[Entity Analytics][Lead generation] Hide leads section and disable Generate button based on ES index permissions

[abhishekbhatia1710]

Summary

Follow-up to #265956, addressing the review request by @ymao1 in this comment.

Closes elastic/security-team#17123

Adds permission-aware UI behaviour to the leads section based on the user's Elasticsearch index-level access to .entity_analytics.entity-leads-*:

• No read access: the entire leads section is hidden
• Read but no write access: leads are shown, but the Generate and Refresh buttons are disabled with a tooltip explaining the permission requirement
• Full access: no change, UI behaves as before

How it works

A new internal API route GET /internal/entity_analytics/leads/privileges checks read and write privileges on the leads index pattern for the current user (using checkPrivilegesDynamicallyWithRequest). The result is fetched once on page load inside useHuntingLeads and drives the UI state.

Screenshots

Generate button disabled (no write access)

Leads section hidden (no read access)

Testing

Test users to create

Use the Kibana Dev Console (Stack Management > Dev Tools) to create the following users.

1. Full access user (read + write on leads index)

POST /_security/role/leads_full_access
{
  "indices": [
    {
      "names": [".entity_analytics.entity-leads-*"],
      "privileges": ["read", "write", "create_index"]
    }
  ]
}

POST /_security/user/leads_full_user
{
  "roles": ["kibana_admin", "leads_full_access"]
}

2. Read-only user (read on leads index, no write)

POST /_security/role/leads_read_only
{
  "indices": [
    {
      "names": [".entity_analytics.entity-leads-*"],
      "privileges": ["read"]
    }
  ]
}

POST /_security/user/leads_read_user
{
  "roles": ["kibana_admin", "leads_read_only"]
}

3. No access user (no leads index permissions)

POST /_security/user/leads_no_access_user
{
  "roles": ["kibana_admin"]
}

Test steps

1. Log in as leads_full_user and navigate to the Entity Analytics page. The leads section should be fully visible with Generate and Refresh buttons enabled.
2. Log in as leads_read_user and navigate to the Entity Analytics page. The leads section should be visible but the Generate and Refresh buttons should be disabled with a tooltip.
3. Log in as leads_no_access_user and navigate to the Entity Analytics page. The leads section should not be rendered.

Note: For steps 2 and 3 to be meaningful, lead generation should have been enabled first (via a full-access user) so the index exists. The privilege check is role-based and works even before the index is created.

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-entity-analytics (Team:Entity Analytics)

[tcalopes]

Desk tested and code reviewed. Looks good, just left some small comments but not blocking

[kibanamachine]

💚 Build Succeeded

• Buildkite Build
• Commit: d908f01

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	12.0MB	12.0MB	+887.0B

History

• 💛 Build #436206 was flaky 091bc25
• 💔 Build #436158 failed d3f6769

cc @abhishekbhatia1710

[kibanamachine]

Starting backport for target branches: 9.4

https://github.com/elastic/kibana/actions/runs/25305608171

[kibanamachine]

💚 All backports created successfully

Status	Branch	Result
✅	9.4

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation