Closed
Conversation
This does not include changes to existing roles, nor the role migration machinery.
These changes were made automatically in an initial commit that added our new features to roles; those changes have since been reverted (320c34f), and thus there should not currently be any behavioral changes in these files, which makes these stylistic changes even more unnecessary. Note: I also noticed that a few old references had (accidentally?) remained in `security_roles.json` after `320c34f485`; this cleans those up as well.
Instead of requiring siemVX read/all, it now requires securitySolutionRulesV1 read/all
It is unclear on wether "dashboards" and "integrations" should be exclusive to `siemV5` or `securitySolutionRulesV1`. So for now we are showing it when the user has either of those.
This is the current behaviour accoring do the documentation https://www.elastic.co/docs/solutions/security/detect-and-alert/detections-requirements.
Now it requires the `securitySolutionRulesV1.all` privilege
No security subfeature is required in all spaces anymore. The test was failing because the `siemV5` feature file never got updated and it was still referencing a feature flag that has been enabled and removed in `main`. The feature flag in question is `endpointManagementSpaceAwarenessEnabled` which was being used to override the subfeature configuration by setting `requireAllSpaces=false` and `privilegesTooltip=undefined`. Now that the feature flag doesn't exist, it makes sense to remove these properties directly in the subfeature configuration instead of overriding them outside of it.
The logic to show it was relying on the old siemPrivileges, however value lists is now under rules.
Reshuffling privileges and removal of alerting privileges from siemV5. These alerting privileges exist exclusively in securitySolutionRulesV1
This notably includes the fix to the infinite loop on the alerts page when a role lacks sufficient lists privileges.
The test broke after merging main into the branch
…and updateable rules
This will ensure behaviors are correct for all intermediate SIEM features.
…ions-subfeatures Files conflicting: x-pack/solutions/security/plugins/security_solution/common/index.ts
…endpoint exceptions tests stop failing. Added a TODO for discussion on how to move forward with the eventual plan to make lists it's own feature
…ds are modified in ruleUpdate object
Conflicts: x-pack/solutions/security/plugins/security_solution/public/detection_engine/rule_management_ui/components/rules_table/rules_tables.tsx x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/bulk_actions/route.ts x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/rule_management/api/rules/find_rules/route.ts x-pack/solutions/security/test/serverless/api_integration/test_suites/platform_security/authorization.ts
…e route, if exceptions list is the only field 'updated' then we can use the special patch function from alerting
…to rules-exceptions-subfeatures
…n't interfere with prebuilt rules customization logic
Contributor
💔 Build FailedFailed CI Steps
Test Failures
Metrics [docs]Module Count
Public APIs missing comments
Async chunks
Public APIs missing exports
Page load bundle
Unknown metric groupsAPI count
History
|
dplumlee
added a commit
that referenced
this pull request
Dec 9, 2025
Contributor
dhurley14
added a commit
that referenced
this pull request
Jan 31, 2026
## Summary Squashed commits from: #243095 Epic: elastic/security-team#9533 Adds a new subfeature to the Rules RBAC feature implemented [here](#239634) for rule exceptions permissions. --------- Co-authored-by: Devin Hurley <devin.hurley@elastic.co>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Summarize your PR. If it involves visual changes include a screenshot or gif.
Checklist
Check the PR satisfies following conditions.
Reviewers should verify this PR satisfies this list as well.
release_note:breakinglabel should be applied in these situations.release_note:*label is applied per the guidelinesbackport:*labels.Identify risks
Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss.
Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging.