Rules exceptions subfeatures #243095
Draft
Rules exceptions subfeatures #243095
+6,293
−2,117
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This does not include changes to existing roles, nor the role migration machinery.
These changes were made automatically in an initial commit that added our new features to roles; those changes have since been reverted (320c34f), and thus there should not currently be any behavioral changes in these files, which makes these stylistic changes even more unnecessary. Note: I also noticed that a few old references had (accidentally?) remained in `security_roles.json` after `320c34f485`; this cleans those up as well.
Instead of requiring siemVX read/all, it now requires securitySolutionRulesV1 read/all
It is unclear on wether "dashboards" and "integrations" should be exclusive to `siemV5` or `securitySolutionRulesV1`. So for now we are showing it when the user has either of those.
This is the current behaviour accoring do the documentation https://www.elastic.co/docs/solutions/security/detect-and-alert/detections-requirements.
Now it requires the `securitySolutionRulesV1.all` privilege
No security subfeature is required in all spaces anymore. The test was failing because the `siemV5` feature file never got updated and it was still referencing a feature flag that has been enabled and removed in `main`. The feature flag in question is `endpointManagementSpaceAwarenessEnabled` which was being used to override the subfeature configuration by setting `requireAllSpaces=false` and `privilegesTooltip=undefined`. Now that the feature flag doesn't exist, it makes sense to remove these properties directly in the subfeature configuration instead of overriding them outside of it.
The logic to show it was relying on the old siemPrivileges, however value lists is now under rules.
Reshuffling privileges and removal of alerting privileges from siemV5. These alerting privileges exist exclusively in securitySolutionRulesV1
This notably includes the fix to the infinite loop on the alerts page when a role lacks sufficient lists privileges.
The test broke after merging main into the branch
…_server [Automatic Migrations] Fixed Privileges for Dashboard endpoints.
In order to maintain backwards compatibility with alert privileges for existing SIEM users, we need more than `alert.read` for `siem:read` users`. Since our only other option is `alert.all`, we instead grant them this privilege (although arguably this is more access than they previously had). However, once the `securityAlerts` privilege work is complete, `securityAlerts.all` will be pared down to precisely what is needed for security users. Discussion around this change can be found [here](https://github.com/elastic/kibana/pull/239634/files/632bbc0e8c2597ae9f676123d6ecd09b644bbf73#r2510764307).
These were deleted before siemv5 was defined, then added back since. Luckily we have tests verifying the fact that these privileges are "replaced."
…-for-siem-upgrade [Defend Workflows cypress fix] Handle siem version dynamically in artifact details tab cypress test
…and updateable rules
This will ensure behaviors are correct for all intermediate SIEM features.
Contributor
⏳ Build in-progress, with failures
Failed CI StepsHistory
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Summarize your PR. If it involves visual changes include a screenshot or gif.
Checklist
Check the PR satisfies following conditions.
Reviewers should verify this PR satisfies this list as well.
release_note:breakinglabel should be applied in these situations.release_note:*label is applied per the guidelinesbackport:*labels.Identify risks
Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss.
Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging.