Add {m365_defender,microsoft_defender_endpoint}.vulnerability indices to kibana_system role permissions #132445

kcreddy · 2025-08-05T12:10:47Z

Add logs-m365_defender.vulnerability-* and logs-microsoft_defender_endpoint.vulnerability-* data stream indices to the kibana_system's read privileges. This is required for the latest transform for 3rd party integrations CDR workflows (vulnerability findings) to work.

Also add delete_index on logs-m365_defender.vulnerability-* and logs-microsoft_defender_endpoint.vulnerability-* to facilitate index removal through ILM policies defined here and here

For {m365_defender,microsoft_defender_endpoint}: Add mapping and transform for CDR workflows integrations#14809

Similar to #124074 and #128350

…party vulnerability findings workflow.

elasticsearchmachine · 2025-08-05T12:12:21Z

Pinging @elastic/es-security (Team:Security)

kcreddy · 2025-08-05T12:30:51Z

...va/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java

+                        "logs-m365_defender.vulnerability-*",
+                        "logs-microsoft_defender_endpoint.vulnerability-*"


This adds permission for the transform, without which results in following error inside the transform:

Cannot create transform [logs-m365_defender.latest_cdr_vulnerabilities-default-0.1.0] because user elastic/kibana lacks the required permissions [logs-m365_defender.vulnerability-*:[read], security_solution-m365_defender.vulnerability_latest:[], security_solution-m365_defender.vulnerability_latest-v1:[]]

Just a note: Per ILM policy you shared, Kibana needs the permission to execute rollover action but that is already covered by logs-* pattern here:

elasticsearch/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java

Lines 311 to 329 in 78c49a6

"logs-*",

"synthetics-*",

"traces-*",

"/metrics-.*&~(metrics-endpoint\\.metadata_current_default.*)/",

".logs-endpoint.action.responses-*",

".logs-endpoint.diagnostic.collection-*",

".logs-endpoint.actions-*",

".logs-endpoint.heartbeat-*",

".logs-osquery_manager.actions-*",

".logs-osquery_manager.action.responses-*",

"logs-osquery_manager.action.responses-*",

"profiling-*"

)

.privileges(

TransportUpdateSettingsAction.TYPE.name(),

TransportPutMappingAction.TYPE.name(),

RolloverAction.NAME,

"indices:admin/data_stream/lifecycle/put"

)

kcreddy · 2025-08-05T12:38:39Z

...va/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java

+                // For source indices of the Cloud Detection & Response (CDR) packages
+                // that has ILM policy
+                RoleDescriptor.IndicesPrivileges.builder()
+                    .indices("logs-m365_defender.vulnerability-*", "logs-microsoft_defender_endpoint.vulnerability-*")
+                    .privileges(
+                        // Require "delete_index" to perform ILM policy actions
+                        TransportDeleteIndexAction.TYPE.name()
+                    )
+                    .build(),


This fixes the permission error for the ILM policy.
The ILM policies are already part of existing integration code: here and here.

Without this correct permissions following error is received when deleting index as user with kibana_system role (as in ILM).

{ "error": { "root_cause": [ { "type": "security_exception", "reason": "action [indices:admin/delete] is unauthorized for user [kibana-system] with effective roles [editor,kibana_system,viewer] on indices [.ds-logs-m365_defender.vulnerability-default-2025.08.05-000002], this action is granted by the index privileges [delete_index,manage,all]" } ], "type": "security_exception", "reason": "action [indices:admin/delete] is unauthorized for user [kibana-system] with effective roles [editor,kibana_system,viewer] on indices [.ds-logs-m365_defender.vulnerability-default-2025.08.05-000002], this action is granted by the index privileges [delete_index,manage,all]" }, "status": 403 }

kcreddy · 2025-08-06T09:50:45Z

@slobodanadamovic, I couldn't see labels v8.18.6, v8.19.2, v9.0.6, v9.1.2. We would like to backport to those versions.

...src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java

...va/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java

slobodanadamovic

LGTM (from es-security side; left only optional comments)

Please make sure to get approval from @elastic/kibana-security team as well.

slobodanadamovic · 2025-08-06T12:30:58Z

@slobodanadamovic, I couldn't see labels v8.18.6, v8.19.2, v9.0.6, v9.1.2. We would like to backport to those versions.

The v8.18.6 and v9.0.6 are not available because 8.18.5 and 9.0.5 are not released yet.

mattc58 · 2025-08-06T12:42:04Z

And 8.18 is no longer being maintained. 8.19 is the last branch available on the 8.x line.

mattc58 · 2025-08-06T13:05:15Z

I'm wrong about the 8.18 being unmaintained now. It will be maintained until 9.2 is released. Sorry about that--so +1 on backporting to 8.18.x.

…permissions # Conflicts: # x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java

… to kibana_system role permissions (elastic#132445) Add logs-m365_defender.vulnerability-* and logs-microsoft_defender_endpoint.vulnerability-* data stream indices to the kibana_system's read privileges. This is required for the latest transform for 3rd party integrations CDR workflows (vulnerability findings) to work. Also add delete_index on logs-m365_defender.vulnerability-* and logs-microsoft_defender_endpoint.vulnerability-* to facilitate index removal through ILM policies. (cherry picked from commit 716bff8)

kcreddy · 2025-08-11T05:10:56Z

💚 All backports created successfully

Status	Branch	Result
✅	9.1
✅	9.0
✅	8.19
✅	8.18

Questions ?

Please refer to the Backport tool documentation

… to kibana_system role permissions (elastic#132445) Add logs-m365_defender.vulnerability-* and logs-microsoft_defender_endpoint.vulnerability-* data stream indices to the kibana_system's read privileges. This is required for the latest transform for 3rd party integrations CDR workflows (vulnerability findings) to work. Also add delete_index on logs-m365_defender.vulnerability-* and logs-microsoft_defender_endpoint.vulnerability-* to facilitate index removal through ILM policies. (cherry picked from commit 716bff8) # Conflicts: # x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java

… to kibana_system role permissions (#132445) (#132627) Add logs-m365_defender.vulnerability-* and logs-microsoft_defender_endpoint.vulnerability-* data stream indices to the kibana_system's read privileges. This is required for the latest transform for 3rd party integrations CDR workflows (vulnerability findings) to work. Also add delete_index on logs-m365_defender.vulnerability-* and logs-microsoft_defender_endpoint.vulnerability-* to facilitate index removal through ILM policies. (cherry picked from commit 716bff8)

… to kibana_system role permissions (#132445) (#132628) Add logs-m365_defender.vulnerability-* and logs-microsoft_defender_endpoint.vulnerability-* data stream indices to the kibana_system's read privileges. This is required for the latest transform for 3rd party integrations CDR workflows (vulnerability findings) to work. Also add delete_index on logs-m365_defender.vulnerability-* and logs-microsoft_defender_endpoint.vulnerability-* to facilitate index removal through ILM policies. (cherry picked from commit 716bff8)

… to kibana_system role permissions (#132445) (#132629) Add logs-m365_defender.vulnerability-* and logs-microsoft_defender_endpoint.vulnerability-* data stream indices to the kibana_system's read privileges. This is required for the latest transform for 3rd party integrations CDR workflows (vulnerability findings) to work. Also add delete_index on logs-m365_defender.vulnerability-* and logs-microsoft_defender_endpoint.vulnerability-* to facilitate index removal through ILM policies. (cherry picked from commit 716bff8)

…indices to kibana_system role permissions (#132445) (#132630) * Add {m365_defender,microsoft_defender_endpoint}.vulnerability indices to kibana_system role permissions (#132445) Add logs-m365_defender.vulnerability-* and logs-microsoft_defender_endpoint.vulnerability-* data stream indices to the kibana_system's read privileges. This is required for the latest transform for 3rd party integrations CDR workflows (vulnerability findings) to work. Also add delete_index on logs-m365_defender.vulnerability-* and logs-microsoft_defender_endpoint.vulnerability-* to facilitate index removal through ILM policies. (cherry picked from commit 716bff8) # Conflicts: # x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java * fix conflicts * fix conflicts

Add permissions for Microsoft Defender integrations required for 3rd …

35e366a

…party vulnerability findings workflow.

kcreddy requested a review from a team as a code owner August 5, 2025 12:10

kcreddy self-assigned this Aug 5, 2025

elasticsearchmachine added the v9.2.0 label Aug 5, 2025

[CI] Auto commit changes from spotless

ce1f3de

kcreddy commented Aug 5, 2025

View reviewed changes

slobodanadamovic self-requested a review August 5, 2025 15:08

kcreddy mentioned this pull request Aug 5, 2025

{m365_defender,microsoft_defender_endpoint}: Add mapping and transform for CDR workflows elastic/integrations#14809

Open

5 tasks

slobodanadamovic reviewed Aug 6, 2025

View reviewed changes

...src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java Outdated Show resolved Hide resolved

slobodanadamovic reviewed Aug 6, 2025

View reviewed changes

...va/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java Show resolved Hide resolved

slobodanadamovic approved these changes Aug 6, 2025

View reviewed changes

slobodanadamovic added v9.0.5 v8.18.5 v8.19.2 v9.1.2 labels Aug 6, 2025

kcreddy added 3 commits August 6, 2025 18:52

Address PR comments

422c48a

Merge remote-tracking branch 'origin/3p-cdr-permissions' into 3p-cdr-…

de59582

…permissions # Conflicts: # x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java

Merge remote-tracking branch 'upstream/main' into 3p-cdr-permissions

163bd32

kcreddy added 3 commits August 6, 2025 18:57

remove comments

e54bc0a

fix conflicts

edcad92

fix previous change

abae8fd

elasticsearchmachine added v8.18.6 and removed v8.18.5 labels Aug 7, 2025

SiddharthMantri self-requested a review August 7, 2025 11:20

SiddharthMantri approved these changes Aug 7, 2025

View reviewed changes

kcreddy added v9.0.6 and removed v9.0.5 labels Aug 7, 2025

kcreddy merged commit 716bff8 into elastic:main Aug 7, 2025
39 checks passed

kcreddy mentioned this pull request Aug 11, 2025

[8.18] Add {m365_defender,microsoft_defender_endpoint}.vulnerability indices to kibana_system role permissions (#132445) #132630

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add {m365_defender,microsoft_defender_endpoint}.vulnerability indices to kibana_system role permissions #132445

Add {m365_defender,microsoft_defender_endpoint}.vulnerability indices to kibana_system role permissions #132445

Uh oh!

kcreddy commented Aug 5, 2025 •

edited

Loading

Uh oh!

elasticsearchmachine commented Aug 5, 2025

Uh oh!

kcreddy Aug 5, 2025 •

edited

Loading

Uh oh!

slobodanadamovic Aug 6, 2025 •

edited

Loading

Uh oh!

kcreddy Aug 5, 2025 •

edited

Loading

Uh oh!

kcreddy commented Aug 6, 2025

Uh oh!

Uh oh!

Uh oh!

slobodanadamovic left a comment

Uh oh!

slobodanadamovic commented Aug 6, 2025

Uh oh!

mattc58 commented Aug 6, 2025

Uh oh!

mattc58 commented Aug 6, 2025

Uh oh!

Uh oh!

kcreddy commented Aug 11, 2025

Uh oh!

Uh oh!

		"logs-m365_defender.vulnerability-*",
		"logs-microsoft_defender_endpoint.vulnerability-*"

	"logs-*",
	"synthetics-*",
	"traces-*",
	"/metrics-.&~(metrics-endpoint\\.metadata_current_default.)/",
	".logs-endpoint.action.responses-*",
	".logs-endpoint.diagnostic.collection-*",
	".logs-endpoint.actions-*",
	".logs-endpoint.heartbeat-*",
	".logs-osquery_manager.actions-*",
	".logs-osquery_manager.action.responses-*",
	"logs-osquery_manager.action.responses-*",
	"profiling-*"
	)
	.privileges(
	TransportUpdateSettingsAction.TYPE.name(),
	TransportPutMappingAction.TYPE.name(),
	RolloverAction.NAME,
	"indices:admin/data_stream/lifecycle/put"
	)

Add {m365_defender,microsoft_defender_endpoint}.vulnerability indices to kibana_system role permissions #132445

Add {m365_defender,microsoft_defender_endpoint}.vulnerability indices to kibana_system role permissions #132445

Uh oh!

Conversation

kcreddy commented Aug 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elasticsearchmachine commented Aug 5, 2025

Uh oh!

kcreddy Aug 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

slobodanadamovic Aug 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kcreddy Aug 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kcreddy commented Aug 6, 2025

Uh oh!

Uh oh!

Uh oh!

slobodanadamovic left a comment

Choose a reason for hiding this comment

Uh oh!

slobodanadamovic commented Aug 6, 2025

Uh oh!

mattc58 commented Aug 6, 2025

Uh oh!

mattc58 commented Aug 6, 2025

Uh oh!

Uh oh!

kcreddy commented Aug 11, 2025

💚 All backports created successfully

Questions ?

Uh oh!

Uh oh!

kcreddy commented Aug 5, 2025 •

edited

Loading

kcreddy Aug 5, 2025 •

edited

Loading

slobodanadamovic Aug 6, 2025 •

edited

Loading

kcreddy Aug 5, 2025 •

edited

Loading