[Security Solution] Rules managment RBAC subfeatures by dplumlee · Pull Request #250131 · elastic/kibana

dplumlee · 2026-01-22T23:29:01Z

Resolves: https://github.com/elastic/security-team/issues/14598
Resolves: https://github.com/elastic/security-team/issues/15244
Resolves: #246471
Based off this PR: #244637

Overview

Adds the following new subfeatures to the Rules RBAC feature within security solution:

security_solution_investigation_guide_edit: ability to modify the note field on detection rules
security_solution_custom_highlighted_fields_edit: ability to modify the investigation_fields field on detection rules
security_solution_enable_disable_rules: ability to enable/disable detection rules
security_solution_manual_run_rules: ability to manually run detection rules
security_solution_rules_management_settings: ability to access rules management settings

Summary

All of these subfeatures are included in the rules:all feature and can be added as extra permissions to a role with only rules:read capabilities.

This PR modifies detection rules UI to support the new granular permissions logic. The rules table has been updated to handle new edge cases with bulk actions when a user only has rules:read permissions as well as the rule edit page and MITRE coverage overview page.

We also modify the API behavior for the rules PUT, rules PATCH, and bulk actions endpoints to be able to edit specific rule params (e.g. note, investigation_fields, enable, etc.) with read only permissions as long as the user has the corresponding subfeature permission. This involved implementing a new server-side permission check that is accessible via the securitySolution context.

The exceptions_list subfeature has also been added to the granular permission PUT route logic along with the new subfeatures added in this PR.

Automated testing

Lastly, this PR adds a lot of test coverage (jest and ess integration) to the logic implemented in both this PR and #245722, and covers the many new edge cases that the granular permissions create. Unit tests have been added for the detection rules client logic in:

detection_rules_client.patch_rule.test.ts
detection_rules_client.update_rule.test.ts

And FTR tests have been added for our CRUD and bulk actions operations in:

x-pack/solutions/security/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_patch/trial_license_complete_tier/patch_rules.ts
x-pack/solutions/security/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_update/trial_license_complete_tier/update_rules.ts
x-pack/solutions/security/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_bulk_actions/trial_license_complete_tier/perform_bulk_enable_disable.ts
x-pack/solutions/security/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_bulk_actions/trial_license_complete_tier/perform_bulk_action.ts
x-pack/solutions/security/test/security_solution_api_integration/test_suites/detections_response/rules_management/rule_bulk_actions/trial_license_complete_tier/perform_bulk_action_dry_run.ts

Screenshots

All taken with the rules-read-subfeatures-all listed in the testing utils section below

Rules table bulk actions - now interact-able with rules:read and new rules subfeatures

Rules table row overflow menu - now a user can manually run a rule with read permissions if the have the correct permissions

Rule edit page - a user can now use the rule edit form if they have the permissions to modify note or investigation_fields

Testing Utils

Testing configs and scripts

This bash script will add/update the kibana roles defined in the config.yml file into your local instance. Usernames will be the same as the role titles and all passwords are set to a default `changeme`. In this file we have `rules-all`, `rules-read`, and `rules-read-subfeatures-all` which can be modified to omit certain permissions based on whatever testing is needed.

config.yaml
rbac-ess-testing-roles.sh

pborgonovi · 2026-02-11T19:13:15Z

PR Testing

Case 1

Rules:Read + Alerts:Read

Opening Rules page I get the following:
- feature_securitySolutionRulesV4.all is missing
  - Role is set to Rules Read. Do we still display this warning?
- feature_securitySolutionAlertsV1.all is missing
  - Role is set to Alerts Read - do we still display this warning?
- Missing read, write, view_index_metadata, manage privileges for the .alerts-security.alerts-default
  - Does the role still require index privilege despite of having Alerts subfeature set to Read?
Opening Rule Details page and scrolling down: no alerts tab, the space is blank until I select either exceptions or executions tab.

Role definition

``` { "rulesread-alertsread": { "cluster": [ "all" ], "indices": [ { "names": [ "auditbeat-*" ], "privileges": [ "all" ], "field_security": { "grant": [ "*" ], "except": [] }, "allow_restricted_indices": false }, { "names": [ ".items-*", ".lists-*" ], "privileges": [ "manage", "view_index_metadata", "read", "write" ], "field_security": { "grant": [ "*" ] }, "allow_restricted_indices": false } ], "applications": [ { "application": "kibana-.kibana", "privileges": [ "feature_siemV5.all", "feature_securitySolutionRulesV4.read", "feature_securitySolutionAlertsV1.read", "feature_dev_tools.all" ], "resources": [ "*" ] } ], "run_as": [], "metadata": {}, "transient_metadata": { "enabled": true }, "description": "Rules read / Alerts read" } } ```

Screenshots

Screen.Recording.2026-02-11.at.10.52.59.AM.mov

Case 2

Rules: Read + Alerts All

Missing read, write, view_index_metadata, manage privileges for the .alerts-security.alerts-default index
- Does the role still require index privilege despite of having Alerts subfeature set to All?
Missing all privileges for the securitySolutionRulesV4 feature.
- Should this be displayed? This role has Rules Read

pborgonovi · 2026-02-13T18:18:31Z

@dplumlee

when no alerts index is present we are showing error messages due to field not located. I suppose these fields should be blank until an index exists?

dplumlee · 2026-02-18T00:33:59Z

@pborgonovi Looking at this it seems to be something better suited to be fixed in the alerts RBAC PR since that's where most of the alerting stuff is changed

chetnarajput-qasource · 2026-03-23T11:34:59Z

/ci

chetnarajput-qasource · 2026-03-24T10:09:21Z

/ci

- relax the requirement to call GET /api/detection_engine/privileges so now roles with alert permissions can call it - enforce ALERTS_API_ALL for routes that make changes to alerts

instead of hard coding the landing tab in every place where we redirect, we will instead redirect to the rule details page and let the router determine in which tab tab the user should land based on their permissions. handle the case where a user receives a url with a tab they don't have access to.

...er/application/rule/methods/bulk_edit_params/schemas/bulk_edit_rule_params_option_schemas.ts

…c-subfeatures

rgodfrey-elastic

LGTM. Thanks for adding the maxSize

…c-subfeatures

cnasikas · 2026-04-06T09:56:48Z

...er/application/rule/methods/bulk_edit_params/schemas/bulk_edit_rule_params_option_schemas.ts

 });

-export const bulkEditParamsOperationsSchema = schema.arrayOf(bulkEditParamsOperationSchema, {
-  minSize: 1,


Thanks! Maybe you can skip calling bulkEditRuleParamsWithReadAuth if the array is empty?

cnasikas · 2026-04-06T10:03:39Z

...er/application/rule/methods/bulk_edit_params/schemas/bulk_edit_rule_params_option_schemas.ts

  ids: schema.maybe(schema.arrayOf(schema.string(), { minSize: 1 })),
-  operations: bulkEditParamsOperationsSchema,
+  operations: schema.arrayOf(bulkEditParamsOperationSchema, {
+    maxSize: 2000,


Could we add the max size to bulkEditParamsOperationsSchema instead and keep the minSize (basically revert the change here and use bulkEditParamsOperationsSchema)? Could my suggestion to skip calling bulkEditRuleParamsWithReadAuth in your code if the array is empty? If not, could we at least be sure that inside the bulkEditRuleParamsWithReadAuth we skip if the operations array is empty?

Talked with @cnasikas about this more in slack. Basically, removing the minSize here is the easier schema refactor of the possible options to maintain current workflows with the new RBAC logic being added. A better path in the future would probably entail adding the add and delete operations to bulkEditParamsOperationsSchema (which right now only allows set). This could allow us to reduce our dependency on the paramsModifier that we currently use in our bulk actions methods (and is responsible for the use case of an empty operations array). Made a slight modification in accordance to this comment but leaving the rest of it for now.

…c-subfeatures

...er/application/rule/methods/bulk_edit_params/schemas/bulk_edit_rule_params_option_schemas.ts

elasticmachine · 2026-04-06T18:17:36Z

⏳ Build in-progress

Buildkite Build
Commit: 83d0ad2
Cloud Deployment
Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-250131-83d0ad26ec25
Security Deployment

Failed CI Steps

Jest Tests #9

Test Failures

[job] [logs] Jest Tests #9 / AssetDocumentTab should select table tab when path tab is table

History

💛 Build #422104 was flaky 416698f
💔 Build #422011 failed 18d6877
💔 Build #421777 failed 92f5e13
💚 Build #421707 succeeded 63d33a2

cc @denar50 @dplumlee

dplumlee self-assigned this Jan 22, 2026

dplumlee force-pushed the rules-managment-rbac-subfeatures branch from d263d07 to 9063a26 Compare February 6, 2026 01:27

elastic deleted a comment from elasticmachine Feb 10, 2026

dplumlee assigned denar50 Feb 11, 2026

dplumlee mentioned this pull request Feb 12, 2026

[ResponseOps] bulkMigrateLegacyActions deletes sidecar SO but rule save is skipped, resulting in lost actions #252794

Open

chetnarajput-qasource added ci:cloud-persist-deployment Persist cloud deployment indefinitely and removed ci:cloud-persist-deployment Persist cloud deployment indefinitely labels Mar 24, 2026

denar50 added 6 commits March 26, 2026 15:19

create alerts feature

3fd870e

create securitySolutionRulesV3

8e75c38

remove unused component

ec4f66e

update alert privileges in the server routes

d431428

- relax the requirement to call GET /api/detection_engine/privileges so now roles with alert permissions can call it - enforce ALERTS_API_ALL for routes that make changes to alerts

make export of product feature getters consistent

3e5e365

andrew-goldstein approved these changes Apr 2, 2026

View reviewed changes

denar50 and others added 2 commits April 2, 2026 16:40

Merge branch 'main' into rules-managment-rbac-subfeatures

f9cfec2

adjusts schema

158b7be

github-advanced-security bot found potential problems Apr 2, 2026

View reviewed changes

...er/application/rule/methods/bulk_edit_params/schemas/bulk_edit_rule_params_option_schemas.ts Fixed Show fixed Hide fixed

adds max size to schema

63d33a2

macroscopeapp bot reviewed Apr 2, 2026

View reviewed changes

...er/application/rule/methods/bulk_edit_params/schemas/bulk_edit_rule_params_option_schemas.ts Outdated Show resolved Hide resolved

grant read access to dv saved objects for rules V4

5a6d844

dplumlee requested a review from rgodfrey-elastic April 2, 2026 21:09

denar50 and others added 5 commits April 2, 2026 23:09

adjust copy in rule subfeatures description labels

060e259

Merge branch 'main' into rules-managment-rbac-subfeatures

7789d23

Changes from node scripts/eslint_all_files --no-cache --fix

92f5e13

fixes cypress tests

6b11227

Merge remote-tracking branch 'upstream/main' into rules-managment-rba…

18d6877

…c-subfeatures

rgodfrey-elastic approved these changes Apr 3, 2026

View reviewed changes

dplumlee added 3 commits April 3, 2026 14:28

Merge remote-tracking branch 'upstream/main' into rules-managment-rba…

9622507

…c-subfeatures

fixes preview tests:

6a7cdaa

update tests broken on merge

416698f

dplumlee requested a review from cnasikas April 3, 2026 18:54

cnasikas reviewed Apr 6, 2026

View reviewed changes

dplumlee added 2 commits April 6, 2026 13:26

address schema comments

553744c

Merge remote-tracking branch 'upstream/main' into rules-managment-rba…

b9b75e9

…c-subfeatures

macroscopeapp bot reviewed Apr 6, 2026

View reviewed changes

...er/application/rule/methods/bulk_edit_params/schemas/bulk_edit_rule_params_option_schemas.ts Show resolved Hide resolved

cnasikas approved these changes Apr 6, 2026

View reviewed changes

fix double array schema

83d0ad2

dplumlee merged commit d8886a4 into elastic:main Apr 6, 2026
19 checks passed

kibanamachine added backport:skip This PR does not require backporting and removed backport:version Backport to applied version labels labels Apr 6, 2026

dplumlee deleted the rules-managment-rbac-subfeatures branch April 6, 2026 19:45

maximpn mentioned this pull request Apr 9, 2026

[Security Solution] Prebuilt rules installation and review endpoints OOM in production #262086

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] Rules managment RBAC subfeatures#250131

[Security Solution] Rules managment RBAC subfeatures#250131
dplumlee merged 122 commits intoelastic:mainfrom
dplumlee:rules-managment-rbac-subfeatures

dplumlee commented Jan 22, 2026 •

edited by banderror

Loading

Uh oh!

pborgonovi commented Feb 11, 2026 •

edited

Loading

Uh oh!

pborgonovi commented Feb 13, 2026

Uh oh!

dplumlee commented Feb 18, 2026

Uh oh!

chetnarajput-qasource commented Mar 23, 2026

Uh oh!

chetnarajput-qasource commented Mar 24, 2026

Uh oh!

Uh oh!

Uh oh!

rgodfrey-elastic left a comment

Uh oh!

cnasikas Apr 6, 2026

Uh oh!

cnasikas Apr 6, 2026 •

edited

Loading

Uh oh!

dplumlee Apr 6, 2026

Uh oh!

Uh oh!

elasticmachine commented Apr 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

15 participants

Conversation

dplumlee commented Jan 22, 2026 • edited by banderror Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

Summary

Automated testing

Screenshots

Testing Utils

Uh oh!

pborgonovi commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Testing

Case 1

Case 2

Uh oh!

pborgonovi commented Feb 13, 2026

Uh oh!

dplumlee commented Feb 18, 2026

Uh oh!

chetnarajput-qasource commented Mar 23, 2026

Uh oh!

chetnarajput-qasource commented Mar 24, 2026

Uh oh!

Uh oh!

Uh oh!

rgodfrey-elastic left a comment

Choose a reason for hiding this comment

Uh oh!

cnasikas Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

cnasikas Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dplumlee Apr 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elasticmachine commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⏳ Build in-progress

Failed CI Steps

Test Failures

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

15 participants

dplumlee commented Jan 22, 2026 •

edited by banderror

Loading

pborgonovi commented Feb 11, 2026 •

edited

Loading

cnasikas Apr 6, 2026 •

edited

Loading

elasticmachine commented Apr 6, 2026 •

edited

Loading