[Detection Engine] Extracts Rules/Alerts/Exceptions permission to new Rules feature privileges by rylnd · Pull Request #239634 · elastic/kibana

rylnd · 2025-10-17T22:34:52Z

Note: this is a rewritten copy of the changes in #232113. Initial feedback and conversation can be found there.

Epic: https://github.com/elastic/security-team/issues/8799

Added a new Rules feature that controls access to:

Detection rules
Alerts
Rule exceptions

In the first iteration, Rules feature doesn't allow more granular customization of a user's role as described in https://github.com/elastic/security-team/issues/8799. Granular controls will be extracted from the Rules feature as sub-features in future iterations.

Note also that this PR does not update existing prebuilt/test roles, as per this suggestion. That work is contained in a followup PR, which will be merged subsequent to this one.

How to test this PR

The extraction of the Rules feature from SIEM opens several new possibilities to configure roles.

Rule: none

This role configuration allows access to the rest of Security Solution without access to Detection Rules and Alerts.

Rules menu item is visible to the users, no Detection rules (SIEM), no Shared exceptions lists items in the menu. Benchmark rules and Migrations should still be accessible.
Users should not be able to access any rule page directly
Users cannot access the Alerts page, Alerts menu is hidden
No coverage page
Detection rule monitoring dashboard - depends on access to the .kibana-event-log-* - should not be visible to user
No security rules shown in Stack management -> Rules
For the security setup guide (Getting started) - no rule setup will be possible

Rule: read

This role configuration should allow users to read rules and visit any rule pages but without the ability to edit rules, alerts, or exceptions.

The minimal Kibana feature configuration:

Required index privileges:

Rule details page:
- No action snoozing option,
- No edit rule settings button or actions menu
- “Enable” control is not editable
- Export should be possible
In the rules table (Installed rules and Rules Monitoring tables):
- Bulk actions: only Export option is present
- “Enable” control is not editable
- No action snoozing option
- No edit rule settings button or actions menu
- No “Create new rule” button
- No “Import rule” button
“Add elastic rules” page:
- No “Install rule” link
- No “Install all” button
- No install rule buttons/or greyed out on the rule flyout.
Rule Updates tab
- No Update all, individual rule updates
- On the update flyout - only option to Close, not Update button
Stack management Rules
- Should not be possible to modify the security rules from there

Rule: all

This role configurration should have access to rules, alerts, and exceptions without limitations.

Ability to create, import, edit, update and delete rules.
Rules write access, the user will be able to see rules and details and edit all rule details.

Testing Utils

Testing configs and scripts

This bash script will add/update the kibana roles defined in the config.yml file into your local instance. Usernames will be the same as the role titles and all passwords are set to a default `changeme`

Additional areas to test

Old role configuration (siemV3) should work correctly. Roles created prior to this PR with siemV3:all should map to siemV4:all + rules:all. Roles with siemV3:read to siemV4:read and rules:read.
Serverless with predefined roles
Check the AI4SOC tier for regressions

PR Handoff TODOs

Release Note

Rules feature privileges are added to ESS. Access to Rules may now be explicitly set on both ESS and Serverless for user roles.

Docs Issue

https://github.com/elastic/docs-content-internal/issues/597

kibanamachine · 2025-10-22T21:26:24Z

Project deployed, see credentials at: https://buildkite.com/elastic/kibana-deploy-project-from-pr/builds/680

e40pud · 2025-10-23T14:15:45Z

Mentioned this in the slack, we want to keep current behaviour that allows alerts modifying when "Security" set to "Read", meaning user should be able to modify alerts with the new "Rules" kibana privilege set to "Read".

Right now I'm getting this error:

kibanamachine · 2025-10-23T15:14:32Z

Cloud deployment initiated, see credentials at: https://buildkite.com/elastic/kibana-deploy-cloud-from-pr/builds/506

denar50 · 2025-10-24T12:28:56Z

@logeekal thanks for the testing!
I have pushed a commit that fixes the permissions for the onboardings. So you should be able to see them now when only having rules read.

This does not include changes to existing roles, nor the role migration machinery.

These changes were made automatically in an initial commit that added our new features to roles; those changes have since been reverted (320c34f), and thus there should not currently be any behavioral changes in these files, which makes these stylistic changes even more unnecessary. Note: I also noticed that a few old references had (accidentally?) remained in `security_roles.json` after `320c34f485`; this cleans those up as well.

Instead of requiring siemVX read/all, it now requires securitySolutionRulesV1 read/all

It is unclear on wether "dashboards" and "integrations" should be exclusive to `siemV5` or `securitySolutionRulesV1`. So for now we are showing it when the user has either of those.

…no-cache --fix'

This is the current behaviour accoring do the documentation https://www.elastic.co/docs/solutions/security/detect-and-alert/detections-requirements.

Now it requires the `securitySolutionRulesV1.all` privilege

e40pud · 2025-12-03T13:32:59Z

@sdesalas

This is moving inside /public/detections/components (instead of /public/common/components) .

The MissingPrivilegesCallOut is not moving anywhere it is still inside the /public/common/components (here is the code).

There is a new component for detections missing privileges that added inside the /public/detections/components (here is the code).

rylnd · 2025-12-03T17:42:39Z

@sdesalas @e40pud thanks for the heads up! I merged those changes in here and tested a few permutations of missing privileges. Things still look/behave as expected on our end 👍 :

…and updateable rules

MichelLosier

LGTM for fleet

pborgonovi

@denar50 @rylnd @dplumlee
I've been doing extensive tests since draft PR thus I'm approving it from Sec Eng Prod end.

This will ensure behaviors are correct for all intermediate SIEM features.

logeekal

Thank for incorporating all the changes from Automatic Migrations. I tested in ECH with all combinations of Dashboards and Rules Privileges and Automatic Migrations is working as expected.

jeramysoucy

LGTM! I appreciate the e2e privilege testing strategy 👍

dhurley14

LGTM! Thanks for carrying this through @rylnd @denar50 @dplumlee.

dhurley14 · 2025-12-05T20:55:13Z

x-pack/solutions/security/packages/features/src/security/v5_features/kibana_features.ts

+        INITIALIZE_SECURITY_SOLUTION,
+      ],
+      savedObject: {
+        all: ['alert', ...savedObjects],


For a future investigation:

In every siem feature we include 'alert' in the savedObject: all but skip it in the read privilege. I'm wondering if the addition of the 'alert' SO is redundant because that SO access is controlled via the alerting: { rule: ... feature? cc: @ymao1

Conflicts: x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_tables.tsx x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/bulk_actions/route.ts x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/find_rules/route.ts x-pack/solutions/security/test/serverless/api_integration/test_suites/platform_security/authorization.ts

elasticmachine · 2025-12-08T17:04:46Z

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	8476	8477	+1

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/security-solution-features`	30	31	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	11.1MB	11.1MB	-1.0KB

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`@kbn/security-solution-features`	10	11	+1

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	169.6KB	170.1KB	+526.0B
`securitySolutionEss`	34.4KB	34.5KB	+59.0B
`securitySolutionServerless`	46.1KB	46.2KB	+55.0B
total			+640.0B

Unknown metric groups

API count

id	before	after	diff
`@kbn/security-solution-features`	36	37	+1

History

💚 Build #369722 succeeded ce7bffc
💛 Build #369068 was flaky b45cdce
💚 Build #368759 succeeded 5f6fbd5
💚 Build #368720 succeeded 56d7cae
💔 Build #368652 failed d04dd7f

cc @rylnd @denar50 @dplumlee

* commit '6647f813c9fa03ac0378e3d4756246e8dc4b4c76': (33 commits) [Detection Engine] Extracts Rules/Alerts/Exceptions permission to new Rules feature privileges (elastic#239634) [Agent Builder] Add Intro Tour (elastic#245551) Add datastream lifecycle support to indices metadata (elastic#245548) [Serverless] Update preconfigured connectors (elastic#245445) [Metrics][Discover] Discover to prefer line chars for time series data (elastic#244595) Update dependency @elastic/ebt to ^1.4.1 (main) (elastic#241629) [One Workflow] fix: request bodies with oneof schemas (`kibana.SetAlertsStatus`, etc) (elastic#245344) Update dependency ai to v5 (elastic#244675) Fix Discover trace waterfall behavior with duplicate spans (elastic#244984) [FSH] Migrated fs usage to kbn/fs for sample ingest (elastic#244163) Streamlang: Unskip type coercion test (elastic#245519) [Response Ops][Reporting] Fixing error in calculating delay value between retries (elastic#245431) Add TopNavMenuBeta to navigation plugin (elastic#243578) [scout] support custom servers configuration (elastic#244306) [Fleet] Run agentless background sync without dry run (elastic#245286) Fix Change Password Flaky Test (elastic#245443) Add new gap fill status for rules (elastic#242595) [Kibana Search] Move SLOs higher up in search results (elastic#245518) feat(slo): introduce find SLO instances internal route (elastic#245333) [FSH] Dropped unnecessary `fs` persistence for synthetics project code (elastic#244338) ...

rylnd self-assigned this Oct 17, 2025

banderror assigned denar50 and dplumlee Oct 20, 2025

rylnd added ci:project-deploy-security Create a Security Serverless Project ci:cloud-deploy Create or update a Cloud deployment labels Oct 20, 2025

denar50 force-pushed the rules-rbac-new branch from a72b214 to 76ad1e0 Compare October 21, 2025 13:12

denar50 mentioned this pull request Oct 22, 2025

[Response Ops][Alerting] Adding new alerting actions to allow more fine grained rule privileges #237526

Merged

rylnd mentioned this pull request Oct 22, 2025

[Security Solution] Init rules RBAC configuration #232113

Closed

26 tasks

This comment was marked as resolved.

Sign in to view

rylnd added ci:cloud-redeploy Always create a new Cloud deployment ci:cloud-persist-deployment Persist cloud deployment indefinitely and removed ci:cloud-deploy Create or update a Cloud deployment ci:project-deploy-security Create a Security Serverless Project labels Oct 23, 2025

denar50 force-pushed the rules-rbac-new branch from 568bc3e to 599bfec Compare October 24, 2025 11:14

denar50 force-pushed the rules-rbac-new branch from 75c64d6 to f4569e9 Compare October 24, 2025 13:19

dplumlee force-pushed the rules-rbac-new branch from d719d76 to 6097515 Compare October 28, 2025 22:14

denar50 force-pushed the rules-rbac-new branch from f873486 to 9096390 Compare October 29, 2025 13:17

rylnd and others added 9 commits October 29, 2025 16:12

Introduces Rules feature and subsequent app changes

958deed

This does not include changes to existing roles, nor the role migration machinery.

update the siem migrations required permissions

02765d8

Instead of requiring siemVX read/all, it now requires securitySolutionRulesV1 read/all

update attack discovery required permissions

b35f598

update timeline required permissions

686745e

fix onboarding sections

2f7cff4

It is unclear on wether "dashboards" and "integrations" should be exclusive to `siemV5` or `securitySolutionRulesV1`. So for now we are showing it when the user has either of those.

[CI] Auto-commit changed files from 'node scripts/eslint_all_files --…

4cb8ba0

…no-cache --fix'

allow alert management operations for roles with read only access

65d000a

This is the current behaviour accoring do the documentation https://www.elastic.co/docs/solutions/security/detect-and-alert/detections-requirements.

fix create shared exception list endpoint

d70db6e

Now it requires the `securitySolutionRulesV1.all` privilege

Merge branch 'main' into rules-rbac-new

339b8ee

allows users with read privileges to view uninstalled prebuilt rules …

d04dd7f

…and updateable rules

MichelLosier approved these changes Dec 3, 2025

View reviewed changes

pborgonovi approved these changes Dec 3, 2025

View reviewed changes

dplumlee and others added 4 commits December 3, 2025 15:56

adds mocks to rule upgrade tests

b66434e

updates rule upgrade cypress tests

56d7cae

Add SIEM V4 user to AI4DSOC capabilities tests

5f6fbd5

This will ensure behaviors are correct for all intermediate SIEM features.

Merge remote-tracking branch 'upstream/main' into rules-rbac-new

b45cdce

logeekal approved these changes Dec 5, 2025

View reviewed changes

Merge branch 'main' into rules-rbac-new

ce7bffc

jeramysoucy approved these changes Dec 5, 2025

View reviewed changes

dhurley14 approved these changes Dec 5, 2025

View reviewed changes

rylnd merged commit 6647f81 into elastic:main Dec 8, 2025
13 checks passed

kibanamachine added the v9.3.0 label Dec 8, 2025

rylnd added the Feature:Detection Alerts/Rules RBAC Security Solution RBAC for rules and alerts label Dec 8, 2025

rylnd mentioned this pull request Dec 8, 2025

[Security Solution] Update Security Roles with new Rules RBAC permissions #245576

Merged

4 tasks

rylnd mentioned this pull request Dec 10, 2025

Rules exceptions subfeatures #243095

Closed

10 tasks

dplumlee mentioned this pull request Dec 10, 2025

[Security Solution] Rules exceptions subfeatures #245722

Merged

rylnd mentioned this pull request Dec 12, 2025

[Security Solution] Fix AlertPrivileges UI hook to use new RBAC features #246254

Merged

4 tasks

banderror mentioned this pull request Jan 13, 2026

[Security] 9.3.0 release notes elastic/docs-content#4610

Merged

2 tasks

rylnd mentioned this pull request Mar 31, 2026

[Detection Engine] Update Test Roles for Rules & Alerts RBAC #260543

Open

gergoabraham mentioned this pull request Apr 8, 2026

[EDR Workflows][‼️ v9.4 ‼️] Enable Endpoint exceptions move feature flag #260983

Merged

2 tasks

Conversation

rylnd commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Note: this is a rewritten copy of the changes in #232113. Initial feedback and conversation can be found there.

How to test this PR

Rule: none

Rule: read

Rule: all

Testing Utils

Additional areas to test

PR Handoff TODOs

Release Note

Docs Issue

Uh oh!

kibanamachine commented Oct 22, 2025

Uh oh!

This comment was marked as resolved.

e40pud commented Oct 23, 2025

Uh oh!

kibanamachine commented Oct 23, 2025

Uh oh!

denar50 commented Oct 24, 2025

Uh oh!

e40pud commented Dec 3, 2025

Uh oh!

rylnd commented Dec 3, 2025

Uh oh!

MichelLosier left a comment

Choose a reason for hiding this comment

Uh oh!

pborgonovi left a comment

Choose a reason for hiding this comment

Uh oh!

logeekal left a comment

Choose a reason for hiding this comment

Uh oh!

jeramysoucy left a comment

Choose a reason for hiding this comment

Uh oh!

dhurley14 left a comment

Choose a reason for hiding this comment

Uh oh!

dhurley14 Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Dec 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💚 Build Succeeded

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Public APIs missing exports

Page load bundle

API count

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

19 participants

rylnd commented Oct 17, 2025 •

edited

Loading

elasticmachine commented Dec 8, 2025 •

edited

Loading