Skip to content

[ResponseOps] Granting kibana_system role access to the cases analytics indices #129414

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Jun 20, 2025
Merged

[ResponseOps] Granting kibana_system role access to the cases analytics indices #129414

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
bc4a819
Update kibana system user permissions for cases analytics index.
adcoelho Jun 13, 2025
cc49a28
[CI] Auto commit changes from spotless
Jun 13, 2025
426e7f9
Merge branch 'main' into cases-analytics-index
elasticmachine Jun 18, 2025
4e04d6a
Add permissions for aliases.
adcoelho Jun 18, 2025
6e1ee6d
[CI] Auto commit changes from spotless
Jun 18, 2025
a862d2f
Merge branch 'main' into cases-analytics-index
adcoelho Jun 18, 2025
b27910b
Merge branch 'main' into cases-analytics-index
adcoelho Jun 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions ...org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,6 +100,8 @@ static RoleDescriptor kibanaSystem(String name) {
// The symbolic constant for this one is in SecurityActionMapper, so not
// accessible from X-Pack core
"cluster:admin/analyze",
"cluster:admin/script/put",
"cluster:admin/script/get",
Comment on lines +103 to +104
Copy link
Contributor

@slobodanadamovic slobodanadamovic Jun 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: You can reference actual action constants here.

Suggested change
"cluster:admin/script/put",
"cluster:admin/script/get",
TransportPutStoredScriptAction.TYPE.name(),
GetStoredScriptAction.NAME,

// To facilitate using the file uploader functionality
"monitor_text_structure",
// To cancel tasks and delete async searches
Expand Down Expand Up @@ -265,6 +267,9 @@ static RoleDescriptor kibanaSystem(String name) {
// Observability, etc.
// Kibana system user uses them to read / write alerts.
RoleDescriptor.IndicesPrivileges.builder().indices(ReservedRolesStore.ALERTS_INDEX_ALIAS).privileges("all").build(),
// "Cases as data" analytics indexes and aliases
RoleDescriptor.IndicesPrivileges.builder().indices(ReservedRolesStore.CASES_ANALYTICS_INDEXES).privileges("all").build(),
RoleDescriptor.IndicesPrivileges.builder().indices(ReservedRolesStore.CASES_ANALYTICS_ALIASES).privileges("all").build(),
// "Alerts as data" public index alias used in Security Solution
// Kibana system user uses them to read / write alerts.
RoleDescriptor.IndicesPrivileges.builder()
Expand Down
4 changes: 4 additions & 0 deletions ...e/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,10 @@ public class ReservedRolesStore implements BiConsumer<Set<String>, ActionListene
/** Alerts, Rules, Cases (RAC) index used by multiple solutions */
public static final String ALERTS_INDEX_ALIAS = ".alerts*";

/** Cases analytics indexes and aliases */
public static final String CASES_ANALYTICS_INDEXES = ".internal.cases*";
public static final String CASES_ANALYTICS_ALIASES = ".cases*";

/** Alerts, Rules, Cases (RAC) preview index used by multiple solutions */
public static final String PREVIEW_ALERTS_INDEX_ALIAS = ".preview.alerts*";

Expand Down
6 changes: 6 additions & 0 deletions .../test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -434,6 +434,10 @@ public void testKibanaSystemRole() {
assertThat(kibanaRole.cluster().check(ClusterUpdateSettingsAction.NAME, request, authentication), is(false));
assertThat(kibanaRole.cluster().check(MonitoringBulkAction.NAME, request, authentication), is(true));

// Script
assertTrue(kibanaRole.cluster().check("cluster:admin/script/put", request, authentication));
assertTrue(kibanaRole.cluster().check("cluster:admin/script/get", request, authentication));

// Inference
assertTrue(kibanaRole.cluster().check("cluster:admin/xpack/inference/get", request, authentication));
assertTrue(kibanaRole.cluster().check("cluster:admin/xpack/inference/put", request, authentication));
Expand Down Expand Up @@ -609,6 +613,8 @@ public void testKibanaSystemRole() {
".apm-agent-configuration",
".apm-custom-link",
".apm-source-map",
ReservedRolesStore.CASES_ANALYTICS_INDEXES + randomAlphaOfLength(randomIntBetween(0, 13)),
ReservedRolesStore.CASES_ANALYTICS_ALIASES + randomAlphaOfLength(randomIntBetween(0, 13)),
ReservedRolesStore.ALERTS_LEGACY_INDEX + randomAlphaOfLength(randomIntBetween(0, 13)),
ReservedRolesStore.ALERTS_LEGACY_INDEX_REINDEXED_V8 + randomAlphaOfLength(randomIntBetween(0, 13)),
ReservedRolesStore.ALERTS_BACKING_INDEX + randomAlphaOfLength(randomIntBetween(0, 13)),
Expand Down