Skip to content

Siem Readiness initial plugin and navigation, package, server api#233714

Merged
JordanSh merged 32 commits intoelastic:mainfrom
JordanSh:siem-readiness-kbn-package
Sep 7, 2025
Merged

Siem Readiness initial plugin and navigation, package, server api#233714
JordanSh merged 32 commits intoelastic:mainfrom
JordanSh:siem-readiness-kbn-package

Conversation

@JordanSh
Copy link
Contributor

@JordanSh JordanSh commented Sep 2, 2025

Summary

Resolves #230516
Resolves #230533

image image

This PR adds the initial infrastructure for the SIEM Readiness feature.

  • Added as a new sub plugin within security solution with basic WIP UI
  • Added simple Readme with enablement instructions
  • Added (temporary) links to the feature page in both ESS and Serverless navigation menus. Will be updated to be part of the launchpad feature once its merged
  • Added Advanced Settings feature flag
  • Added experimental feature flag to hide the Advanced Setting from serverless users
  • Added Kibana package that provides easy logging of tasks across security solution
  • Added an API endpoint to handle index logging

How to enable

Create a local ESS environment (Advanced Setting flag is hidden in serverless regardless of kibana.dev.yml settings)

Enable the experimental flag in your kibana.dev.yml by adding this line:

xpack.securitySolution.enableExperimental: ['siemReadinessDashboard']

This should allow rendering of the Enable SIEM Readiness Dashboard setting in the Advanced Settings page via http://localhost:5601/app/management/kibana/settings. After switching on the toggle and reloading, the SIEM Readiness link should be available via the navigation menu and the search bar.

@JordanSh JordanSh added the Team:Cloud Security Cloud Security team related label Sep 2, 2025
@JordanSh JordanSh added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting labels Sep 2, 2025
@JordanSh JordanSh self-assigned this Sep 2, 2025
@JordanSh JordanSh marked this pull request as ready for review September 3, 2025 13:34
@JordanSh JordanSh requested review from a team as code owners September 3, 2025 13:34
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security)

Copy link
Contributor

@PhilippeOberti PhilippeOberti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM for the @elastic/security-threat-hunting-investigations team. Thank you for keeping this first PR very small and targeted, makes the review a lot nicer on everyone :)

Copy link
Contributor

@mattkime mattkime left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just one question regarding the management code owner review

export const ENABLE_CLOUD_CONNECTOR_SETTING = 'securitySolution:enableCloudConnector' as const;

/** This Kibana Advanced Setting allows users to enable/disable the SIEM Readiness Feature */
export const ENABLE_SIEM_READINESS_SETTING = 'securitySolution:enableSiemReadiness' as const;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should this be imported from the management package?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let me know if i should move this, i've followed the pattern of other advanced settings from security solution as can be seen in this file

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm just curious why its defined in two different places. Its not a huge deal but I am trying to understand before delivering my approval.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thank you for noticing its being defined twice. indeed the other const in the management package ended up not being used at the end. i will remove it and only leave this one. thank you for catching this

@JordanSh JordanSh requested a review from mattkime September 4, 2025 16:10
@mattkime mattkime removed their request for review September 4, 2025 17:09
@JordanSh JordanSh enabled auto-merge (squash) September 7, 2025 07:45
@JordanSh JordanSh merged commit 074fae5 into elastic:main Sep 7, 2025
13 checks passed
@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
securitySolution 7921 7928 +7

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id before after diff
@kbn/siem-readiness - 6 +6

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 10.3MB 10.3MB +2.8KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
elasticAssistant 301.4KB 301.4KB +33.0B
securitySolution 96.7KB 96.9KB +215.0B
securitySolutionEss 31.1KB 31.2KB +82.0B
securitySolutionServerless 44.9KB 45.0KB +89.0B
total +419.0B
Unknown metric groups

API count

id before after diff
@kbn/siem-readiness - 8 +8

async chunk count

id before after diff
securitySolution 102 103 +1

ESLint disabled line counts

id before after diff
securitySolution 673 674 +1

Total ESLint disabled count

id before after diff
securitySolution 775 776 +1

History

cc @JordanSh

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:skip This PR does not require backporting release_note:skip Skip the PR/issue when compiling release notes Team:Cloud Security Cloud Security team related v9.2.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Create Security Readiness KBN Package Create Security Readiness Plugin

7 participants