changes to the number of registered
panel types will trigger a review from the
`@elastic/kibana-presentation` team.

This PR also adds an additional test for panel types registered with an
advanced license.
2025-01-09 08:37:29 -05:00
Elena Shostak
d4196cd902
Fleet Privileges Display (#204402)
## Summary

Fixed privileges display for features/subFeatures that require all
spaces.

### Before
Role privileges display for only `Default` space selected

<img width="728" alt="Screenshot 2024-12-17 at 13 32 17"
src="https://github.com/user-attachments/assets/151b7012-aa1a-430c-be22-cc91e64362e3"
/>

Privileges summary display for only `Default` space selected

<img width="471" alt="Screenshot 2024-12-17 at 13 32 50"
src="https://github.com/user-attachments/assets/964c2223-163d-4081-a37d-196f5df5df5c"
/>

### After
Role privileges display for only `Default` space selected

<img width="739" alt="Screenshot 2024-12-17 at 13 30 00"
src="https://github.com/user-attachments/assets/0f98a9d7-211d-46ec-82c6-25d29a44be6b"
/>

Privileges summary display for only `Default` space selected

<img width="569" alt="Screenshot 2024-12-17 at 13 30 19"
src="https://github.com/user-attachments/assets/932771fd-6486-4b7e-9de5-6cd34ab74dc9"
/>

### How to test
With `Default` space:
1. Navigate to Creating a new Role and assign Kibana privileges.
2. Set the Spaces to `Default` Space and the privilege level to All.
3. Navigate to Management category and verify that Fleet is set to
`None`.
4. Click on "View privilege summary" and verify that Fleet is set to
`None`.

With `*All Spaces`:
1. Navigate to Creating a new Role and assign Kibana privileges.
2. Set the Spaces to `*All Spaces` and the privilege level to All.
3. Navigate to Management category and verify that Fleet is set to `All`
4. Click on "View privilege summary" and verify that Fleet is set to
`All`


### Checklist

Check the PR satisfies following conditions. 

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

__Fixes: https://github.com/elastic/kibana/issues/194686__

## Release Note
Fixed privileges display for features/subFeatures that require all
spaces.

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2025-01-09 14:22:51 +01:00
jennypavlova
13582aa458
[ECO][Inventory v2] Hosts entity summary endpoint changes (#203617)
## Summary

Closes #202300

This PR changes the entity client function to v2 (`searchEntities`) in
`getLatestEntity`. After the change to use `v2.searchEntities` the
parameters are also updated to include the time range (`start` and `end`
are required)

## Testing
~- We can create some definitions manually- in the Kibana DEV tools: ~ -
Not needed after we merged the V2 PR

- In a local environment enable the entities feature flag ( it should be
a clean env as the entities should not be enabled before ):
<img width="1911" alt="image"
src="https://github.com/user-attachments/assets/75d6f77d-5039-41ca-80ca-34c3bf99844e"
/>

- Some hosts and containers are required - oblt cluster/metricbeat or
   - Create hosts using synthtrace: 
       ```
node scripts/synthtrace infra_hosts_with_apm_hosts
--scenarioOpts.numInstances=20
       ```
   - Create containers using synthtrace: 
       ```
       node scripts/synthtrace infra_docker_containers.ts
       ```

- In the UI 
- Open asset details view for hosts and containers and check the summary
endpoint response:
  ⚠️ Updated: 


![image](https://github.com/user-attachments/assets/27683b74-f0b5-43a0-9a8f-98cd2a61e68e)

- If the entities FF is disabled (default: no `logs` should be part of
the `sourceDataStreams`):


![image](https://github.com/user-attachments/assets/7b8851b4-514c-4fc7-ab84-720b2ccb16ae)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Sergi Romeu <sergi.romeu@elastic.co>
2025-01-09 13:17:37 +00:00
elastic-renovate-prod[bot]
a54045841c
Update dependency @xyflow/react to ^12.3.6 (main) (#204459)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@xyflow/react](https://reactflow.dev)
([source](https://togithub.com/xyflow/xyflow/tree/HEAD/packages/react))
| dependencies | patch | [`^12.3.5` ->
`^12.3.6`](https://renovatebot.com/diffs/npm/@xyflow%2freact/12.3.5/12.3.6)
|

---

### Release Notes

<details>
<summary>xyflow/xyflow (@&#8203;xyflow/react)</summary>

###
[`v12.3.6`](https://togithub.com/xyflow/xyflow/blob/HEAD/packages/react/CHANGELOG.md#1236)

[Compare
Source](https://togithub.com/xyflow/xyflow/compare/@xyflow/react@12.3.5...@xyflow/react@12.3.6)

##### Patch Changes

- [#&#8203;4846](https://togithub.com/xyflow/xyflow/pull/4846)
[`75017939`](7501793900)
Thanks [@&#8203;moklick](https://togithub.com/moklick)! - Make it
possible to use expandParent with immer and other immutable helpers

- [#&#8203;4865](https://togithub.com/xyflow/xyflow/pull/4865)
[`2c4acc2b`](2c4acc2bd9)
Thanks [@&#8203;moklick](https://togithub.com/moklick)! - Add group node
to BuiltInNode type. Thanks
[@&#8203;sjdemartini](https://togithub.com/sjdemartini)!

- [#&#8203;4877](https://togithub.com/xyflow/xyflow/pull/4877)
[`9a8309da`](9a8309dab8)
Thanks [@&#8203;peterkogo](https://togithub.com/peterkogo)! - Fix
intersections for nodes with origins other than \[0,0]. Thanks
[@&#8203;gmvrpw](https://togithub.com/gmvrpw)!

- [#&#8203;4844](https://togithub.com/xyflow/xyflow/pull/4844)
[`6f11e552`](6f11e552c3)
Thanks [@&#8203;moklick](https://togithub.com/moklick)! - Allow custom
data-testid for ReactFlow component

- [#&#8203;4816](https://togithub.com/xyflow/xyflow/pull/4816)
[`43aa52a8`](43aa52a8cd)
Thanks [@&#8203;moklick](https://togithub.com/moklick)! - Type
isValidConnection prop correctly by passing EdgeType

- [#&#8203;4855](https://togithub.com/xyflow/xyflow/pull/4855)
[`106c2cf8`](106c2cf8e5)
Thanks [@&#8203;mhuggins](https://togithub.com/mhuggins)! - Support
passing `path` element attributes to `BaseEdge` component.

- [#&#8203;4862](https://togithub.com/xyflow/xyflow/pull/4862)
[`adf4fb4e`](adf4fb4e7b)
Thanks [@&#8203;bcakmakoglu](https://togithub.com/bcakmakoglu)! -
Prevent default scrolling behavior when nodes or a selection is moved
with an arrow key press.

- [#&#8203;4875](https://togithub.com/xyflow/xyflow/pull/4875)
[`41d4743a`](41d4743a69)
Thanks [@&#8203;peterkogo](https://togithub.com/peterkogo)! - Prevent
unnecessary rerenders of edges when resizing the flow.

- [#&#8203;4826](https://togithub.com/xyflow/xyflow/pull/4826)
[`5f90acda`](5f90acdab1)
Thanks [@&#8203;chrtze](https://togithub.com/chrtze)! - Forward ref of
the div inside Panel components.

- Updated dependencies
\[[`d60331e6`](d60331e6ba)]:
-
[@&#8203;xyflow/system](https://togithub.com/xyflow/system)[@&#8203;0](https://togithub.com/0).0.47

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://togithub.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40MjUuMSIsInVwZGF0ZWRJblZlciI6IjM3LjQyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJUZWFtOkNsb3VkIFNlY3VyaXR5IiwiYmFja3BvcnQ6YWxsLW9wZW4iLCJyZWxlYXNlX25vdGU6c2tpcCJdfQ==-->

Co-authored-by: elastic-renovate-prod[bot] <174716857+elastic-renovate-prod[bot]@users.noreply.github.com>
2025-01-09 13:04:20 +00:00
Alberto Blázquez
1e9606de9c
Turn AssetInventory sub-plugin into a Security solution page (#205363)
## Summary

Turn AssetInventory plugin into a simple Security solution page based on
this conversation:
- https://github.com/elastic/security-team/issues/10346

Follow-up of this work, where we initially developed the Asset Inventory
bare-bones as a plugin:
- https://github.com/elastic/kibana/issues/201704

Part of this work stream though not originally planned:
- https://github.com/elastic/security-team/issues/11247?reload=1

### Motivation

Reasoning behind is enabling fast development changes without any major
refactors in other packages/components that need to be reused, which
seems impossible as of now with the current codebase.

### Checklist

- [x] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [x] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

### Identify risks

In the future, we'll probably have to turn AssetInventory into a
sub-plugin again. Doing so doesn't bring any risk in the present, and
should only involve the re-generation of the deleted files in this PR.

---------

Co-authored-by: Paulo Henrique <paulo.henrique@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2025-01-09 13:53:31 +01:00
Angela Chuang
0c0dd631bb
[Security Solution][threat hunting explore] EUI refresh: Rename color variables (#204908)
## Summary

https://github.com/elastic/kibana/issues/202499

### Running Kibana with the Borealis theme
In order to run Kibana with Borealis, you'll need to do the following:

Set the following in kibana.dev.yml:
uiSettings.experimental.themeSwitcherEnabled: true

Run Kibana with the following environment variable set:
KBN_OPTIMIZER_THEMES="borealislight,borealisdark,v8light,v8dark" yarn
start

This will expose a toggle under Stack Management > Advanced Settings >
Theme version, which you can use to toggle between Amsterdam and
Borealis.


![Image](https://github.com/user-attachments/assets/78d64946-43fc-4400-bbb1-229d900b7f05)

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2025-01-09 12:47:25 +00:00
Angela Chuang
78dfe5f81e
[Security Solution][threat hunting explore] EUI refresh: Remove custom color hex (#204631)
## Summary

https://github.com/elastic/kibana/issues/202498
https://github.com/elastic/kibana/issues/202503

1. This PR does **Not** include the severity color change. It will be
implemented in a follow up PR once color tokens have been decided.
2. This PR updates the type `GetLensAttributes` to accept `euiTheme`, so
all the functions in this type are updated accordingly.

https://github.com/elastic/kibana/pull/204631/files#diff-abe20658865cad59eadcff945552b40832d96da0264ed89ddd5ab25ded1420a3R30

----

## To test:

Please verify if visualizations are displayed properly.

### Running Kibana with the Borealis theme
In order to run Kibana with `Borealis`, you'll need to do the following:

1. Set the following in kibana.dev.yml:
`uiSettings.experimental.themeSwitcherEnabled: true`
4. Run Kibana with the following environment variable set: 
```KBN_OPTIMIZER_THEMES="borealislight,borealisdark,v8light,v8dark" yarn start```

5. This will expose a toggle under Stack Management > Advanced Settings > Theme version, which you can use to toggle between Amsterdam and Borealis.


![Image](https://github.com/user-attachments/assets/78d64946-43fc-4400-bbb1-229d900b7f05)

----


### Explore


<img width="2557" alt="host_after" src="https://github.com/user-attachments/assets/f69b6e2a-58f6-4ed4-9f38-dcdbcf9919ed" />
<img width="1281" alt="users_after" src="https://github.com/user-attachments/assets/0eec8e9c-e678-4a66-83ee-4b8d11380b8e" />
<img width="2552" alt="network_dns" src="https://github.com/user-attachments/assets/19f06d2a-6e51-419b-9f89-233bfa5727ba" />
<img width="2557" alt="network_after" src="https://github.com/user-attachments/assets/3b90c5e2-23a1-4f15-a2d0-f9290a39af30" />

----

### Dashboards

<img width="2557" alt="dashboard_overview" src="https://github.com/user-attachments/assets/c1873359-fee9-42c6-addd-fe2bc1c98aee" />
<img width="2558" alt="dashboard_detection_response_2" src="https://github.com/user-attachments/assets/f6853710-0938-402b-b326-fa00d586b5d6" />
<img width="2559" alt="dashboard_detection_response_1" src="https://github.com/user-attachments/assets/4eb75526-9a57-46e9-b090-b53353956ea1" />

----


### Alerts
<img width="2555" alt="alerts_chart_collapsed" src="https://github.com/user-attachments/assets/6ecf5dd5-a785-4701-900b-0454f024b36d" />
<img width="2554" alt="summary" src="https://github.com/user-attachments/assets/1731a6ea-ef2b-4d7d-bf21-4041e59f0ad4" />
<img width="2559" alt="trend" src="https://github.com/user-attachments/assets/b9a741d1-a359-4273-9555-850cdcbc8932" />
<img width="2557" alt="counts" src="https://github.com/user-attachments/assets/a6193ccc-86b8-4974-ad9f-9417e200e859" />
<img width="1281" alt="treemap" src="https://github.com/user-attachments/assets/7b6e163a-a660-4bb1-a6de-88e21934b98a" />

----

### Rules preview
<img width="2556" alt="Screenshot 2024-12-18 at 13 45 33" src="https://github.com/user-attachments/assets/47099c18-86ee-455a-a5af-ebd6a29904a5" />


----

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2025-01-09 12:46:55 +00:00
Antonio
5235234640
[ResponseOps][Rules] Moved params of anomaly detection rules to a separate package (#205497)
Connected with #195189

## Summary

- Moved params of anomaly detection rule type to
`/response-ops/rule_params/anomaly_detection/`
- Moved params of anomaly detection jobs health rule type to
`/response-ops/rule_params/anomaly_detection_jobs_health/`

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2025-01-09 11:58:40 +00:00
Milosz Marcinkowski
96ea0102b6
[Profiling UI] Remove redundant page separator (#206004)
Closes #206002

## Summary

This PR removes redundant page separator to save up some space.

Before:

<img width="1727" alt="Screenshot 2025-01-08 at 16 16 50"
src="https://github.com/user-attachments/assets/9f69ebb2-d1a7-430e-9d9e-376712909ac1"
/>

After: 

<img width="1728" alt="Screenshot 2025-01-08 at 16 19 34"
src="https://github.com/user-attachments/assets/9d738aa0-adba-46f3-ba79-5f20b7b90499"
/>
2025-01-09 11:37:39 +00:00
Alejandro Fernández Haro
1b54898c30
[Upgrade Assistant] Reindexing optimizations (#205055) 2025-01-09 12:37:30 +01:00
Elena Stoeva
542da4a773
[Data Streams] Improve jest tests for bulk actions (#204938)
Follow-up to https://github.com/elastic/kibana/pull/203083

## Summary

This PR improves the jest tests for bulk actions in data streams.
2025-01-09 10:03:14 +00:00
Jusheng Huang
74da51f917
[Fleet] Fix required validation for multi text input field (#205768)
## Summary

Fixes #196648 

-   add required validation to blank spaces value
-  when adding additional rows for path. It seems that the updated
value is specially processed.

**And this is why the required validation is not triggered when clicking
to add a row.**


![image](https://github.com/user-attachments/assets/f2f0d813-3762-47c5-bf31-1171c82c3b07)

## After fixup


![image](https://github.com/user-attachments/assets/857bef47-38c1-4951-8ea9-15b5ef5d143d)
2025-01-09 10:58:53 +01:00
Hanna Tamoudi
aff921700c
[Automatic import] readme input types templates (#194308) 2025-01-09 10:35:15 +01:00
Joe Reuter
3515a0f7b8
🌊 Streams: Show data retention on stream (#204125)
Show data retention on streams

In case of a policy, the name of the policy is shown (badge is clickable
and leads to the edit page of the policy):
<img width="524" alt="Screenshot 2024-12-12 at 20 57 36"
src="https://github.com/user-attachments/assets/2664b45b-2473-49c4-b1d6-dccb8fe48d43"
/>

In case of DLM, the effect retention is shown:
<img width="532" alt="Screenshot 2024-12-12 at 20 58 42"
src="https://github.com/user-attachments/assets/07ca8086-75e2-45f8-9d71-17bd0a76ebe5"
/>

This is just the display piece, editing retention will be added later
on.

This PR adjusts the base streams data stream settings to use a localized
data stream retention configuration to make it compatible with
serverless.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2025-01-09 09:25:19 +01:00
Miriam
5d65a48134
[ObsUX] Use styled from @emotion in log-stream component (#205918)
Closes https://github.com/elastic/kibana/issues/205683

LogStream embeddable loads correctly

<img width="1486" alt="Screenshot 2025-01-08 at 15 08 46"
src="https://github.com/user-attachments/assets/7e53e7ba-2b86-471d-9fb0-39ae54b7f919"
/>
2025-01-09 08:07:08 +00:00
Pierre Gayvallet
5b96912781
[NL-to-ESQL] update internal documentation (#205853)
## Summary

Fix https://github.com/elastic/kibana/issues/205606

- Re-generate the internal ES|QL documentation using the generation
script (+ human review)
- Add more scenario to the NL-to-ESQL evaluation suite  
- Some prompt engineering
  - improving the system instructions / functions summary
  - add more examples to the summary
  - adapt a few opinionated examples for some specific functions 

## Evaluation

- average based on 4 runs for each model/branch tuple
- the new tests were locally added to main to run against the same suite
and properly evaluate the difference

| Model  | before (main) | after (PR) | delta |
| ------------- | ------------- | ------------- | ------------- |
| GPT-4o  | 90.9 | 97.74  | + 6.84 |
| Claude 3.5 Sonnet v2  |  88.58 | 96.49 | +7.91 |
| Gemini 1.5-pro-002  | 88.17  | 94.19 | +6.02 |

Overall, the prompt engineering somewhat significantly improved the
generation efficiency.
2025-01-09 08:04:29 +01:00
Pierre Gayvallet
8eec8065bd
[inference] handle toolCall indices not starting at 0 (#205954)
## Summary

Turns out, claude can in some situations (when returning both text and
toolcall in a single message) starts their toolcall index at `1` instead
of `0`, which introducing null values in the concatenated messages.

This fixes it, by removing null values from the tool calls when merging
the chunks.

Also remove the SKA codeowner override for the inference plugin to get
back the shared ownership
2025-01-09 08:00:31 +01:00
Matthias Wilhelm
cbcb24e036
[Discover] Unskip functional discover request counts test and skip ES|QL part (#205690)
Unskipping the main test, and unskipping the `ES|QL` part due to flakiness
2025-01-09 06:35:40 +01:00
Steph Milovic
7a63ae2e4c
[Security solution] CSS emotion/react fix (#205934) 2025-01-09 02:21:38 +00:00
Catherine Liu
0c2ba89389
[Inspector] EUI Visual Refresh Integration (#204436)
## Summary

Related to https://github.com/elastic/kibana/issues/203132.
Closes [#204595](https://github.com/elastic/kibana/issues/204595).

This replaces all references to euiThemeVars in favor of the useEuiTheme
hook in the inspector plugin.


### Checklist

Check the PR satisfies following conditions. 

Reviewers should verify this PR satisfies this list as well.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [ ] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

### Identify risks

Does this PR introduce any risks? For example, consider risks like hard
to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified
risk. Invite stakeholders and evaluate how to proceed before merging.

- [ ] [See some risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx)
- [ ] ...

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2025-01-09 01:26:25 +00:00
Marta Bondyra
ea6d7bef93
[Dashboard][Collapsable Panels] Respond to touch events (#204225)
## Summary

Adds support to touch events. The difference between these ones and
mouse events is that once they are active, the scroll is off (just like
in the current Dashboard)


https://github.com/user-attachments/assets/4cdcc850-7391-441e-ab9a-0abbe70e4e56

Fixes https://github.com/elastic/kibana/issues/202014
2025-01-08 23:59:46 +00:00
Dominique Clarke
c398818d72
[Synthetics] e2e tests - adjust navigating to pages and add video to help diagnose flaky test (#205420)
## Summary

Adjusts navigating to pages. Directly navigates to some pages instead of
clicking on a button to navigate. Also adds video for certain tests to
help with debugging any flakiness.
2025-01-08 16:36:31 -05:00
Gerard Soldevila
2be928c489
SKA: Categorise remaining packages (#205875)
## Summary

* Delete unused package `@kbn/formatters`
* Delete unused package `@kbn/response-ops-feature-flag-service`
* Flag `@kbn/generate-console-definitions` as `devOnly: true`
* Flag `@kbn/plugin-check` as `devOnly: true`
* Flag `@kbn/set-map` as `devOnly: true`
* Flag `@kbn/synthetics-private-location` as `devOnly: true`
* Categorise `@kbn/calculate-auto` as `platform/shared`
* Categorise `@kbn/charts-theme` as `platform/shared`
* Categorise `@kbn/saved-search-component` as `platform/shared`
* Categorise `@kbn/use-tracked-promise` as `platform/shared`
* Categorise `@kbn/charts-theme` as `platform/shared`
* Categorise `@kbn/response-ops-rule-form` as `platform/shared`
2025-01-08 22:20:14 +01:00
Tim Sullivan
63c0d185ef
[File Upload Component] Use forms.maxWidth styling from euiTheme (#205947)
## Summary

Follows https://github.com/elastic/eui/pull/8221
2025-01-08 13:58:33 -07:00
jennypavlova
d6e28f766a
[ECO][Inventory v2] Remove the landing page to enable the entity model (#205534)
Closes #203095
Closes https://github.com/elastic/kibana/issues/204263


## Summary

This PR removes the page for the enabling functionality and welcome
screen. After the migration to v2 API we don't need to enable it anymore
as we are not using transforms

### Before: 


![image](https://github.com/user-attachments/assets/0c8d5841-9189-4551-a1be-87801cfcf57d)


![image](https://github.com/user-attachments/assets/75a73dd8-6b16-452b-abcf-41e1fcca6645)

### After: 
The same without the extra step to enable the entities and the welcome
screen:
- No data: 

![image](https://github.com/user-attachments/assets/dbfdf501-36e7-4b6f-a8b6-ed0a6748ab62)

- With data:

![image](https://github.com/user-attachments/assets/0bbb2983-4e0a-477c-ac11-d2256b5ff854)

## Testing

- In a local environment enable the entities feature flag ( it should be
a clean env as the entities should not be enabled before ):
<img width="1911" alt="image"
src="https://github.com/user-attachments/assets/75d6f77d-5039-41ca-80ca-34c3bf99844e"
/>

- Go to Inventory 
- Check before and after ingesting data
- Synthtrace: `node scripts/synthtrace logs_traces_hosts.ts` - ~⚠️ this
case can't be checked before
https://github.com/elastic/kibana/pull/203452 is merged~ -
https://github.com/elastic/kibana/pull/203452 is merged 🎉
2025-01-08 19:30:17 +00:00
Sergi Massaneda
15a161142d
[SIEM migrations] Implement ES|QL lookups and other fixes (#204960)
## Summary

Adds support for ES|QL native LOOKUP JOIN operators for Splunk lookups. 

- Lookups import changes:
- Stores the lookups files as indices using `lookup_<lookup_name>`
pattern (queries fail if the name contains `-`)
- Indexes the lookups content data without duplicates (supports csv and
json/ndjson)
- Stores the lookup index name as the resource content that is passed to
the translation agent
- Fixes bug with `_lookup` suffix in the names coming from Splunk:
queries use the `_lookup` suffix, but files in the. lookup editor don't
have it)

- Lookups translation changes:
- Prompt for the `inline_query` node updated to support lookups,
replacing the splunk lookup name with the new Elastic lookup index name.
Placeholders for missing macros/lookups are now added in this node
instead of the `translate_query` node.
- Prompt for ES|QL translation updated to convert LOOKUP syntax and
ignore macro/lookups placeholders
  
- Other improvements on the agent graph:
- All rule migration nodes in the graph now generate a "summary"
explaining the reasoning behind each decision of the LLM, they are
displayed in the comments section of each rule translation.
- The inline query node was moved inside the translation sub-graph since
it's only needed there.
- Validation now is executed without placeholders, preventing it from
running all the iterations without being able to fix it.
- A deterministic node was added at the end to set the translation
result and ensure minimum defaults are met.
- Avoid inline_query LLM calls when a prebuilt rule matched or when the
Splunk query is unsupported
- Avoid prebuilt_rule matching LLM calls when no prebuilt rule is
retrieved from the semantic search.
- Avoid integration matching LLM calls when no integration is retrieved
from the semantic search.

- Other fixes
- Fixes bug which was setting translation `FULL` when we missed the
integration and index pattern (logs-*). Changed to `PARTIAL`
- Fixes bug where the description was missing for custom translated
rules, we now fallback to the splunk rule title if the description is
missing
  - Added summary comment for prebuilt rule matching

### Screenshots

#### New summary comments:

##### Prebuilt rule matching:

- matching
![prebuilt
matching](https://github.com/user-attachments/assets/63c86cd9-f06d-4664-89db-2fa36bdff838)

- not matching
![prebuilt not
matching](https://github.com/user-attachments/assets/3bd6bf7b-0564-416b-9b16-700b346dd95e)

##### Query inlining summary:

![Inlining
summary](https://github.com/user-attachments/assets/6bf88e61-e269-4d4b-a01f-1a009c622982)

##### Integration matching:

- matching:
![integration
matching](https://github.com/user-attachments/assets/a77e01d9-3a2e-4629-a575-905b6995d55d)

- not matching
![integration no
match](https://github.com/user-attachments/assets/ce21b0e4-e3a3-4e2c-b6d2-2114f8a7f146)

##### ES|QL translation


![translation](https://github.com/user-attachments/assets/d0dd0879-c9ce-44f3-aa44-e3b724cd5898)

Needs manual translation reason:

![unsupported](https://github.com/user-attachments/assets/45fd73b2-5fc0-4504-99bd-e263c01c3a11)


#### Lookups UI:

![UI](https://github.com/user-attachments/assets/c7271e47-b0a5-4b31-b5cf-d99285e108bf)

Lookup index example:
![lookup
index](https://github.com/user-attachments/assets/88c275b8-96dd-4770-804b-164b3e3d4f8f)

Translation
![lookup
translation](https://github.com/user-attachments/assets/647a6003-e930-407b-aaf2-02bc1ea95de6)

#### Test data


[rules.json](https://github.com/user-attachments/files/18208912/rules.json)

[all_macros.json](https://github.com/user-attachments/files/18208914/all_macros.json)

[lookups.zip](https://github.com/user-attachments/files/18208904/lookups.zip)
(uncompress before uploading)
2025-01-08 19:26:22 +00:00
Pierre Gayvallet
015911d2bb
Use default elser deployment for product documentation (#204760)
## Summary

Fix https://github.com/elastic/kibana/issues/204559

Use the default ELSER deployment (`.elser-2-elasticsearch`) for the
product documentation semantic_text fields instead of maintaining our
own custom deployment.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2025-01-08 20:17:14 +01:00
Søren Louv-Jansen
ad3b9880c7
[Obs AI Assistant] Use architecture-specific elser model (#205851)
Closes https://github.com/elastic/kibana/issues/205852

When installing the Obs knowledge base it will always install the model
`.elser_model_2`.
For Linux with an x86-64 CPU an optimised version of Elser exists
(`elser_model_2_linux-x86_64`). We should use that when possible.

After this change the inference endpoint will use
`.elser_model_2_linux-x86_64` on supported hardware:

![image](https://github.com/user-attachments/assets/fedc6700-877a-47ab-a3b8-055db53407d0)
2025-01-08 19:59:20 +01:00
Davis McPhee
8eb326d596
[Discover] Fix issue where KEEP columns are not applied after Elasticsearch error (#205833)
## Summary

This PR fixes an issue where columns are not applied correctly when
using the ES|QL `KEEP` command after an Elasticsearch error has
occurred.

Fixes #205353.

### Checklist

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [x] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
2025-01-08 14:20:24 -04:00