Skip to content

Commit 883ac60

Browse files
authored
Merge branch 'main' into poc/reusing-tests-2
2 parents a99211e + d538654 commit 883ac60

1,320 files changed

Lines changed: 9707 additions & 12126 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/CODEOWNERS

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -911,7 +911,6 @@ x-pack/plugins/infra/server/lib/alerting @elastic/actionable-observability
911911
/x-pack/test/alerting_api_integration/spaces_only/tests/alerting/transform_rule_types/ @elastic/ml-ui
912912
/x-pack/test/screenshot_creation/apps/ml_docs @elastic/ml-ui
913913
/x-pack/test/screenshot_creation/services/ml_screenshots.ts @elastic/ml-ui
914-
/docs/api/machine-learning/ @elastic/mlr-docs
915914

916915
# Additional plugins and packages maintained by the ML team.
917916
/x-pack/test/accessibility/apps/transform.ts @elastic/ml-ui
@@ -1020,9 +1019,6 @@ x-pack/plugins/cloud_integrations/cloud_full_story/server/config.ts @elastic/kib
10201019
/x-pack/test/functional/services/cases/ @elastic/response-ops
10211020
/x-pack/test/functional_with_es_ssl/apps/cases/ @elastic/response-ops
10221021
/x-pack/test/api_integration/apis/cases/ @elastic/response-ops
1023-
/docs/api/actions-and-connectors @elastic/mlr-docs
1024-
/docs/api/alerting @elastic/mlr-docs
1025-
/docs/api/cases @elastic/mlr-docs
10261022

10271023
# Enterprise Search
10281024
/x-pack/test/functional_enterprise_search/ @elastic/enterprise-search-frontend
@@ -1114,11 +1110,16 @@ x-pack/plugins/cloud_integrations/cloud_full_story/server/config.ts @elastic/kib
11141110
/x-pack/plugins/stack_connectors/common/gen_ai @elastic/security-threat-hunting-explore
11151111

11161112
## Security Solution sub teams - Detection Rule Management
1113+
/x-pack/plugins/security_solution/common/api/detection_engine/fleet_integrations @elastic/security-detection-rule-management
1114+
/x-pack/plugins/security_solution/common/api/detection_engine/prebuilt_rules @elastic/security-detection-rule-management
1115+
/x-pack/plugins/security_solution/common/api/detection_engine/rule_management @elastic/security-detection-rule-management
1116+
/x-pack/plugins/security_solution/common/api/detection_engine/rule_monitoring @elastic/security-detection-rule-management
1117+
/x-pack/plugins/security_solution/common/api/detection_engine/model/rule_schema @elastic/security-detection-rule-management @elastic/security-detection-engine
1118+
11171119
/x-pack/plugins/security_solution/common/detection_engine/fleet_integrations @elastic/security-detection-rule-management
11181120
/x-pack/plugins/security_solution/common/detection_engine/prebuilt_rules @elastic/security-detection-rule-management
11191121
/x-pack/plugins/security_solution/common/detection_engine/rule_management @elastic/security-detection-rule-management
11201122
/x-pack/plugins/security_solution/common/detection_engine/rule_monitoring @elastic/security-detection-rule-management
1121-
/x-pack/plugins/security_solution/common/detection_engine/rule_schema @elastic/security-detection-rule-management @elastic/security-detection-engine
11221123

11231124
/x-pack/plugins/security_solution/docs/testing/test_plans/detection_response/prebuilt_rules @elastic/security-detection-rule-management
11241125
/x-pack/plugins/security_solution/docs/testing/test_plans/detection_response/rule_management @elastic/security-detection-rule-management
@@ -1153,7 +1154,7 @@ x-pack/plugins/cloud_integrations/cloud_full_story/server/config.ts @elastic/kib
11531154

11541155
## Security Solution sub teams - Detection Engine
11551156

1156-
/x-pack/plugins/security_solution/common/detection_engine/schemas/alerts @elastic/security-detection-engine
1157+
/x-pack/plugins/security_solution/common/api/detection_engine @elastic/security-detection-engine
11571158
/x-pack/plugins/security_solution/common/field_maps @elastic/security-detection-engine
11581159

11591160
/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui @elastic/security-detection-engine

docs/api-generated/rules/rule-apis-passthru.asciidoc

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ Any modifications made to this file will be overwritten.
5353
<a class="up" href="#__Methods">Up</a>
5454
<pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule</code></pre></div>
5555
<div class="method-summary">Creates a rule with a randomly generated rule identifier. (<span class="nickname">createRule</span>)</div>
56-
<div class="method-notes">You must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule you're creating. For example, you must have privileges for the <strong>Management &gt; Stack rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong> features, or <strong>Security</strong> features. If the rule has actions, you must also have <code>read</code> privileges for the <strong>Management &gt; Actions and Connectors</strong> feature. NOTE: This API supports only token-based authentication. When you create a rule, it identifies which roles you have at that point in time. Thereafter, when the rule performs queries, it uses those security privileges. If a user with different privileges updates the rule, its behavior might change.</div>
56+
<div class="method-notes">To create a rule, you must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule you're creating. For example, you must have privileges for the <strong>Management &gt; Stack rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong> features, or <strong>Security</strong> features. If the rule has actions, you must also have <code>read</code> privileges for the <strong>Management &gt; Actions and Connectors</strong> feature. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs.</div>
5757
5858
<h3 class="field-label">Path parameters</h3>
5959
<div class="field-items">
@@ -289,7 +289,7 @@ Any modifications made to this file will be overwritten.
289289
<a class="up" href="#__Methods">Up</a>
290290
<pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule/{ruleId}</code></pre></div>
291291
<div class="method-summary">Creates a rule with a specific rule identifier. (<span class="nickname">createRuleId</span>)</div>
292-
<div class="method-notes">You must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule you're creating. For example, you must have privileges for the <strong>Management &gt; Stack rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong> features, or <strong>Security</strong> features. If the rule has actions, you must also have <code>read</code> privileges for the <strong>Management &gt; Actions and Connectors</strong> feature. NOTE: This API supports only token-based authentication. When you create a rule, it identifies which roles you have at that point in time. Thereafter, when the rule performs queries, it uses those security privileges. If a user with different privileges updates the rule, its behavior might change.</div>
292+
<div class="method-notes">To create a rule, you must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule you're creating. For example, you must have privileges for the <strong>Management &gt; Stack rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong> features, or <strong>Security</strong> features. If the rule has actions, you must also have <code>read</code> privileges for the <strong>Management &gt; Actions and Connectors</strong> feature. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs.</div>
293293
294294
<h3 class="field-label">Path parameters</h3>
295295
<div class="field-items">
@@ -527,7 +527,7 @@ Any modifications made to this file will be overwritten.
527527
<a class="up" href="#__Methods">Up</a>
528528
<pre class="delete"><code class="huge"><span class="http-method">delete</span> /s/{spaceId}/api/alerting/rule/{ruleId}</code></pre></div>
529529
<div class="method-summary">Deletes a rule. (<span class="nickname">deleteRule</span>)</div>
530-
<div class="method-notes">You must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule you're deleting. For example, the <strong>Management</strong> &gt; <strong>Stack Rules</strong> feature, <strong>Analytics</strong> &gt; <strong>Discover</strong> or <strong>Machine Learning</strong> features, <strong>Observability</strong>, or <strong>Security</strong> features. WARNING: After you delete a rule, you cannot recover it.</div>
530+
<div class="method-notes">To delete a rule, you must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule you're deleting. For example, the <strong>Management</strong> &gt; <strong>Stack Rules</strong> feature, <strong>Analytics</strong> &gt; <strong>Discover</strong> or <strong>Machine Learning</strong> features, <strong>Observability</strong>, or <strong>Security</strong> features. WARNING: After you delete a rule, you cannot recover it. If the API key that is used by the rule was created automatically, it is deleted.</div>
531531
532532
<h3 class="field-label">Path parameters</h3>
533533
<div class="field-items">
@@ -629,7 +629,7 @@ Any modifications made to this file will be overwritten.
629629
<a class="up" href="#__Methods">Up</a>
630630
<pre class="post"><code class="huge"><span class="http-method">post</span> /s/{spaceId}/api/alerting/rule/{ruleId}/_enable</code></pre></div>
631631
<div class="method-summary">Enables a rule. (<span class="nickname">enableRule</span>)</div>
632-
<div class="method-notes">This API supports token-based authentication only. You must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule. For example, the <strong>Management &gt; Stack Rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong>, and <strong>Security</strong> features.</div>
632+
<div class="method-notes">To enable a rule, you must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule. For example, the <strong>Management &gt; Stack Rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong>, and <strong>Security</strong> features. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs.</div>
633633
634634
<h3 class="field-label">Path parameters</h3>
635635
<div class="field-items">
@@ -2594,7 +2594,7 @@ Any modifications made to this file will be overwritten.
25942594
<a class="up" href="#__Methods">Up</a>
25952595
<pre class="put"><code class="huge"><span class="http-method">put</span> /s/{spaceId}/api/alerting/rule/{ruleId}</code></pre></div>
25962596
<div class="method-summary">Updates the attributes for a rule. (<span class="nickname">updateRule</span>)</div>
2597-
<div class="method-notes">You must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule you're updating. For example, you must have privileges for the <strong>Management &gt; Stack rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong> features, or <strong>Security</strong> features. If the rule has actions, you must also have <code>read</code> privileges for the <strong>Management &gt; Actions and Connectors</strong> feature. NOTE: This API supports only token-based authentication. When you update a rule, it identifies which roles you have at that point in time. Thereafter, when the rule performs queries, it uses those security privileges. If you have different privileges than the user that created or most recently updated the rule, you might change its behavior. Though some properties are optional, when you update the rule the existing property values are overwritten with default values. Therefore, it is recommended to explicitly set all property values.</div>
2597+
<div class="method-notes">To update a rule, you must have <code>all</code> privileges for the appropriate Kibana features, depending on the <code>consumer</code> and <code>rule_type_id</code> of the rule you're updating. For example, you must have privileges for the <strong>Management &gt; Stack rules</strong> feature, <strong>Analytics &gt; Discover</strong> and <strong>Machine Learning</strong> features, <strong>Observability</strong> features, or <strong>Security</strong> features. If the rule has actions, you must also have <code>read</code> privileges for the <strong>Management &gt; Actions and Connectors</strong> feature. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs. NOTE: If the API key has different privileges than the key that created or most recently updated the rule, the rule behavior might change. Though some properties are optional, when you update the rule the existing property values are overwritten with default values. Therefore, it is recommended to explicitly set all property values.</div>
25982598
25992599
<h3 class="field-label">Path parameters</h3>
26002600
<div class="field-items">

docs/api/alerting/create_rule.asciidoc

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -30,17 +30,6 @@ you must also have `read` privileges for the *Management* >
3030
*{connectors-feature}* feature. For more details, refer to
3131
<<kibana-feature-privileges>>.
3232

33-
=== {api-description-title}
34-
35-
[WARNING]
36-
====
37-
* This API supports only
38-
<<token-api-authentication,token-based authentication>>.
39-
* When you create a rule, it identifies which roles you have at that point in time.
40-
Thereafter, when the rule performs queries, it uses those security privileges.
41-
If a user with different privileges updates the rule, its behavior might change.
42-
====
43-
4433
[[create-rule-api-path-params]]
4534
=== {api-path-parms-title}
4635

docs/api/alerting/update_rule.asciidoc

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -29,21 +29,6 @@ features, *{observability}*, or *Security* features. If the rule has
2929
*{connectors-feature}* feature. For more details, refer to
3030
<<kibana-feature-privileges>>.
3131

32-
=== {api-description-title}
33-
34-
[WARNING]
35-
====
36-
* This API supports only
37-
<<token-api-authentication,token-based authentication>>.
38-
* When you update a rule, it identifies which roles you have at that point in time.
39-
Thereafter, when the rule performs queries, it uses those security privileges.
40-
If you have different privileges than the user that created or most recently
41-
updated the rule, you might change its behavior.
42-
* Though some properties are optional, when you update the rule the existing
43-
property values are overwritten with default values. Therefore, it is
44-
recommended to explicitly set all property values.
45-
====
46-
4732
[[update-rule-api-path-params]]
4833
=== {api-path-parms-title}
4934

docs/management/action-types.asciidoc

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,9 @@ action in the current space.
159159
For out-of-the-box and standardized connectors, refer to
160160
<<pre-configured-connectors,preconfigured connectors>>.
161161

162+
TIP: You can also manage connectors as resources with the https://registry.terraform.io/providers/elastic/elasticstack/latest[Elasticstack provider] for Terraform.
163+
For more details, refer to the https://registry.terraform.io/providers/elastic/elasticstack/latest/docs/resources/kibana_action_connector[elasticstack_kibana_action_connector] resource.
164+
162165
[float]
163166
[[importing-and-exporting-connectors]]
164167
=== Importing and exporting connectors

docs/user/alerting/alerting-setup.asciidoc

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,11 @@
44
<titleabbrev>Set up</titleabbrev>
55
++++
66

7+
:frontmatter-description: Prerequisites and production considerations for using {kib} {alert-features}.
8+
:frontmatter-tags-products: [alerting]
9+
:frontmatter-tags-content-type: [other]
10+
:frontmatter-tags-user-goals: [configure]
11+
712
{kib} {alert-features} are automatically enabled, but might require some additional
813
configuration.
914

@@ -77,27 +82,26 @@ A rule or connector created in one space will not be visible in another.
7782
Rules are authorized using an API key.
7883
Its credentials are used to run all background tasks associated with the rule, including condition checks like {es} queries and triggered actions.
7984

80-
You can create API keys and use them in the header of your API calls as described in <<api-keys>>.
81-
If you create or edit a rule in {kib}, an API key is created that captures a snapshot of your privileges at the time of the edit. The following actions regenerate the API key in {kib}:
85+
If you create or edit a rule in {kib}, an API key is created that captures a snapshot of your privileges at the time of the edit.
86+
The following actions regenerate the API key in {kib}:
8287

8388
* Creating a rule
8489
* Updating a rule
8590

86-
When you disable a rule, it retains the associated API key which is reused when
87-
the rule is enabled. If the API key is missing when you enable the rule (for
88-
example, in the case of imported rules), it generates a new key that has your
89-
security privileges.
91+
When you disable a rule, it retains the associated API key which is reused when the rule is enabled.
92+
If the API key is missing when you enable the rule (for example, in the case of imported rules), it generates a new key that has your security privileges.
93+
94+
You can update an API key manually in **{stack-manage-app} > {rules-ui}** or in the rule details page by selecting **Update API key** in the actions menu.
9095

91-
You can update an API key manually in
92-
**{stack-manage-app} > {rules-ui}** or in the rule details page by selecting
93-
**Update API key** in the actions menu.
96+
If you manage your rules by using {kib} APIs, they support support both key- and token-based authentication as described in <<api-authentication>>.
97+
To use key-based authentication, create API keys and use them in the header of your API calls as described in <<api-keys>>.
98+
To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically.
99+
In both cases, the API key is subsequently associated with the rule and used when it runs.
94100

95101
[IMPORTANT]
96102
==============================================
97-
If a rule requires certain privileges, such as index privileges, to run and a
98-
user without those privileges updates the rule, the rule will no longer
99-
function. Conversely, if a user with greater or administrator privileges
100-
modifies the rule, it will begin running with increased privileges.
103+
If a rule requires certain privileges, such as index privileges, to run and a user without those privileges updates the rule, the rule will no longer function.
104+
Conversely, if a user with greater or administrator privileges modifies the rule, it will begin running with increased privileges.
101105
The same behavior occurs when you change the API key in the header of your API calls.
102106
==============================================
103107

0 commit comments

Comments
 (0)