Commit graph

43 commits

Author SHA1 Message Date
Julia Rechkunova
7fa04e92bc
[Kibana] New "Saved Query Management" privilege to allow saving queries across Kibana (#166937)
- Resolves https://github.com/elastic/kibana/issues/158173

Based on PoC https://github.com/elastic/kibana/pull/166260

## Summary

This PR adds a new "Saved Query Management" privilege with 2 options:
- `All` will override any per app privilege and will allow users to save
queries from any Kibana page
- `None` will default to per app privileges (backward-compatible option)

<img width="600" alt="Screenshot 2023-09-21 at 15 26 25"
src="6d53548e-5c5a-4d6d-a86a-1e639cb77202">

### Checklist

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Matthias Wilhelm <matthias.wilhelm@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Stratoula Kalafateli <efstratia.kalafateli@elastic.co>
2023-09-29 11:52:39 +02:00
Shahzad
519c4d6249
[Synthetics] Added ability to hide public locations (#164863) 2023-09-14 17:49:11 +02:00
Garrett Spong
6acf72f25c
[Security Solution] Adds RBAC for Assistant (#163031)
## Summary

Adds `All`/`None` RBAC for the Elastic AI Assistant within the Security
app via Kibana feature privileges, and also via serverless PLI App
Features for the Security `complete` product (see
https://github.com/elastic/security-team/issues/7023).

Added as high-level category to enable future support of sub-features
(included sample `Create Conversation` sub-feature plumbed as example).

<p align="center">
<img width="500"
src="b42ab3fe-65e1-49b9-a379-262f2438c0eb"
/>
</p> 

Note: Since [`minimumLicense:
'enterprise'`](https://github.com/elastic/kibana/pull/163031/files#diff-56de8b6234daf4e0e69efe680e5a4afc4f88d152243b773d90c3991fa9dabc19R28)
is configured on this privilege, when the license check isn't satisfied,
the privilege will be hidden (not disabled).

## Testing

Feature is available for `enterprise` licenses and when `All` privilege
is set, otherwise Assistant is hidden in Timeline, all `Chat` UI
elements are hidden, and the `cmd/ctrl + ;` shortcut is unavailable.

---

### On Prem Testing:
Create two roles, one for each `all`/`none` Security Elastic AI
Assistant privilege (via Dev Tools):

<details><summary>PUT /_security/role/assistant_all</summary>
<p>

``` ts
PUT /_security/role/assistant_all
{
  "cluster": [
    "all"
  ],
  "indices": [
    {
      "names": [
        "*"
      ],
      "privileges": [
        "all"
      ],
      "field_security": {
        "grant": [
          "*"
        ],
        "except": []
      },
      "allow_restricted_indices": false
    }
  ],
  "applications": [
    {
      "application": "kibana-.kibana",
      "privileges": [
        "feature_securitySolutionAssistant.minimal_all",
        "feature_siem.all",
        "feature_securitySolutionCases.all",
        "feature_actions.all"
      ],
      "resources": [
        "*"
      ]
    }
  ],
  "run_as": [],
  "metadata": {},
  "transient_metadata": {
    "enabled": true
  }
}
```
</p>
</details>


<details><summary>PUT /_security/role/assistant_none</summary>
<p>

``` ts
PUT /_security/role/assistant_none
{
  "cluster": [
    "all"
  ],
  "indices": [
    {
      "names": [
        "*"
      ],
      "privileges": [
        "all"
      ],
      "field_security": {
        "grant": [
          "*"
        ],
        "except": []
      },
      "allow_restricted_indices": false
    }
  ],
  "applications": [
    {
      "application": "kibana-.kibana",
      "privileges": [
        "feature_siem.all",
        "feature_securitySolutionCases.all",
        "feature_actions.all"
      ],
      "resources": [
        "*"
      ]
    }
  ],
  "run_as": [],
  "metadata": {},
  "transient_metadata": {
    "enabled": true
  }
}
```
</p>
</details>

Create a new `assistant_user` (assigned both roles above), log in and
test assistant availability, then remove one role at a time testing
each:

<details><summary>POST /_security/user/assistant_user (ALL)</summary>
<p>

``` ts
POST /_security/user/assistant_user
{
    "username": "assistant_user",
    "password": "changeme",
    "roles": [
      "assistant_all",
      "assistant_none"
    ],
    "full_name": "Assistant User",
    "email": "assistant-user@elastic.co",
    "metadata": {},
    "enabled": true
}
```
</p>
</details>

Test that assistant is available in UI via `Chat` buttons and shortcut
keys.

<details><summary>PUT /_security/user/assistant_user (NONE)</summary>
<p>

``` ts
PUT /_security/user/assistant_user
{
    "username": "assistant_user",
    "roles": [
      "assistant_none"
    ],
    "full_name": "Assistant User",
    "email": "assistant-user@elastic.co",
    "metadata": {},
    "enabled": true
}
```
</p>
</details>

Test that assistant is **NOT** available in UI via `Chat` buttons or
shortcut keys.

---

### Serverless Testing:

To test with the Assistant available, set `productTypes` to `complete`
in `config/serverless.security.yml`

```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'security', product_tier: 'complete' },
    { product_line: 'endpoint', product_tier: 'complete' },
  ]
  ```

otherwise to test without the Assistant, pick a different product type like `essentials`:

```
xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'security', product_tier: 'essentials' },
    { product_line: 'endpoint', product_tier: 'essentials' },
  ]
```

Then start Serverless Kibana: `yarn serverless-security`

---

### Checklist

Delete any items that are not applicable to this PR.

- [X] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
2023-08-11 15:48:59 -06:00
Dario Gieselaar
0627686500
[Observability AI Assistant] Feature controls (#163232)
This adds feature controls for the AI Assistant feature.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2023-08-07 19:53:18 +02:00
Yulia Čech
b75546f7eb
[Guided onboarding] Use Kibana features to grant access (#155065)
## Summary

Fixes https://github.com/elastic/kibana/issues/149132

This PR adds a Kibana feature for the guided onboarding plugin for
better permissions handling. By default `kibana_admin` and `editor`
roles are granted access to guided onboarding. The role `viewer` on the
other hand doesn't have enough permissions to see or use guided
onboarding. For any roles that don't have the correct permissions,
guided onboarding is completely disabled, the same as it's disabled
on-prem.
When creating a new role, the feature "Setup guides" can be enabled or
disabled.

### How to test
1. Add `xpack.cloud.id: 'testID'` to `/config/kibana.dev.yml`
1. Start ES with `yarn es snapshot` and Kibana with `yarn start``
2. Login as elastic and create a test user with the role `viewer`
3. Clear everything from your browser's local storage 
4. Login as the test user and check the following
- On the first visit, the "on-prem" welcome message is shown (not the
guided onboarding landing page)
- The url `/app/home#/getting_started` is unknown and redirects back to
the home page
- There is no button "Setup guides" in the header
- There is no link "Setup guides" in the help menu

### Checklist

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2023-04-26 04:33:58 -07:00
Ashokaditya
8c8bb8f798
[Security Solution][Endpoint][Response Actions] Enable feature flag for execute by default (#155686)
From 8.8 `responseActionExecuteEnabled` is set to `true` by default

## Summary

Enables the `responseActionExecuteEnabled` feature flag by default for
`execute` response action.


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2023-04-25 14:19:00 -07:00
Jiawei Wu
3b07f96b44
[RAM] Window Maintenance Client/Saved Object and Mapping/REST APIs (#153411)
## Summary
Resolves: https://github.com/elastic/kibana/issues/152270
Specs:
https://docs.google.com/document/u/1/d/1-QblF6P19W9o5-10Us3bfgN80GRfjSIhybHrvJS_ObA/edit

This PR implements the following:
- New maintenance window SO
- New maintenance window client in the alerting plugin (generates and
queries maintenance window events, and other CRUD functionality around
the SO)
- New maintenance window REST APIs 
- Kibana privileges for reading/writing maintenance window

This PR does not include integration with task runner, a new PR will be
created to do that work.
 
## APIs:

```
Find all maintenance windows in current space
GET `${INTERNAL_BASE_ALERTING_API_PATH}/rules/maintenance_window/_find`
body: {}
```

```
Create maintenance window:
POST `${INTERNAL_BASE_ALERTING_API_PATH}/rules/maintenance_window`
body: {
  title: string,
  duration: number,
  r_rule: RRule
}
```

```
Update maintenance window by ID:
POST `${INTERNAL_BASE_ALERTING_API_PATH}/rules/maintenance_window/{id}`,
body: {
  title?: string,
  duration?: number,
  enabled?: boolean,
  r_rule?: RRule,
}
```

```
Get maintenance window by ID:
GET `${INTERNAL_BASE_ALERTING_API_PATH}/rules/maintenance_window/{id}`,
```

```
Delete maintenance window by ID:
DELETE `${INTERNAL_BASE_ALERTING_API_PATH}/rules/maintenance_window/{id}`,
```

```
Archive maintenance window by ID:
POST `${INTERNAL_BASE_ALERTING_API_PATH}/rules/maintenance_window/{id}/_archive`,
body: {
  archive: boolean
}
```

```
Finish maintenance window by ID:
POST `${INTERNAL_BASE_ALERTING_API_PATH}/rules/maintenance_window/{id}/_finish`,
```


## Maintenance window response schema:
```
{
  id: string;
  title: string;
  enabled: boolean;
  duration: number;
  expirationDate: string;
  events: DateRange[];
  rRule: RRuleParams;
  status: 'running' | 'upcoming' | 'finished' | 'archived';
  startDate: string | null;
  endDate: string | null;
  createdBy: string | null;
  updatedBy: string | null;
  createdAt: string;
  updatedAt: string;
}
```

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2023-04-13 13:02:28 -07:00
Kevin Delemme
a04c420569
feat(slo): remove feature flag (#152834) 2023-03-08 12:45:05 -07:00
Ashokaditya
8476ee1bbd
[Security Solution][Endpoint][Response Actions] Execute Operations behind FF for 8.7 (#150383)
## Summary

Hides `execute` RBAC control behind FF so that it is not available in
8.7

### Checklist
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2023-02-07 02:39:27 -07:00
Ashokaditya
06179742f7
[Security Solution][Endpoint][Response Actions] execute endpoint response action API (#149589)
## Summary

Adds an API route for `execute` endpoint response action.

**RBAC control**
![Screenshot 2023-01-27 at 18 47
00](https://user-images.githubusercontent.com/1849116/215157828-2673a54b-0387-4ff1-b896-f2f4f6a769a6.png)


**successful req/res**
![Screenshot 2023-01-27 at 17 01
30](https://user-images.githubusercontent.com/1849116/215131907-9af70973-83dd-4197-b628-0d7526a6d6d1.png)


<details> 
<summary>**.logs-endpoint.actions-default doc source**</summary>

```json5
{
  "EndpointActions": {
    "data": {
      "comment": " get list of files",
      "parameters": {
        "command": "ls -al",
        "timeout": 2500
      },
      "command": "execute"
    },
    "action_id": "dae148b2-aaaf-4a7e-b5e3-0c530dafc974",
    "input_type": "endpoint",
    "expiration": "2023-02-10T15:54:45.768Z",
    "type": "INPUT_ACTION"
  },
  "agent": {
    "id": [
      "cef48f14-d4ae-4bd6-a281-d5aba6b9c88a"
    ]
  },
  "@timestamp": "2023-01-27T15:54:45.768Z",
  "event": {
    "agent_id_status": "auth_metadata_missing",
    "ingested": "2023-01-27T15:54:45Z"
  },
  "user": {
    "id": "elastic"
  }
}
```
</details>


<details> 
<summary>*.fleet-actions doc source*</summary>

```json5
{
  "action_id": "dae148b2-aaaf-4a7e-b5e3-0c530dafc974",
  "expiration": "2023-02-10T15:54:45.768Z",
  "type": "INPUT_ACTION",
  "input_type": "endpoint",
  "data": {
    "command": "execute",
    "comment": " get list of files",
    "parameters": {
      "command": "ls -al",
      "timeout": 2500
    }
  },
  "@timestamp": "2023-01-27T15:54:45.768Z",
  "agents": [
    "cef48f14-d4ae-4bd6-a281-d5aba6b9c88a"
  ],
  "timeout": 300,
  "user_id": "elastic"
}
```
</details>

### Checklist
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
2023-01-31 05:22:27 -07:00
Kevin Logan
a0c689a8a0
[Security Solution] Set the Get File feature flag to true by default (#149612)
## Summary

Sets the Get File feature flag to true by default in preparation for the
release of the feature.

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2023-01-27 10:35:03 -07:00
Jiawei Wu
dc28138d00
[RAM] [Flapping] Add Flapping Rules Settings (#147774)
## Summary
Resolves: https://github.com/elastic/kibana/issues/143529
This PR adds a new saved object `rules-settings` with the schema:
```
  properties: {
    flapping: {
      properties: {
        enabled: {
          type: 'boolean',
        },
        lookBackWindow: {
          type: 'long',
        },
        statusChangeThreshold: {
          type: 'long',
        },
        createdBy: {
          type: 'keyword',
        },
        updatedBy: {
          type: 'keyword',
        },
        createdAt: {
          type: 'date',
        },
        updatedAt: {
          type: 'date',
        },
      },
    },
  },
```
It also adds 2 new endpoints:
`GET /rules/settings/_flapping`
`POST /rules/settings/_flapping`

The new rules settings saved object is instantiated per space, using a
predetermined ID to enable OCC. This new saved object allows the user to
control rules flapping settings for a given space. Access control to the
new saved object is done through the kibana features API. A new
`RulesSettingsClient` was created and can be used to interact with the
settings saved object. This saved object is instantiated lazily. When
the code calls `rulesSettingsClient.flapping().get` or
`rulesSettingsClient.flapping().update`, we will lazily create a new
saved object if one does not exist for the current space. (I have
explored bootstrapping this saved object elsewhere but I think this is
the easiest solution, I am open to change on this).

We have set up the rules settings to support future rule settings
sections by making the settings client and permissions modular. Since
permission control can be easily extended by using sub features.

This PR doesn't contain integration for the `task_runner` to use the
flapping settings, but I can do that in this PR if needed.

### Rules settings feature and sub feature (under management)

![rulessettingsprivileges](https://user-images.githubusercontent.com/74562234/210391168-f8dd53d8-21b6-43b1-b653-116c04ad69ed.png)

### Rules settings settings button

![with_permission_rules_config](https://user-images.githubusercontent.com/74562234/208450003-167521de-4222-4705-86cf-8909a6525b18.png)

### Rules settings modal

![rule_config_modal](https://user-images.githubusercontent.com/74562234/208449115-a08150d6-de93-4be7-a19e-7da91496c4a3.png)

### Disabled

![rules_config_modal_disabled](https://user-images.githubusercontent.com/74562234/208450225-8784fcdb-fa27-48cc-9785-e4a8e6360c0e.png)

### Rules settings settings button with insufficient permissions

![no_permission_rules_config](https://user-images.githubusercontent.com/74562234/208450117-9116ecaf-0ca0-4861-b0be-08554587e385.png)

### Rules settings modal with insufficient write subfeature permissions

![no_flapping_permission](https://user-images.githubusercontent.com/74562234/208450263-24a45395-9960-4b55-bbc9-8dbf88646f62.png)

### Rules settings modal with insufficient read subfeature permissions
![Screenshot from 2023-01-03
23-01-48](https://user-images.githubusercontent.com/74562234/210501223-06c9c5cd-73c2-4a11-9889-3a7505e6e0d5.png)

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2023-01-17 17:40:02 -07:00
Kevin Logan
9786a8fb7c
[Security Solution] Enable Endpoint management RBAC feature flag by default (#148109)
## Summary

Enable the RBAC feature flag for Endpoint management RBAC by default.


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2023-01-10 08:54:42 -07:00
Jean-Louis Leysens
6de90aab9b
[Files] Add default file kind (#144803)
## Summary

Introduce a default file kind for images in Kibana. This file kind will
be the download/upload target usable for all images across Kibana.
Consider the following:

A Kibana user wants to add a branding logo to their dashboard. They need
to create a new image or select from a set of existing images (i.e.,
images already uploaded). This set of images is the "default image" set.
The idea will be this set of images can be access across dashboards and
solutions. For example, the same user can access the branding image they
uploaded in Cases.

## How it works

* We added a new default file kind specifically for images, this is
registered from the files plugin
* In order to access these files over HTTP users will need the
`files:defaultImage` privilege
* This is a distinct privilege from the file management privilege and
allows users to access HTTP endpoints controlled by
`access:files:defaultImage` as well as the underlying `file` saved
object
* Consider a dashboard user that wants to add an image embeddable: they
will need access to `file` saved object as well as the endpoints for
creating/reading/deleting the default file kind. In order to get this
their role must grant the new "Shared images" privilege.

<img width="749" alt="Screenshot 2022-11-22 at 10 34 25"
src="https://user-images.githubusercontent.com/8155004/203295230-24a0be94-9c59-4a53-8757-336e9fc8f6c4.png">
2022-11-23 04:37:05 -07:00
Jean-Louis Leysens
a166fba83d
[Files] Files management (#144425)
## Summary

Files management UI that rounds out the files MVP. This is UI is
intended to be progressively enhanced and provides a way for system
administrators get some insight and manage the files created and stored
in Kibana.

## To reviewers

* This is UI for retrieval and deletion of files (the R+D of CRUD)
* Creating and deleting tags to be supported in a future version
* This UI is intended to form part of the broader content management
experience
* We use the `TableListView` component as far as possible

## How to test

1. Start Kibana with `yarn start --run-examples`
2. Go to the "Developer Examples" from the left nav menu
3. Go to the "Files example" plugin
4. Click the "Upload file" button, upload a few different image types
(PNG, JPG and WEBP)
5. Go to "Stack management" > "Files"
6. Behold your files in the management UI
7. (Bonus) check that the UI and API `GET /api/files/find`, `GET
/api/files/metrics` and `DELETE /api/files/blobs` are not accessible to
non-admin or appropriately privileged users (i.e., those with "Files
management" access).

## List of functionality

 - [x] List all saved objects (scoped to admin)
 - [x] Is able to bulk-delete files
 - [x] Shows basic storage diagnostics
 - [x] Is able to search and filter files

## Screenshots

<details>
<summary>screenshots</summary>

<img width="1545" alt="Screenshot 2022-11-08 at 13 56 54"
src="https://user-images.githubusercontent.com/8155004/200570783-cfefdbf3-c5ff-4ece-ba24-48a455fcca75.png">

<img width="910" alt="Screenshot 2022-11-10 at 12 52 35"
src="https://user-images.githubusercontent.com/8155004/201083812-bc9f25f5-b423-43a6-9229-5e2a4cdd943a.png">

<img width="451" alt="Screenshot 2022-11-10 at 12 37 07"
src="https://user-images.githubusercontent.com/8155004/201081039-832a1980-684c-4abb-bb05-0c7c6a849d4d.png">

<img width="959" alt="Screenshot 2022-11-08 at 13 57 15"
src="https://user-images.githubusercontent.com/8155004/200570797-f122cff5-7043-4e01-9b51-d5663c1b26d6.png">

<img width="500" alt="Screenshot 2022-11-08 at 13 57 38"
src="https://user-images.githubusercontent.com/8155004/200570801-35cdbd99-0256-4dee-9f78-2f6ad853305f.png">

</details>

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2022-11-17 05:53:31 -07:00
Paul Tavares
731c8b962b
[Security] Fix security privileges tests by removing Security Solution file_operations_all sub-feature from test assertions (#145247)
## Summary

- Remove `file_operations_all` from list of sub-feature of SIEM
(security solution). This sub-feature [was recently placed behind an
experimental feature
flag](https://github.com/elastic/kibana/pull/145042), which is disabled
by default for 8.6.
- Un-skips tests


Fixes: #145134
Fixes: #145135
Fixes: #145136
2022-11-15 10:34:50 -05:00
Tiago Costa
19c4e19813
skip flaky suite (#145134) 2022-11-14 17:40:57 +00:00
Paul Tavares
6b6cdf8ab7
[Security Solution][Endpoint] Misc. updates in support of get-file response action (#144948)
## Summary

- Updates the `get-file` action response `outputs` to match latest from
endpoint
- Fix server size `doesFileHanveChunks()` and remove the `.keyword` from
the search field term (index mapping will be setup correctly for these
indexes)
- Updates the names of the File storage indexes
- Sets the `endpointRbacV1Enabled` FF to `true` (enables feature by
default)
- Uses Fleet exposed function utilities to retrieve the indexes for
File's metadata and data chunks

The following Fleet changes were also done

- Created common methods in fleet for retrieving the file metadata and
data indexes using an integration name (should protect us against index
names going forward and avoid having integrations in kibana keep
hard-coded values)
- Removed the .keyword from a few places in the file server service
(still need to test)
- Adjusted both the Fleet and the Security Solution code to use the new
methods for getting the integration specific index names (cc/
@juliaElastic )
2022-11-14 08:22:02 -07:00
Jeramy Soucy
fb632caa33
Show sub-feature privileges when using the Basic license (#142020)
* Augments /api/security/privileges with optional respectLicenseLevel parameter for use by the edit_role_page.
Implements fix for 125289 - Show sub-feature privileges when using the Basic license

* Changed EuiTooltip to EuiIconTip.

* Updated unit tests for feature table expanded row to include new property checks.

* Renamed property to improve readability and reduce confusion. Fixed state of switch checked in sub-feature customization.

* [CI] Auto-commit changed files from 'node scripts/eslint --no-cache --fix'

* Fixed privilege get API default for 'respectLicenseLevel'. Updated privilege unit tests.

* [CI] Auto-commit changed files from 'node scripts/precommit_hook.js --ref HEAD~1..HEAD --fix'

* Uodated test description to match property name.

* Updated privilege API integration tests to include new 'respectLicenseLevel' optional parameter.

* Replaced empty fragment with undefined.

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Thom Heymann <190132+thomheymann@users.noreply.github.com>
2022-10-11 09:33:58 -04:00
Christos Nasikas
494047a2c0
[Cases] Enable Cases on the stack management page (#125224)
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2022-03-04 13:52:01 +02:00
Cristina Amico
b12f70800c
[Fleet] Add support for non-superuser access to Fleet and Integrations (#122347)
* [Fleet] Split Fleet and Integration privileges

* Update UI when Fleet has All privileges and Integrations have None

* Replace remaining superuser checks

* Updates to server/plugin

* Update getAuthzFromRequest

* Update start method in the client side

* Fix tests

* Fix functional tests

* Make changes to the UI based on new privilege system

* Further UI changes

* Make capabilities accessible to unit tests in createStartServices

* Fix failing tests

* Fix ts checks

* Address most review comments

* Introduce hook exposing authz and make UI checks more granular; address rest of comments

* Remove capabilities hook

* Get rid of useCapabilites

* Address review comments

* Other fixes

* Fix tutorial app privileges

* Address code review comments and update privileges naming

* Fix i18n failing check

* Block fleet server setup UI  when user does not have manage_service_account privilege

* Minor changes

* Use unique i18n id

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Josh Dover <doverfake@elastic.co>
2022-01-31 18:59:18 +01:00
Xavier Mouligneau
e185afefa2
Register "minimal" feature privileges regardless of the current license level (#115992)
* bring minimal-* privilege up

* Fix api_integration for minimal_

* attempt to fix minimal_ UI

* fix tests

* Update x-pack/plugins/security/server/authorization/privileges/privileges.test.ts

Co-authored-by: Larry Gregory <lgregorydev@gmail.com>

* fix tests

* fix es-lint

Co-authored-by: Larry Gregory <lgregorydev@gmail.com>
2021-10-26 18:49:01 +01:00
Felix Stürmer
125c569944
[RAC] [Observability] Enable the observability alerting and cases features (#115785)
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2021-10-25 15:19:59 +02:00
Josh Dover
5974fcfdb5
Allow elastic/fleet-server to call appropriate Fleet APIs (#113932) 2021-10-19 12:14:57 +02:00
Xavier Mouligneau
3b958e76aa
[Security Solution] Top-level Cases feature under the Security (#112980)
* add the new top cases feature in security

* fix api intyegration and cypress

* fix api integration

* fix cypress roles test

* missing api integration

* review Joe

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
2021-09-30 20:18:25 -04:00
Felix Stürmer
238c61de07
[RAC] [Observability] Remove rac feature flags from default functional tests (#111942) 2021-09-15 11:17:52 +02:00
Uladzislau Lasitsa
70090e326c
Timelion App removal (#110255)
* Remove timelion app and stuff which related to it

* Fix CI

* Fix lint

* Fix tests

* Fix tests

* Fis tests

* Fix some comments

* Clean up

* fix CI

* fix some comments

* Fix deprecation examples

* Return `enabled` property in config for timelion vis

* Remove unused angular lib

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Alexey Antonov <alexwizp@gmail.com>
2021-09-10 14:53:07 +03:00
Patryk Kopyciński
9edcf9e71e
[Osquery] RBAC (#106669) 2021-08-10 16:36:27 +02:00
Steph Milovic
de07e98663
[Observability] [Cases] Cases in the observability app (#101487) 2021-06-10 16:39:27 -06:00
Brandon Kobel
4584a8b570
Elastic License 2.0 (#90099)
* Updating everything except the license headers themselves

* Applying ESLint rules

* Manually replacing the stragglers
2021-02-03 18:12:39 -08:00
Nicolas Chaulet
1b6cfe819d
[Fleet] Rename ingestManager plugin ID fleet (#83200) 2020-11-19 08:43:14 -05:00
Pierre Gayvallet
d4b2a5145a
SavedObjects tagging MVP (#79096)
* create xpack plugin skeleton, start to implement management section

* add tag creation modal

* first implementation of the tags table

* use InMemoryTable

* add edit modal and delete action

* update plugin list

* add tag list, fix types

* add capabilities check on client-side

* add tag combo box component

* add missing i18n keys

* fix privilege FTR tests

* add base structure for FTR tests

* fix feature ftr test

* use string literals for i18n

* create savedObjectsTaggingOss plugin, move API types to oss plugin, start to wire to SO management page.

* update plugin list

* fix types

* allow to use `_find` with multiple references

* add FTR test for _find API on references fields

* add _find integration tests

* update generated doc

* start to implement tag filtering on SO management section

* update generated docs

* wire tagging API to dashboard listing page

* fix i18n namespace

* fix type & tests

* update dashboard listing snapshots

* adapt FTR listingTable service to search for parsable queries

* wite tagging API to visualize listing

* update tagging plugin limits

* add server-side and client-side validation for tag create/edit

* rename title field to name

* fix types

* fix types bis

* add removeReferencesTo API to SOR/SOC

* update generated doc

* add server-side unit test for `savedObjectsTagging` plugin

* move tagging API types to its own file

* add savedObjectsTaggingOss mock

* add tags_cache tests

* add tests for client-side tag client

* extract uiApi to distinct files

* various API improvements

* add more tests

* add link between tag and so management sections + add connection counts

* add base functional test suite for tagging

* add more FTR tests

* improve feature control func test

* update codeowners

* update generated doc

* fix access to proxy modal

* adapt SO save modal to allow to add tag field

* add SO decorator registry and tag implementation

* add unit tests for SO tag decorator

* add functional tests for visualize integration

* add tag SO read permission for vis/dash feature

* add RBAC api integ tests

* add API integration tests

* add test for getTagConnectionsUrl

* add SOM test suite

* add dashboard integration suite

* remove test line

* add missing unit tests

* improve API types doc

* fix create modal save button label

* remove console.log

* improve doc

* self review

* add refresh interval for tag cache

* improve page object doc

* minor cleanup

* address review comments

* small layout fixes

* add initial focus

* use lazy accessor for tag request handler context

* adapt SOM export and export route to handle references

* remove icon from feature config due to master changes

* fix SO table tests

* update generated docs

* sort tags by name in filter dropdown and listing component

* wire SO tagging to dashboard save modal

* fix types

* - add 'create tag' action in tag selector
- add notifications on update/create/delete from management
- delete modal wording

* add description max length validation

* remove real-time validation

* fix i18n bundle id

* update expected size of savedObjectsTagging plugin

* use own useIfMounted

* update limit again, contract components cannot be lazy loaded atm.

* math is hard

* remove single usage of lodash for bundle size

* add async imports for create/edit modal

* add FTR test for 'create tag' action from tag selector

* allow 'create new' option to prepopulate name field

* extract savedObjectToTag

* add advancedSettings read user for security api_integ suite

* add audit login for security client wrapper

* use import type when possible

* wire SO tagging to lens visualization

* fix lens jest test

* Fix `create tag` option being selected when closing the selector dropdown

* add sorting to tag column from getTableColumnDef

* address some of restrry comments

* rename tag selector's setSelected option to onTagsSelected

* fix audit logging even type for saved_object_remove_references

* update plugin size limit to current size

* adapt maxlength validation wording

* remove selection column until we have batch action menu

* remove connections link when user lack read privilege to savedObjectManagement

* forbid registering multiple SO decorators with the same priority

* add so decorator test

* extract getTagFindReferences and create API mock

* update audit-logging ascidoc

* doc nit

* throw conflict error if update returns any failure

* use refresh=true as default

* wording nits

* export: rename `references` to `hasReference`

* update generated doc

* set description max length to 100

* do not initialize tag cache on anonymous pages

* split fetchObjectsToExport into two distinct functions

* change tag client `delete` call order

* tsdoc nits

* more nits

* add README for oss plugin

* add oss plugin start tests

* SavedObject.find: rename `references` to `hasReference`

* change section description label

* remove url prefix constants

* last nits and comments

* update generated doc
2020-11-03 10:33:18 +01:00
Gidi Meir Morris
25c5daa83a
Renames "Built-In Alerts" feature to "Stack Alerts" and "Actions" feature to "Actions and Connectors" (#79513)
Renames "Built-In Alerts" feature to "Stack Alerts" and "Actions" feature to "Actions and Connectors" as we've decided these names make more appropriate and better communicate what these features are.
2020-10-06 17:51:05 +01:00
Larry Gregory
09b11b61f0
Introduce reserved ml privilege for the apm_user role (#72266)
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2020-07-28 07:44:37 -04:00
Gidi Meir Morris
4abe864f10
Adds Role Based Access-Control to the Alerting & Action plugins based on Kibana Feature Controls (#67157)
This PR adds _Role Based Access-Control_ to the Alerting framework & Actions feature using  Kibana Feature Controls, addressing most of the Meta issue: https://github.com/elastic/kibana/issues/43994

This also closes https://github.com/elastic/kibana/issues/62438

This PR includes the following:

1. Adds `alerting` specific Security Actions (not to be confused with Alerting Actions) to the `security` plugin which allows us to assign alerting specific privileges to users of other plugins using the `features` plugin.
2. Removes the security wrapper from the savedObjectsClient in AlertsClient and instead plugs in the new AlertsAuthorization which performs the privilege checks on each api call made to the AlertsClient.
3. Adds privileges in each plugin that is already using the Alerting Framework which mirror (as closely as possible) the existing api-level tag-based privileges and plugs them into the AlertsClient.
4. Adds feature granted privileges arounds Actions (by relying on Saved Object privileges under the hood) and plugs them into the ActionsClient
5. Removes the legacy api-level tag-based privilege system from both the Alerts and Action HTTP APIs
2020-07-22 14:45:57 +01:00
James Gowdy
a1e511a727
[ML] Changing all calls to ML endpoints to use internal user (#70487)
* [ML] Changing all calls to ML endpoints to use internal user

* updating alerting

* updating documentation

* [ML] Changing all calls to ML endpoints to use internal user

* updating alerting

* updating documentation

* fixing missed types

* adding authorization headers to endpoint calls

* correcting has privileges call

* updating security tests

* odd eslint error

* adding auth header to module setup

* fixing missing auth argument

* fixing delete DFA job permission checks

* removing debug test tag

* removing additional ml privilege checks

* adding authorization header to _evaluate

* updating alerting cluster client name

* code clean up

* changing authorizationHeader name

* updating alterting documentation

* fixing secondary credentials

* adding management links

* updating SIEM telemetry

* fixing merge conflicts

* granting access to index patterns

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2020-07-14 15:48:24 +01:00
Tiago Costa
6c62c686cf
chore(NA): upgrade to lodash@4 (#69868)
* chore(NA): upgrade oss to lodash4

chore(NA): migrate cli, cli_plugin, cli_keystore,  dev, test_utils and apm src script to lodash4

chore(NA): missing file for cli plugin

chore(NA): add src core

chore(NA): es archiver and fixtures

chore(NA): try to fix functional test failure

chore(NA): migrate src/legacy entirely to lodash4 except src/legacy/core_plugins

chore(NA): move legacy core plugins to lodash4

chore(NA): upgrade optimize to lodash4

chore(NA): upgrade to lodash4 on advanced_settings, charts, console and dashboard

chore(NA): migrate to lodash4 on dev_tools, discover, embeddable, es_ui)shared, expressions, home plugins

chore(NA): upgrade data plugin to lodash4

chore(NA): upgrade usage_collection, ui_actions, tile_map, telemtry, share, saved_objects, saved_objects_management, region_map and navigation to lodash4

chore(NA): missing data upgrades to lodash4

Revert "chore(NA): upgrade usage_collection, ui_actions, tile_map, telemtry, share, saved_objects, saved_objects_management, region_map and navigation to lodash4"

This reverts commit 137055c5fed2fc52bb26547e0bc1ad2e3d4fe309.

Revert "Revert "chore(NA): upgrade usage_collection, ui_actions, tile_map, telemtry, share, saved_objects, saved_objects_management, region_map and navigation to lodash4""

This reverts commit f7e73688782998513d9fb6d7e8f0765e9beb28d1.

Revert "chore(NA): missing data upgrades to lodash4"

This reverts commit 92b85bf947a89bfc70cc4052738a6b2128ffb076.

Revert "chore(NA): upgrade data plugin to lodash4"

This reverts commit 88fdb075ee1e26c4ac979b6681d8a2b002df74c6.

chore(NA): upgrade idx_pattern_mgt, input_control_vis, inspector, kbn_legacy, kbn_react, kbn_usage_collections, kbn_utils, management and maps_legacy to lodash4

chore(NA): map src plugin data to lodash3

chore(NA): missing lodash.clonedeep dep

chore(NA): change packages kbn-config-schema deps

chore(NA): update renovate config

chore(NA): upgrade vis_type plugins to lodash4

chore(NA): move vis_type_vislib to lodash3

chore(NA): update visualizations and visualize to lodash4

chore(NA): remove lodash 3 types from src and move test to lodash4

chore(NA): move home, usage_collection and management to lodash 3

Revert "chore(NA): move home, usage_collection and management to lodash 3"

This reverts commit f86e8585f02d21550746569af54215b076a79a3d.

chore(NA): move kibana_legacy, saved_objects saved_objects_management into lodash3

chore(NA): update x-pack test to mock lodash4

Revert "chore(NA): move kibana_legacy, saved_objects saved_objects_management into lodash3"

This reverts commit 2d10fe450533e1b36db21d99cfae3ce996a244e0.

* chore(NA): move x-pack and packages to lodash 4

* chore(NA): remove mention to lodash from main package.json

* chore(NA): remove helper alias for lodash4 and make it the default lodash

* chore(NA): fix last failing types in the repo

* chore(NA): fix public api

* chore(NA): fix types for agg_row.tsx

* chore(NA): fix increment of optimizer modules in the rollup plugin

* chore(NA): migrate `src/core/public/http/fetch.ts` (#5)

* omit undefined query props

* just remove merge usage

* fix types

* chore(NA): fixes for feedback from apm team

* chore(NA): recover old behaviour on apm LoadingIndeicatorContext.tsx

* chore(NA): fixes for feedback from watson

* Platform lodash4 tweaks (#6)

* chore(NA): fix types and behaviour on src/core/server/elasticsearch/errors.ts

* Canvas fixes for lodash upgrade

* [APM] Adds unit test for APM service maps transform (#7)

* Adds a snapshot unit test for getConnections and rearranges some code to make testing easier

* reverts `ArrayList` back to `String[]` in the painless script within `fetch_service_paths_from_trace_ids.ts`

* chore(NA): update yarn.lock

* chore(NA): remove any and use a real type for alerts task runner

Co-authored-by: Gidi Meir Morris <github@gidi.io>

* chore(NA): used named import for triggers_actions_ui file

* chore(NA): fix eslint

* chore(NA): fix types

* Delete most uptime lodash references.

* Simplify. Clean up types.

* [Uptime] Delete most uptime lodash references (#8)

* Delete most uptime lodash references.

* Simplify. Clean up types.

* chore(NA): add eslint rule to avoid using lodash3

* chore(NA): apply changes on feedback from es-ui team

* fix some types (#9)

* Clean up some expressions types.

* chore(NA): missing ts-expect-error statements

* Upgrade lodash 4 vislib (#11)

* replace lodash 3 with lodash 4 on vislib plugin

* Further changes

* further replacement of lodash3 to 4

* further work on upgrading to lodash 4

* final changes to update lodash

* chore(NA): upgrade data plugin to lodash4

chore(NA): upgrade data plugin public to lodash4

chore(NA): fix typecheck task

chore(NA): fix agg_config with hasIn

chore(NA): assign to assignIn and has to hasIn

chore(NA): upgrade data plugin server to lodash4

chore(NA): new signature for core api

fix(NA): match behaviour between lodash3 and lodash4 for set in search_source

* chore(NA): remove lodash3 completely from the repo

* chore(NA): fix x-pack/test/api_integration/apis/metrics_ui/snapshot.ts missing content

* chore(NA): fix lodash usage on apm

* chore(NA): fix typecheck for maps

* Patch lodash template (#12)

* Applying changes from https://github.com/elastic/kibana/pull/64985

* Using isIterateeCall, because it seems less brittle

* Also patching `lodash/template` and `lodash/fp/template`

* Reorganizing some files...

* Revising comment

* Ends up `_` is a function also... I hate JavaScript

Co-authored-by: Pierre Gayvallet <pierre.gayvallet@gmail.com>
Co-authored-by: Josh Dover <me@joshdover.com>
Co-authored-by: Clint Andrew Hall <clint.hall@elastic.co>
Co-authored-by: Oliver Gupte <ogupte@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Gidi Meir Morris <github@gidi.io>
Co-authored-by: Justin Kambic <justin.kambic@elastic.co>
Co-authored-by: Stratoula Kalafateli <stratoula1@gmail.com>
Co-authored-by: Luke Elmers <luke.elmers@elastic.co>
Co-authored-by: Brandon Kobel <brandon.kobel@gmail.com>
Co-authored-by: kobelb <brandon.kobel@elastic.co>
2020-07-03 01:30:13 +01:00
Xavier Mouligneau
46ed40ec07
[SECURITY] rename server plugin to siem (#69044)
* rename server plugin to siem to avoid privilege issue

* review from alerting

* missing change with rename

* fix tests

* missing api integration test

* fix api integration spaces
2020-06-15 09:16:52 -04:00
Xavier Mouligneau
1216b0f7cd
[SECURITY] Rename siem plugin to security_solution (#67902)
* rename siem to security_solution

* rename siem to security solution inside of code

* rename translation keys

* fix snapshot

* replace siem for security solution in tutorial

* missing translation to be renamed

* fix types for api test integration

* updates runner file to match the new path

* change category for kibana settings

* miss renaming in advance settings

* fixes cypress tests

* fix api integration test

* fix new translation

* fix unit test

* update translation i18n

* update translation i18n II

Co-authored-by: Gloria Hornero <snootchie.boochies@gmail.com>
2020-06-04 05:35:13 -04:00
restrry
bf04235dae apply prettier styles 2020-05-22 09:08:58 +02:00
Xavier Mouligneau
bcfc02987f
[SIEMDPOINT] Move endpoint to siem (#66907)
* adds the stuff

* keeps moving stuff

* finishes moving the stuff

* moves tests

* fix type

* try moving it all at once. BROKEN

* move endpoint to siem

* fix package coming from endpoint

* missing scripts + change url

* fix eslint

* temporary disable functional testing for endpoint

* fix api integration types

* allow api integration test + comment functional test

* fix internationalization

* fix internationalization II

* fix jest test

* fix x-pack test

* fix i18n

* fix api integration

* fix circular dependency

* add new dependency to cypress test

Co-authored-by: Davis Plumlee <davis.plumlee@elastic.co>
Co-authored-by: oatkiller <robert.austin@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2020-05-19 11:24:53 -04:00
Larry Gregory
9d89a4fb49
Support multiple reserved feature privileges (#61980)
* support multiple reserved feature privileges

* update reserved privilege ids

* additional testing

* Add ml_user and ml_admin reserved privileges

* prrevent reserved privilege ids from sttarting with 'reserved_'

* address pr feedback: dedicated reserved privilege type

* re-enable ML test suites

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2020-04-08 13:03:15 -04:00
Larry Gregory
b82cc6ed4a
Support for sub-feature privileges (#60563)
* initial server-side support for sub-feature privileges (#57507)

* initial server-side support for sub-feature privileges

* start addressing PR feedback

* renaming interfaces

* move privilege id collision check to security plugin

* additional testing

* change featurePrivilegeIterator import location

* fix link assertions following rebase from master

* Initial UI support for sub-feature privileges (#59198)

* Initial UI support for sub-feature privileges

* Address PR feedback

* display deleted spaces correctly in the privilege summary

* additional testing

* update snapshot

* Enables sub-feature privileges for gold+ licenses (#59750)

* enables sub-feature privileges for gold+ licenses

* Address PR feedback

* address platform review feedback
2020-03-24 11:12:49 -04:00