Skip to content

Commit 360e4c7

Browse files
joepeeplesjoepeeples
authored
Remove feature flag conditionals (#5853)
1 parent c73c723 commit 360e4c7

File tree

6 files changed

+295
-378
lines changed

6 files changed

+295
-378
lines changed

‎docs/serverless/advanced-entity-analytics/ers-req.mdx‎

Lines changed: 63 additions & 99 deletions
Original file line numberDiff line numberDiff line change
@@ -13,38 +13,26 @@ This page covers the requirements for using the entity risk scoring and asset cr
1313

1414
### User roles
1515

16-
{/* TO-DO: Remove the DocIf conditionals once the feature is available in production. */}
16+
To turn on the risk scoring engine, you need either the appropriate <DocLink slug="/serverless/general/assign-user-roles">predefined Security user role</DocLink> or a <DocLink slug="/serverless/custom-roles">custom role</DocLink> with the right privileges:
1717

18-
<DocIf condition={"((serverlessCustomRoles))" === "false"}>
19-
To turn on the risk scoring engine, you need one of the following <DocLink slug="/serverless/general/assign-user-roles" section="security">Security user roles</DocLink>:
18+
**Predefined roles**
2019

21-
* Platform engineer
22-
* Detections admin
23-
* Admin
24-
</DocIf>
20+
* Platform engineer
21+
* Detections admin
22+
* Admin
2523

26-
<DocIf condition={"((serverlessCustomRoles))" === "true"}>
27-
To turn on the risk scoring engine, you need either the appropriate <DocLink slug="/serverless/general/assign-user-roles">predefined Security user role</DocLink> or a <DocLink slug="/serverless/custom-roles">custom role</DocLink> with the right privileges:
24+
**Custom role privileges**
2825

29-
**Predefined roles**
30-
31-
* Platform engineer
32-
* Detections admin
33-
* Admin
34-
35-
**Custom role privileges**
36-
37-
<DocTable columns={[{ title: "Cluster" }, { title: "Index" }, { title: "((kib))" }]}>
38-
<DocRow>
39-
<DocCell>
40-
* `manage_index_templates`
41-
* `manage_transform`
42-
</DocCell>
43-
<DocCell>`all` privilege for `risk-score.risk-score-*`</DocCell>
44-
<DocCell>**Read** for the **Security** feature</DocCell>
45-
</DocRow>
46-
</DocTable>
47-
</DocIf>
26+
<DocTable columns={[{ title: "Cluster" }, { title: "Index" }, { title: "((kib))" }]}>
27+
<DocRow>
28+
<DocCell>
29+
* `manage_index_templates`
30+
* `manage_transform`
31+
</DocCell>
32+
<DocCell>`all` privilege for `risk-score.risk-score-*`</DocCell>
33+
<DocCell>**Read** for the **Security** feature</DocCell>
34+
</DocRow>
35+
</DocTable>
4836

4937
### Known limitations
5038

@@ -57,74 +45,50 @@ To use the asset criticality feature, turn on the `securitySolution:enableAssetC
5745

5846
### User roles
5947

60-
{/* TO-DO: Remove the DocIf conditionals once the feature is available in production. */}
61-
62-
<DocIf condition={"((serverlessCustomRoles))" === "false"}>
63-
The following <DocLink slug="/serverless/general/assign-user-roles" section="security">Security user roles</DocLink> allow you to view an entity's asset criticality:
64-
65-
* Viewer
66-
* Tier 1 analyst
67-
68-
The following Security user roles allow you to view, assign, change, or unassign an entity's asset criticality:
69-
70-
* Editor
71-
* Tier 2 analyst
72-
* Tier 3 analyst
73-
* Threat intelligence analyst
74-
* Rule author
75-
* SOC manager
76-
* Endpoint operations analyst
77-
* Platform engineer
78-
* Detections admin
79-
* Endpoint policy manager
80-
</DocIf>
81-
82-
<DocIf condition={"((serverlessCustomRoles))" === "true"}>
83-
To use asset criticality, you need either the appropriate <DocLink slug="/serverless/general/assign-user-roles">predefined Security user role</DocLink> or a <DocLink slug="/serverless/custom-roles">custom role</DocLink> with the right privileges:
84-
85-
**Predefined roles**
86-
87-
<DocTable columns={[{ title: "Action" }, { title: "Predefined role" }]}>
88-
<DocRow>
89-
<DocCell>View asset criticality</DocCell>
90-
<DocCell>
91-
* Viewer
92-
* Tier 1 analyst
93-
</DocCell>
94-
</DocRow>
95-
<DocRow>
96-
<DocCell>View, assign, change, or unassign asset criticality</DocCell>
97-
<DocCell>
98-
* Editor
99-
* Tier 2 analyst
100-
* Tier 3 analyst
101-
* Threat intelligence analyst
102-
* Rule author
103-
* SOC manager
104-
* Endpoint operations analyst
105-
* Platform engineer
106-
* Detections admin
107-
* Endpoint policy manager
108-
</DocCell>
109-
</DocRow>
110-
</DocTable>
111-
112-
**Custom role privileges**
113-
114-
Custom roles need the following privileges for the `.asset-criticality.asset-criticality-<space-id>` index:
115-
116-
<DocTable columns={[{ title: "Action" }, { title: "Index privilege" }]}>
117-
<DocRow>
118-
<DocCell>View asset criticality</DocCell>
119-
<DocCell>`read`</DocCell>
120-
</DocRow>
121-
<DocRow>
122-
<DocCell>View, assign, or change asset criticality</DocCell>
123-
<DocCell>`read` and `write`</DocCell>
124-
</DocRow>
125-
<DocRow>
126-
<DocCell>Unassign asset criticality</DocCell>
127-
<DocCell>`delete`</DocCell>
128-
</DocRow>
129-
</DocTable>
130-
</DocIf>
48+
To use asset criticality, you need either the appropriate <DocLink slug="/serverless/general/assign-user-roles">predefined Security user role</DocLink> or a <DocLink slug="/serverless/custom-roles">custom role</DocLink> with the right privileges:
49+
50+
**Predefined roles**
51+
52+
<DocTable columns={[{ title: "Action" }, { title: "Predefined role" }]}>
53+
<DocRow>
54+
<DocCell>View asset criticality</DocCell>
55+
<DocCell>
56+
* Viewer
57+
* Tier 1 analyst
58+
</DocCell>
59+
</DocRow>
60+
<DocRow>
61+
<DocCell>View, assign, change, or unassign asset criticality</DocCell>
62+
<DocCell>
63+
* Editor
64+
* Tier 2 analyst
65+
* Tier 3 analyst
66+
* Threat intelligence analyst
67+
* Rule author
68+
* SOC manager
69+
* Endpoint operations analyst
70+
* Platform engineer
71+
* Detections admin
72+
* Endpoint policy manager
73+
</DocCell>
74+
</DocRow>
75+
</DocTable>
76+
77+
**Custom role privileges**
78+
79+
Custom roles need the following privileges for the `.asset-criticality.asset-criticality-<space-id>` index:
80+
81+
<DocTable columns={[{ title: "Action" }, { title: "Index privilege" }]}>
82+
<DocRow>
83+
<DocCell>View asset criticality</DocCell>
84+
<DocCell>`read`</DocCell>
85+
</DocRow>
86+
<DocRow>
87+
<DocCell>View, assign, or change asset criticality</DocCell>
88+
<DocCell>`read` and `write`</DocCell>
89+
</DocRow>
90+
<DocRow>
91+
<DocCell>Unassign asset criticality</DocCell>
92+
<DocCell>`delete`</DocCell>
93+
</DocRow>
94+
</DocTable>

‎docs/serverless/edr-install-config/defend-feature-privs.mdx‎

Lines changed: 64 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -7,80 +7,72 @@ tags: ["security","defend","reference","manage"]
77

88
<DocBadge template="technical preview" />
99

10-
{/* TO-DO: Remove the DocIf conditionals once the feature is available in production. */}
10+
You can create user roles and define privileges to manage feature access in ((elastic-sec)). This allows you to use the principle of least privilege while managing access to ((elastic-defend))'s features.
1111

12-
<DocIf condition={"((serverlessCustomRoles))" === "false"}>
13-
<DocBadgeComingSoon>Coming soon</DocBadgeComingSoon>
14-
</DocIf>
12+
Configure roles and privileges in **Stack Management** → **Custom Roles**. For more details on using this UI, refer to <DocLink slug="/serverless/custom-roles" />.
1513

16-
<DocIf condition={"((serverlessCustomRoles))" === "true"}>
17-
You can create user roles and define privileges to manage feature access in ((elastic-sec)). This allows you to use the principle of least privilege while managing access to ((elastic-defend))'s features.
14+
<DocCallOut title="Note">
15+
((elastic-defend))'s feature privileges must be assigned to **All Spaces**. You can't assign them to an individual space.
16+
</DocCallOut>
1817

19-
Configure roles and privileges in **Stack Management** → **Custom Roles**. For more details on using this UI, refer to <DocLink slug="/serverless/custom-roles" />.
18+
To grant access, select **All** for the **Security** feature in the **((kib)) privileges** configuration UI, then turn on the **Customize sub-feature privileges** switch. For each of the following sub-feature privileges, select the type of access you want to allow:
2019

21-
<DocCallOut title="Note">
22-
((elastic-defend))'s feature privileges must be assigned to **All Spaces**. You can't assign them to an individual space.
23-
</DocCallOut>
20+
* **All**: Users have full access to the feature, which includes performing all available actions and managing configuration.
21+
* **Read**: Users can view the feature, but can't perform any actions or manage configuration (some features don't have this privilege).
22+
* **None**: Users can't access or view the feature.
2423

25-
To grant access, select **All** for the **Security** feature in the **((kib)) privileges** configuration UI, then turn on the **Customize sub-feature privileges** switch. For each of the following sub-feature privileges, select the type of access you want to allow:
26-
27-
* **All**: Users have full access to the feature, which includes performing all available actions and managing configuration.
28-
* **Read**: Users can view the feature, but can't perform any actions or manage configuration (some features don't have this privilege).
29-
* **None**: Users can't access or view the feature.
30-
31-
<DocTable columns={[{ title: "", width: "25%" }, { title: "" }]}>
32-
<DocRow>
33-
<DocCell>**Endpoint List**</DocCell>
34-
<DocCell>Access the <DocLink slug="/serverless/security/endpoints-page">Endpoints</DocLink> page, which lists all hosts running ((elastic-defend)), and associated integration details.</DocCell>
35-
</DocRow>
36-
<DocRow>
37-
<DocCell>**Trusted Applications**</DocCell>
38-
<DocCell>Access the <DocLink slug="/serverless/security/trusted-applications">Trusted applications</DocLink> page to remediate conflicts with other software, such as antivirus or endpoint security applications</DocCell>
39-
</DocRow>
40-
<DocRow>
41-
<DocCell>**Host Isolation Exceptions**</DocCell>
42-
<DocCell>Access the <DocLink slug="/serverless/security/host-isolation-exceptions">Host isolation exceptions</DocLink> page to add specific IP addresses that isolated hosts can still communicate with.</DocCell>
43-
</DocRow>
44-
<DocRow>
45-
<DocCell>**Blocklist**</DocCell>
46-
<DocCell>Access the <DocLink slug="/serverless/security/blocklist">Blocklist</DocLink> page to prevent specified applications from running on hosts, extending the list of processes that ((elastic-defend)) considers malicious.</DocCell>
47-
</DocRow>
48-
<DocRow>
49-
<DocCell>**Event Filters**</DocCell>
50-
<DocCell>Access the <DocLink slug="/serverless/security/event-filters">Event Filters</DocLink> page to filter out endpoint events that you don't want stored in ((es)).</DocCell>
51-
</DocRow>
52-
<DocRow>
53-
<DocCell>**((elastic-defend)) Policy Management**</DocCell>
54-
<DocCell>Access the <DocLink slug="/serverless/security/policies-page">Policies</DocLink> page and ((elastic-defend)) integration policies to configure protections, event collection, and advanced policy features.</DocCell>
55-
</DocRow>
56-
<DocRow>
57-
<DocCell>**Response Actions History**</DocCell>
58-
<DocCell>Access the <DocLink slug="/serverless/security/response-actions-history">response actions history</DocLink> for endpoints.</DocCell>
59-
</DocRow>
60-
<DocRow>
61-
<DocCell>**Host Isolation**</DocCell>
62-
<DocCell>Allow users to <DocLink slug="/serverless/security/isolate-host">isolate and release hosts</DocLink>.</DocCell>
63-
</DocRow>
64-
<DocRow>
65-
<DocCell>**Process Operations**</DocCell>
66-
<DocCell>Perform host process-related <DocLink slug="/serverless/security/response-actions">response actions</DocLink>, including `processes`, `kill-process`, and `suspend-process`.</DocCell>
67-
</DocRow>
68-
<DocRow>
69-
<DocCell>**File Operations**</DocCell>
70-
<DocCell>Perform file-related <DocLink slug="/serverless/security/response-actions">response actions</DocLink> in the response console.</DocCell>
71-
</DocRow>
72-
<DocRow>
73-
<DocCell>**Execute Operations**</DocCell>
74-
<DocCell>
75-
Perform shell commands and script-related <DocLink slug="/serverless/security/response-actions">response actions</DocLink> in the response console.
76-
<DocCallOut title="Warning" color="warning">
77-
The commands are run on the host using the same user account running the ((elastic-defend)) integration, which normally has full control over the system. Only grant this feature privilege to ((elastic-sec)) users who require this level of access.
78-
</DocCallOut>
79-
</DocCell>
80-
</DocRow>
81-
<DocRow>
82-
<DocCell>**Scan Operations**</DocCell>
83-
<DocCell>Perform folder scan <DocLink slug="/serverless/security/response-actions">response actions</DocLink> in the response console.</DocCell>
84-
</DocRow>
85-
</DocTable>
86-
</DocIf>
24+
<DocTable columns={[{ title: "", width: "25%" }, { title: "" }]}>
25+
<DocRow>
26+
<DocCell>**Endpoint List**</DocCell>
27+
<DocCell>Access the <DocLink slug="/serverless/security/endpoints-page">Endpoints</DocLink> page, which lists all hosts running ((elastic-defend)), and associated integration details.</DocCell>
28+
</DocRow>
29+
<DocRow>
30+
<DocCell>**Trusted Applications**</DocCell>
31+
<DocCell>Access the <DocLink slug="/serverless/security/trusted-applications">Trusted applications</DocLink> page to remediate conflicts with other software, such as antivirus or endpoint security applications</DocCell>
32+
</DocRow>
33+
<DocRow>
34+
<DocCell>**Host Isolation Exceptions**</DocCell>
35+
<DocCell>Access the <DocLink slug="/serverless/security/host-isolation-exceptions">Host isolation exceptions</DocLink> page to add specific IP addresses that isolated hosts can still communicate with.</DocCell>
36+
</DocRow>
37+
<DocRow>
38+
<DocCell>**Blocklist**</DocCell>
39+
<DocCell>Access the <DocLink slug="/serverless/security/blocklist">Blocklist</DocLink> page to prevent specified applications from running on hosts, extending the list of processes that ((elastic-defend)) considers malicious.</DocCell>
40+
</DocRow>
41+
<DocRow>
42+
<DocCell>**Event Filters**</DocCell>
43+
<DocCell>Access the <DocLink slug="/serverless/security/event-filters">Event Filters</DocLink> page to filter out endpoint events that you don't want stored in ((es)).</DocCell>
44+
</DocRow>
45+
<DocRow>
46+
<DocCell>**((elastic-defend)) Policy Management**</DocCell>
47+
<DocCell>Access the <DocLink slug="/serverless/security/policies-page">Policies</DocLink> page and ((elastic-defend)) integration policies to configure protections, event collection, and advanced policy features.</DocCell>
48+
</DocRow>
49+
<DocRow>
50+
<DocCell>**Response Actions History**</DocCell>
51+
<DocCell>Access the <DocLink slug="/serverless/security/response-actions-history">response actions history</DocLink> for endpoints.</DocCell>
52+
</DocRow>
53+
<DocRow>
54+
<DocCell>**Host Isolation**</DocCell>
55+
<DocCell>Allow users to <DocLink slug="/serverless/security/isolate-host">isolate and release hosts</DocLink>.</DocCell>
56+
</DocRow>
57+
<DocRow>
58+
<DocCell>**Process Operations**</DocCell>
59+
<DocCell>Perform host process-related <DocLink slug="/serverless/security/response-actions">response actions</DocLink>, including `processes`, `kill-process`, and `suspend-process`.</DocCell>
60+
</DocRow>
61+
<DocRow>
62+
<DocCell>**File Operations**</DocCell>
63+
<DocCell>Perform file-related <DocLink slug="/serverless/security/response-actions">response actions</DocLink> in the response console.</DocCell>
64+
</DocRow>
65+
<DocRow>
66+
<DocCell>**Execute Operations**</DocCell>
67+
<DocCell>
68+
Perform shell commands and script-related <DocLink slug="/serverless/security/response-actions">response actions</DocLink> in the response console.
69+
<DocCallOut title="Warning" color="warning">
70+
The commands are run on the host using the same user account running the ((elastic-defend)) integration, which normally has full control over the system. Only grant this feature privilege to ((elastic-sec)) users who require this level of access.
71+
</DocCallOut>
72+
</DocCell>
73+
</DocRow>
74+
<DocRow>
75+
<DocCell>**Scan Operations**</DocCell>
76+
<DocCell>Perform folder scan <DocLink slug="/serverless/security/response-actions">response actions</DocLink> in the response console.</DocCell>
77+
</DocRow>
78+
</DocTable>

‎docs/serverless/explore/conf-map-ui.mdx‎

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,8 @@ configure `source.geo` and `destination.geo` ECS fields for your indices.
2424
<div id="prereq-perms"></div>
2525

2626
## Permissions required
27-
{/* TO-DO: Remove the DocIf conditionals once the feature is available in production. */}
28-
29-
<DocIf condition={"((serverlessCustomRoles))" === "false"}>
30-
To view the map, you need the appropriate <DocLink slug="/serverless/general/assign-user-roles">predefined user role</DocLink>.
31-
</DocIf>
32-
<DocIf condition={"((serverlessCustomRoles))" === "true"}>
33-
To view the map, you need the appropriate <DocLink slug="/serverless/general/assign-user-roles">predefined user role</DocLink> or a <DocLink slug="/serverless/custom-roles">custom role</DocLink> with at least `Read` privileges for the `Maps` feature.
34-
</DocIf>
27+
28+
To view the map, you need the appropriate <DocLink slug="/serverless/general/assign-user-roles">predefined user role</DocLink> or a <DocLink slug="/serverless/custom-roles">custom role</DocLink> with at least `Read` privileges for the `Maps` feature.
3529

3630
<div id="kibana-index-pattern"></div>
3731

0 commit comments

Comments
 (0)