[Security Solution] Adds Inbox plugin by spong · Pull Request #265634 · elastic/kibana

spong · 2026-04-24T23:33:06Z

Summary

Introduces the Inbox plugin/package and surrounding scaffolding. Includes plugin with RBAC, stubbed out API routes, and client hooks, and kbn-inbox-common package for OAS generation and zod schemas. Please see README.md for detailed architecture.

Disabled by default, enabled via kibana.dev.yml:

xpack.inbox.enabled: true

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

PR developed with Cursor + Claude Opus 4.7 Super Duper xHigh Thinking++

elasticmachine · 2026-04-24T23:33:11Z

Pinging @elastic/security-solution (Team: SecuritySolution)

…ally, or add an exception to src/dev/yarn_deduplicate/index.ts and then commit the changes and push to your branch

github-actions · 2026-04-25T01:19:08Z

🔍 Preview links for changed docs

github-actions · 2026-04-25T01:19:12Z

Vale Linting Results

Summary: 1 warning, 1 suggestion found

⚠️ Warnings (1)

File	Line	Rule	Message
docs/extend/plugin-list.md	169	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.

💡 Suggestions (1)

File	Line	Rule	Message
docs/extend/plugin-list.md	167	Elastic.Wordiness	Consider using 'all' instead of 'all of '.

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

radtke-vale · 2026-04-27T10:38:26Z

+  "group": "platform",
+  "visibility": "shared",


Just to make sure I'm following - is the idea that observability or search might also drop items into the inbox later on, which is why we’re going with a platform/shared setup?

Yup! Treating this as a generic platform capability for now to see how managing workflow approvals and surfacing summaries pans out at large. We can lock this down as a security specific implementation later if that makes more sense. RBAC is only surfaced in Security now fwiw, but this should at least give us the flexibility depending on how things shake out.

delanni

limits 👍

kibanamachine · 2026-04-28T05:42:00Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: ed313e9

Failed CI Steps

Test Failures

[job] [logs] affected Scout: [ observability / apm ] plugin / local-serverless-observability_complete - Custom links template validation - Create custom link with template URL and filters

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`inbox`	-	20	+20

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/inbox-common`	-	17	+17
`inbox`	-	7	+7
total			+24

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`inbox`	-	4.9KB	+4.9KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`inbox`	-	4.7KB	+4.7KB
`securitySolutionEss`	37.4KB	37.4KB	+28.0B
`securitySolutionServerless`	49.9KB	50.0KB	+56.0B
total			+4.8KB

Unknown metric groups

API count

id	before	after	diff
`@kbn/inbox-common`	-	17	+17
`inbox`	-	7	+7
total			+24

async chunk count

id	before	after	diff
`inbox`	-	1	+1

ESLint disabled line counts

id	before	after	diff
`@kbn/inbox-common`	-	1	+1

Total ESLint disabled count

id	before	after	diff
`@kbn/inbox-common`	-	1	+1

History

💔 Build #434565 failed fe82c8a
💛 Build #434362 was flaky d4a83ca
💛 Build #433859 was flaky 854c4a3
💔 Build #433855 failed d8c49a9
💔 Build #433852 failed 81df21f

cc @spong

maximpn

@spong Thanks for fix in @kbn/openapi-generator 🙏

andrew-goldstein · 2026-04-28T16:50:31Z

+    actions: z.array(InboxAction),
+    total: z.number().int(),


Consider a TODO re: paging

spong · 2026-04-28T16:54:30Z

+export const PLUGIN_ID = 'inbox' as const;
+export const PLUGIN_NAME = 'Inbox' as const;
+export const APP_PATH = '/app/inbox' as const;


Re-export from x-pack/platform/packages/shared/kbn-inbox-common/constants.ts?

andrew-goldstein

Thanks @spong for getting the Inbox party started 🎉
LGTM 🚀

…types (#267326) ### Summary Cleanup pass on `@kbn/evals-common` and the `evals` plugin, mirroring what was done for `@kbn/inbox-common` in #265634. No functional changes for end users, but the OAS docs generated from these routes are now correct, and the in-memory cost of the Zod schemas drops via the upstream lazy-bind optimization. ### Changes - **Switch to canonical `buildRouteValidationWithZod` from `@kbn/zod-helpers/v4`** - Deleted the local copy in `kbn-evals-common/impl/schemas/common.ts` and its re-export from `kbn-evals-common/index.ts`. - Updated all 18 evals route files to import the helper from `@kbn/zod-helpers/v4`. - Pruned `@kbn/zod-helpers` and `@kbn/core` from `kbn-evals-common`'s `moon.yml` / `tsconfig.json`; added `@kbn/zod-helpers` to the `evals` plugin's instead. - The canonical helper attaches `_sourceSchema` to the returned validator (added in #263354), which `kbn-router-to-openapispec` unwraps so route `params` / `query` / `body` actually appear in generated OAS docs. The local copy did not, so any OAS doc generation for these routes was silently dropping schema info. - **Regenerated OAS types** (`yarn openapi:generate` in `kbn-evals-common`) - Picks up the `lazySchema(() => …)` wrappers introduced by #264125 and tuned in #266343 (upstream `colinhacks/zod#5897` lazy-bind memory optimization). 19 `.gen.ts` files updated; pattern matches the prior inbox regen exactly. - **README cleanup** — pointed at the new helper location and dropped the obsolete "after regenerating, you may need to fix unused imports" workaround (no longer needed thanks to the OAS-generator `fix_eslint.ts` fix from #265634, which forces the non-editor branch when invoked from agent/IDE terminals). _PR developed with Cursor + Claude Opus 4.7 Super Duper xHigh Thinking++_

spong added 2 commits April 24, 2026 17:18

Inbox initial commit

05797ff

Expand test coverage/fixtures

5198cab

spong requested review from andrew-goldstein, ashokaditya and radtke-vale April 24, 2026 23:33

spong self-assigned this Apr 24, 2026

spong added the release_note:skip Skip the PR/issue when compiling release notes label Apr 24, 2026

spong requested a review from a team as a code owner April 24, 2026 23:33

spong added backport:skip This PR does not require backporting Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v9.5.0 labels Apr 24, 2026

spong and others added 8 commits April 24, 2026 17:34

Merge branch 'main' into inbox-a-go-go

81df21f

Changes from node scripts/lint_ts_projects --fix

469bad3

Changes from node scripts/build_plugin_list_docs

92577dc

TO FIX: Run node 'scripts/yarn_deduplicate && yarn kbn bootstrap' loc…

ca4110c

…ally, or add an exception to src/dev/yarn_deduplicate/index.ts and then commit the changes and push to your branch

Changes from node scripts/generate codeowners

a7b3ef7

Changes from node scripts/regenerate_moon_projects.js --update

d8c49a9

Update codeowners

2f02b9a

Set bundle limits

4ef25ba

spong requested a review from a team as a code owner April 25, 2026 01:16

Changes from node scripts/regenerate_moon_projects.js --update

854c4a3

radtke-vale reviewed Apr 27, 2026

View reviewed changes

delanni approved these changes Apr 27, 2026

View reviewed changes

spong added 4 commits April 27, 2026 09:41

Leverage zod-helpers/v4 instead of local utils

3d4949d

Merge branch 'main' of github.com:elastic/kibana into inbox-a-go-go

d4a83ca

Regen OAS types to include lazySchema changes

9d49c9c

Merge branch 'main' of github.com:elastic/kibana into inbox-a-go-go

fe82c8a

Fix OAS generator when ran by agent

976b3d9

spong requested a review from a team as a code owner April 28, 2026 04:20

spong requested a review from sdesalas April 28, 2026 04:20

spong commented Apr 28, 2026

View reviewed changes

Comment thread src/platform/packages/shared/kbn-openapi-generator/src/lib/fix_eslint.ts

Feedback from Vale linter

ed313e9

maximpn requested review from maximpn and removed request for sdesalas April 28, 2026 07:26

maximpn approved these changes Apr 28, 2026

View reviewed changes

andrew-goldstein reviewed Apr 28, 2026

View reviewed changes

spong commented Apr 28, 2026

View reviewed changes

andrew-goldstein approved these changes Apr 28, 2026

View reviewed changes

spong added the Feature:Inbox This is the label for the Inbox Project label Apr 28, 2026

spong merged commit 36544cf into elastic:main Apr 28, 2026
22 checks passed

spong deleted the inbox-a-go-go branch April 28, 2026 17:19

This was referenced Apr 29, 2026

[Security Solution] Register Workflows with Inbox #266256

Open

[kbn-evals] Adopt canonical @kbn/zod-helpers/v4 and regenerate OAS types #267326

Merged

Conversation

spong commented Apr 24, 2026

Summary

Checklist

Uh oh!

elasticmachine commented Apr 24, 2026

Uh oh!

github-actions Bot commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

github-actions Bot commented Apr 25, 2026

Vale Linting Results

Uh oh!

Uh oh!

radtke-vale Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

spong Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

delanni left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kibanamachine commented Apr 28, 2026

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Page load bundle

API count

async chunk count

ESLint disabled line counts

Total ESLint disabled count

History

Uh oh!

maximpn left a comment

Choose a reason for hiding this comment

Uh oh!

andrew-goldstein Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

spong Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

andrew-goldstein left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

github-actions Bot commented Apr 25, 2026 •

edited

Loading

spong Apr 27, 2026 •

edited

Loading