[Cases] [Security Solution] New cases subfeatures, add comments and reopen cases #194898
+3,543
−524
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -46,7 +46,7 @@ viewer: | |
| - feature_siem.read | ||
| - feature_siem.read_alerts | ||
| - feature_siem.endpoint_list_read | ||
| - feature_securitySolutionCasesV2.read | ||
|
There was a problem hiding this comment. Are these new privileges for all these roles also updated in the elasticsearch-controller repo? The privileges in this file here should be a copy of those. If not, I'd suggest you create a PR on the other repo first, to update the privileges before merging this PR. There was a problem hiding this comment. The privileges in There was a problem hiding this comment.
As I explained in https://github.com/elastic/kibana/pull/194898/files#r1801715345, it might be easier to do it the other way around: first merge the PR, wait until the changes reach production, and then drop legacy privileges from the predefined roles. Alternatively, you could update the predefined roles first, but you’d need to keep both old and new privileges since we’ll have Kibana pods running on different versions simultaneously, and later update predefined roles once again to remove legacy privileges. |
||
| - feature_securitySolutionAssistant.all | ||
| - feature_securitySolutionAttackDiscovery.all | ||
| - feature_actions.read | ||
|
|
@@ -126,7 +126,7 @@ editor: | |
| - feature_siem.process_operations_all | ||
| - feature_siem.actions_log_management_all # Response actions history | ||
| - feature_siem.file_operations_all | ||
| - feature_securitySolutionCasesV2.all | ||
| - feature_securitySolutionAssistant.all | ||
| - feature_securitySolutionAttackDiscovery.all | ||
| - feature_actions.read | ||
|
|
@@ -175,7 +175,7 @@ t1_analyst: | |
| - feature_siem.read | ||
| - feature_siem.read_alerts | ||
| - feature_siem.endpoint_list_read | ||
| - feature_securitySolutionCasesV2.read | ||
| - feature_securitySolutionAssistant.all | ||
| - feature_securitySolutionAttackDiscovery.all | ||
| - feature_actions.read | ||
|
|
@@ -230,7 +230,7 @@ t2_analyst: | |
| - feature_siem.read | ||
| - feature_siem.read_alerts | ||
| - feature_siem.endpoint_list_read | ||
| - feature_securitySolutionCasesV2.all | ||
| - feature_securitySolutionAssistant.all | ||
| - feature_securitySolutionAttackDiscovery.all | ||
| - feature_actions.read | ||
|
|
@@ -300,7 +300,7 @@ t3_analyst: | |
| - feature_siem.actions_log_management_all # Response actions history | ||
| - feature_siem.file_operations_all | ||
| - feature_siem.scan_operations_all | ||
| - feature_securitySolutionCasesV2.all | ||
| - feature_securitySolutionAssistant.all | ||
| - feature_securitySolutionAttackDiscovery.all | ||
| - feature_actions.read | ||
|
|
@@ -362,7 +362,7 @@ threat_intelligence_analyst: | |
| - feature_siem.all | ||
| - feature_siem.endpoint_list_read | ||
| - feature_siem.blocklist_all | ||
| - feature_securitySolutionCasesV2.all | ||
| - feature_securitySolutionAssistant.all | ||
| - feature_securitySolutionAttackDiscovery.all | ||
| - feature_actions.read | ||
|
|
@@ -430,7 +430,7 @@ rule_author: | |
| - feature_siem.host_isolation_exceptions_read | ||
| - feature_siem.blocklist_all # Elastic Defend Policy Management | ||
| - feature_siem.actions_log_management_read | ||
| - feature_securitySolutionCasesV2.all | ||
| - feature_securitySolutionAssistant.all | ||
| - feature_securitySolutionAttackDiscovery.all | ||
| - feature_actions.read | ||
|
|
@@ -502,7 +502,7 @@ soc_manager: | |
| - feature_siem.file_operations_all | ||
| - feature_siem.execute_operations_all | ||
| - feature_siem.scan_operations_all | ||
| - feature_securitySolutionCasesV2.all | ||
| - feature_securitySolutionAssistant.all | ||
| - feature_securitySolutionAttackDiscovery.all | ||
| - feature_actions.all | ||
|
|
@@ -562,7 +562,7 @@ detections_admin: | |
| - feature_siem.all | ||
| - feature_siem.read_alerts | ||
| - feature_siem.crud_alerts | ||
| - feature_securitySolutionCasesV2.all | ||
| - feature_securitySolutionAssistant.all | ||
| - feature_securitySolutionAttackDiscovery.all | ||
| - feature_actions.all | ||
|
|
@@ -621,7 +621,7 @@ platform_engineer: | |
| - feature_siem.host_isolation_exceptions_all | ||
| - feature_siem.blocklist_all # Elastic Defend Policy Management | ||
| - feature_siem.actions_log_management_read | ||
| - feature_securitySolutionCasesV2.all | ||
| - feature_securitySolutionAssistant.all | ||
| - feature_securitySolutionAttackDiscovery.all | ||
| - feature_actions.all | ||
|
|
@@ -694,7 +694,7 @@ endpoint_operations_analyst: | |
| - feature_siem.file_operations_all | ||
| - feature_siem.execute_operations_all | ||
| - feature_siem.scan_operations_all | ||
| - feature_securitySolutionCasesV2.all | ||
| - feature_securitySolutionAssistant.all | ||
| - feature_securitySolutionAttackDiscovery.all | ||
| - feature_actions.all | ||
|
|
@@ -769,7 +769,7 @@ endpoint_policy_manager: | |
| - feature_siem.event_filters_all | ||
| - feature_siem.host_isolation_exceptions_all | ||
| - feature_siem.blocklist_all # Elastic Defend Policy Management | ||
| - feature_securitySolutionCasesV2.all | ||
| - feature_securitySolutionAssistant.all | ||
| - feature_securitySolutionAttackDiscovery.all | ||
| - feature_actions.all | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -35,7 +35,7 @@ | |
| "siem": ["read", "read_alerts"], | ||
| "securitySolutionAssistant": ["all"], | ||
| "securitySolutionAttackDiscovery": ["all"], | ||
| "securitySolutionCasesV2": ["read"], | ||
|
There was a problem hiding this comment. same here @azasypkin - should both versions be kept? There was a problem hiding this comment. Same answer here: you can keep just the latest in dev-only files, but production will require a bit of coordination. |
||
| "actions": ["read"], | ||
| "builtInAlerts": ["read"] | ||
| }, | ||
|
|
@@ -82,7 +82,7 @@ | |
| "siem": ["read", "read_alerts"], | ||
| "securitySolutionAssistant": ["all"], | ||
| "securitySolutionAttackDiscovery": ["all"], | ||
| "securitySolutionCasesV2": ["read"], | ||
| "actions": ["read"], | ||
| "builtInAlerts": ["read"] | ||
| }, | ||
|
|
@@ -150,7 +150,7 @@ | |
| "actions_log_management_all", | ||
| "file_operations_all" | ||
| ], | ||
| "securitySolutionCasesV2": ["all"], | ||
| "securitySolutionAssistant": ["all"], | ||
| "securitySolutionAttackDiscovery": ["all"], | ||
| "actions": ["read"], | ||
|
|
@@ -210,7 +210,7 @@ | |
| "siem": ["all", "read_alerts", "crud_alerts"], | ||
| "securitySolutionAssistant": ["all"], | ||
| "securitySolutionAttackDiscovery": ["all"], | ||
| "securitySolutionCasesV2": ["all"], | ||
| "actions": ["read"], | ||
| "builtInAlerts": ["all"] | ||
| }, | ||
|
|
@@ -263,7 +263,7 @@ | |
| "siem": ["all", "read_alerts", "crud_alerts"], | ||
| "securitySolutionAssistant": ["all"], | ||
| "securitySolutionAttackDiscovery": ["all"], | ||
| "securitySolutionCasesV2": ["all"], | ||
| "actions": ["all"], | ||
| "builtInAlerts": ["all"] | ||
| }, | ||
|
|
@@ -311,7 +311,7 @@ | |
| "siem": ["all", "read_alerts", "crud_alerts"], | ||
| "securitySolutionAssistant": ["all"], | ||
| "securitySolutionAttackDiscovery": ["all"], | ||
| "securitySolutionCasesV2": ["all"], | ||
| "actions": ["read"], | ||
| "builtInAlerts": ["all"], | ||
| "dev_tools": ["all"] | ||
|
|
@@ -366,7 +366,7 @@ | |
| "siem": ["all", "read_alerts", "crud_alerts"], | ||
| "securitySolutionAssistant": ["all"], | ||
| "securitySolutionAttackDiscovery": ["all"], | ||
| "securitySolutionCasesV2": ["all"], | ||
| "actions": ["all"], | ||
| "builtInAlerts": ["all"] | ||
| }, | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,89 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| import { i18n } from '@kbn/i18n'; | ||
|
|
||
| import { DEFAULT_APP_CATEGORIES } from '@kbn/core-application-common'; | ||
| import { KibanaFeatureScope } from '@kbn/features-plugin/common'; | ||
| import type { BaseKibanaFeatureConfig } from '../../types'; | ||
| import { APP_ID, CASES_FEATURE_ID, CASES_FEATURE_ID_V2 } from '../../constants'; | ||
| import type { CasesFeatureParams } from '../types'; | ||
|
|
||
| /** | ||
| * @deprecated Use getCasesBaseKibanaFeatureV2 instead | ||
| */ | ||
| export const getCasesBaseKibanaFeature = ({ | ||
| uiCapabilities, | ||
| apiTags, | ||
| savedObjects, | ||
| }: CasesFeatureParams): BaseKibanaFeatureConfig => { | ||
| return { | ||
| deprecated: { | ||
| notice: i18n.translate( | ||
| 'securitySolutionPackages.features.featureRegistry.linkSecuritySolutionCase.deprecationMessage', | ||
| { | ||
| defaultMessage: | ||
| 'The {currentId} permissions are deprecated, please see {casesFeatureIdV2}.', | ||
| values: { | ||
| currentId: CASES_FEATURE_ID, | ||
| casesFeatureIdV2: CASES_FEATURE_ID_V2, | ||
| }, | ||
| } | ||
| ), | ||
| }, | ||
| id: CASES_FEATURE_ID, | ||
| name: i18n.translate( | ||
| 'securitySolutionPackages.features.featureRegistry.linkSecuritySolutionCaseTitleDeprecated', | ||
| { | ||
| defaultMessage: 'Cases (Deprecated)', | ||
| } | ||
| ), | ||
| order: 1100, | ||
| category: DEFAULT_APP_CATEGORIES.security, | ||
| scope: [KibanaFeatureScope.Spaces, KibanaFeatureScope.Security], | ||
| app: [CASES_FEATURE_ID, 'kibana'], | ||
| catalogue: [APP_ID], | ||
| cases: [APP_ID], | ||
| privileges: { | ||
| all: { | ||
| api: apiTags.all, | ||
| app: [CASES_FEATURE_ID, 'kibana'], | ||
| catalogue: [APP_ID], | ||
| cases: { | ||
| create: [APP_ID], | ||
| read: [APP_ID], | ||
| update: [APP_ID], | ||
| }, | ||
| savedObject: { | ||
| all: [...savedObjects.files], | ||
| read: [...savedObjects.files], | ||
| }, | ||
| ui: uiCapabilities.all, | ||
| replacedBy: [ | ||
| { | ||
| feature: CASES_FEATURE_ID_V2, | ||
| privileges: ['minimal_all', 'create_comment', 'case_reopen'], | ||
|
There was a problem hiding this comment. Users currently with 'all For more on There was a problem hiding this comment. Important I believe we agreed in #194898 (comment) to use "extended" syntax to have separate definition for |
||
| }, | ||
| ], | ||
| }, | ||
| read: { | ||
| api: apiTags.read, | ||
| app: [CASES_FEATURE_ID, 'kibana'], | ||
| catalogue: [APP_ID], | ||
| cases: { | ||
| read: [APP_ID], | ||
| }, | ||
| savedObject: { | ||
| all: [], | ||
| read: [...savedObjects.files], | ||
| }, | ||
| ui: uiCapabilities.read, | ||
| replacedBy: [{ feature: CASES_FEATURE_ID_V2, privileges: ['read'] }], | ||
| }, | ||
| }, | ||
| }; | ||
| }; | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| import type { ProductFeatureCasesKey, CasesSubFeatureId } from '../../product_features_keys'; | ||
| import type { ProductFeatureKibanaConfig } from '../../types'; | ||
|
|
||
| export type DefaultCasesProductFeaturesConfig = Record< | ||
| ProductFeatureCasesKey, | ||
| ProductFeatureKibanaConfig<CasesSubFeatureId> | ||
| >; |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@azasypkin is the expectation to keep both versions since the original
feature_securitySolutionCasesisn't "technically" gone, just deprecated? What would be the expectations be for serverless roles?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Important
This file is used for development, so you can safely remove the old privileges. However, for the real predefined roles defined in the ES controller Helm chart values, you’ll want to keep the old definitions until your changes are fully promoted to all environments, as there will be pods with different Kibana versions interacting with ES at the same time. Once your changes are fully deployed in Serverless production, you should be able to safely update the definitions in the ES controller to replace the privileges of the deprecated features.
(Corrected my original message, I shouldn’t write comments at night 🙈)