From f3a558340e3df83be0d918893aebce7ed83fc043 Mon Sep 17 00:00:00 2001 From: mohitjha-elastic Date: Fri, 29 Aug 2025 13:08:46 +0530 Subject: [PATCH 1/3] Add required ilm index for delete privilege --- .../store/KibanaOwnedReservedRoleDescriptors.java | 14 +++++++++++--- .../authz/store/ReservedRolesStoreTests.java | 8 +++++--- 2 files changed, 16 insertions(+), 6 deletions(-) diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java index e2cd55298f17e..d2bc592fb0e03 100644 --- a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java +++ b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java @@ -536,7 +536,11 @@ static RoleDescriptor kibanaSystem(String name) { // For source indices of the Cloud Detection & Response (CDR) packages // that ships a transform and has ILM policy RoleDescriptor.IndicesPrivileges.builder() - .indices("logs-m365_defender.vulnerability-*", "logs-microsoft_defender_endpoint.vulnerability-*") + .indices( + "logs-m365_defender.vulnerability-*", + "logs-microsoft_defender_endpoint.vulnerability-*", + "logs-sentinel_one.application_risk-*" + ) .privileges( "read", "view_index_metadata", @@ -544,10 +548,14 @@ static RoleDescriptor kibanaSystem(String name) { TransportDeleteIndexAction.TYPE.name() ) .build(), - // For ExtraHop and QualysGAV specific actions. Kibana reads, writes and manages this index + // For ExtraHop, QualysGAV, and SentinelOne Application Dataset specific actions. Kibana reads, writes and manages this index // for configured ILM policies. RoleDescriptor.IndicesPrivileges.builder() - .indices("logs-extrahop.investigation-*", "logs-qualys_gav.asset-*") + .indices( + "logs-extrahop.investigation-*", + "logs-qualys_gav.asset-*", + "logs-sentinel_one.application-*" + ) .privileges( "manage", "create_index", diff --git a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java index 9611b5bcdc4ec..975fb6c148862 100644 --- a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java +++ b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java @@ -1772,7 +1772,8 @@ public void testKibanaSystemRole() { Arrays.asList( "logs-m365_defender.vulnerability-" + randomAlphaOfLength(randomIntBetween(0, 13)), - "logs-microsoft_defender_endpoint.vulnerability-" + randomAlphaOfLength(randomIntBetween(0, 13)) + "logs-microsoft_defender_endpoint.vulnerability-" + randomAlphaOfLength(randomIntBetween(0, 13)), + "logs-sentinel_one.application_risk-*" + randomAlphaOfLength(randomIntBetween(0, 13)) ).forEach(indexName -> { final IndexAbstraction indexAbstraction = mockIndexAbstraction(indexName); assertThat(kibanaRole.indices().allowedIndicesMatcher("indices:foo").test(indexAbstraction), is(false)); @@ -1974,11 +1975,12 @@ public void testKibanaSystemRole() { assertThat(kibanaRole.indices().allowedIndicesMatcher(RolloverAction.NAME).test(indexAbstraction), is(true)); }); - // Tests for third-party agent indices (ExtraHop, QualysGAV) that `kibana_system` has full management access to + // Tests for third-party agent indices (ExtraHop, QualysGAV, SentinelOne) that `kibana_system` has full management access to // This includes read, write, create, delete, and all ILM-related management actions. Arrays.asList( "logs-extrahop.investigation-" + randomAlphaOfLength(randomIntBetween(1, 10)), - "logs-qualys_gav.asset-" + randomAlphaOfLength(randomIntBetween(1, 10)) + "logs-qualys_gav.asset-" + randomAlphaOfLength(randomIntBetween(1, 10)), + "logs-sentinel_one.application-*" + randomAlphaOfLength(randomIntBetween(1, 10)) ).forEach((index_qualys_extra_hop) -> { final IndexAbstraction indexAbstraction = mockIndexAbstraction(index_qualys_extra_hop); From e04c72772a38a2dae157a2f0e99beb8f820dfc9b Mon Sep 17 00:00:00 2001 From: mohitjha-elastic Date: Fri, 29 Aug 2025 14:34:32 +0530 Subject: [PATCH 2/3] Add changelog --- docs/changelog/133793.yaml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 docs/changelog/133793.yaml diff --git a/docs/changelog/133793.yaml b/docs/changelog/133793.yaml new file mode 100644 index 0000000000000..6bf73ecaa060c --- /dev/null +++ b/docs/changelog/133793.yaml @@ -0,0 +1,6 @@ +pr: 133793 +summary: "[Sentinel One] Add `manage`, `create_index`, `read`, `index`, `write`, `delete`, permission for third party agent indices `kibana_system`" +area: Authorization +type: enhancement +issues: + - 133703 From 061cb936ad1727150a473db2e90a9d0a6204089a Mon Sep 17 00:00:00 2001 From: elasticsearchmachine Date: Fri, 29 Aug 2025 09:13:19 +0000 Subject: [PATCH 3/3] [CI] Auto commit changes from spotless --- .../authz/store/KibanaOwnedReservedRoleDescriptors.java | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java index d2bc592fb0e03..22192077a5c2b 100644 --- a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java +++ b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java @@ -548,14 +548,11 @@ static RoleDescriptor kibanaSystem(String name) { TransportDeleteIndexAction.TYPE.name() ) .build(), - // For ExtraHop, QualysGAV, and SentinelOne Application Dataset specific actions. Kibana reads, writes and manages this index + // For ExtraHop, QualysGAV, and SentinelOne Application Dataset specific actions. Kibana reads, writes and manages this + // index // for configured ILM policies. RoleDescriptor.IndicesPrivileges.builder() - .indices( - "logs-extrahop.investigation-*", - "logs-qualys_gav.asset-*", - "logs-sentinel_one.application-*" - ) + .indices("logs-extrahop.investigation-*", "logs-qualys_gav.asset-*", "logs-sentinel_one.application-*") .privileges( "manage", "create_index",