[Response Ops][Alerting] Add additional features to alerting rules by denar50 · Pull Request #252703 · elastic/kibana

denar50 · 2026-02-11T12:25:53Z

If you're here because your Kibana feature suddenly changed...

That is happening because this PR is extracting features from alerting.rule.all, namely enable, manual_run and manage_rule_settings (see this change). Your role had alerting.rule.all, so I added the rest of the features to it to ensure backwards compatibility. If you think your Kibana feature doesn't need any of those, you're welcome to remove them in a follow up PR.

Summary

ResposneOps previously created two alerting features on rules SOs in this PR: enable and manual_run, in order to enable the RBAC efforts in the Detection Engine.

Now we are introducing a sub feature within the Rules feature inside the security solution to grant access to "rule settings management" which comprises the ability to manage the gap fill schedulers (see the ticket here).

However we encountered that there is no alerting privilege for rules that matches this new Kibana sub feature.
Additionally we found that the existing alerting.rule.all feature does not allow us to toggle privileges off once it is granted (see the video below where we are able to bypass rules rbac permissions by calling an endpoint that performs authorization using only alerting privileges)

rule-subfeature-issue.mov

Therefore this PR :

introduces a new feature called manage_rule_settings feature for rule SOs in the alerting framework based on the previous PR.
fixes the issue where users with alerting.rule.all will always have all permissions of subfeatures even when they are explicitly toggled off through the Kibana Security role management UI.
This is done by extracting the new alerting features from alerting.rule.all into their own features. This triggers a change in all existing Kibana features that previously included alerting.rule.all since now we will have to explicitly add enable, manual_run and manage_rule_settings in those places.

How was this tested?

I put these commits on top of my branch where I have the "Rules management settings" sub feature which is using the alerting feature provided in this PR.

`manage_rule_settings`

I create a role with read only access to the rule feature and only this sub feature enable. I am then able to create operate the gap fill scheduler. See the video below 👇

alerts-rbac-test.mov

Issue with `alerting.rule.all`

I created a role that has all the permissions for rules, I toggled off enable and then tried to reproduce the issue I previously recorded.

alert.rule.all.fixed.mov

managing the gap fill scheduler requires users to be able to read rules, backfills and schedule backfills

…ofill-scheduler

darnautov · 2026-03-03T13:07:50Z

I think we should also update x-pack/solutions/observability/plugins/observability/server/features/logs_feature.ts and x-pack/platform/plugins/shared/ml/common/types/capabilities.ts?

darnautov · 2026-03-03T17:20:41Z

+    },
+  },
+};
+


Let's add a user with "all" on alertsFixture but with the manual_run sub-feature excluded. And use it to assert alerting.rule.all no longer implicitly grants sub-features

Suggested change

export const AllWithoutManualRunUser: User = {

username: 'all_without_manual_run',

fullName: 'all_without_manual_run',

password: 'all_without_manual_run-password',

role: {

name: 'all_without_manual_run_role',

kibana: [

{

feature: {

actions: ['all'],

alertsFixture: ['minimal_all', 'enable_disable', 'manage_rule_settings'],

},

spaces: ['space1'],

},

],

elasticsearch: {

indices: [

{

names: [`${ES_TEST_INDEX_NAME}*`],

privileges: ['all'],

},

],

},

},

};

then you can updates other tests like create_gap_auto_fill_scheduler.ts, update_gap_autp_fill_scheduler.ts etc, with assertions like "denies manual backfill scheduling when manual_run sub-feature is disabled"

manage_rule_settings has permissions to trigger backfills though. I added two new users: one without any backfill permissions (manual_run and manage_rule_settings) and another without manage_rule_settings, and updated the tests related to gaps.

In order to verify that roles without explicit backfill features are denied even when they have alerting.rule.all

…ofill-scheduler

gsoldevila

Core changes LGTM

…ofill-scheduler

shahargl

lgtm

consulthys

LGT Stack Monitoring

darnautov

LGTM!

benakansara

actionable-obs changes LGTM

dhurley14

LGTM - unrelated to this PR but the @elastic/security-threat-hunting-investigations team is set as the only codeowners for the path x-pack/solutions/security/packages/features which I don't think is correct. We should split that up based on feature ownership, or add all the teams with features in the security solution as codeowners to that same path.

…ofill-scheduler

elasticmachine · 2026-03-06T12:44:10Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: e477661

Failed CI Steps

Scout: [ platform / navigation ] plugin

Test Failures

[job] [logs] Scout: [ platform / navigation ] plugin / local-serverless-security_complete - navigation - opens panel on legacy management landing page

Metrics [docs]

✅ unchanged

History

💔 Build #405695 failed cb4ef9c
💛 Build #405135 was flaky bd26d06
💛 Build #404984 was flaky de759a4
💛 Build #404375 was flaky 9f76ab0
💛 Build #403714 was flaky 8752121
💔 Build #403678 failed 7fa56e8

cc @denar50

jgowdyelastic

Code LGTM

…lastic#252703) # If you're here because your Kibana feature suddenly changed... That is happening because this PR is extracting features from `alerting.rule.all`, namely `enable`, `manual_run` and `manage_rule_settings` (see [this change](https://github.com/elastic/kibana/pull/252703/changes#diff-dc097e1e414af2ca21196b12c7d901373108da58de4dd7505cc169b0e62ec2d3L75)). Your role had `alerting.rule.all`, so I added the rest of the features to it to ensure backwards compatibility. If you think your Kibana feature doesn't need any of those, you're welcome to remove them in a follow up PR. # Summary ResposneOps previously created two alerting features on rules SOs in [this PR](elastic#237526): `enable` and `manual_run`, in order to enable the RBAC efforts in the Detection Engine. Now we are introducing a sub feature within the Rules feature inside the security solution to grant access to "rule settings management" which comprises the ability to manage the gap fill schedulers (see the ticket [here](elastic/security-team#15244)). However we encountered that there is no alerting privilege for rules that matches this new Kibana sub feature. Additionally we found that the existing `alerting.rule.all` feature does not allow us to toggle privileges off once it is granted (see the video below where we are able to bypass rules rbac permissions by calling an endpoint that performs authorization using only alerting privileges) https://github.com/user-attachments/assets/de2a38cd-259e-48aa-b1f2-a38c88f2de88 Therefore this PR : - introduces a new feature called `manage_rule_settings` feature for rule SOs in the alerting framework based on the previous PR. - fixes the issue where users with `alerting.rule.all` will always have all permissions of subfeatures even when they are explicitly toggled off through the Kibana Security role management UI. This is done by extracting the new alerting features from `alerting.rule.all` into their own features. This triggers a change in all existing Kibana features that previously included `alerting.rule.all` since now we will have to explicitly add `enable`, `manual_run` and `manage_rule_settings` in those places. # How was this tested? I put these commits on top of my branch where I have the "Rules management settings" sub feature which is using the alerting feature provided in this PR. ## `manage_rule_settings` I create a role with read only access to the rule feature and only this sub feature enable. I am then able to create operate the gap fill scheduler. See the video below 👇 https://github.com/user-attachments/assets/2bc285a4-d35a-412c-a9fd-2153fdec1b9e ## Issue with `alerting.rule.all` I created a role that has all the permissions for rules, I toggled off `enable` and then tried to reproduce the issue I previously recorded. https://github.com/user-attachments/assets/42d47fbf-5dd0-47ff-8f04-2a8f1c0591f9 --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

elastic deleted a comment from elasticmachine Feb 11, 2026

elastic deleted a comment from elasticmachine Feb 12, 2026

denar50 and others added 4 commits February 12, 2026 15:49

add a new alerting action to manage rule settings

7a09d1d

Changes from node scripts/eslint_all_files --no-cache --fix

e5266dd

update test snapshot

b130811

add missing permissions for managing rule settings operations

699c3aa

managing the gap fill scheduler requires users to be able to read rules, backfills and schedule backfills

denar50 force-pushed the expose-permission-on-rules-to-modify-gap-autofill-scheduler branch from d716807 to 699c3aa Compare February 12, 2026 14:49

add missing read permissions for gap fill scheduling

dee891b

denar50 marked this pull request as ready for review February 12, 2026 19:14

denar50 requested review from a team as code owners February 12, 2026 19:14

denar50 requested review from dhurley14 and rgodfrey-elastic February 12, 2026 19:14

denar50 self-assigned this Feb 12, 2026

denar50 added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting labels Feb 12, 2026

denar50 and others added 3 commits February 12, 2026 20:15

Merge branch 'main' into expose-permission-on-rules-to-modify-gap-aut…

57003a3

…ofill-scheduler

Merge branch 'main' into expose-permission-on-rules-to-modify-gap-aut…

8b313f2

…ofill-scheduler

Changes from node scripts/regenerate_moon_projects.js --update

d3f86ad

elastic-vault-github-plugin-prod bot requested a review from a team as a code owner February 13, 2026 12:35

botelastic bot added the Team:One Workflow Team label for One Workflow (Workflow automation) label Feb 13, 2026

denar50 added 2 commits February 16, 2026 13:03

fix unit test

8b26ff3

Merge branch 'main' into expose-permission-on-rules-to-modify-gap-aut…

098a06b

…ofill-scheduler

elastic deleted a comment from elasticmachine Feb 16, 2026

darnautov self-requested a review February 17, 2026 10:29

Merge branch 'main' into expose-permission-on-rules-to-modify-gap-aut…

faffdf8

…ofill-scheduler

dhurley14 approved these changes Feb 17, 2026

View reviewed changes

darnautov added the release_note:fix label Mar 3, 2026

Changes from node scripts/generate codeowners

67a849d

darnautov added release_note:skip Skip the PR/issue when compiling release notes and removed release_note:fix labels Mar 3, 2026

fix feature definitions: add features excluded from alerting.rule.all

8752121

denar50 requested review from a team as code owners March 3, 2026 13:14

darnautov reviewed Mar 3, 2026

View reviewed changes

denar50 added 3 commits March 4, 2026 13:33

create new test scenarios

9f76ab0

In order to verify that roles without explicit backfill features are denied even when they have alerting.rule.all

Merge branch 'main' into expose-permission-on-rules-to-modify-gap-aut…

7be4e2f

…ofill-scheduler

Merge branch 'main' into expose-permission-on-rules-to-modify-gap-aut…

de759a4

…ofill-scheduler

gsoldevila approved these changes Mar 5, 2026

View reviewed changes

Merge branch 'main' into expose-permission-on-rules-to-modify-gap-aut…

bd26d06

…ofill-scheduler

shahargl approved these changes Mar 5, 2026

View reviewed changes

consulthys approved these changes Mar 5, 2026

View reviewed changes

darnautov approved these changes Mar 5, 2026

View reviewed changes

benakansara approved these changes Mar 5, 2026

View reviewed changes

dhurley14 approved these changes Mar 5, 2026

View reviewed changes

PhilippeOberti approved these changes Mar 5, 2026

View reviewed changes

Merge branch 'main' into expose-permission-on-rules-to-modify-gap-aut…

cb4ef9c

…ofill-scheduler

crespocarlos approved these changes Mar 6, 2026

View reviewed changes

Merge branch 'main' into expose-permission-on-rules-to-modify-gap-aut…

e477661

…ofill-scheduler

jgowdyelastic approved these changes Mar 6, 2026

View reviewed changes

denar50 merged commit eed0992 into elastic:main Mar 6, 2026
18 checks passed

kibanamachine added the v9.4.0 label Mar 6, 2026

dhurley14 mentioned this pull request Mar 9, 2026

CODEOWNERS for x-pack/solutions/security/packages/features should include all teams with features in the security solution #256718

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Response Ops][Alerting] Add additional features to alerting rules#252703

[Response Ops][Alerting] Add additional features to alerting rules#252703
denar50 merged 41 commits intoelastic:mainfrom
denar50:expose-permission-on-rules-to-modify-gap-autofill-scheduler

denar50 commented Feb 11, 2026 •

edited

Loading

Uh oh!

darnautov commented Mar 3, 2026

Uh oh!

darnautov Mar 3, 2026

Uh oh!

denar50 Mar 4, 2026

Uh oh!

gsoldevila left a comment

Uh oh!

shahargl left a comment

Uh oh!

consulthys left a comment

Uh oh!

darnautov left a comment

Uh oh!

benakansara left a comment

Uh oh!

dhurley14 left a comment

Uh oh!

elasticmachine commented Mar 6, 2026

Uh oh!

jgowdyelastic left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

17 participants

+export const AllWithoutManualRunUser: User = {
+  username: 'all_without_manual_run',
+  fullName: 'all_without_manual_run',
+  password: 'all_without_manual_run-password',
+  role: {
+    name: 'all_without_manual_run_role',
+    kibana: [
+      {
+        feature: {
+          actions: ['all'],
+          alertsFixture: ['minimal_all', 'enable_disable', 'manage_rule_settings'],
+        },
+        spaces: ['space1'],
+      },
+    ],
+    elasticsearch: {
+      indices: [
+        {
+          names: [`${ES_TEST_INDEX_NAME}*`],
+          privileges: ['all'],
+        },
+      ],
+    },
+  },
+};

Conversation

denar50 commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

If you're here because your Kibana feature suddenly changed...

Summary

How was this tested?

manage_rule_settings

Issue with alerting.rule.all

Uh oh!

darnautov commented Mar 3, 2026

Uh oh!

darnautov Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

denar50 Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

gsoldevila left a comment

Choose a reason for hiding this comment

Uh oh!

shahargl left a comment

Choose a reason for hiding this comment

Uh oh!

consulthys left a comment

Choose a reason for hiding this comment

Uh oh!

darnautov left a comment

Choose a reason for hiding this comment

Uh oh!

benakansara left a comment

Choose a reason for hiding this comment

Uh oh!

dhurley14 left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Mar 6, 2026

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

History

Uh oh!

jgowdyelastic left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

17 participants

denar50 commented Feb 11, 2026 •

edited

Loading

`manage_rule_settings`

Issue with `alerting.rule.all`