Give the kibana system user permission to read security entities

[hop-dev]

As part of the entity store feature we need the Kibana system user to be able to read entity store entities.

What is the entity store?

The entity store is a new security feature which extracts entities (hosts & users) from logs and metrics data.

The documents in the .entities.v1.latest.security* index each represent an entity extracted from event data, properties are added as we see them over time, for example for a host we store ip, mac, and OS information, for a user we store things like email, name, roles.

Why does Kibana system need read access?

Primarily in 8.16.0 we need read access in order to execute an enrich policy on a regular basis as part of our architecture.

But going forward we will be building experiences on top of the entities index, for example the Kibana system user will read the entities index in order to perform risk scoring on the entities.

[elasticsearchmachine]

@hop-dev please enable the option "Allow edits and access to secrets by maintainers" on your PR. For more information, see the documentation.

[elasticsearchmachine]

Pinging @elastic/es-core-infra (Team:Core/Infra)

[elasticsearchmachine]

Hi @hop-dev, I've created a changelog YAML for you.

[hop-dev]

@elasticsearchmachine merge upstream

[hop-dev]

@elasticmachine merge upstream

[kkrik-es]

Oops this was unintended, apologies.

[azasypkin]

Hey @hop-dev,

Would you mind updating PR description with more details about the requirements behind this change?

• Why do we need to make this change exactly? What part of Kibana will be leveraging this permission?
• Do you have any discussion or issue you could link to from this PR?
• What does create this index and ingest data to it?
• Is it a system or hidden index?
• What kind of data is stored in this index?

The more details, the better. Thanks!

[hop-dev]

@azasypkin I've updated the description, let me know if you need any more info.

[hop-dev]

@elasticmachine merge upstream

[azasypkin]

@azasypkin I've updated the description, let me know if you need any more info.

That’s super helpful, @hop-dev, thanks! One last question - are these indices created with hidden: true?

[hop-dev]

@azasypkin they currently are not, but I have been thinking we should hide them because of the dot prefix, why do you ask?

[azasypkin]

@azasypkin they currently are not, but I have been thinking we should hide them because of the dot prefix, why do you ask?

Yeah, if we don’t want users to interact with these indices directly, then making them hidden or even system indices (depends on your requirements, a bit more involved, but much safer, see

elasticsearch/modules/kibana/src/main/java/org/elasticsearch/kibana/KibanaPlugin.java

Lines 25 to 53 in 430ec3b

	public static final SystemIndexDescriptor KIBANA_INDEX_DESCRIPTOR = SystemIndexDescriptor.builder()
	.setIndexPattern(".kibana_*")
	.setDescription("Kibana saved objects system index")
	.setAliasName(".kibana")
	.setType(Type.EXTERNAL_UNMANAGED)
	.setAllowedElasticProductOrigins(KIBANA_PRODUCT_ORIGIN)
	.setAllowsTemplates()
	.build();
	public static final SystemIndexDescriptor REPORTING_INDEX_DESCRIPTOR = SystemIndexDescriptor.builder()
	.setIndexPattern(".reporting-*")
	.setDescription("system index for reporting")
	.setType(Type.EXTERNAL_UNMANAGED)
	.setAllowedElasticProductOrigins(KIBANA_PRODUCT_ORIGIN)
	.build();
	public static final SystemIndexDescriptor APM_AGENT_CONFIG_INDEX_DESCRIPTOR = SystemIndexDescriptor.builder()
	.setIndexPattern(".apm-agent-configuration*")
	.setDescription("system index for APM agent configuration")
	.setType(Type.EXTERNAL_UNMANAGED)
	.setAllowedElasticProductOrigins(KIBANA_PRODUCT_ORIGIN)
	.build();
	public static final SystemIndexDescriptor APM_CUSTOM_LINK_INDEX_DESCRIPTOR = SystemIndexDescriptor.builder()
	.setIndexPattern(".apm-custom-link*")
	.setDescription("system index for APM custom links")
	.setType(Type.EXTERNAL_UNMANAGED)
	.setAllowedElasticProductOrigins(KIBANA_PRODUCT_ORIGIN)
	.build();

and

elasticsearch/x-pack/plugin/fleet/src/main/java/org/elasticsearch/xpack/fleet/Fleet.java

Lines 284 to 292 in 430ec3b

	return new SystemDataStreamDescriptor(
	".fleet-actions-results",
	"Result history of fleet actions",
	SystemDataStreamDescriptor.Type.EXTERNAL,
	composableIndexTemplate,
	Map.of(),
	ALLOWED_PRODUCTS,
	ExecutorNames.DEFAULT_SYSTEM_DATA_STREAM_THREAD_POOLS
	);

) makes total sense to me.

[hop-dev]

Really appreciate the guidance, I'll look into it 👍

[hop-dev]

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Questions ?

Please refer to the Backport tool documentation