[AI4DSOC] Add possibility to disable Stack Rules, Rules Settings and Maintenance window based on Serverless Tier by tomsonpl · Pull Request #214586 · elastic/kibana

tomsonpl · 2025-03-14T14:04:57Z

Description

Disable Rules Settings, Maintenance Window, and Rules UI in Search AI Lake Tier (AI for the SOC product).

This PR adds configuration options to disable Rules Settings, Maintenance Window, and Rules UI in the Search AI Lake tier. These changes are part of the effort to streamline the feature set available in this specific tier.

Changes

Added configuration flags in serverless.security.search_ai_lake.yml:

xpack.alerting.maintenanceWindow.enabled: false
xpack.alerting.rulesSettings.enabled: false
xpack.trigger_actions_ui.rules.enabled: false

Modified the alerting plugin to support enabling/disabling rule settings and maintenance window features
Modified the triggers_actions_ui plugin to support enabling/disabling the Stack Rules UI

Testing

Verified that when these settings are disabled in the Search AI Lake tier:
- Maintenance Window UI is not accessible
- Stack Rules is not registered in the management section
- Rules Settings UI is not accessible (can this exist without Stack Rules) ?

Please add the following configuration to your serverless.security.dev.yml file:

xpack.securitySolutionServerless.productTypes:
  [
    { product_line: 'ai_soc', product_tier: 'search_ai_lake' },
  ]

Closes: https://github.com/elastic/security-team/issues/12099
Closes: https://github.com/elastic/security-team/issues/12100

Partially Closes: https://github.com/elastic/security-team/issues/12396

tomsonpl · 2025-03-14T14:05:08Z

/ci

tomsonpl · 2025-03-14T15:11:16Z

/ci

tomsonpl · 2025-03-17T09:03:43Z

/ci

# Conflicts: # config/serverless.security.search_ai_lake.yml

tomsonpl · 2025-04-02T08:12:43Z

/ci

azasypkin · 2025-04-04T11:28:19Z

config/serverless.security.search_ai_lake.yml

+xpack.alerting.maintenanceWindow.enabled: false
+xpack.alerting.rulesSettings.enabled: false


note: If I understand correctly these two entries don't disable plugins, they look more like feature flags of the alerting plugin that's enabled, so maybe you should place them under something other than the ## Disable plugins section?

I know we don't do this frequently, but it'd super helpful to future readers if the comments in the config file would clarify why exactly you set what you set.

Hmm, do you mean something like ## Disable features next to plugins? Since these 2 are part of a plugin's features and not a plugin itself?

Added a comment :) Thanks @azasypkin !

pmuellr · 2025-04-04T13:47:54Z

@cnasikas I'm wondering a couple things regarding not registering the feature:

do we have other scenarios where we don't register certain features? I'm not sure we do, and wondering what the effects would be
how will routes respond when the feature is not enabled? There's nothing directly here about the routes, so I assume you can still use them, but wondering what's going to happen. I think ideally, the routes would all respond with a "not authorized" sort of response (feels like and looks like that's what it should/will do)
I think we probably want a FT for this scenario to make sure we get the right response for MW and settings when the features are disabled; I think hitting a single API for each is fine, presumably we have auth tests for all this anyway so one API should be good enough to test for this scenario
BWC / ZDT issues - there doesn't seem to be any issues of that sort directly in this code, but where we run into issues with config changes is when older versions end up seeing new config - like kibana controller adding settings before all the running kibanas can accept the change. I think if the changes to use these new settings are confined to config/serverless.security.search_ai_lake.yml and nowhere outside of Kibana (eg, the controller), we should be good.

@tomsonpl - could you try using some of the mw routes with a Kibana instance with these features disabled to see what the results are? They aren't doc'd but you can find them under
x-pack/platform/plugins/shared/alerting/server/routes/maintenance_window/apis

tomsonpl · 2025-04-04T14:14:09Z

Hey @pmuellr thanks for your comment, these are totally valid concerns.

I tested API routes to create a new MW:

POST kbn:/internal/alerting/rules/maintenance_window
{
    "title": "test",
    "duration": 1000,
    "r_rule": {
        "dtstart": "1743775356936"
    }
}

which returned a validation error, so the route is registered anyway - my hope was that the routes are not being registered.

When I enter http://0.0.0.0:5601/app/management/insightsAndAlerting/maintenanceWindows with feature being not enabled it shows Management main page (without changing url).

tomsonpl · 2025-04-08T08:01:23Z

Is there anything I can do here to help review this? :) Thanks!
cc: @cnasikas @pmuellr

…e-alerting-features

mgiota · 2025-05-27T10:03:18Z

I am in the process of backporting my PR into 8.19 and while resolving some conflicts in my PR, I noticed this PR was not backported. @pmuellr Here's a Slack thread with more info on the topic of backporting stuff into 8.19

kibanamachine · 2025-05-27T10:55:59Z

Starting backport for target branches: 8.19

https://github.com/elastic/kibana/actions/runs/15273422197

kibanamachine · 2025-05-27T10:56:02Z

Starting backport for target branches: 8.19

https://github.com/elastic/kibana/actions/runs/15273422284

tomsonpl · 2025-05-27T10:56:53Z

Hey, thanks for raising this! I looked for some more detailed information on what should be merged, and I think you're right, in the end this one should be backported.
I'll try to get it done today.

kibanamachine · 2025-05-27T11:02:20Z

💔 All backports failed

Status	Branch	Result
❌	8.19	Backport failed because of merge conflicts You might need to backport the following PRs to 8.19: - [ftr] split x-pack discover config (#217483)

Manual backport

To create the backport manually run:

node scripts/backport --pr 214586

Questions ?

Please refer to the Backport tool documentation

kibanamachine · 2025-05-27T11:02:22Z

💔 All backports failed

Status	Branch	Result
❌	8.19	Backport failed because of merge conflicts You might need to backport the following PRs to 8.19: - [ftr] split x-pack discover config (#217483)

Manual backport

To create the backport manually run:

node scripts/backport --pr 214586

Questions ?

Please refer to the Backport tool documentation

tomsonpl · 2025-05-27T11:20:20Z

💚 All backports created successfully

Status	Branch	Result
✅	8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

tomsonpl · 2025-05-27T11:22:23Z

I created a backport manually where I kept all the alerting code changes, but did not include the AI SOC parts. Since the functionality is dependent on other PRs, not merged to 8.19.

…Maintenance window based on Serverless Tier (elastic#214586) (cherry picked from commit 6356f2c) # Conflicts: # .buildkite/ftr_platform_stateful_configs.yml # config/serverless.security.search_ai_lake.yml # src/platform/test/plugin_functional/test_suites/core_plugins/rendering.ts # x-pack/platform/plugins/shared/alerting/server/config.test.ts # x-pack/platform/plugins/shared/alerting/server/config.ts # x-pack/platform/plugins/shared/alerting/server/index.ts # x-pack/test/security_solution_cypress/cypress/e2e/ai4dsoc/capabilities/access.cy.ts # x-pack/test/security_solution_cypress/cypress/e2e/ai4dsoc/constants.ts # x-pack/test/security_solution_cypress/cypress/e2e/ai4dsoc/navigation/navigation.cy.ts # x-pack/test/security_solution_cypress/cypress/urls/navigation.ts

kibanamachine · 2025-05-28T11:48:42Z

Looks like this PR has a backport PR but it still hasn't been merged. Please merge it ASAP to keep the branches relatively in sync.
cc: @tomsonpl

…Maintenance window based on Serverless Tier (elastic#214586)

…nanceWindow capability (elastic#218999) ## Summary This PR fixes an issue with the ResponseOps alerts table not handling the `maintenanceWindow` capability being `undefined`. In the AI4DSOC effort, [we recently disabled](elastic#214586) the `maintenanceWindow` capability which cause the `useBulkGetMaintenanceWindowsQuery` hook to crash. Current behavior https://github.com/user-attachments/assets/8ab8c97f-04a0-45cb-95e7-cc9114e87190 Fixed behavior https://github.com/user-attachments/assets/0749bda3-7838-47b7-a65b-5c9b6a92a245 ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios relates to elastic/security-team#11973 Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

kibanamachine · 2025-05-29T12:48:57Z

Looks like this PR has a backport PR but it still hasn't been merged. Please merge it ASAP to keep the branches relatively in sync.
cc: @tomsonpl

…Maintenance window based on Serverless Tier (elastic#214586) (cherry picked from commit 6356f2c) # Conflicts: # .buildkite/ftr_platform_stateful_configs.yml # config/serverless.security.search_ai_lake.yml # src/platform/test/plugin_functional/test_suites/core_plugins/rendering.ts # x-pack/platform/plugins/shared/alerting/server/config.test.ts # x-pack/platform/plugins/shared/alerting/server/config.ts # x-pack/platform/plugins/shared/alerting/server/index.ts # x-pack/platform/plugins/shared/triggers_actions_ui/public/plugin.ts # x-pack/test/security_solution_cypress/cypress/e2e/ai4dsoc/capabilities/access.cy.ts # x-pack/test/security_solution_cypress/cypress/e2e/ai4dsoc/constants.ts # x-pack/test/security_solution_cypress/cypress/e2e/ai4dsoc/navigation/navigation.cy.ts # x-pack/test/security_solution_cypress/cypress/urls/navigation.ts

tomsonpl · 2025-05-30T06:46:13Z

💚 All backports created successfully

Status	Branch	Result
✅	8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine · 2025-05-30T13:49:00Z

Looks like this PR has a backport PR but it still hasn't been merged. Please merge it ASAP to keep the branches relatively in sync.
cc: @tomsonpl

…nanceWindow capability (elastic#218999) ## Summary This PR fixes an issue with the ResponseOps alerts table not handling the `maintenanceWindow` capability being `undefined`. In the AI4DSOC effort, [we recently disabled](elastic#214586) the `maintenanceWindow` capability which cause the `useBulkGetMaintenanceWindowsQuery` hook to crash. Current behavior https://github.com/user-attachments/assets/8ab8c97f-04a0-45cb-95e7-cc9114e87190 Fixed behavior https://github.com/user-attachments/assets/0749bda3-7838-47b7-a65b-5c9b6a92a245 ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios relates to elastic/security-team#11973 Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> (cherry picked from commit 23ad755)

…gs and Maintenance window based on Serverless Tier (#214586) (#221998)

…nanceWindow capability (elastic#218999) ## Summary This PR fixes an issue with the ResponseOps alerts table not handling the `maintenanceWindow` capability being `undefined`. In the AI4DSOC effort, [we recently disabled](elastic#214586) the `maintenanceWindow` capability which cause the `useBulkGetMaintenanceWindowsQuery` hook to crash. Current behavior https://github.com/user-attachments/assets/8ab8c97f-04a0-45cb-95e7-cc9114e87190 Fixed behavior https://github.com/user-attachments/assets/0749bda3-7838-47b7-a65b-5c9b6a92a245 ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios relates to elastic/security-team#11973 Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> (cherry picked from commit 23ad755)

tomsonpl added 2 commits March 14, 2025 14:56

disable rule settings and maintenance window

cce7478

fix

fda3fef

tomsonpl self-assigned this Mar 14, 2025

fix

6053fe4

fix tests

0a9da07

tomsonpl added 2 commits March 18, 2025 10:27

Merge branch 'main' into hide-alerting-features

593f131

# Conflicts: # config/serverless.security.search_ai_lake.yml

Merge branch 'main' into hide-alerting-features

21bc37e

tomsonpl marked this pull request as ready for review April 2, 2025 15:13

tomsonpl requested review from a team as code owners April 2, 2025 15:13

Merge branch 'main' into hide-alerting-features

1e1a7af

tomsonpl added release_note:skip Skip the PR/issue when compiling release notes Team:Security Generative AI Security Generative AI backport:version Backport to applied version labels v9.1.0 labels Apr 2, 2025

Merge branch 'main' into hide-alerting-features

bf95227

azasypkin approved these changes Apr 4, 2025

View reviewed changes

Update serverless.security.search_ai_lake.yml

6027f49

Merge branch 'main' into hide-alerting-features

fd9f596

add rules enabled to config

7b8ffc5

tomsonpl marked this pull request as draft April 9, 2025 19:38

Merge remote-tracking branch 'origin/hide-alerting-features' into hid…

5d5283c

…e-alerting-features

tomsonpl added backport:skip This PR does not require backporting and removed backport:version Backport to applied version labels labels Apr 28, 2025

tomsonpl added backport:version Backport to applied version labels v8.19.0 and removed backport:skip This PR does not require backporting labels May 27, 2025

tomsonpl mentioned this pull request May 27, 2025

[8.19] [AI4DSOC] Add possibility to disable Stack Rules, Rules Settings and Maintenance window based on Serverless Tier (#214586) #221608

Closed

kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label May 28, 2025

akowalska622 pushed a commit to akowalska622/kibana that referenced this pull request May 29, 2025

[AI4DSOC] Add possibility to disable Stack Rules, Rules Settings and …

77b63aa

…Maintenance window based on Serverless Tier (elastic#214586)

tomsonpl mentioned this pull request May 30, 2025

[8.19] [AI4DSOC] Add possibility to disable Stack Rules, Rules Settings and Maintenance window based on Serverless Tier (#214586) #221998

Merged

tomsonpl added a commit that referenced this pull request Jun 2, 2025

[8.19] [AI4DSOC] Add possibility to disable Stack Rules, Rules Settin…

028f102

…gs and Maintenance window based on Serverless Tier (#214586) (#221998)

kibanamachine removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label Jun 2, 2025

js-jankisalvi mentioned this pull request Oct 21, 2025

[ResponseOps][MW] Move MW code to its own plugin - UI side #239899

Closed

		xpack.alerting.maintenanceWindow.enabled: false
		xpack.alerting.rulesSettings.enabled: false

Conversation

tomsonpl commented Mar 14, 2025 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

Testing

Uh oh!

tomsonpl commented Mar 14, 2025

Uh oh!

tomsonpl commented Mar 14, 2025

Uh oh!

tomsonpl commented Mar 17, 2025

Uh oh!

tomsonpl commented Apr 2, 2025

Uh oh!

azasypkin Apr 4, 2025

Choose a reason for hiding this comment

Uh oh!

tomsonpl Apr 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tomsonpl Apr 4, 2025

Choose a reason for hiding this comment

Uh oh!

pmuellr commented Apr 4, 2025

Uh oh!

tomsonpl commented Apr 4, 2025

Uh oh!

tomsonpl commented Apr 8, 2025

Uh oh!

mgiota commented May 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kibanamachine commented May 27, 2025

Uh oh!

kibanamachine commented May 27, 2025

Uh oh!

tomsonpl commented May 27, 2025

Uh oh!

kibanamachine commented May 27, 2025

💔 All backports failed

Manual backport

Questions ?

Uh oh!

kibanamachine commented May 27, 2025

💔 All backports failed

Manual backport

Questions ?

Uh oh!

tomsonpl commented May 27, 2025

💚 All backports created successfully

Questions ?

Uh oh!

tomsonpl commented May 27, 2025

Uh oh!

kibanamachine commented May 28, 2025

Uh oh!

kibanamachine commented May 29, 2025

Uh oh!

tomsonpl commented May 30, 2025

💚 All backports created successfully

Questions ?

Uh oh!

kibanamachine commented May 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

12 participants

tomsonpl commented Mar 14, 2025 •

edited by kibanamachine

Loading

tomsonpl Apr 4, 2025 •

edited

Loading

mgiota commented May 27, 2025 •

edited

Loading