Skip to content

[Security Solution] Fix AlertPrivileges UI hook to use new RBAC features#246254

Merged
rylnd merged 4 commits intoelastic:mainfrom
rylnd:alerts-permissions-use-rules-not-siem
Dec 15, 2025
Merged

[Security Solution] Fix AlertPrivileges UI hook to use new RBAC features#246254
rylnd merged 4 commits intoelastic:mainfrom
rylnd:alerts-permissions-use-rules-not-siem

Conversation

@rylnd
Copy link
Copy Markdown
Contributor

@rylnd rylnd commented Dec 12, 2025 •
edited by kibanamachine
Loading

Summary

This hook, used by a few UI components, was incorrectly still relying on the general SIEM/Security kibana feature for determining access to alerts; it should have been updated to use the new SecurityRulesV1 feature (#239634), instead (which for 9.3 contains the Alerts privileges, and will be split into its own privileges in a later release).

This updates the hook appropriately, as well as removes some unused mocks that were referencing the hold hasSiem* values. Given that the hook was meant specifically for checking alerts privileges, there were/are no legitimate uses of the SIEM/Security feature in this hook.

How To Review

The following components previously required Security:Read permissions. They've now been updated to require RulesV1:Read permissions.

  1. Explore > [Hosts|Network|Users] > [Host|Network|User] Detail Page
    • AlertsByStatus (aka "Alerts by Severity") Panel
    • AlertCountbyRuleStatus (aka "Alerts by Rule") Panel
  2. Dashboards > Overview Page
    • "Alert trend" Panel
  3. Dashboards > Detection & Response Page
    • AlertsByStatus (aka "Alerts") Panel
Example: `AlertsByStatus` and `AlertCountByRuleStatus` Panels on User Detail Page: Screenshot 2025-12-12 at 1 20 20 PM

Checklist

  • Unit or functional tests were updated or added to match the most common scenarios
  • This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
  • The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
  • Review the backport guidelines and apply applicable backport:* labels.

@rylnd
Fix Alert Privileges UI hook to use new RBAC features
24389d1 
This hook, used by a few UI components, was incorrectly still relying on
the general SIEM/Security kibana feature for determining access to
alerts; it should have been updated to use the new SecurityRulesV1
feature, instead (which for 9.3 contains the Alerts privileges, and will
be split into its own privileges in a later release).

This updates the hook appropriately, as well as removes some unused
mocks that were referencing the hold `hasSiem*` values. Given that the
hook was meant specifically for checking alerts privileges, there
were/are no legitimate uses of the SIEM/Security feature in this hook.
@rylnd rylnd self-assigned this Dec 12, 2025
@rylnd rylnd added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Feature:Detection Alerts/Rules RBAC Security Solution RBAC for rules and alerts Team:Detection Engine Security Solution Detection Engine Area 9.3 candidate labels Dec 12, 2025
@rylnd rylnd marked this pull request as ready for review December 12, 2025 21:20
@rylnd rylnd requested review from a team as code owners December 12, 2025 21:20
@rylnd rylnd requested a review from machadoum December 12, 2025 21:20
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Dec 12, 2025

Pinging @elastic/security-detection-engine (Team:Detection Engine)

PhilippeOberti
PhilippeOberti approved these changes Dec 12, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@PhilippeOberti PhilippeOberti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review only, LGTM for the @elastic/security-threat-hunting-investigations team

@rylnd rylnd enabled auto-merge (squash) December 15, 2025 15:40
hop-dev
hop-dev approved these changes Dec 15, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@hop-dev hop-dev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀

@rylnd rylnd merged commit 750f019 into elastic:main Dec 15, 2025
13 checks passed
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Dec 15, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #41 / Serverless Observability - Deployment-agnostic AI Assistant API integration tests observability AI Assistant tool: retrieve_elastic_doc POST /internal/observability_ai_assistant/chat/complete The second request - Sending the user prompt should send 1 document to the llm

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 10.7MB 10.7MB +20.0B

History

cc @rylnd

@rylnd rylnd deleted the alerts-permissions-use-rules-not-siem branch December 15, 2025 21:44
@rylnd rylnd added backport:version Backport to applied version labels and removed backport:skip This PR does not require backporting labels Dec 22, 2025
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Dec 22, 2025

Starting backport for target branches: 9.3

https://github.com/elastic/kibana/actions/runs/20444299632

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 6, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

23 similar comments
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 7, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 8, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 9, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 12, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 13, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 14, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 15, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 16, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 19, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 20, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 21, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 22, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 23, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 26, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 27, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 28, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 29, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 30, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Feb 2, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Feb 3, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Feb 4, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Feb 5, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Feb 6, 2026

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 246254 locally
cc: @rylnd

@rylnd
Copy link
Copy Markdown
Contributor Author

rylnd commented Feb 6, 2026

Already in 9.3; backport is unnecessary.

@rylnd rylnd added the backport:skip This PR does not require backporting label Feb 6, 2026
@kibanamachine kibanamachine removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label Feb 6, 2026
@rylnd rylnd added backport missing Added to PRs automatically when the are determined to be missing a backport. and removed backport:version Backport to applied version labels labels Feb 6, 2026
@kibanamachine kibanamachine removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label Feb 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hop-dev hop-dev hop-dev approved these changes

@andrew-goldstein andrew-goldstein andrew-goldstein approved these changes

@denar50 denar50 denar50 approved these changes

@PhilippeOberti PhilippeOberti PhilippeOberti approved these changes

@KDKHD KDKHD KDKHD approved these changes

@machadoum machadoum Awaiting requested review from machadoum machadoum is a code owner automatically assigned from elastic/security-entity-analytics

Assignees

@rylnd rylnd

Labels

9.3 candidate backport:skip This PR does not require backporting Feature:Detection Alerts/Rules RBAC Security Solution RBAC for rules and alerts release_note:skip Skip the PR/issue when compiling release notes Team:Detection Engine Security Solution Detection Engine Area v9.3.0 v9.4.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

9 participants

@rylnd @elasticmachine @kibanamachine @hop-dev @andrew-goldstein @denar50 @PhilippeOberti @KDKHD @yctercero