[8.14] [Security Solution] - Security solution ES|QL configurable via advanced setting (#181616) by kibanamachine · Pull Request #182430 · elastic/kibana

kibanamachine · 2024-05-02T17:07:07Z

Backport

This will backport the following commits from main to 8.14:

[Security Solution] - Security solution ES|QL configurable via advanced setting (#181616)

Questions ?

Please refer to the Backport tool documentation

…ed setting (elastic#181616) ## Summary This PR links the ESQL functionality in security solution to the `discover:enableESQL` advanced setting. The advanced setting will only be present in ESS, but not serverless The way this should work to maintain parity with the rest of Kibana such as discover and stack rules: - By default ES|QL will be enabled across all Kibana - When the ES|QL advanced setting is disabled: - Timeline - ES|QL tab should not be accessible on any newly created timelines - Existing Timelines with an ES|QL query should still have the tab accessible - Rules - New ES|QL rule should not be available to be created in the *Rule Creation* workflow - Existing ES|QL rules should still run and be able to be edited **Timeline Demo Video:** https://github.com/elastic/kibana/assets/17211684/d5429be9-de37-43e2-882d-687b3371beb4 **Rules Demo Video:** https://github.com/elastic/kibana/assets/17211684/7df2fd11-bd2b-4e50-ad97-b6e1d0f7867a --------- Co-authored-by: Vitalii Dmyterko <92328789+vitaliidm@users.noreply.github.com> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 963391e)

michaelolo24 · 2024-05-02T17:58:11Z

@elasticmachine merge upstream

michaelolo24 · 2024-05-02T19:20:02Z

@elasticmachine merge upstream

michaelolo24 · 2024-05-02T19:58:33Z

@elasticmachine merge upstream

kibana-ci · 2024-05-02T20:33:55Z

💔 Build Failed

Failed CI Steps

Test Failures

[job] [logs] Serverless Detection Engine - Exceptions - Security Solution Cypress Tests #2 / Add exception using data views from rule details "before each" hook for "Creates an exception item and close all matching alerts" "before each" hook for "Creates an exception item and close all matching alerts"
[job] [logs] Serverless Detection Engine - Exceptions - Security Solution Cypress Tests #2 / Add multiple conditions and validate the generated exceptions Use multipe AND conditions and validate it generates one exception Use multipe AND conditions and validate it generates one exception
[job] [logs] Serverless Detection Engine - Exceptions - Security Solution Cypress Tests #2 / Add multiple conditions and validate the generated exceptions Use multipe OR conditions and validate it generates multiple exceptions Use multipe OR conditions and validate it generates multiple exceptions
[job] [logs] Defend Workflows Cypress Tests on Serverless #8 / Agent Policy Settings - Complete Agent Tamper Protection is available with no upselling component present "before all" hook for "should display upselling section for protections" "before all" hook for "should display upselling section for protections"
[job] [logs] Defend Workflows Cypress Tests on Serverless #9 / Agent Policy Settings - Essentials Agent Tamper Protection is unavailable with upselling component present "before all" hook for "should display upselling section for protections" "before all" hook for "should display upselling section for protections"
[job] [logs] Defend Workflows Cypress Tests on Serverless #6 / Agent policy settings API operations on Complete Agent tamper protections "before all" hook for "allow enabling the feature" "before all" hook for "allow enabling the feature"
[job] [logs] Defend Workflows Cypress Tests on Serverless #7 / Agent policy settings API operations on Essentials Agent tamper protections "before all" hook for "throw error when trying to update agent policy settings" "before all" hook for "throw error when trying to update agent policy settings"
[job] [logs] Defend Workflows Cypress Tests on Serverless #2 / App Features for Security Complete PLI Endpoint Operations Analyst "before all" hook for "should allow access to Endpoint list page" "before all" hook for "should allow access to Endpoint list page"
[job] [logs] Defend Workflows Cypress Tests on Serverless #3 / App Features for Security Complete PLI with Endpoint Complete Addon Endpoint Operations Analyst "before all" hook for "should allow access to Endpoint list page" "before all" hook for "should allow access to Endpoint list page"
[job] [logs] Defend Workflows Cypress Tests on Serverless #4 / App Features for Security Essential PLI Endpoint Operations Analyst "before all" hook for "should allow access to Endpoint list page" "before all" hook for "should allow access to Endpoint list page"
[job] [logs] Defend Workflows Cypress Tests on Serverless #5 / App Features for Security Essentials PLI with Endpoint Essentials Addon Endpoint Operations Analyst "before all" hook for "should allow access to Endpoint list page" "before all" hook for "should allow access to Endpoint list page"
[job] [logs] Defend Workflows Cypress Tests #3 / Artifact tabs in Policy Details page Trusted applications tab "before all" hook for "[NONE] User cannot see the tab for Trusted applications" "before all" hook for "[NONE] User cannot see the tab for Trusted applications"
[job] [logs] Defend Workflows Cypress Tests on Serverless #2 / Artifact tabs in Policy Details page Trusted applications tab Given there are no Trusted applications entries "before all" hook for "[ALL] User can add Trusted applications artifact" "before all" hook for "[ALL] User can add Trusted applications artifact"
[job] [logs] Defend Workflows Cypress Tests #4 / Artifacts pages When on the Trusted applications entries list "before all" hook for "no access - should show no privileges callout" "before all" hook for "no access - should show no privileges callout"
[job] [logs] Defend Workflows Cypress Tests on Serverless #3 / Artifacts pages When on the Trusted applications entries list "before all" hook for "no access - should show no privileges callout" "before all" hook for "no access - should show no privileges callout"
[job] [logs] Defend Workflows Cypress Tests #5 / Automated Response Actions From alerts "before all" hook for "should have generated endpoint and rule" "before all" hook for "should have generated endpoint and rule"
[job] [logs] Defend Workflows Cypress Tests on Serverless #4 / Automated Response Actions From alerts "before all" hook for "should have generated endpoint and rule" "before all" hook for "should have generated endpoint and rule"
[job] [logs] FTR Configs #48 / Cloud Security Posture Findings Page - Alerts Rule details The rule page contains the expected matching data
[job] [logs] FTR Configs #48 / Cloud Security Posture Findings Page - Alerts Rule details The rule page contains the expected matching data
[job] [logs] Defend Workflows Cypress Tests #14 / Document signing: "before all" hook for "should fail if data tampered" "before all" hook for "should fail if data tampered"
[job] [logs] FTR Configs #52 / endpoint Endpoint Exceptions "before all" hook for "should add event.module=endpoint to entry if only wildcard operator is present"
[job] [logs] FTR Configs #90 / endpoint Endpoint Exceptions "before all" hook for "should add event.module=endpoint to entry if only wildcard operator is present"
[job] [logs] FTR Configs #52 / endpoint Endpoint Exceptions "before all" hook for "should add event.module=endpoint to entry if only wildcard operator is present"
[job] [logs] FTR Configs #90 / endpoint Endpoint Exceptions "before all" hook for "should add event.module=endpoint to entry if only wildcard operator is present"
[job] [logs] Defend Workflows Cypress Tests #1 / Endpoint generated alerts "before all" hook for "should create a Detection Engine alert from an endpoint alert" "before all" hook for "should create a Detection Engine alert from an endpoint alert"
[job] [logs] Defend Workflows Cypress Tests on Serverless #1 / Endpoint generated alerts "before all" hook for "should create a Detection Engine alert from an endpoint alert" "before all" hook for "should create a Detection Engine alert from an endpoint alert"
[job] [logs] Defend Workflows Cypress Tests #10 / Endpoints page "before all" hook for "Loads the endpoints page" "before all" hook for "Loads the endpoints page"
[job] [logs] Defend Workflows Cypress Tests #6 / Form User with no access can not create an endpoint response action "before all" hook for "no endpoint response action option during rule creation" "before all" hook for "no endpoint response action option during rule creation"
[job] [logs] Defend Workflows Cypress Tests on Serverless #5 / Form User with no access can not create an endpoint response action "before all" hook for "no endpoint response action option during rule creation" "before all" hook for "no endpoint response action option during rule creation"
[job] [logs] Defend Workflows Cypress Tests #16 / Isolate command from Manage "before all" hook for "should allow filtering endpoint by Isolated status" "before all" hook for "should allow filtering endpoint by Isolated status"
[job] [logs] Defend Workflows Cypress Tests #8 / No License User cannot use endpoint action in form "before all" hook for "response actions are disabled" "before all" hook for "response actions are disabled"
[job] [logs] Defend Workflows Cypress Tests #11 / Policy Details Protection updates Renders and saves protection updates "before all" hook for "should render the protection updates tab content" "before all" hook for "should render the protection updates tab content"
[job] [logs] Defend Workflows Cypress Tests #12 / Policy List Renders policy list with outdated policies "before all" hook for "should render the policy list" "before all" hook for "should render the policy list"
[job] [logs] Defend Workflows Cypress Tests #7 / Response actions history page "before all" hook for "enable filtering by type" "before all" hook for "enable filtering by type"
[job] [logs] Defend Workflows Cypress Tests #18 / Response actions history page "before all" hook for "retains expanded action details on page reload" "before all" hook for "retains expanded action details on page reload"
[job] [logs] Defend Workflows Cypress Tests on Serverless #8 / Response actions history page "before all" hook for "retains expanded action details on page reload" "before all" hook for "retains expanded action details on page reload"
[job] [logs] Defend Workflows Cypress Tests #4 / Response console execute command "before all" hook for "should execute a command from response console" "before all" hook for "should execute a command from response console"
[job] [logs] Defend Workflows Cypress Tests #5 / Response console get-file command "before all" hook for "should get file from response console" "before all" hook for "should get file from response console"
[job] [logs] Defend Workflows Cypress Tests #6 / Response console isolate command "before all" hook for "should isolate host from response console" "before all" hook for "should isolate host from response console"
[job] [logs] Defend Workflows Cypress Tests #7 / Response console kill-process command "before all" hook for "should kill process from response console" "before all" hook for "should kill process from response console"
[job] [logs] Defend Workflows Cypress Tests #8 / Response console processes command "before all" hook for "should return processes from response console" "before all" hook for "should return processes from response console"
[job] [logs] Defend Workflows Cypress Tests #9 / Response console release command "before all" hook for "should release host from response console" "before all" hook for "should release host from response console"
[job] [logs] Defend Workflows Cypress Tests #10 / Response console suspend-process command "before all" hook for "should suspend process from response console" "before all" hook for "should suspend process from response console"
[job] [logs] Defend Workflows Cypress Tests #19 / Response console Execute operations: "before all" hook for ""execute --command" - should execute a command" "before all" hook for ""execute --command" - should execute a command"
[job] [logs] Defend Workflows Cypress Tests on Serverless #11 / Response console Execute operations: "before all" hook for ""execute --command" - should execute a command" "before all" hook for ""execute --command" - should execute a command"
[job] [logs] Defend Workflows Cypress Tests #20 / Response console File operations: "before all" hook for ""get-file --path" - should retrieve a file" "before all" hook for ""get-file --path" - should retrieve a file"
[job] [logs] Defend Workflows Cypress Tests on Serverless #12 / Response console File operations: "before all" hook for ""get-file --path" - should retrieve a file" "before all" hook for ""get-file --path" - should retrieve a file"
[job] [logs] Defend Workflows Cypress Tests #15 / Response console From endpoint list "before all" hook for "should open responder" "before all" hook for "should open responder"
[job] [logs] Defend Workflows Cypress Tests #1 / Response console Host Isolation: "before all" hook for "should isolate a host from response console" "before all" hook for "should isolate a host from response console"
[job] [logs] Defend Workflows Cypress Tests on Serverless #13 / Response console Host Isolation: "before all" hook for "should isolate a host from response console" "before all" hook for "should isolate a host from response console"
[job] [logs] Defend Workflows Cypress Tests #3 / Response console Host Isolation: "before all" hook for "should release an isolated host via response console" "before all" hook for "should release an isolated host via response console"
[job] [logs] Defend Workflows Cypress Tests on Serverless #1 / Response console Host Isolation: "before all" hook for "should release an isolated host via response console" "before all" hook for "should release an isolated host via response console"
[job] [logs] Defend Workflows Cypress Tests #2 / Response console Processes operations: "before all" hook for ""processes" - should obtain a list of processes" "before all" hook for ""processes" - should obtain a list of processes"
[job] [logs] Defend Workflows Cypress Tests on Serverless #14 / Response console Processes operations: "before all" hook for ""processes" - should obtain a list of processes" "before all" hook for ""processes" - should obtain a list of processes"
[job] [logs] Defend Workflows Cypress Tests #13 / Response console: From Alerts "before all" hook for "should open responder from alert details flyout" "before all" hook for "should open responder from alert details flyout"
[job] [logs] Defend Workflows Cypress Tests #9 / Results see results when has RBAC "before all" hook for "see endpoint action" "before all" hook for "see endpoint action"
[job] [logs] Defend Workflows Cypress Tests on Serverless #6 / Results see results when has RBAC "before all" hook for "see endpoint action" "before all" hook for "see endpoint action"
[job] [logs] FTR Configs #59 / Screenshots - serverless security UI response ops docs security cases list view case settings screenshot
[job] [logs] FTR Configs #59 / Screenshots - serverless security UI response ops docs security cases list view case settings screenshot
[job] [logs] FTR Configs #4 / serverless security UI navigation breadcrumbs reflect navigation state
[job] [logs] FTR Configs #4 / serverless security UI navigation breadcrumbs reflect navigation state
[job] [logs] Defend Workflows Cypress Tests #17 / Unenroll agent from fleet changing agent policy when agent tamper protection is enabled but then is switched to a policy with it also enabled "before all" hook for "should unenroll from fleet without issues" "before all" hook for "should unenroll from fleet without issues"
[job] [logs] Defend Workflows Cypress Tests #16 / Unenroll agent from fleet changing when agent tamper protection is enabled but then is switched to a policy with it disabled "before all" hook for "should unenroll from fleet without issues" "before all" hook for "should unenroll from fleet without issues"
[job] [logs] Defend Workflows Cypress Tests #15 / Unenroll agent from fleet when agent tamper protection is disabled but then is switched to a policy with it enabled "before all" hook for "should unenroll from fleet without issues" "before all" hook for "should unenroll from fleet without issues"
[job] [logs] Defend Workflows Cypress Tests #13 / Unenroll agent from fleet when agent tamper protection is enabled "before all" hook for "should unenroll from fleet without issues" "before all" hook for "should unenroll from fleet without issues"
[job] [logs] Defend Workflows Cypress Tests #11 / Unenroll agent from fleet with agent tamper protection is disabled "before all" hook for "should unenroll from fleet without issues" "before all" hook for "should unenroll from fleet without issues"
[job] [logs] Defend Workflows Cypress Tests #18 / Uninstall agent from host changing agent policy when agent tamper protection is disabled but then is switched to a policy with it enabled "before all" hook for "should uninstall from host without issues" "before all" hook for "should uninstall from host without issues"
[job] [logs] Defend Workflows Cypress Tests #20 / Uninstall agent from host changing agent policy when agent tamper protection is enabled but then is switched to a policy with it also enabled "before all" hook for "should uninstall from host without issues" "before all" hook for "should uninstall from host without issues"
[job] [logs] Defend Workflows Cypress Tests #19 / Uninstall agent from host changing agent policy when agent tamper protection is enabled but then is switched to a policy with it disabled "before all" hook for "should uninstall from host without issues" "before all" hook for "should uninstall from host without issues"
[job] [logs] Defend Workflows Cypress Tests #12 / Uninstall agent from host when agent tamper protection is disabled "before all" hook for "should uninstall from host without issues" "before all" hook for "should uninstall from host without issues"
[job] [logs] Defend Workflows Cypress Tests #14 / Uninstall agent from host when agent tamper protection is enabled "before all" hook for "should uninstall from host with the uninstall token" "before all" hook for "should uninstall from host with the uninstall token"
[job] [logs] Defend Workflows Cypress Tests #17 / When accessing Endpoint Response Console from Cases "before all" hook for "should display responder option in take action menu" "before all" hook for "should display responder option in take action menu"
[job] [logs] Defend Workflows Cypress Tests on Serverless #7 / When accessing Endpoint Response Console from Cases "before all" hook for "should display responder option in take action menu" "before all" hook for "should display responder option in take action menu"
[job] [logs] Defend Workflows Cypress Tests #2 / When defining a kibana role for Endpoint security access "before all" hook for "should display RBAC entries with expected controls" "before all" hook for "should display RBAC entries with expected controls"
[job] [logs] Defend Workflows Cypress Tests on Serverless #11 / When displaying the Policy Details in Endpoint Essentials PLI "before all" hook for "should display upselling section for protection updates" "before all" hook for "should display upselling section for protection updates"
[job] [logs] Defend Workflows Cypress Tests on Serverless #10 / When displaying the Policy Details in Endpoint Essentials PLI "before all" hook for "should display upselling section for protection updates" "before all" hook for "should display upselling section for protection updates"
[job] [logs] Defend Workflows Cypress Tests on Serverless #10 / When displaying the Policy Details in Security Essentials PLI "before all" hook for "should display upselling section for protections" "before all" hook for "should display upselling section for protections"
[job] [logs] Defend Workflows Cypress Tests on Serverless #9 / When on the Endpoint List in Security Essentials PLI and Isolated hosts exist "before all" hook for "should display release options in host row actions" "before all" hook for "should display release options in host row actions"
[job] [logs] FTR Configs #42 / X-Pack Accessibility Tests - Group 3 Security Solution Accessibility Detections Create Rule Flow Custom Query Rule Define Step default view meets a11y requirements
[job] [logs] FTR Configs #42 / X-Pack Accessibility Tests - Group 3 Security Solution Accessibility Detections Create Rule Flow Custom Query Rule Define Step default view meets a11y requirements

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	5455	5454	-1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	13.6MB	13.6MB	+2.6KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	82.2KB	82.2KB	-15.0B

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @michaelolo24

kibanamachine assigned michaelolo24 May 2, 2024

kibanamachine added the backport This PR is a backport of another PR label May 2, 2024

kibanamachine enabled auto-merge (squash) May 2, 2024 17:07

kibanamachine mentioned this pull request May 2, 2024

[Security Solution] - Security solution ES|QL configurable via advanced setting #181616

Merged

github-actions bot approved these changes May 2, 2024

View reviewed changes

Merge branch '8.14' into backport/8.14/pr-181616

5f7f6e2

Merge branch '8.14' into backport/8.14/pr-181616

a5da838

Merge branch '8.14' into backport/8.14/pr-181616

9bee381

michaelolo24 closed this May 2, 2024

auto-merge was automatically disabled May 2, 2024 20:05
Pull request was closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[8.14] [Security Solution] - Security solution ES|QL configurable via advanced setting (#181616)#182430

[8.14] [Security Solution] - Security solution ES|QL configurable via advanced setting (#181616)#182430
kibanamachine wants to merge 4 commits intoelastic:8.14from
kibanamachine:backport/8.14/pr-181616

kibanamachine commented May 2, 2024

Uh oh!

michaelolo24 commented May 2, 2024

Uh oh!

michaelolo24 commented May 2, 2024

Uh oh!

michaelolo24 commented May 2, 2024

Uh oh!

kibana-ci commented May 2, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

kibanamachine commented May 2, 2024

Backport

Questions ?

Uh oh!

michaelolo24 commented May 2, 2024

Uh oh!

michaelolo24 commented May 2, 2024

Uh oh!

michaelolo24 commented May 2, 2024

Uh oh!

kibana-ci commented May 2, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Async chunks

Page load bundle

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kibana-ci commented May 2, 2024 •

edited

Loading