Skip to content

[7.x] [Security Solution][Detections] Refactor ML calls for newest ML permissions (#74582)#74919

Merged
spong merged 1 commit intoelastic:7.xfrom
spong:backport/7.x/pr-74582
Aug 13, 2020
Merged

[7.x] [Security Solution][Detections] Refactor ML calls for newest ML permissions (#74582)#74919
spong merged 1 commit intoelastic:7.xfrom
spong:backport/7.x/pr-74582

Conversation

@spong
Copy link
Copy Markdown
Member

@spong spong commented Aug 13, 2020

Backports the following commits to 7.x:

…ssions (elastic#74582)

## Summary

Addresses elastic#73567.

ML Users (role: `machine_learning_user`) were previously able to invoke the ML Recognizer API, which we use to get not-yet-installed ML Jobs relevant to our index patterns. As of elastic#64662 this is not true, and so we receive errors from components using the underlying hook, `useSiemJobs`.

To solve this I've created two separate hooks to replace `useSiemJobs`:

* `useSecurityJobs`
  * used on ML Popover
  * includes uninstalled ML Jobs
  * checks (and returns) `isMlAdmin` before fetching data
* `useInstalledSecurityJobs`
  * used on ML Jobs Dropdown and Anomalies Table
  * includes only installed ML Jobs
  * checks (and returns) `isMlUser` before fetching data

Note that we while we now receive the knowledge to do so, we do not always inform the user in the case of invalid permissions, and instead have the following behaviors:

#### User has insufficient license
* ML Popover:  shows an upgrade CTA
* Anomalies Tables: show no data
* Rule Creation: ML Rule option is disabled, shows upgrade CTA
* Rule Details: ML Job Id is displayed as text
#### User is ML User
* ML Popover:  not shown
* Anomalies Tables: show no data
* Rule Creation: ML Rule option is disabled
* Rule Details: ML Job Id is displayed as text
#### User is ML Admin
* ML Popover:  shown
* Anomalies Tables: show data __for installed ML Jobs__
  * This is the same as previous logic, but worth calling out that you can't view historical anomalies
* Rule Creation: ML Rule option is enabled, all ML Jobs available
* Rule Details: ML Job Id is displayed as hyperlink, job status badge shown

### Checklist

- [x] [Unit or functional tests](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#cross-browser-compatibility) were updated or added to match the most common scenarios

### For maintainers

- [ ] This was checked for breaking API changes and was [labeled appropriately](https://github.com/elastic/kibana/blob/master/CONTRIBUTING.md#release-notes-process)
@spong spong added the backport This PR is a backport of another PR label Aug 13, 2020
@kibanamachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

Build metrics

@kbn/optimizer bundle module count

id value diff baseline
securitySolution 2035 +6 2029

async chunks size

id value diff baseline
ml 8.0MB -6.9KB 8.0MB
securitySolution 7.3MB +8.3KB 7.3MB
total +1.4KB

page load bundle size

id value diff baseline
ml 573.2KB +5.2KB 568.0KB
securitySolution 805.9KB +83.0B 805.8KB
total +5.3KB

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@spong spong merged commit 8991c4f into elastic:7.x Aug 13, 2020
@spong spong deleted the backport/7.x/pr-74582 branch August 13, 2020 02:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants