Commit graph

80596 commits

Author SHA1 Message Date
Jon
a26f5d8b61
[codeowners] Filter kibanamachine (#199404)
Currently we remove CODEOWNERS on backport branches to avoid review
assignments: reviews were already collected on the source pull request.
If there's a conflict, it will go through another round of review but
not require all the original assignees.

We want to re-add the file for our own tooling, and to avoid CODEOWNERS
merge conflicts on backports. To do this, we're going to add a global
override to code assignments on backport branches.

This updates our CODEOWNERS libraries to ignore assignments to
`kibanamachine`.

---------

Co-authored-by: Dzmitry Lemechko <dzmitry.lemechko@elastic.co>
2024-11-12 12:39:17 -06:00
Quynh Nguyen (Quinn)
61cc4129a3
[ES|QL] Hide field statistics tab and Dashboard when ES|QL is in use, disable Index data visualizer for MATCH and QSRT functions (#197538)
## Summary

Part of https://github.com/elastic/kibana/issues/196995. This PR
disables field statistics tab and Dashboard embeddable when ES|QL is in
used. In Index data visualizer, it is disabled when MATCH & QSRT is in
used.

**1. Hide Discover's Field statistics tab:** 


https://github.com/user-attachments/assets/07cbf6ab-4e8f-4430-852a-2fe14269f26a


**2. ML's Index data visualizer:**

Message will popup and user will not be allowed to run query if it
contains `MATCH` or `QRST`



![image](https://github.com/user-attachments/assets/42251d13-8b49-4eee-a65c-e275a4a7312f)



**3. Dashboard:**

Hide the option to add panel and show unavailable for existing ES|QL
panel


<img width="1728" alt="Screenshot 2024-11-05 at 09 44 21"
src="https://github.com/user-attachments/assets/ef763c8d-cdd6-4ece-ae13-f45726e3ef16">

For existing dashboards and saved searches with ES|QL field statistics:

<img width="1209" alt="Screenshot 2024-11-06 at 12 00 10"
src="https://github.com/user-attachments/assets/3c423d01-42b1-48bc-994c-3340dee94bdc">




### Checklist

Delete any items that are not applicable to this PR.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)


### Risk Matrix

Delete this section if it is not applicable to this PR.

Before closing this PR, invite QA, stakeholders, and other developers to
identify risks that should be tested prior to the change/feature
release.

When forming the risk matrix, consider some of the following examples
and how they may potentially impact the change:

| Risk | Probability | Severity | Mitigation/Notes |

|---------------------------|-------------|----------|-------------------------|
| Multiple Spaces&mdash;unexpected behavior in non-default Kibana Space.
| Low | High | Integration tests will verify that all features are still
supported in non-default Kibana Space and when user switches between
spaces. |
| Multiple nodes&mdash;Elasticsearch polling might have race conditions
when multiple Kibana nodes are polling for the same tasks. | High | Low
| Tasks are idempotent, so executing them multiple times will not result
in logical error, but will degrade performance. To test for this case we
add plenty of unit tests around this logic and document manual testing
procedure. |
| Code should gracefully handle cases when feature X or plugin Y are
disabled. | Medium | High | Unit tests will verify that any feature flag
or plugin combination still results in our service operational. |
| [See more potential risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) |


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#_add_your_labels)
- [ ] This will appear in the **Release Notes** and follow the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Stratoula Kalafateli <efstratia.kalafateli@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-11-12 12:38:04 -06:00
Viduni Wickramarachchi
ed4c0df9ee
[Obs AI Assistant] Include an AdHoc instruction about the slack connector to avoid executing a loop (#199531)
Closes https://github.com/elastic/kibana/issues/185028

## Summary

### Problem
The ticket mentions that there was an issue with displaying results.
However both `display results` and `visualize query` are working as
expected based on my investigation. More details including a video are
attached
[here](https://github.com/elastic/kibana/issues/185028#issuecomment-2464879452).

The function calling loop seems to occur when the AI Assistant is trying
to send the output to Slack via the Kibana Slack connector. In order to
do this, the LLM invokes the function `execute_connector`. For the Slack
connector, `id` and `params` properties are required. However, the LLM
only populated `id` and not `params` which causes an error when
validated against the schema for the Slack connector.

- Sometimes, it's able to retry a few times and successfully send the
output to Slack.
- Sometimes, it goes into a loop trying to find `params` and failing
repeatedly.

Attaching another similar issue for more context -
https://github.com/elastic/kibana/issues/195564

_With the solution below, my intention is to send the output to Slack in
one go, without retrying the function `execute_connector`._

### Solution
Based on the solutions I experimented with, seems like we need to force
the LLM to understand what's needed for the Slack connector. I tried a
few options here and the combination of updates that worked are as
follows:
- Appending an AdHoc instruction about the Slack connector properties.
(This gives the LLM some additional information about the required
properties)
- Updating the `properties` attached to the connector (when passing the
connector list to the LLM), to reflect both `id` and `params` with
`message`.

With the above change, the AI Assistant has managed to consistently send
the output to Slack _**without any retries**_ because of missing
`params`.

### Screenshots:
(all alert triggers successfully sent the output to Slack without having
to retry the function)

<img width="1452" alt="success-attempts-to-slack-connector"
src="https://github.com/user-attachments/assets/715a5957-2c04-4a55-868f-34abe564f6d4">
2024-11-12 13:28:08 -05:00
Charlotte Alexandra Wilson
5d0b62ce9e
Confirmation Modal - show warning message when nothing has been changed in modal. (#199523) 2024-11-12 18:21:50 +00:00
Nathan Reese
80a9f40e25
[maps] fix Upgraded maps panel displays Cannot create AbstractESSourceDescriptor when indexPatternId is not provided error and no data (#199690)
Closes https://github.com/elastic/kibana/issues/191777

In 8.15, map embeddable was migrated from a legacy embeddable to a react
embeddable. This changed reference injection. See below for details.
TLDR is that legacy embeddables pass all references to the embeddable
factory when no references for the panel exist. React embeddables just
pass an empty reference list regardless of if panel references exist or
not.

[Reference injection with legacy
embeddables](https://github.com/elastic/kibana/blob/8.15/src/plugins/dashboard/common/dashboard_container/persistable_state/dashboard_container_references.ts#L53)
```
workingState.panels[key] = { ...panel };
const filteredReferences = getReferencesForPanelId(key, references);
const panelReferences = filteredReferences.length === 0 ? references : filteredReferences;
```

[Reference injection with react
embeddables](https://github.com/elastic/kibana/blob/8.15/src/plugins/dashboard/public/dashboard_container/embeddable/dashboard_container.tsx#L835)
```
    const rawState = this.getInput().panels[childId].explicitInput;
    const { id, ...serializedState } = rawState;
    if (!rawState || Object.keys(serializedState).length === 0) return;
    const references = getReferencesForPanelId(childId, this.savedObjectReferences);
    return {
      rawState,
      references,
    };
```

### Test instructions
1) install dashboard from 7.17 saved objects from issue.
2) Open dashboard. Verify data-view is found. Note, layer will not load
since your install has no index 'logstash-*', but reference problem has
been fixed

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-11-12 11:19:40 -07:00
Kevin Delemme
eea4a204e4
fix(slo): remove extra field from synthetics indicator params (#199542) 2024-11-12 13:15:02 -05:00
Steph Milovic
194de0dadb
[Security solution] assistantKnowledgeBaseByDefault flag removed (#198180) 2024-11-12 11:10:53 -07:00
Sandra G
0ab841f6d6
[Data Usage] add functional tests for privileges (#199377)
## Summary

functional tests for data usage plugin privileges and roles
2024-11-12 13:03:37 -05:00
Lisa Cawley
517063d0a4
[DOCS] Remove inference connector docs (#198633) 2024-11-12 11:56:37 -06:00
Carlos Crespo
c4d3de8316
[Inventory][ECO] Replace Entity with InventoryEntityLatest type (#198760)
closes [#198758](https://github.com/elastic/kibana/issues/198758)

## Summary

This PR removes the Entity type used across the Inventory and replaces
it with `InventoryEntityLatest`, which provides strong typing for the
latest entity object. This change makes the code leverage TypeScript’s
intellisense and autocompletion in the editor, making the code easier to
work with and more maintainable across the codebase.

`InventoryEntityLatest` is the interface that the API returns and what
the UI consumes. Note that this is distinct from the index mapping
defined by `entityLatestSchema`, creating a separation layer between
Elasticsearch and the UI.

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2024-11-12 18:47:00 +01:00
Gloria Hornero
81af529c8c
[Security Solution] Using API auth for API calls in Serverless Cypress tests (#190152)
### Context

In our Cypress tests, we use API calls to set up the data needed to run
the tests. Currently, we are using basic authentication for both ESS and
serverless environments. However, for serverless, we should be using API
key authentication, especially given that basic authentication will be
deprecated soon.

### Challenges

* Handling different authentication methods depending on whether the
environment is serverless or ESS.
* Allowing some tests to access or modify internal indexes.
* Managing how the username is handled across different tests.

### Implentation

To ensure the correct authentication is used based on the environment
where the tests are executed, the `rootRequest` method is used to build
the API request. Within this method, the appropriate authentication type
is selected.

All API calls will use an `admin` API key. The `admin` role is the least
restrictive, which is appropriate for setting up data for tests rather
than validating application behavior. This role minimizes the risk of
issues during setup.

A specific challenge arose when we needed to access or modify internal
indexes, a capability restricted to the `system_indices_superuser` role
for testing purposes. The issue stems from the API key generation
method, which is tied to the user's role rather than the user itself.
Since serverless currently lacks a role that permits access to internal
indexes, we are, upon recommendation from the appex-qa team, using the
Elasticsearch client directly with the `system_indices_superuser` role
for these scenarios.

For tests that assert the username, we made adjustments. Previously, the
`system_indices_superuser` role was used universally, which is no longer
the case for serverless. We now retrieve the username dynamically from
user information instead of hardcoding the value.

### To be discussed

When making modifications related to "username", it became apparent that
we sometimes use "fullname" and, in other cases, "username," even though
they seem intended to represent the same concept. Should we standardize
on a single term across the solution?

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2024-11-12 18:20:10 +01:00
Sergi Massaneda
9a9f02c931
[IndexAdapter] Extract index-adapter package from data-stream-adapter (#199575)
## Summary

Extracts `IndexAdapter` from `DataStreamAdapter` and
`IndexPatternAdapter` from `DataStreamSpaceAdapter`.

There are no breaking changes for the _data-stream-adapter_ package; the
behavior of both the `DataStreamAdapter` and `DataStreamSpaceAdapter`
remains unchanged.

The new _index-adapter_ package exports `IndexAdapter` and
`IndexPatternAdapter` to manage individual indices without using data
streams.

This is needed for SIEM rule migrations.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-11-12 18:16:32 +01:00
Candace Park
ce481f1e53
[Security Solution][Endpoint Exceptions] Warning callout for incomplete code signature for endpoint exceptions (#198245)
## Summary

Navigate to Security Solution > Manage > Rules > Add Endpoint Exception

- [x] Warning callout shown in endpoint exceptions when code signature
field is incomplete (i.e. process.code_signature.subject_name w/o
process.code_signature.trusted or vice versa)
- [x] For mac operating systems, process.code_signature.team_id is also
accepted as an equivalent to subject_name
- [ ] Warning callout is also shown for nested entries for this code
signature field: process.Ext.code_signature
- [x] Unit Tests

# Screenshots
Subject name only -- warning is present

![image](https://github.com/user-attachments/assets/eccf4d49-a4b1-47fc-8c51-bddf4fd6664f)

Trusted field only -- warning is present

![image](https://github.com/user-attachments/assets/d3ba6716-e7d1-4709-a5b1-1e472964b6e3)


Both subject name and trusted fields -- no warning is present

![image](https://github.com/user-attachments/assets/11b179ff-278e-4ec6-a749-638f428215aa)
2024-11-12 11:11:16 -06:00
Nathan Reese
36be9947ce
[time slider control] fix Time slider control needs to better sync with dashboard time range (#199544)
Closes https://github.com/elastic/kibana/issues/199227

PR subscribes to reload$ and adjusts timeslider when parent reloads.

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-11-12 10:01:41 -07:00
Miriam
7f2a324e0f
[ObsUX][APM] Migrate APM infra tests to agnostic deployment tests (#199775)
### Summary
Closes https://github.com/elastic/kibana/issues/198976
Part of https://github.com/elastic/kibana/issues/193245

This PR contains the changes to migrate infrastructure test folder to
Deployment-agnostic testing strategy.

#### How to test
Serverless
```
node scripts/functional_tests_server --config x-pack/test/api_integration/deployment_agnostic/configs/serverless/oblt.serverless.config.ts
node scripts/functional_test_runner --config x-pack/test/api_integration/deployment_agnostic/configs/serverless/oblt.serverless.config.ts --grep="APM"
```
It's recommended to be run against
[MKI](https://github.com/crespocarlos/kibana/blob/main/x-pack/test_serverless/README.md#run-tests-on-mki)

Stateful
```
node scripts/functional_tests_server --config x-pack/test/api_integration/deployment_agnostic/configs/stateful/oblt.stateful.config.ts
node scripts/functional_test_runner --config x-pack/test/api_integration/deployment_agnostic/configs/stateful/oblt.stateful.config.ts --grep="APM"
```
Checks

- [ ] (OPTIONAL, only if a test has been unskipped) Run flaky test suite
- [x]  local run for serverless
- [x]  local run for stateful
- [x]  MKI run for serverless
2024-11-12 16:55:15 +00:00
Bryce Buchanan
8a8363f02c
[INFRA] Illegal dependency fix (#199395)
## Summary

This PR makes the `vis-type-timeseries-plugin` a shared component fixing
the dependency error for infra plugin.

I removed the infra folder from the exceptions list because it was
preventing the linter from acknowledging the fix.
2024-11-12 08:50:41 -08:00
Melissa Alvarez
bfbeb14310
[ML] AIOps: update the icon for the "View in Log Pattern Analysis" link to be logPatternAnalysis (#199556)
## Summary

Related meta issue: https://github.com/elastic/kibana/issues/196660


![image](https://github.com/user-attachments/assets/2c3f6a3e-56d9-48cb-a806-a7c2b6a09d44)


### Checklist

Delete any items that are not applicable to this PR.

- [ ] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [ ] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [ ] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [ ] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-11-12 09:47:08 -07:00
Marta Bondyra
13e9b9950a
[Lens] speed up functional test suite by setting the time picker via ui settings (#199479)
1. Speeds up functional test suite by setting the time picker via ui
settings
2. removes legacy tests from editor frame (replaced by adding some
conditions to drag_drop functional tests) as they were not the best
tests anyway
2024-11-12 17:40:47 +01:00
Alberto Blázquez
fd5b40d495
Fix responsiveness of Misconfigurations data grid (#199679)
## Summary

Closes https://github.com/elastic/kibana/issues/195950.

Enhances Misconfigurations data grid setting a fixed width on the link
and result columns.

Additionally, adds a "Open" header above the link in mobile views to
visually identify what the link does.

### Screenshots

<details><summary>Wide table</summary>
<img width="920" alt="Screenshot 2024-11-11 at 18 42 26"
src="https://github.com/user-attachments/assets/97f7c6ae-9e4d-4134-963b-4f999b8ef177">
</details> 

<details><summary>Shrink table</summary>
<img width="390" alt="Screenshot 2024-11-11 at 18 42 34"
src="https://github.com/user-attachments/assets/fddcde02-b753-44f3-9ded-3c886b8854b5">
</details> 

<details><summary>"Open" header added in mobile-only</summary>
<img width="315" alt="Screenshot 2024-11-11 at 18 58 02"
src="https://github.com/user-attachments/assets/fa9df2ea-ed70-43de-b19b-8f80e5f2a965">
</details> 


### Checklist

Delete any items that are not applicable to this PR.

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)
- [x] Any UI touched in this PR is usable by keyboard only (learn more
about [keyboard accessibility](https://webaim.org/techniques/keyboard/))
- [x] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [x] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [x] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)
2024-11-12 10:37:58 -06:00
Nicolas Chaulet
839a9759ea
[Fleet] Fix Install with streaming to save readme and icons (#199727) 2024-11-12 10:21:22 -06:00
Sergi Romeu
49a16accbf
[APM] Migrate /environment to deployment agnostic test (#199582)
## Summary

Closes https://github.com/elastic/kibana/issues/198969
Part of https://github.com/elastic/kibana/issues/193245

This PR contains the changes to migrate `environment` test folder to
Deployment-agnostic testing strategy.

### How to test

- Serverless

```
node scripts/functional_tests_server --config x-pack/test/api_integration/deployment_agnostic/configs/serverless/oblt.serverless.config.ts
node scripts/functional_test_runner --config x-pack/test/api_integration/deployment_agnostic/configs/serverless/oblt.serverless.config.ts --grep="APM"
```

It's recommended to be run against
[MKI](https://github.com/crespocarlos/kibana/blob/main/x-pack/test_serverless/README.md#run-tests-on-mki)

- Stateful
```
node scripts/functional_tests_server --config x-pack/test/api_integration/deployment_agnostic/configs/stateful/oblt.stateful.config.ts
node scripts/functional_test_runner --config x-pack/test/api_integration/deployment_agnostic/configs/stateful/oblt.stateful.config.ts --grep="APM"
```

## Checks

- [ ] (OPTIONAL, only if a test has been unskipped) Run flaky test suite
- [x] local run for serverless
- [x] local run for stateful
- [x] MKI run for serverless
2024-11-12 10:18:02 -06:00
James Gowdy
c58989c419
[ML] Anomaly detection: Adds spacer below split card chart in job wizard (#199708)
Adds a spacer below the chart so the `Add metric` label doesn't appear
like it is underneath the cards due to their drop shadow.

Recommend viewing the diff with whitespace hidden as the change looks
larger than it actually is.

<img width="1064" alt="image"
src="https://github.com/user-attachments/assets/90e460c4-5ad6-4f4b-bf9f-7163d740747f">

vs 

<img width="1057" alt="image"
src="https://github.com/user-attachments/assets/bb8d7bc3-17bb-428d-a8a4-c515a5845025">
2024-11-12 16:13:29 +00:00
Kibana Machine
23185f2624 skip failing test suite (#199719) 2024-11-13 02:53:12 +11:00
Abdul Wahab Zahid
d8710a4cf9
[Dataset Quality] /degraded_docs, /degraded_fields, /details and /values deployment agnostic tests (#198277)
Move the following Dataset Quality API Integration test suites
to deployment agnostic test suites:
1. `/data_streams/degraded_docs.spec.ts`
2. `/data_streams/degraded_fields.spec.ts`
3. `/data_streams/data_stream_details.spec.ts`
4. `/data_streams/degraded_field_values.spec.ts` 

Note that individual tests (e.g. related to authorization in suites) or
test suites dependent on role management, or the ones which behave
differently on Serverless vs. Stateful, haven't been moved to deployment
agnostic.

----

After this commit, the remaining tests in Serlerless/Stateful directories
will be:

**Dataset Quality Serverless API Integration tests** (under
`x-pack/test_serverless/api_integration/test_suites/observability/dataset_quality_api_integration`):
1. `/data_stream_details.ts` _Only contains a single test which cannot
be moved to DA_

**Dataset Quality Stateful API Integration tests** (under
`x-pack/test/dataset_quality_api_integration/tests`):
1. `/data_streams/data_stream_details.spec.ts` _Only contains a single
test which cannot be moved to DA_
2. `/data_streams/degraded_docs.spec.ts` _Only contains a single test
which cannot be moved to DA_
3. `/data_streams/stats.spec.ts` _This suite whole cannot be moved to DA
as it depends on role management_
4. `/integrations/integration_dashboards.spec.ts` _Not moved in this PR_
2024-11-12 16:35:29 +01:00
Maxim Palenov
06986e4a86
[Security Solution] Add Alert Suppression editable component (#198673)
**Partially addresses:** https://github.com/elastic/kibana/issues/171520

## Summary

This PR adds is built on top of https://github.com/elastic/kibana/pull/193828 and https://github.com/elastic/kibana/pull/196948 and adds an Alert Suppression editable component for Three Way Diff tab's final edit side of the upgrade prebuilt rule workflow.

## Details

https://github.com/elastic/kibana/issues/171520 required adding editable components for each field diffable rule field. Alert Suppression edit component was extracted from Define Rule Step Component into a separate reusable component. To simplify the logic it was split into common Alert Suppression and Threshold Alert Suppression since the latter is a specific use case.

## Caveats

Upgrade prebuilt rules workflow is quite different from rule creation and editing. In create and edit rule forms users are capable to change any field at their will. Upgrade prebuilt rules workflow allow to modify only specific fields having diff in the current rule upgrade.

There are fields which depend on each other. In particular Alert Suppression isn't supported for EQL sequence though it's addressed in https://github.com/elastic/kibana/pull/189725. 

- Alert Suppression editable component in Three Way Diff workflow isn't disabled EQL sequence rule queries. Alert suppression support for rules with EQL sequence queries is implemented in https://github.com/elastic/kibana/pull/189725. 

- Machine learning rule type require running selected machine learning jobs otherwise input could be disabled in case of there are no fields to pick from otherwise a warning message below the combobox is shown.

## How to test

The simplest way to test is via patching installed prebuilt rules via Rule Patch API. Please follow steps below

- Enable Prebuilt rule customization feature by adding a `prebuiltRulesCustomizationEnabled` feature flag
- Run Kibana locally
- Install a prebuilt rule, e.g. `Potential Code Execution via Postgresql` with rule_id `2a692072-d78d-42f3-a48a-775677d79c4e`
- Patch the installed rule by running a query below

```bash
curl -X PATCH --user elastic:changeme  -H 'Content-Type: application/json' -H 'kbn-xsrf: 123' -H "elastic-api-version: 2023-10-31" -d '{"rule_id":"2a692072-d78d-42f3-a48a-775677d79c4e","version":1,"alert_suppression":{"group_by":["host.name"]}}' http://localhost:5601/kbn/api/detection_engine/rules
```

- Open `Detection Rules (SIEM)` Page -> `Rule Updates` -> click on `Potential Code Execution via Postgresql` rule -> expand `EQL Query` to see EQL Query -> press `Edit` button

## Screenshots

Custom query prebuilt rule (UI looks similar for EQL, Indicator Match, New Terms and ES|QL rule types)

![image](https://github.com/user-attachments/assets/86015d5b-e252-4d0b-9aa3-fc14679a493b)

Machine learning prebuilt rule with a diff in alert suppression

![image](https://github.com/user-attachments/assets/210246cd-27fd-4976-befc-dee023101ec9)

Threshold prebuilt rule

![image](https://github.com/user-attachments/assets/44b0c1bc-4134-4d58-bd9a-e8e2d4c50802)
2024-11-12 08:46:39 -06:00
Kibana Machine
4a2de76333
Unauthorized route migration for routes owned by obs-ux-logs-team (#198349)
### Authz API migration for unauthorized routes

This PR migrates unauthorized routes owned by your team to a new
security configuration.
Please refer to the documentation for more information: [Authorization
API](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)

### **Before migration:**
```ts
router.get({
  path: '/api/path',
  ...
}, handler);
```

### **After migration:**
```ts
router.get({
  path: '/api/path',
  security: {
    authz: {
      enabled: false,
      reason: 'This route is opted out from authorization because ...',
    },
  },
  ...
}, handler);
```

### What to do next?
1. Review the changes in this PR.
2. Elaborate on the reasoning to opt-out of authorization.
3. Routes without a compelling reason to opt-out of authorization should
plan to introduce them as soon as possible.
2. You might need to update your tests to reflect the new security
configuration:
  - If you have snapshot tests that include the route definition.

## Any questions?
If you have any questions or need help with API authorization, please
reach out to the `@elastic/kibana-security` team.

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Co-authored-by: Marco Antonio Ghiani <marcoantonio.ghiani01@gmail.com>
2024-11-12 15:17:12 +01:00
Nicolas Chaulet
f9e8aa07b7
[Fleet] Change uninstall tokens space when changing agent policies spaces (#199536) 2024-11-12 08:28:54 -05:00
Nicolas Chaulet
7e06f55436
[Fleet] Fix install with streaming test (#199725) 2024-11-12 08:28:28 -05:00
Marco Antonio Ghiani
9975c552da
[Logs] Deprecation warning for Logs Explorer and Logs Stream (#199652)
## 📓 Summary

Closes https://github.com/elastic/observability-dev/issues/4070

- Update the deprecation callouts to suggest that the user use Discover.
- Replace the beta badge in Logs Explorer with a deprecation notice.
- Mark the advanced setting to enable the log stream to be deprecated.

<img width="844" alt="Screenshot 2024-11-11 at 15 22 51"
src="https://github.com/user-attachments/assets/5f8a4858-cad5-4d75-9868-d1c9d54a9ce5">

---------

Co-authored-by: Marco Antonio Ghiani <marcoantonio.ghiani@elastic.co>
Co-authored-by: Mike Birnstiehl <114418652+mdbirnstiehl@users.noreply.github.com>
2024-11-12 14:25:09 +01:00
Miriam
c4e97c6b65
[ObsUX][APM] Migrate error_rate tests to agnostic deployment tests (#199672)
### Summary
Closes https://github.com/elastic/kibana/issues/198970
Part of https://github.com/elastic/kibana/issues/193245

This PR contains the changes to migrate error_rate test folder to
Deployment-agnostic testing strategy.

#### How to test
Serverless
```
node scripts/functional_tests_server --config x-pack/test/api_integration/deployment_agnostic/configs/serverless/oblt.serverless.config.ts
node scripts/functional_test_runner --config x-pack/test/api_integration/deployment_agnostic/configs/serverless/oblt.serverless.config.ts --grep="APM"
```
It's recommended to be run against
[MKI](https://github.com/crespocarlos/kibana/blob/main/x-pack/test_serverless/README.md#run-tests-on-mki)

Stateful
```
node scripts/functional_tests_server --config x-pack/test/api_integration/deployment_agnostic/configs/stateful/oblt.stateful.config.ts
node scripts/functional_test_runner --config x-pack/test/api_integration/deployment_agnostic/configs/stateful/oblt.stateful.config.ts --grep="APM"
```
Checks

- [ ] (OPTIONAL, only if a test has been unskipped) Run flaky test suite
- [x]  local run for serverless
- [x]  local run for stateful
- [x]  MKI run for serverless
2024-11-12 12:49:51 +00:00
Kate Sosedova
627692c4ef
Remove a condition to hide space from dropdown menu even if there's o… (#199601)
## Summary
- Based [on the
issue](https://github.com/orgs/elastic/projects/1102/views/15?pane=issue&itemId=86718686&issue=elastic%7Ckibana%7C199594),
I removed a condition to hide space from dropdown menu even if there's
only one (for admins and regular users)
- I also changed the wording from "Your spaces" to just "Spaces" so that
we're consistent in all cases, [based on this
comment](https://github.com/elastic/UX/issues/113#issuecomment-2464988675).

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-11-12 13:32:51 +01:00
mohamedhamed-ahmed
73694426f9
[Discover] Breakdown support for fieldstats (#199028)
closes https://github.com/elastic/kibana/issues/192700

## 📝  Summary

This PR add a new `Add breakdown` button to the field stats popover for
all applicable fields.

## 🎥 Demo


https://github.com/user-attachments/assets/d647189c-9b04-4127-a4fd-f9764babe46e

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2024-11-12 14:26:36 +02:00
Kibana Machine
763b5deafd
Unauthorized route migration for routes owned by kibana-core (#198333)
### Authz API migration for unauthorized routes

This PR migrates unauthorized routes owned by your team to a new
security configuration.
Please refer to the documentation for more information: [Authorization
API](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)

### **Before migration:**
```ts
router.get({
  path: '/api/path',
  ...
}, handler);
```

### **After migration:**
```ts
router.get({
  path: '/api/path',
  security: {
    authz: {
      enabled: false,
      reason: 'This route is opted out from authorization because ...',
    },
  },
  ...
}, handler);
```

### What to do next?
1. Review the changes in this PR.
2. Elaborate on the reasoning to opt-out of authorization.
3. Routes without a compelling reason to opt-out of authorization should
plan to introduce them as soon as possible.
2. You might need to update your tests to reflect the new security
configuration:
  - If you have snapshot tests that include the route definition.

## Any questions?
If you have any questions or need help with API authorization, please
reach out to the `@elastic/kibana-security` team.

Co-authored-by: Jean-Louis Leysens <jeanlouis.leysens@elastic.co>
2024-11-12 06:21:58 -06:00
Elena Shostak
9bb3661060
Changed log level for message with authz opt out (#199678)
## Summary

Changed log level for message with authz opt out from `warn` to `debug`


__Closes: https://github.com/elastic/kibana/issues/199677__
2024-11-12 06:05:56 -06:00
Maryam Saeidi
8668757459
[Custom threshold] Fix the custom equation label on the preview lens chart (#199618)
Fixes #181876

## Summary

This PR fixes the custom equation label on the preview lens chart.

|With label|Without label|With group by field|
|---|---|---|

|![image](d638f49e-98e2-4df7-8852-84dc62b9f739)|
2024-11-12 13:01:36 +01:00
Ania Kowalska
13ae98602f
[Discover] fix: responsive data view picker (#199617)
## Summary

Closes https://github.com/elastic/kibana/issues/199434

`ChangeDataView` had two problems on smaller screens:

1. The `Data view` label was wrapped across two rows, causing the parent
container to expand and misalign with the picker.
2. The picker container was overflowing, and the text was not truncated.

![image](https://github.com/user-attachments/assets/1eeb5cf2-bcae-4a1d-b28c-13c5c508b4c1)

Setting `min-width: 0` on two parent containers solved the problem:
<img width="442" alt="Screenshot 2024-11-11 at 11 52 09"
src="https://github.com/user-attachments/assets/564b392b-38c5-4376-a1a3-4f4c6b3d58c1">

![data-view-picker](https://github.com/user-attachments/assets/08e23d5a-7f09-4530-aca5-bac7fa0da7cd)



### Checklist

Delete any items that are not applicable to this PR.

- [x] Any UI touched in this PR does not create any new axe failures
(run axe in browser:
[FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/),
[Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US))
- [x] This renders correctly on smaller devices using a responsive
layout. (You can test this [in your
browser](https://www.browserstack.com/guide/responsive-testing-on-local-server))
- [x] This was checked for [cross-browser
compatibility](https://www.elastic.co/support/matrix#matrix_browsers)


### For maintainers

- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#_add_your_labels)
- [ ] This will appear in the **Release Notes** and follow the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
2024-11-12 13:01:16 +01:00
Vadim Kibana
be1a4bbe40
[ES|QL] STATS command APIs (#199322)
## Summary

Partially addresses https://github.com/elastic/kibana/issues/191812

This PR implement higher-level convenience methods for working with
`STATS` commands:

- `commands.stats.list()` - iterates over all `STATS` commands.
- `commands.stats.byIndex()` - retrieves the Nth `STATS` command.
- `commands.stats.summarize()` - returns summary about fields used in
aggregates and grouping for all `STATS` commands in the query.
- `commands.stats.summarizeCommand()` - same as `.summarize()`, but
returns a summary only about the requested command.

Usage:

```ts
const query = EsqlQuery.fromSrc('FROM index | STATS a = max(b)');
const summary = commands.stats.summarize(query); // [ { aggregates: { a: { fields: ['b'] }} ]
```


### Checklist

Delete any items that are not applicable to this PR.


- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
### For maintainers

- [x] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#_add_your_labels)
2024-11-12 12:59:36 +01:00
Ahmad Bamieh
a10eb1fe4e
[UA][Core] Surface integrations with internal APIs in upgrade assistant (#199026)
## Summary

> In https://github.com/elastic/kibana/issues/117241 we're surfacing
usage of APIs marked as `deprecated: true` in the Upgrade Assistant to
help users prepare for a major upgrade. While internal APIs aren't
really deprecated in the same sense we are making a breaking change by
blocking external integrations with these APIs. Since this could be
equally disruptive to users depending on these APIs it would help our
users to surface such usage in the UA too.

The `api` deprecations now have two sub types:
1. routes deprecations `options.deprecated: { … }`
2. access deprecations `options.access: 'internal'`

This PR adds the second `api` deprecation subtype. The reason i kept one
`api` deprecation type and i didnt create a new type is that they have
exactly the same registration process but are triggered by different
attributes. The `api` deprecation is fully managed by the core team
internal services and are configured by the user through the route
interface so it makes sense to keep them as one type. I also can see us
adding more subtypes to this and just piggybacking on the current flow
instead of duplicating it everytime.


**Checklist**
- [x] Create deprecation subtype
- [x] Example plugin
- [x] Surface the deprecation in UA
- [x] Api access deprecation copy (@florent-leborgne )
- [x] Update README and code annotations
- [x] Unit tests
- [x] Integration tests


Closes https://github.com/elastic/kibana/issues/194675

### Design decisions:
If the API has both route deprecation (`options.deprecated: { … }` ) AND
is an internal api `options.access: 'internal'`

The current behavior i went for in my PR:
I show this API once in the UA under the internal access deprecation.
While showing the route deprecation details if defined. This seems to
make the most sense since users should stop using this API altogether.

### Copy decisions:
@florent-leborgne wrote the copy for this deprecation subtype.
<img width="1319" alt="image"
src="https://github.com/user-attachments/assets/9a32f6d1-686a-4405-aec6-786ac5e10130">

<img width="713" alt="image"
src="https://github.com/user-attachments/assets/1304c98d-4c64-468e-a7d6-19c1193bf678">


## Testing

Run kibana locally with the test example plugin that has deprecated
routes
```
yarn start --plugin-path=examples/routing_example --plugin-path=examples/developer_examples
```

The following comprehensive deprecated routes examples are registered
inside the folder:
`examples/routing_example/server/routes/deprecated_routes`

Run them in the dev console to trigger the deprecation condition so they
show up in the UA:

```
GET kbn:/api/routing_example/d/internal_deprecated_route?elasticInternalOrigin=false
GET kbn:/internal/routing_example/d/internal_only_route?elasticInternalOrigin=false
GET kbn:/internal/routing_example/d/internal_versioned_route?apiVersion=1&elasticInternalOrigin=false
```

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2024-11-12 14:19:22 +03:00
Carlos Crespo
fb666aa765
[APM] Migrate apm alerts tests to deployment agnostic (#199097)
## Summary

Closes [#198959](https://github.com/elastic/kibana/issues/198959)
Part of https://github.com/elastic/kibana/issues/193245

This PR contains the changes to migrate `alerts` test folder to
Deployment-agnostic testing strategy.
It also fixes a bug when filtering alerts by
`kibana.alert.rule.producer`. On serverless ,the producer is
`observability`, not `apm`

### How to test

- Serverless

```
node scripts/functional_tests_server --config x-pack/test/api_integration/deployment_agnostic/configs/serverless/oblt.serverless.config.ts
node scripts/functional_test_runner --config x-pack/test/api_integration/deployment_agnostic/configs/serverless/oblt.serverless.config.ts --grep="APM"
```

It's recommended to be run against
[MKI](https://github.com/crespocarlos/kibana/blob/main/x-pack/test_serverless/README.md#run-tests-on-mki)
- This PR won't pass on MKI while the instance is not created using the
`kibana.alert.rule.producer` fix from this PR

- Stateful
```
node scripts/functional_tests_server --config x-pack/test/api_integration/deployment_agnostic/configs/stateful/oblt.stateful.config.ts
node scripts/functional_test_runner --config x-pack/test/api_integration/deployment_agnostic/configs/stateful/oblt.stateful.config.ts --grep="APM"
```

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
2024-11-12 11:01:23 +00:00
Alejandro Fernández Haro
93d7044919
[Feature Flags] Add APM transaction + better example code (#199671)
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2024-11-12 11:59:52 +01:00
Sergi Romeu
803738fa0c
[APM] Migrate /data_view to deployment agnostic test (#199296)
## Summary

Closes https://github.com/elastic/kibana/issues/198965
Part of https://github.com/elastic/kibana/issues/193245

This PR contains the changes to migrate `data_view` test folder to
Deployment-agnostic testing strategy.

### How to test

- Serverless

```
node scripts/functional_tests_server --config x-pack/test/api_integration/deployment_agnostic/configs/serverless/oblt.serverless.config.ts
node scripts/functional_test_runner --config x-pack/test/api_integration/deployment_agnostic/configs/serverless/oblt.serverless.config.ts --grep="APM"
```

It's recommended to be run against
[MKI](https://github.com/crespocarlos/kibana/blob/main/x-pack/test_serverless/README.md#run-tests-on-mki)

- Stateful
```
node scripts/functional_tests_server --config x-pack/test/api_integration/deployment_agnostic/configs/stateful/oblt.stateful.config.ts
node scripts/functional_test_runner --config x-pack/test/api_integration/deployment_agnostic/configs/stateful/oblt.stateful.config.ts --grep="APM"
```

## Checks

- [x] (OPTIONAL, only if a test has been unskipped) Run flaky test suite
- [x] local run for serverless
- [x] local run for stateful
- [x] MKI run for serverless
2024-11-12 11:41:34 +01:00
elastic-renovate-prod[bot]
84d79e1442
Update dependency @elastic/elasticsearch to ^8.15.2 (main) (#199705)
Co-authored-by: elastic-renovate-prod[bot] <174716857+elastic-renovate-prod[bot]@users.noreply.github.com>
Co-authored-by: Alejandro Fernández Haro <alejandro.haro@elastic.co>
2024-11-12 11:41:15 +01:00
Cauê Marcondes
4a16e910e9
[Inventory][ECO] Use ControlGroupRenderer to filter by entity types (#199174)
closes https://github.com/elastic/kibana/issues/193397


https://github.com/user-attachments/assets/e78639a8-bc63-4c5a-8676-0ad9b5f0563e

- Added `Entity type` control group field on the Inventory page. 
- Added `Filters` buttons to the Unified Search bar on the Inventory
oage
- Moved common hooks from infra to Obs-shared
- Refactoring

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
2024-11-12 10:28:02 +00:00
Liam Thompson
d6b8f9b619
[DOCS] Search AI assistant (#199602) 2024-11-12 10:21:31 +00:00
Nikita Indik
3d3b32faf6
[Security Solution] FinalEdit: Add fields that are common for all rule types (#196642)
**Partially addresses: https://github.com/elastic/kibana/issues/171520**
**Is a follow-up to: https://github.com/elastic/kibana/pull/196326**

This PR enables editing of common fields in the new "Updates" tab of the rule upgrade flyout. The common fields are fields applicable to all rule types.

## Summary
These fields are editable now:
 - `building_block`
 - `description`
 - `false_positives`
 - `investigation_fields`
 - `max_signals`
 - `note`
 - `references`
 - `related_integrations`
 - `required_fields`
 - `risk_score`
 - `risk_score_mapping`
 - `rule_name_override`
 - `rule_schedule`
 - `setup`
 - `severity`
 - `severity_mapping`
 - `tags`
 - `threat`
 - `timeline_template`
 - `timestamp_override`

<img width="2672" alt="Scherm­afbeelding 2024-10-16 om 17 32 06" src="https://github.com/user-attachments/assets/6dd615e2-6e84-4e1f-b674-f42d03f575e7">

### Testing
 - Ensure the `prebuiltRulesCustomizationEnabled` feature flag is enabled.
 - To simulate the availability of prebuilt rule upgrades, downgrade a currently installed prebuilt rule using the `PATCH api/detection_engine/rules` API. 
   - Set `version: 1` in the request body to downgrade it to version 1.
   - Modify other rule fields in the request body as needed to test the changes.
2024-11-12 11:04:10 +01:00
James Gowdy
fa6d8ee9e0
[ML] File upload adding deployment initialization step (#198446)
Fixes https://github.com/elastic/kibana/issues/196696

When adding a semantic text field, we now have an additional step in the
file uploading process which calls inference for the selected inference
endpoint.
The response of the inference call is ignored and a poll is started to
check to see of the model has been deployed by check to see if
`num_allocations > 0`
Any errors returned from the inference call will stop the upload, unless
they are timeout errors which are ignored.


https://github.com/user-attachments/assets/382ce565-3b4b-47a3-a081-d79c15aa462f
2024-11-12 10:02:26 +00:00
José Luis González
8a7514f5e2
[Search][Connectors][a11y] Fixing wrong navigation sequence after closing Manual configuration dialog (#199613)
## Summary

This PR closes this issue:
https://github.com/elastic/kibana/issues/197623

Now we don't close the Popover content when clicking in any of the
options listed in order to keep this content visible. And to solve the
z-index issue where the Popover were displayed on top of the Flyout we
are modifying the Flyout z-index to become exactly the same as the
Popover + 1 to overlap this content.

Now we keep the same tab index focus we got before opening the Flyout
from the Popover options.

![CleanShot 2024-11-11 at 11 38
57](https://github.com/user-attachments/assets/0a1ff5cb-13ff-45ba-8a89-f5ca91ad77ef)
2024-11-12 10:56:52 +01:00
Stratoula Kalafateli
dbc9e31dbc
[ES|QL] Marks tech preview functions in the editor (#199631)
## Summary

Closes https://github.com/elastic/kibana/issues/194062

Indicates tech preview functions in the editor.

![image
(62)](https://github.com/user-attachments/assets/a6d2b1e8-f7c7-4bee-8a9f-3c9d5026c79e)
2024-11-12 09:04:01 +01:00
Stratoula Kalafateli
e87fbd8c24
[ES|QL] Group by histogram suggestion first in the list (#199611)
## Summary

Ensures that group BY histogram suggestion is first on the list. It
fixes a regression caused from the refactoring of autocomplete


<img width="1108" alt="image"
src="https://github.com/user-attachments/assets/a6d6ba7b-c346-4d07-98f4-ac4c4b3ae857">


### Checklist

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
2024-11-12 09:03:50 +01:00
Kibana Machine
6e5f793c48
[api-docs] 2024-11-12 Daily api_docs build (#199729)
Generated by
https://buildkite.com/elastic/kibana-api-docs-daily/builds/889
2024-11-12 01:26:12 -06:00