mirror of
https://github.com/elastic/kibana.git
synced 2025-04-23 09:19:04 -04:00
d6fa87e0d5
# Backport This will backport the following commits from `main` to `8.14`: - [[Security Solution] - Security solution ES|QL configurable via advanced setting (#181616)](https://github.com/elastic/kibana/pull/181616) <!--- Backport version: 8.9.8 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Michael Olorunnisola","email":"michael.olorunnisola@elastic.co"},"sourceCommit":{"committedDate":"2024-05-02T17:02:46Z","message":"[Security Solution] - Security solution ES|QL configurable via advanced setting (#181616)\n\n## Summary\r\n\r\nThis PR links the ESQL functionality in security solution to the\r\n`discover:enableESQL` advanced setting. The advanced setting will only\r\nbe present in ESS, but not serverless\r\n\r\nThe way this should work to maintain parity with the rest of Kibana such\r\nas discover and stack rules:\r\n\r\n- By default ES|QL will be enabled across all Kibana\r\n- When the ES|QL advanced setting is disabled:\r\n - Timeline\r\n - ES|QL tab should not be accessible on any newly created timelines\r\n- Existing Timelines with an ES|QL query should still have the tab\r\naccessible\r\n - Rules\r\n- New ES|QL rule should not be available to be created in the *Rule\r\nCreation* workflow\r\n - Existing ES|QL rules should still run and be able to be edited\r\n\r\n\r\n\r\n**Timeline Demo Video:**\r\n\r\n\r\nd5429be9-de37-43e2-882d-687b3371beb4\r\n\r\n**Rules Demo Video:**\r\n\r\n\r\n\r\n7df2fd11-bd2b-4e50-ad97-b6e1d0f7867a\r\n\r\n---------\r\n\r\nCo-authored-by: Vitalii Dmyterko <92328789+vitaliidm@users.noreply.github.com>\r\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>","sha":"963391ed0f7513c24c4827444feb971e460c53c0","branchLabelMapping":{"^v8.15.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","Team:Threat Hunting:Investigations","ci:build-serverless-image","v8.14.0","v8.15.0"],"number":181616,"url":"https://github.com/elastic/kibana/pull/181616","mergeCommit":{"message":"[Security Solution] - Security solution ES|QL configurable via advanced setting (#181616)\n\n## Summary\r\n\r\nThis PR links the ESQL functionality in security solution to the\r\n`discover:enableESQL` advanced setting. The advanced setting will only\r\nbe present in ESS, but not serverless\r\n\r\nThe way this should work to maintain parity with the rest of Kibana such\r\nas discover and stack rules:\r\n\r\n- By default ES|QL will be enabled across all Kibana\r\n- When the ES|QL advanced setting is disabled:\r\n - Timeline\r\n - ES|QL tab should not be accessible on any newly created timelines\r\n- Existing Timelines with an ES|QL query should still have the tab\r\naccessible\r\n - Rules\r\n- New ES|QL rule should not be available to be created in the *Rule\r\nCreation* workflow\r\n - Existing ES|QL rules should still run and be able to be edited\r\n\r\n\r\n\r\n**Timeline Demo Video:**\r\n\r\n\r\nd5429be9-de37-43e2-882d-687b3371beb4\r\n\r\n**Rules Demo Video:**\r\n\r\n\r\n\r\n7df2fd11-bd2b-4e50-ad97-b6e1d0f7867a\r\n\r\n---------\r\n\r\nCo-authored-by: Vitalii Dmyterko <92328789+vitaliidm@users.noreply.github.com>\r\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>","sha":"963391ed0f7513c24c4827444feb971e460c53c0"}},"sourceBranch":"main","suggestedTargetBranches":["8.14"],"targetPullRequestStates":[{"branch":"8.14","label":"v8.14.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.15.0","labelRegex":"^v8.15.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/181616","number":181616,"mergeCommit":{"message":"[Security Solution] - Security solution ES|QL configurable via advanced setting (#181616)\n\n## Summary\r\n\r\nThis PR links the ESQL functionality in security solution to the\r\n`discover:enableESQL` advanced setting. The advanced setting will only\r\nbe present in ESS, but not serverless\r\n\r\nThe way this should work to maintain parity with the rest of Kibana such\r\nas discover and stack rules:\r\n\r\n- By default ES|QL will be enabled across all Kibana\r\n- When the ES|QL advanced setting is disabled:\r\n - Timeline\r\n - ES|QL tab should not be accessible on any newly created timelines\r\n- Existing Timelines with an ES|QL query should still have the tab\r\naccessible\r\n - Rules\r\n- New ES|QL rule should not be available to be created in the *Rule\r\nCreation* workflow\r\n - Existing ES|QL rules should still run and be able to be edited\r\n\r\n\r\n\r\n**Timeline Demo Video:**\r\n\r\n\r\nd5429be9-de37-43e2-882d-687b3371beb4\r\n\r\n**Rules Demo Video:**\r\n\r\n\r\n\r\n7df2fd11-bd2b-4e50-ad97-b6e1d0f7867a\r\n\r\n---------\r\n\r\nCo-authored-by: Vitalii Dmyterko <92328789+vitaliidm@users.noreply.github.com>\r\nCo-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>","sha":"963391ed0f7513c24c4827444feb971e460c53c0"}}]}] BACKPORT--> --------- Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
71 lines
2 KiB
YAML
71 lines
2 KiB
YAML
# Security Project config
|
|
|
|
## Disable plugins
|
|
enterpriseSearch.enabled: false
|
|
xpack.apm.enabled: false
|
|
xpack.infra.enabled: false
|
|
xpack.observabilityLogsExplorer.enabled: false
|
|
xpack.observability.enabled: false
|
|
xpack.observabilityAIAssistant.enabled: false
|
|
xpack.search.notebooks.enabled: false
|
|
|
|
## Cloud settings
|
|
xpack.cloud.serverless.project_type: security
|
|
|
|
## Enable the Security Solution Serverless plugin
|
|
xpack.securitySolutionServerless.enabled: true
|
|
xpack.securitySolutionServerless.productTypes:
|
|
[
|
|
{ product_line: 'security', product_tier: 'complete' },
|
|
{ product_line: 'endpoint', product_tier: 'complete' },
|
|
{ product_line: 'cloud', product_tier: 'complete' },
|
|
]
|
|
|
|
xpack.securitySolution.offeringSettings: {
|
|
ILMEnabled: false, # Index Lifecycle Management (ILM) functionalities disabled, not supported by serverless Elasticsearch
|
|
}
|
|
|
|
newsfeed.enabled: true
|
|
|
|
## Set the home route
|
|
uiSettings.overrides.defaultRoute: /app/security/get_started
|
|
|
|
## Set the dev project switcher current type
|
|
xpack.serverless.plugin.developer.projectSwitcher.currentType: 'security'
|
|
|
|
# Specify in telemetry the project type
|
|
telemetry.labels.serverless: security
|
|
|
|
# Fleet specific configuration
|
|
xpack.fleet.internal.registry.capabilities: ['security']
|
|
xpack.fleet.internal.registry.spec.max: '3.0'
|
|
xpack.fleet.internal.registry.kibanaVersionCheckEnabled: false
|
|
# Temporary until all packages implement new spec https://github.com/elastic/kibana/issues/166742
|
|
xpack.fleet.internal.registry.spec.min: '1.0'
|
|
xpack.fleet.internal.registry.excludePackages: [
|
|
# Oblt integrations
|
|
'apm',
|
|
'synthetics',
|
|
'synthetics_dashboards',
|
|
|
|
# Removed in 8.11 integrations
|
|
'cisco',
|
|
'microsoft',
|
|
'symantec',
|
|
'cyberark',
|
|
|
|
# ML integrations
|
|
'dga',
|
|
]
|
|
# fleet_server package installed to publish agent metrics
|
|
xpack.fleet.packages:
|
|
- name: fleet_server
|
|
version: latest
|
|
|
|
xpack.ml.ad.enabled: true
|
|
xpack.ml.dfa.enabled: true
|
|
xpack.ml.nlp.enabled: true
|
|
xpack.ml.compatibleModuleType: 'security'
|
|
|
|
# Disable the embedded Dev Console
|
|
console.ui.embeddedEnabled: false
|