[Security Solution][Attacks/Alerts][Setup and miscellaneous] Attacks indices RBAC (#243079)

[e40pud]

Summary

Related to #243079

Here we introduce a new internal attack discovery endpoint that returns missing index privileges for the users.

There are two indices user should have access to in order to be able to work with attack discovery feature: .alerts-security.attack.discovery.alerts-* and .adhoc.alerts-security.attack.discovery.alerts.

The required privileges are read, write, view_index_metadata and maintenance.

The endpoint checks whether any of those required privileges are missing for those two indices and returns the information about it in a form like this:

[
  {
    index_name: '.alerts-security.attack.discovery.alerts-default',
    privileges: ['read', 'write', 'view_index_metadata', 'maintenance'],
  },
  {
    index_name: '.adhoc.alerts-security.attack.discovery.alerts-default',
    privileges: ['read', 'write', 'view_index_metadata', 'maintenance'],
  },
]

Testing

1. Create a role which has attack discovery kibana privileges and lacks index privileges to one of the indices: .alerts-security.attack.discovery.alerts-* and/or .adhoc.alerts-security.attack.discovery.alerts.
2. Use this cURL request to get missing privileges information

curl --location 'http://localhost:5601/internal/elastic_assistant/attack_discovery/_missing_privileges' \
--header 'kbn-xsrf: true' \
--header 'elastic-api-version: 1' \
--header 'x-elastic-internal-origin: security-solution'

NOTE: You need to add credentials of the user with the created role rights in this request.

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[e40pud]

@elasticmachine merge upstream

[KDKHD]

Nice, tested locally with changing index privileges!

[andrew-goldstein]

Thanks @e40pud for this new API!
✅ Desk tested locally
LGTM 🚀

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 01fbee3

Failed CI Steps

• Scout: [ platform / streams_app ] plugin

Test Failures

• [job] [logs] Scout: [ platform / streams_app ] plugin / ECS/Otel type pre-selection for known fields
• [job] [logs] Scout: [ platform / streams_app ] plugin / serverless-oblt - Stream data mapping - schema editor - Wired Streams - ECS/Otel type pre-selection for known fields

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
alerting	347	348	+1
apm	2047	2048	+1
automaticImport	976	977	+1
cases	1194	1195	+1
datasetQuality	892	893	+1
discover	1860	1861	+1
elasticAssistant	537	538	+1
embeddableAlertsTable	561	562	+1
infra	1742	1743	+1
ml	2815	2816	+1
monitoring	749	750	+1
observability	1616	1617	+1
observabilityAIAssistantApp	768	769	+1
observabilityShared	329	330	+1
onechat	1513	1514	+1
securitySolution	8436	8437	+1
slo	1316	1317	+1
stackAlerts	251	252	+1
synthetics	1372	1373	+1
timelines	280	281	+1
transform	810	811	+1
triggersActionsUi	1092	1093	+1
uptime	894	895	+1
total			+23

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
@kbn/elastic-assistant-common	774	778	+4

Unknown metric groups

API count

id	before	after	diff
@kbn/elastic-assistant-common	904	909	+5

References to deprecated APIs

id	before	after	diff
securitySolution	431	432	+1

History

• 💛 Build #367077 was flaky 141cbfd
• 💚 Build #366838 succeeded c181641

cc @e40pud