Skip to content

Extend kibana-system permissions to manage security entities #133968

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 15 commits into from
Sep 16, 2025
Merged

Extend kibana-system permissions to manage security entities #133968

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
baa4e56
extend kibana-system permissions for .entities.* indices
kubasobon Sep 2, 2025
b91c972
Merge branch 'main' into entity-store-history-permissions
kubasobon Sep 2, 2025
f92ac23
Merge branch 'main' into entity-store-history-permissions
kubasobon Sep 4, 2025
88aed35
trigger CI
kubasobon Sep 4, 2025
33aa6da
Update docs/changelog/133968.yaml
kubasobon Sep 4, 2025
bd69339
update viewer/editor & add reset management
kubasobon Sep 15, 2025
7dd39b6
Merge branch 'entity-store-history-permissions' of github.com:elastic…
kubasobon Sep 15, 2025
f5c6124
fix typos
kubasobon Sep 15, 2025
871aa59
[CI] Auto commit changes from spotless
Sep 15, 2025
fb3f831
Merge branch 'main' into entity-store-history-permissions
kubasobon Sep 15, 2025
392ef47
extend validation exemption on .entities indices
kubasobon Sep 16, 2025
afd6ba7
Merge branch 'entity-store-history-permissions' of github.com:elastic…
kubasobon Sep 16, 2025
3dd8a17
[CI] Update transport version definitions
Sep 16, 2025
e824b9a
Merge branch 'main' into entity-store-history-permissions
kubasobon Sep 16, 2025
18f91e6
Merge branch 'main' into entity-store-history-permissions
kubasobon Sep 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions docs/changelog/133968.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
pr: 133968
summary: Extend kibana-system permissions to manage security entities
area: Infra/Core
type: enhancement
issues: []
2 changes: 1 addition & 1 deletion .../dot-prefix-validation/src/main/java/org/elasticsearch/validation/DotPrefixValidator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ public abstract class DotPrefixValidator<RequestType> implements MappedActionFil
"\\.ml-state-\\d+",
"\\.slo-observability\\.sli-v\\d+.*",
"\\.slo-observability\\.summary-v\\d+.*",
"\\.entities\\.v\\d+\\.latest\\..*",
"\\.entities\\.v\\d+\\..*",
"\\.monitoring-es-8-.*",
"\\.monitoring-logstash-8-.*",
"\\.monitoring-kibana-8-.*",
Expand Down
4 changes: 4 additions & 0 deletions ...prefix-validation/src/test/java/org/elasticsearch/validation/DotPrefixValidatorTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,10 @@ public void testValidation() {
nonOpV.validateIndices(Set.of(".slo-observability.summary-v2.3-2024-01-01"));
nonOpV.validateIndices(Set.of("<.slo-observability.summary-v3.3.{2024-10-16||/M{yyyy-MM-dd|UTC}}>"));
nonOpV.validateIndices(Set.of(".entities.v1.latest.builtin_services_from_ecs_data"));
nonOpV.validateIndices(Set.of(".entities.v1.history.2025-09-16.security_host_default"));
nonOpV.validateIndices(Set.of(".entities.v2.history.2025-09-16.security_user_custom"));
nonOpV.validateIndices(Set.of(".entities.v5.reset.security_user_custom"));
nonOpV.validateIndices(Set.of(".entities.v1.latest.noop"));
nonOpV.validateIndices(Set.of(".entities.v92.latest.eggplant.potato"));
nonOpV.validateIndices(Set.of("<.entities.v12.latest.eggplant-{M{yyyy-MM-dd|UTC}}>"));
nonOpV.validateIndices(Set.of(".monitoring-es-8-thing"));
Expand Down
10 changes: 9 additions & 1 deletion ...org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -595,7 +595,15 @@ static RoleDescriptor kibanaSystem(String name) {
.indices(".asset-criticality.asset-criticality-*")
.privileges("create_index", "manage", "read", "write")
.build(),
RoleDescriptor.IndicesPrivileges.builder().indices(".entities.v1.latest.security*").privileges("read", "write").build(),
RoleDescriptor.IndicesPrivileges.builder().indices(".entities.*").privileges("read", "write").build(),
RoleDescriptor.IndicesPrivileges.builder()
.indices(".entities.*history*")
.privileges("create_index", "manage", "read", "write")
.build(),
RoleDescriptor.IndicesPrivileges.builder()
.indices(".entities.*reset*")
.privileges("create_index", "manage", "read", "write")
.build(),
// For cloud_defend usageCollection
RoleDescriptor.IndicesPrivileges.builder()
.indices("logs-cloud_defend.*", "metrics-cloud_defend.*")
Expand Down
4 changes: 3 additions & 1 deletion ...e/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,7 @@ public class ReservedRolesStore implements BiConsumer<Set<String>, ActionListene

/** "Security Solutions" Entity Store and Asset Criticality indices for Asset Inventory and Entity Analytics */
public static final String ENTITY_STORE_V1_LATEST_INDEX = ".entities.v1.latest.security_*";
public static final String ENTITY_STORE_HISTORY_INDEX = ".entities.*.history.*";
public static final String ASSET_CRITICALITY_INDEX = ".asset-criticality.asset-criticality-*";

/** Index pattern for Universal Profiling */
Expand Down Expand Up @@ -780,6 +781,7 @@ private static RoleDescriptor buildViewerRoleDescriptor() {
ReservedRolesStore.LISTS_INDEX_REINDEXED_V8,
ReservedRolesStore.LISTS_ITEMS_INDEX_REINDEXED_V8,
ReservedRolesStore.ENTITY_STORE_V1_LATEST_INDEX,
ReservedRolesStore.ENTITY_STORE_HISTORY_INDEX,
ReservedRolesStore.ASSET_CRITICALITY_INDEX
)
.privileges("read", "view_index_metadata")
Expand Down Expand Up @@ -849,7 +851,7 @@ private static RoleDescriptor buildEditorRoleDescriptor() {
.build(),
// Security - Entity Store is view only
RoleDescriptor.IndicesPrivileges.builder()
.indices(ReservedRolesStore.ENTITY_STORE_V1_LATEST_INDEX)
.indices(ReservedRolesStore.ENTITY_STORE_V1_LATEST_INDEX, ReservedRolesStore.ENTITY_STORE_HISTORY_INDEX)
.privileges("read", "view_index_metadata")
.build(),
// Alerts-as-data
Expand Down