[EDR Workflows] Global artifact API privilege to deprecated features by gergoabraham · Pull Request #225678 · elastic/kibana

gergoabraham · 2025-06-27T16:09:23Z

Summary

#219566 deprecated siemV2, and added a new global_artifact_management_all privilege. See previous PR description for diagrams.

However, the replaceBy role deprecation feature does not 'migrate' privileges completely, only copies ui: privileges.

Therefore, api:securitySolution-writeGlobalArtifacts was missing from the required places, resulting in the bug described in the original issue: https://github.com/elastic/security-team/issues/12921

This PR:

adds the missing api: privileges to the required places,
for this, it copy/pastes Endpoint Exceptions api/ui privileges directly into multiple Kibana feature versions, so it can be versioned/deprecated (its siem/siemV2 privileges differ from siemV3): 17f6397 and 4c8730e
adds a new backward compatibility API test, that uses the space aware feature flag to regress the bug issue

Tip

This bug was found by another backward compatibility tests, during enabling the space awareness feature flag. Those tests were skipped in the PR, and can be enabled after this fix is merged to 9.1.
https://github.com/elastic/kibana/pull/222230/files#diff-2f89ba63a6a03d9982bb0a0022c1a6e733b889aa7779a8ea9ebb771bae9e68f2

Important

The fix only affects an api privilege, that is only used behind a feature flag. Therefore, not having this fix in the next serverless promotion should not cause any issue on serverless, as serverless environment does not use this api privilege.

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Unit or functional tests were updated or added to match the most common scenarios

…rivileges

…LL privileges

elasticmachine · 2025-06-27T16:09:26Z

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

gergoabraham · 2025-06-27T16:28:15Z

...ins/security_solution_serverless/server/product_features/security_product_features_config.ts

+              ...(baseFeatureConfig.privileges.all.api ?? []),
+
+              // API access must be also added, as only UI privileges are copied when replacing a deprecated feature
+              `${APP_ID}-writeGlobalArtifacts`,


@semd @azasypkin @paul-tavares
here we have kind of a hole in the system, but i'd like to add a rationale to it.

on serverless, we provide global_artifact_management_all for users who have siem|siemV2.all (because it includes endpoint exceptions all), and not for siem|siemV2.minimal_all.

but, the api privileges do not differentiate between all and minimal_all, therefore there can be users, who have the minimal_all, but don't have any artifact write privilege, and they will still granted with the new writeGlobalArtifacts api privilege.

what can they do with it?
nothing. (@paul-tavares, please correct me if i'm wrong).
the api privilege on its own does not mean a thing. it is always used together with an artifact ALL privilege (siem.all for endpoint exceptions, siem.anything + siem.trusted_applications_all|event_filters_all|etc for others)

also, as soon the role will be updated to siemV3 (e.g. by manual update), this situation stops existing. hence, i believe we can go forward with this, for the sake of not making this even more complex.

please let me know your thoughts!

This is correct - the privilege by itself does not grant users access to artifacts.

gergoabraham · 2025-06-27T16:31:12Z

x-pack/test_serverless/api_integration/test_suites/security/platform_security/authorization.ts

                "api:bulkGetUserProfiles",
                "api:securitySolution-entity-analytics",
                "api:securitySolution-threat-intelligence",
+                "api:securitySolution-writeGlobalArtifacts",


in this file it is visible, that api:securitySolution-writeGlobalArtifacts has 2 more occurrences than ui:siemV3/writeGlobalArtifacts, namely, the extra occurrences are in siem.minimal_all and `siemV2.minimal_all.
the reason is in this comment: #225678 (comment)

…features

azasypkin · 2025-07-01T17:46:04Z

The fix only affects an api privilege, that is only used behind a feature flag.

Would you mind adding instructions to the PR description on how to toggle this feature flag and test it locally? I definitely lack a lot of context around the security solution features, how they're composed, and how they're used to do a proper review, but I can at least look at the lower-level details (registered privileges and actions level) to see if anything obvious stands out.

gergoabraham · 2025-07-02T07:57:15Z

Would you mind adding instructions to the PR description on how to toggle this feature flag and test it locally? I definitely lack a lot of context around the security solution features, how they're composed, and how they're used to do a proper review, but I can at least look at the lower-level details (registered privileges and actions level) to see if anything obvious stands out.

hey @azasypkin, i'd definitely appreciate you looking into the details, thanks! 🙇

there are detailed steps in the linked bug issue, does that work for you? let me know if you miss something.
https://github.com/elastic/security-team/issues/12921

…privilege is replaced with more privileges than necessary (#226473) ## Summary Log a warning in tests if deprecated feature …privilege is replaced with more privileges than necessary. It can come in handy when we review feature deprecation PRs and want to quickly check CI test logs for early signs of problems. See example output in #225678 (review) Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

…privilege is replaced with more privileges than necessary (elastic#226473) ## Summary Log a warning in tests if deprecated feature …privilege is replaced with more privileges than necessary. It can come in handy when we review feature deprecation PRs and want to quickly check CI test logs for early signs of problems. See example output in elastic#225678 (review) Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> (cherry picked from commit 89c5382)

…eature privilege is replaced with more privileges than necessary (#226473) (#226790) # Backport This will backport the following commits from `main` to `8.17`: - [chore(security, tests): log a warning in tests if deprecated feature privilege is replaced with more privileges than necessary (#226473)](#226473)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Aleh Zasypkin <aleh.zasypkin@elastic.co> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

…eature privilege is replaced with more privileges than necessary (#226473) (#226792) # Backport This will backport the following commits from `main` to `8.19`: - [chore(security, tests): log a warning in tests if deprecated feature privilege is replaced with more privileges than necessary (#226473)](#226473)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Aleh Zasypkin <aleh.zasypkin@elastic.co> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

…eature privilege is replaced with more privileges than necessary (#226473) (#226791) # Backport This will backport the following commits from `main` to `8.18`: - [chore(security, tests): log a warning in tests if deprecated feature privilege is replaced with more privileges than necessary (#226473)](#226473)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Aleh Zasypkin <aleh.zasypkin@elastic.co> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

…features

szwarckonrad

Went through the DW code, looks good implementation wise!

…features

tomsonpl

lgtm 👍

…features

elasticmachine · 2025-07-15T11:24:02Z

💚 Build Succeeded

Buildkite Build
Commit: 4fa794a

Metrics [docs]

✅ unchanged

History

💔 Build #319078 failed 06e1822
💚 Build #318553 succeeded d61a5ac
💚 Build #317613 succeeded 7e4c0c8
💚 Build #316169 succeeded 8c7205a
💔 Build #314789 failed 0913668

cc @gergoabraham

kibanamachine · 2025-07-15T11:49:38Z

Starting backport for target branches: 9.1

https://github.com/elastic/kibana/actions/runs/16292431090

…lastic#225678) ## Summary elastic#219566 deprecated `siemV2`, and added a new `global_artifact_management_all` privilege. See previous PR description for diagrams. However, the `replaceBy` role deprecation feature does not 'migrate' privileges completely, only copies `ui:` privileges. Therefore, `api:securitySolution-writeGlobalArtifacts` was missing from the required places, resulting in the bug described in the original issue: elastic/security-team#12921 This PR: - adds the missing `api:` privileges to the required places, - for this, it copy/pastes Endpoint Exceptions `api`/`ui` privileges directly into multiple Kibana feature versions, so it can be versioned/deprecated (its `siem`/`siemV2` privileges differ from `siemV3`): 17f6397 and 4c8730e - adds a new backward compatibility API test, that uses the space aware feature flag to regress the bug issue > [!TIP] > This bug was found by another backward compatibility tests, during enabling the space awareness feature flag. Those tests were skipped in the PR, and can be enabled after this fix is merged to 9.1. https://github.com/elastic/kibana/pull/222230/files#diff-2f89ba63a6a03d9982bb0a0022c1a6e733b889aa7779a8ea9ebb771bae9e68f2 > [!IMPORTANT] > The fix only affects an `api` privilege, that is only used behind a feature flag. Therefore, not having this fix in the next serverless promotion should not cause any issue on serverless, as serverless environment does not use this api privilege. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios (cherry picked from commit 1dc8cf8)

kibanamachine · 2025-07-15T11:55:52Z

💚 All backports created successfully

Status	Branch	Result
✅	9.1

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…tures (#225678) (#227991) # Backport This will backport the following commits from `main` to `9.1`: - [[EDR Workflows] Global artifact API privilege to deprecated features (#225678)](#225678)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Gergő Ábrahám <gergo.abraham@elastic.co>

## Summary These tests have been disabled on `9.1` due to a bug, that has been fixed since with this PR: - #225678

…lastic#225678) ## Summary elastic#219566 deprecated `siemV2`, and added a new `global_artifact_management_all` privilege. See previous PR description for diagrams. However, the `replaceBy` role deprecation feature does not 'migrate' privileges completely, only copies `ui:` privileges. Therefore, `api:securitySolution-writeGlobalArtifacts` was missing from the required places, resulting in the bug described in the original issue: elastic/security-team#12921 This PR: - adds the missing `api:` privileges to the required places, - for this, it copy/pastes Endpoint Exceptions `api`/`ui` privileges directly into multiple Kibana feature versions, so it can be versioned/deprecated (its `siem`/`siemV2` privileges differ from `siemV3`): 17f6397 and 4c8730e - adds a new backward compatibility API test, that uses the space aware feature flag to regress the bug issue > [!TIP] > This bug was found by another backward compatibility tests, during enabling the space awareness feature flag. Those tests were skipped in the PR, and can be enabled after this fix is merged to 9.1. https://github.com/elastic/kibana/pull/222230/files#diff-2f89ba63a6a03d9982bb0a0022c1a6e733b889aa7779a8ea9ebb771bae9e68f2 > [!IMPORTANT] > The fix only affects an `api` privilege, that is only used behind a feature flag. Therefore, not having this fix in the next serverless promotion should not cause any issue on serverless, as serverless environment does not use this api privilege. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

…privilege is replaced with more privileges than necessary (elastic#226473) ## Summary Log a warning in tests if deprecated feature …privilege is replaced with more privileges than necessary. It can come in handy when we review feature deprecation PRs and want to quickly check CI test logs for early signs of problems. See example output in elastic#225678 (review) Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

…lastic#225678) ## Summary elastic#219566 deprecated `siemV2`, and added a new `global_artifact_management_all` privilege. See previous PR description for diagrams. However, the `replaceBy` role deprecation feature does not 'migrate' privileges completely, only copies `ui:` privileges. Therefore, `api:securitySolution-writeGlobalArtifacts` was missing from the required places, resulting in the bug described in the original issue: elastic/security-team#12921 This PR: - adds the missing `api:` privileges to the required places, - for this, it copy/pastes Endpoint Exceptions `api`/`ui` privileges directly into multiple Kibana feature versions, so it can be versioned/deprecated (its `siem`/`siemV2` privileges differ from `siemV3`): 17f6397 and 4c8730e - adds a new backward compatibility API test, that uses the space aware feature flag to regress the bug issue > [!TIP] > This bug was found by another backward compatibility tests, during enabling the space awareness feature flag. Those tests were skipped in the PR, and can be enabled after this fix is merged to 9.1. https://github.com/elastic/kibana/pull/222230/files#diff-2f89ba63a6a03d9982bb0a0022c1a6e733b889aa7779a8ea9ebb771bae9e68f2 > [!IMPORTANT] > The fix only affects an `api` privilege, that is only used behind a feature flag. Therefore, not having this fix in the next serverless promotion should not cause any issue on serverless, as serverless environment does not use this api privilege. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

gergoabraham added 8 commits June 27, 2025 13:16

add acceptance test

c8e7386

add writeGlobalArtifacts api privileges to siem and siemV2 ALL

92968ec

add writeGlobalArtifacts api privileges to deprecated artifacts ALL p…

056ce8e

…rivileges

fine-tune backward compatibility test to make it stricter

a01b22b

insert Endpoint Exception privileges in every place

17f6397

add writeGlobalArtifacts api priv to deprecated Endpoint Exceptions A…

4c8730e

…LL privileges

update snapshot test

878b4b5

add extra cases to the backward compatibility test

47e0de4

gergoabraham self-assigned this Jun 27, 2025

gergoabraham added the release_note:skip Skip the PR/issue when compiling release notes label Jun 27, 2025

gergoabraham requested a review from a team as a code owner June 27, 2025 16:09

gergoabraham added the Team:Defend Workflows “EDR Workflows” sub-team of Security Solution label Jun 27, 2025

gergoabraham requested review from a team as code owners June 27, 2025 16:09

gergoabraham added the backport:version Backport to applied version labels label Jun 27, 2025

gergoabraham requested a review from a team as a code owner June 27, 2025 16:09

gergoabraham added the v9.1.0 label Jun 27, 2025

gergoabraham requested review from pzl and tomsonpl June 27, 2025 16:09

gergoabraham requested review from azasypkin and semd June 27, 2025 16:09

gergoabraham commented Jun 27, 2025

View reviewed changes

pzl requested review from szwarckonrad and removed request for pzl June 27, 2025 18:54

Merge branch 'main' into global-artifact-api-privilege-to-deprecated-…

d52a2ab

…features

gergoabraham mentioned this pull request Jun 30, 2025

Using migrated roles on Fleet server side #225358

Closed

9 tasks

PhilippeOberti approved these changes Jul 8, 2025

View reviewed changes

Merge branch 'main' into global-artifact-api-privilege-to-deprecated-…

7e4c0c8

…features

paul-tavares approved these changes Jul 10, 2025

View reviewed changes

szwarckonrad approved these changes Jul 11, 2025

View reviewed changes

Merge branch 'main' into global-artifact-api-privilege-to-deprecated-…

d61a5ac

…features

tomsonpl approved these changes Jul 14, 2025

View reviewed changes

gergoabraham added 2 commits July 15, 2025 08:48

Merge branch 'main' into global-artifact-api-privilege-to-deprecated-…

06e1822

…features

Merge branch 'main' into global-artifact-api-privilege-to-deprecated-…

4fa794a

…features

gergoabraham merged commit 1dc8cf8 into elastic:main Jul 15, 2025
11 of 12 checks passed

kibanamachine added the v9.2.0 label Jul 15, 2025

kibanamachine mentioned this pull request Jul 15, 2025

[9.1] [EDR Workflows] Global artifact API privilege to deprecated features (#225678) #227991

Merged

gergoabraham deleted the global-artifact-api-privilege-to-deprecated-features branch July 15, 2025 12:09

This was referenced Jul 15, 2025

[EDR Workflows][9.1] Unskip artifact RBAC tests #228030

Merged

[Fleet][Security Solution] Enable Space Awareness feature for Fleet and Security Solution #227862

Merged

gergoabraham added a commit that referenced this pull request Jul 17, 2025

[EDR Workflows][9.1] Unskip artifact RBAC tests (#228030)

c20ba81

## Summary These tests have been disabled on `9.1` due to a bug, that has been fixed since with this PR: - #225678

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[EDR Workflows] Global artifact API privilege to deprecated features#225678

[EDR Workflows] Global artifact API privilege to deprecated features#225678
gergoabraham merged 16 commits intoelastic:mainfrom
gergoabraham:global-artifact-api-privilege-to-deprecated-features

gergoabraham commented Jun 27, 2025 •

edited by kibanamachine

Loading

Uh oh!

elasticmachine commented Jun 27, 2025

Uh oh!

gergoabraham Jun 27, 2025

Uh oh!

paul-tavares Jun 30, 2025

Uh oh!

gergoabraham Jun 27, 2025

Uh oh!

azasypkin commented Jul 1, 2025

Uh oh!

gergoabraham commented Jul 2, 2025

Uh oh!

szwarckonrad left a comment

Uh oh!

tomsonpl left a comment

Uh oh!

elasticmachine commented Jul 15, 2025

Uh oh!

Uh oh!

kibanamachine commented Jul 15, 2025

Uh oh!

kibanamachine commented Jul 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Conversation

gergoabraham commented Jun 27, 2025 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

Uh oh!

elasticmachine commented Jun 27, 2025

Uh oh!

gergoabraham Jun 27, 2025

Choose a reason for hiding this comment

Uh oh!

paul-tavares Jun 30, 2025

Choose a reason for hiding this comment

Uh oh!

gergoabraham Jun 27, 2025

Choose a reason for hiding this comment

Uh oh!

azasypkin commented Jul 1, 2025

Uh oh!

gergoabraham commented Jul 2, 2025

Uh oh!

szwarckonrad left a comment

Choose a reason for hiding this comment

Uh oh!

tomsonpl left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Jul 15, 2025

💚 Build Succeeded

Metrics [docs]

History

Uh oh!

Uh oh!

kibanamachine commented Jul 15, 2025

Uh oh!

kibanamachine commented Jul 15, 2025

💚 All backports created successfully

Questions ?

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

gergoabraham commented Jun 27, 2025 •

edited by kibanamachine

Loading