Skip to content

Commit 06aa32b

Browse files
CohenIdoCohenIdo
authored
[Cloud Security][CDR] Update Wiz vuln privileges
1 parent 9f98c44 commit 06aa32b

File tree

2 files changed

+102
-27
lines changed

2 files changed

+102
-27
lines changed

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java‎

Lines changed: 73 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,8 @@
3030
import static org.elasticsearch.xpack.core.security.authz.store.ReservedRolesStore.getRemoteIndicesReadPrivileges;
3131

3232
/**
33-
* This exists in a separate file so it can be assigned to the Kibana security team in the CODEOWNERS file
33+
* This exists in a separate file so it can be assigned to the Kibana security
34+
* team in the CODEOWNERS file
3435
*/
3536
class KibanaOwnedReservedRoleDescriptors {
3637

@@ -87,9 +88,11 @@ static RoleDescriptor kibanaSystem(String name) {
8788
SuggestProfilesAction.NAME,
8889
ProfileHasPrivilegesAction.NAME,
8990
"write_fleet_secrets",
90-
// To facilitate ML UI functionality being controlled using Kibana security privileges
91+
// To facilitate ML UI functionality being controlled using Kibana security
92+
// privileges
9193
"manage_ml",
92-
// The symbolic constant for this one is in SecurityActionMapper, so not accessible from X-Pack core
94+
// The symbolic constant for this one is in SecurityActionMapper, so not
95+
// accessible from X-Pack core
9396
"cluster:admin/analyze",
9497
// To facilitate using the file uploader functionality
9598
"monitor_text_structure",
@@ -104,7 +107,8 @@ static RoleDescriptor kibanaSystem(String name) {
104107
.build(),
105108
RoleDescriptor.IndicesPrivileges.builder().indices(".monitoring-*").privileges("read", "read_cross_cluster").build(),
106109
RoleDescriptor.IndicesPrivileges.builder().indices(".management-beats").privileges("create_index", "read", "write").build(),
107-
// To facilitate ML UI functionality being controlled using Kibana security privileges
110+
// To facilitate ML UI functionality being controlled using Kibana security
111+
// privileges
108112
RoleDescriptor.IndicesPrivileges.builder().indices(".ml-anomalies*", ".ml-stats-*").privileges("read").build(),
109113
RoleDescriptor.IndicesPrivileges.builder()
110114
.indices(".ml-annotations*", ".ml-notifications*")
@@ -139,20 +143,23 @@ static RoleDescriptor kibanaSystem(String name) {
139143
RoleDescriptor.IndicesPrivileges.builder().indices("traces-apm.*").privileges("read", "read_cross_cluster").build(),
140144
RoleDescriptor.IndicesPrivileges.builder().indices("traces-apm-*").privileges("read", "read_cross_cluster").build(),
141145

142-
// Logstash telemetry queries of kibana task runner to access Logstash metric indices
146+
// Logstash telemetry queries of kibana task runner to access Logstash metric
147+
// indices
143148
RoleDescriptor.IndicesPrivileges.builder().indices("metrics-logstash.*").privileges("read").build(),
144149

145150
// Data telemetry reads mappings, metadata and stats of indices
146151
RoleDescriptor.IndicesPrivileges.builder().indices("*").privileges("view_index_metadata", "monitor").build(),
147-
// Endpoint diagnostic information. Kibana reads from these indices to send telemetry
152+
// Endpoint diagnostic information. Kibana reads from these indices to send
153+
// telemetry
148154
RoleDescriptor.IndicesPrivileges.builder().indices(".logs-endpoint.diagnostic.collection-*").privileges("read").build(),
149155
// Fleet secrets. Kibana can only write to this index.
150156
RoleDescriptor.IndicesPrivileges.builder()
151157
.indices(".fleet-secrets*")
152158
.privileges("write", "delete", "create_index")
153159
.allowRestrictedIndices(true)
154160
.build(),
155-
// Other Fleet indices. Kibana reads and writes to these indices to manage Elastic Agents.
161+
// Other Fleet indices. Kibana reads and writes to these indices to manage
162+
// Elastic Agents.
156163
RoleDescriptor.IndicesPrivileges.builder()
157164
.indices(".fleet-actions*")
158165
.privileges("all")
@@ -217,26 +224,32 @@ static RoleDescriptor kibanaSystem(String name) {
217224
.indices(ReservedRolesStore.LISTS_INDEX, ReservedRolesStore.LISTS_ITEMS_INDEX)
218225
.privileges("all")
219226
.build(),
220-
// "Alerts as data" internal backing indices used in Security Solution, Observability, etc.
221-
// Kibana system user creates these indices; reads / writes to them via the aliases (see below).
227+
// "Alerts as data" internal backing indices used in Security Solution,
228+
// Observability, etc.
229+
// Kibana system user creates these indices; reads / writes to them via the
230+
// aliases (see below).
222231
RoleDescriptor.IndicesPrivileges.builder().indices(ReservedRolesStore.ALERTS_BACKING_INDEX).privileges("all").build(),
223-
// "Alerts as data" public index aliases used in Security Solution, Observability, etc.
232+
// "Alerts as data" public index aliases used in Security Solution,
233+
// Observability, etc.
224234
// Kibana system user uses them to read / write alerts.
225235
RoleDescriptor.IndicesPrivileges.builder().indices(ReservedRolesStore.ALERTS_INDEX_ALIAS).privileges("all").build(),
226236
// "Alerts as data" public index alias used in Security Solution
227237
// Kibana system user uses them to read / write alerts.
228238
RoleDescriptor.IndicesPrivileges.builder().indices(ReservedRolesStore.PREVIEW_ALERTS_INDEX_ALIAS).privileges("all").build(),
229239
// "Alerts as data" internal backing indices used in Security Solution
230-
// Kibana system user creates these indices; reads / writes to them via the aliases (see below).
240+
// Kibana system user creates these indices; reads / writes to them via the
241+
// aliases (see below).
231242
RoleDescriptor.IndicesPrivileges.builder()
232243
.indices(ReservedRolesStore.PREVIEW_ALERTS_BACKING_INDEX_ALIAS)
233244
.privileges("all")
234245
.build(),
235-
// Endpoint / Fleet policy responses. Kibana requires read access to send telemetry
246+
// Endpoint / Fleet policy responses. Kibana requires read access to send
247+
// telemetry
236248
RoleDescriptor.IndicesPrivileges.builder().indices("metrics-endpoint.policy-*").privileges("read").build(),
237249
// Endpoint metrics. Kibana requires read access to send telemetry
238250
RoleDescriptor.IndicesPrivileges.builder().indices("metrics-endpoint.metrics-*").privileges("read").build(),
239-
// Endpoint events. Kibana reads endpoint alert lineage for building and sending telemetry
251+
// Endpoint events. Kibana reads endpoint alert lineage for building and sending
252+
// telemetry
240253
RoleDescriptor.IndicesPrivileges.builder().indices("logs-endpoint.events.*").privileges("read").build(),
241254
// Fleet package install and upgrade
242255
RoleDescriptor.IndicesPrivileges.builder()
@@ -261,39 +274,48 @@ static RoleDescriptor kibanaSystem(String name) {
261274
"indices:admin/data_stream/lifecycle/put"
262275
)
263276
.build(),
264-
// Endpoint specific action responses. Kibana reads and writes (for third party agents) to the index
277+
// Endpoint specific action responses. Kibana reads and writes (for third party
278+
// agents) to the index
265279
// to display action responses to the user.
266280
RoleDescriptor.IndicesPrivileges.builder()
267281
.indices(".logs-endpoint.action.responses-*")
268282
.privileges("auto_configure", "read", "write")
269283
.build(),
270-
// Endpoint specific actions. Kibana reads and writes to this index to track new actions and display them.
284+
// Endpoint specific actions. Kibana reads and writes to this index to track new
285+
// actions and display them.
271286
RoleDescriptor.IndicesPrivileges.builder()
272287
.indices(".logs-endpoint.actions-*")
273288
.privileges("auto_configure", "read", "write")
274289
.build(),
275-
// Legacy Osquery manager specific action responses. Kibana reads from these to display responses to the user.
290+
// Legacy Osquery manager specific action responses. Kibana reads from these to
291+
// display responses to the user.
276292
RoleDescriptor.IndicesPrivileges.builder()
277293
.indices(".logs-osquery_manager.action.responses-*")
278294
.privileges("auto_configure", "create_index", "read", "index", "delete")
279295
.build(),
280-
// Osquery manager specific action responses. Kibana reads from these to display responses to the user.
296+
// Osquery manager specific action responses. Kibana reads from these to display
297+
// responses to the user.
281298
RoleDescriptor.IndicesPrivileges.builder()
282299
.indices("logs-osquery_manager.action.responses-*")
283300
.privileges("read", "view_index_metadata")
284301
.build(),
285-
// Osquery manager specific actions. Kibana reads and writes to this index to track new actions and display them.
302+
// Osquery manager specific actions. Kibana reads and writes to this index to
303+
// track new actions and display them.
286304
RoleDescriptor.IndicesPrivileges.builder()
287305
.indices(".logs-osquery_manager.actions-*")
288306
.privileges("auto_configure", "create_index", "read", "index", "write", "delete")
289307
.build(),
290308

291-
// Third party agent (that use non-Elastic Defend integrations) info logs indices.
309+
// Third party agent (that use non-Elastic Defend integrations) info logs
310+
// indices.
292311
// Kibana reads from these to display agent status/info to the user.
293-
// These are indices that filebeat writes to, and the data in these indices are ingested by Fleet integrations
294-
// in order to provide support for response actions related to malicious events for such agents.
312+
// These are indices that filebeat writes to, and the data in these indices are
313+
// ingested by Fleet integrations
314+
// in order to provide support for response actions related to malicious events
315+
// for such agents.
295316
RoleDescriptor.IndicesPrivileges.builder().indices("logs-sentinel_one.*", "logs-crowdstrike.*").privileges("read").build(),
296-
// For ILM policy for APM, Endpoint, & Synthetics packages that have delete action
317+
// For ILM policy for APM, Endpoint, & Synthetics packages that have delete
318+
// action
297319
RoleDescriptor.IndicesPrivileges.builder()
298320
.indices(
299321
".logs-endpoint.diagnostic.collection-*",
@@ -332,7 +354,8 @@ static RoleDescriptor kibanaSystem(String name) {
332354
TransportUpdateSettingsAction.TYPE.name()
333355
)
334356
.build(),
335-
// For destination indices of the Threat Intel (ti_*) packages that ships a transform for supporting IOC expiration
357+
// For destination indices of the Threat Intel (ti_*) packages that ships a
358+
// transform for supporting IOC expiration
336359
RoleDescriptor.IndicesPrivileges.builder()
337360
.indices("logs-ti_*_latest.*")
338361
.privileges(
@@ -346,7 +369,8 @@ static RoleDescriptor kibanaSystem(String name) {
346369
TransportUpdateSettingsAction.TYPE.name()
347370
)
348371
.build(),
349-
// For source indices of the Threat Intel (ti_*) packages that ships a transform for supporting IOC expiration
372+
// For source indices of the Threat Intel (ti_*) packages that ships a transform
373+
// for supporting IOC expiration
350374
RoleDescriptor.IndicesPrivileges.builder()
351375
.indices("logs-ti_*.*-*")
352376
.privileges(
@@ -370,7 +394,8 @@ static RoleDescriptor kibanaSystem(String name) {
370394
TransportUpdateSettingsAction.TYPE.name()
371395
)
372396
.build(),
373-
// For src/dest indices of the Cloud Security Posture packages that ships a transform
397+
// For src/dest indices of the Cloud Security Posture packages that ships a
398+
// transform
374399
RoleDescriptor.IndicesPrivileges.builder()
375400
.indices("logs-cloud_security_posture.findings-*", "logs-cloud_security_posture.vulnerabilities-*")
376401
.privileges("read", "view_index_metadata")
@@ -390,6 +415,27 @@ static RoleDescriptor kibanaSystem(String name) {
390415
TransportUpdateSettingsAction.TYPE.name()
391416
)
392417
.build(),
418+
RoleDescriptor.IndicesPrivileges.builder()
419+
.indices("logs-wiz.vulnerability-*")
420+
.privileges("read", "view_index_metadata")
421+
.build(),
422+
RoleDescriptor.IndicesPrivileges.builder()
423+
// manage privilege required by the index alias
424+
.indices("security_solution-*.vulnerability_latest")
425+
.privileges("manage", TransportIndicesAliasesAction.NAME, TransportUpdateSettingsAction.TYPE.name())
426+
.build(),
427+
RoleDescriptor.IndicesPrivileges.builder()
428+
.indices("security_solution-*.vulnerability_latest-*")
429+
.privileges(
430+
"create_index",
431+
"index",
432+
"manage",
433+
"read",
434+
"delete",
435+
TransportIndicesAliasesAction.NAME,
436+
TransportUpdateSettingsAction.TYPE.name()
437+
)
438+
.build(),
393439
RoleDescriptor.IndicesPrivileges.builder().indices("risk-score.risk-*").privileges("all").build(),
394440
RoleDescriptor.IndicesPrivileges.builder()
395441
.indices(".asset-criticality.asset-criticality-*")
@@ -403,7 +449,8 @@ static RoleDescriptor kibanaSystem(String name) {
403449
// SLO observability solution internal indices
404450
// Kibana system user uses them to read / write slo data.
405451
RoleDescriptor.IndicesPrivileges.builder().indices(".slo-observability.*").privileges("all").build(),
406-
// Endpoint heartbeat. Kibana reads from these to determine metering/billing for endpoints.
452+
// Endpoint heartbeat. Kibana reads from these to determine metering/billing for
453+
// endpoints.
407454
RoleDescriptor.IndicesPrivileges.builder().indices(".logs-endpoint.heartbeat-*").privileges("read").build(),
408455
// For connectors telemetry. Will be removed once we switched to connectors API
409456
RoleDescriptor.IndicesPrivileges.builder().indices(".elastic-connectors*").privileges("read").build() },

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java‎

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1609,13 +1609,41 @@ public void testKibanaSystemRole() {
16091609
assertThat(kibanaRole.indices().allowedIndicesMatcher(RolloverAction.NAME).test(indexAbstraction), is(true));
16101610
});
16111611

1612+
Arrays.asList("logs-wiz.vulnerability-" + randomAlphaOfLength(randomIntBetween(0, 13))).forEach((cspIndex) -> {
1613+
final IndexAbstraction indexAbstraction = mockIndexAbstraction(cspIndex);
1614+
assertThat(kibanaRole.indices().allowedIndicesMatcher("indices:foo").test(indexAbstraction), is(false));
1615+
assertThat(kibanaRole.indices().allowedIndicesMatcher("indices:bar").test(indexAbstraction), is(false));
1616+
assertThat(
1617+
kibanaRole.indices().allowedIndicesMatcher(TransportDeleteIndexAction.TYPE.name()).test(indexAbstraction),
1618+
is(false)
1619+
);
1620+
assertThat(kibanaRole.indices().allowedIndicesMatcher(GetIndexAction.NAME).test(indexAbstraction), is(true));
1621+
assertThat(
1622+
kibanaRole.indices().allowedIndicesMatcher(TransportCreateIndexAction.TYPE.name()).test(indexAbstraction),
1623+
is(false)
1624+
);
1625+
assertThat(kibanaRole.indices().allowedIndicesMatcher(TransportIndexAction.NAME).test(indexAbstraction), is(false));
1626+
assertThat(kibanaRole.indices().allowedIndicesMatcher(TransportDeleteAction.NAME).test(indexAbstraction), is(false));
1627+
assertThat(kibanaRole.indices().allowedIndicesMatcher(TransportSearchAction.TYPE.name()).test(indexAbstraction), is(true));
1628+
assertThat(kibanaRole.indices().allowedIndicesMatcher(TransportMultiSearchAction.TYPE.name()).test(indexAbstraction), is(true));
1629+
assertThat(kibanaRole.indices().allowedIndicesMatcher(TransportGetAction.TYPE.name()).test(indexAbstraction), is(true));
1630+
assertThat(kibanaRole.indices().allowedIndicesMatcher(READ_CROSS_CLUSTER_NAME).test(indexAbstraction), is(false));
1631+
assertThat(
1632+
kibanaRole.indices().allowedIndicesMatcher(TransportUpdateSettingsAction.TYPE.name()).test(indexAbstraction),
1633+
is(true)
1634+
);
1635+
assertThat(kibanaRole.indices().allowedIndicesMatcher(TransportPutMappingAction.TYPE.name()).test(indexAbstraction), is(true));
1636+
assertThat(kibanaRole.indices().allowedIndicesMatcher(RolloverAction.NAME).test(indexAbstraction), is(true));
1637+
});
1638+
16121639
Arrays.asList(
16131640
"logs-cloud_security_posture.findings_latest-default",
16141641
"logs-cloud_security_posture.scores-default",
16151642
"logs-cloud_security_posture.vulnerabilities_latest-default",
16161643
"logs-cloud_security_posture.findings_latest-default-" + Version.CURRENT,
16171644
"logs-cloud_security_posture.scores-default-" + Version.CURRENT,
1618-
"logs-cloud_security_posture.vulnerabilities_latest-default" + Version.CURRENT
1645+
"logs-cloud_security_posture.vulnerabilities_latest-default" + Version.CURRENT,
1646+
"security_solution-*.vulnerability_latest-" + Version.CURRENT
16191647
).forEach(indexName -> {
16201648
logger.info("index name [{}]", indexName);
16211649
final IndexAbstraction indexAbstraction = mockIndexAbstraction(indexName);

0 commit comments

Comments
 (0)