Add aws_securityhub.finding source indices to kibana_system role permissions #137866
Conversation
kcreddy
changed the title
elasticsearchmachine
added
needs:triage
kcreddy
added
>non-issue
:Security/Authorization
|
Pinging @elastic/es-security (Team:Security) |
|
@elasticsearchmachine test this please |
azasypkin
left a comment
azasypkin
left a comment
There was a problem hiding this comment.
LGTM from the Kibana Platform Security perspective. Thanks for the updating spreadsheet that tracks owners of every Kibana System permission.
| "logs-google_scc.finding-*", | ||
| "logs-aws.securityhub_findings-*", | ||
| "logs-aws.securityhub_findings_full_posture-*", | ||
| "logs-aws_securityhub.finding-*", |
There was a problem hiding this comment.
Just out of curiosity: what is the difference in the data stored in "logs-aws.securityhub_findings-*" that we already have above and "logs-aws_securityhub.finding-*"? Is the former for the list of findings and the latter for the details of a specific finding or ...?
There was a problem hiding this comment.
https://docs.aws.amazon.com/securityhub/latest/userguide/what-are-securityhub-services.html
https://aws.amazon.com/blogs/aws/unify-your-security-with-the-new-aws-security-hub-for-risk-prioritization-and-response-at-scale-preview/
AWS rebranded existing AWS Security Hub to AWS Security Hub CSPM, and there's a new AWS SecurityHub that can provides additional correlation, contextualization, and visualization capabilities.
Our existing aws integration used logs-aws.securityhub_findings-* indices which only had CSPM capabilities, but this new integration aws_securityhub which uses "logs-aws_securityhub.finding-*" indices is going to have more capabilities as provided by the new AWS SecurityHub.
There was a problem hiding this comment.
Ah, I see, thanks for the additional context!
3 participants
Adding
logs-aws_securityhub.finding-*data stream indices to thekibana_systemprivileges. This is required for the latest transform to work.Related: elastic/integrations#15932
Similar to #124074, #128350