Skip to content

Commit ba7d342

Browse files
e40pudzacharyparikh
e40pud
authored and
zacharyparikh
committed
[Security Solution][Attack Discovery] Granting reserved role access to .adhoc.alerts* and .internal.adhoc.alerts* indices (elastic#221759)
## Summary Main ticket ([Internal link](elastic/security-team#12484)) These changes reflect serverless roles updates in the elastic/elasticsearch-controller#996. ## Description This is a part of the "Attack Discovery" feature where we introduce the scheduling and alerts generation. The attack discovery scheduling feature requires a possibility to generate alerts without running an existing (registered in alerting framework) rule and for that we are writing "adhoc" generated alerts to a separate index (than normal alerts) so they won't show up with standard `.alerts*` queries, but still need the same permissions as "normal" alert indices. The new `.adhoc.alerts*` act same way as existing `.alerts*` and `.preview.alerts*` indices and reserved roles should have same access rights.
1 parent 0e813c0 commit ba7d342

File tree

10 files changed

+73
-0
lines changed

10 files changed

+73
-0
lines changed

‎src/platform/packages/shared/kbn-es/src/serverless_resources/project_roles/oblt/roles.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ viewer:
2121
- names:
2222
- '.alerts*'
2323
- '.preview.alerts*'
24+
- '.adhoc.alerts*'
2425
privileges:
2526
- 'read'
2627
- 'view_index_metadata'
@@ -68,6 +69,8 @@ editor:
6869
- '.alerts*'
6970
- '.internal.preview.alerts*'
7071
- '.preview.alerts*'
72+
- '.adhoc.alerts*'
73+
- '.internal.adhoc.alerts*'
7174
privileges:
7275
- 'read'
7376
- 'view_index_metadata'

‎src/platform/packages/shared/kbn-es/src/serverless_resources/project_roles/security/roles.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ viewer:
1616
- names:
1717
- '.alerts*'
1818
- '.preview.alerts*'
19+
- '.adhoc.alerts*'
1920
privileges:
2021
- 'read'
2122
- 'view_index_metadata'
@@ -95,6 +96,8 @@ editor:
9596
- '.alerts*'
9697
- '.internal.preview.alerts*'
9798
- '.preview.alerts*'
99+
- '.internal.adhoc.alerts*'
100+
- '.adhoc.alerts*'
98101
- 'risk-score.risk-score-*'
99102
privileges:
100103
- 'read'
@@ -420,6 +423,8 @@ rule_author:
420423
- .siem-signals-*
421424
- .internal.preview.alerts-security*
422425
- .preview.alerts-security*
426+
- .internal.adhoc.alerts-security*
427+
- .adhoc.alerts-security*
423428
privileges:
424429
- read
425430
- write
@@ -492,6 +497,8 @@ soc_manager:
492497
- .siem-signals-*
493498
- .preview.alerts-security*
494499
- .internal.preview.alerts-security*
500+
- .adhoc.alerts-security*
501+
- .internal.adhoc.alerts-security*
495502
privileges:
496503
- read
497504
- write
@@ -568,6 +575,8 @@ detections_admin:
568575
- .siem-signals-*
569576
- .preview.alerts-security*
570577
- .internal.preview.alerts-security*
578+
- .adhoc.alerts-security*
579+
- .internal.adhoc.alerts-security*
571580
privileges:
572581
- read
573582
- write
@@ -631,6 +640,8 @@ platform_engineer:
631640
- .siem-signals-*
632641
- .preview.alerts-security*
633642
- .internal.preview.alerts-security*
643+
- .adhoc.alerts-security*
644+
- .internal.adhoc.alerts-security*
634645
- risk-score.risk-score-*
635646
privileges:
636647
- all
@@ -708,6 +719,8 @@ endpoint_operations_analyst:
708719
- .siem-signals-*
709720
- .preview.alerts-security*
710721
- .internal.preview.alerts-security*
722+
- .adhoc.alerts-security*
723+
- .internal.adhoc.alerts-security*
711724
privileges:
712725
- read
713726
- write
@@ -794,6 +807,8 @@ endpoint_policy_manager:
794807
- .siem-signals-*
795808
- .preview.alerts-security*
796809
- .internal.preview.alerts-security*
810+
- .adhoc.alerts-security*
811+
- .internal.adhoc.alerts-security*
797812
privileges:
798813
- read
799814
- write

‎src/platform/packages/shared/kbn-es/src/serverless_resources/security_roles.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -200,6 +200,8 @@
200200
".alerts-security*",
201201
".preview.alerts-security*",
202202
".internal.preview.alerts-security*",
203+
".adhoc.alerts-security*",
204+
".internal.adhoc.alerts-security*",
203205
".siem-signals-*"
204206
],
205207
"privileges": ["read", "write", "maintenance", "view_index_metadata"]
@@ -255,6 +257,8 @@
255257
".alerts-security*",
256258
".preview.alerts-security*",
257259
".internal.preview.alerts-security*",
260+
".adhoc.alerts-security*",
261+
".internal.adhoc.alerts-security*",
258262
".siem-signals-*"
259263
],
260264
"privileges": ["read", "write", "manage"]
@@ -295,6 +299,8 @@
295299
".alerts-security*",
296300
".preview.alerts-security*",
297301
".internal.preview.alerts-security*",
302+
".adhoc.alerts-security*",
303+
".internal.adhoc.alerts-security*",
298304
".lists*",
299305
".items*",
300306
"apm-*-transaction*",
@@ -366,6 +372,8 @@
366372
".alerts-security*",
367373
".preview.alerts-security*",
368374
".internal.preview.alerts-security*",
375+
".adhoc.alerts-security*",
376+
".internal.adhoc.alerts-security*",
369377
".siem-signals-*"
370378
],
371379
"privileges": ["all"]

‎src/platform/packages/shared/kbn-es/src/stateful_resources/roles.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ viewer:
99
- names:
1010
- '.alerts*'
1111
- '.preview.alerts*'
12+
- '.adhoc.alerts*'
1213
privileges:
1314
- 'read'
1415
- 'view_index_metadata'
@@ -80,6 +81,8 @@ editor:
8081
- '.internal.alerts*'
8182
- '.internal.preview.alerts*'
8283
- '.preview.alerts*'
84+
- '.internal.adhoc.alerts*'
85+
- '.adhoc.alerts*'
8386
privileges:
8487
- 'maintenance'
8588
- 'read'

‎x-pack/platform/plugins/shared/alerting/server/alerts_service/resource_installer_utils.test.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,8 @@ describe('getIndexTemplateAndPattern', () => {
4747
'.preview.alerts-',
4848
'.internal.preview.alerts-',
4949
'.reindexed-v8-internal.preview.alerts-',
50+
'.adhoc.alerts-',
51+
'.internal.adhoc.alerts-',
5052
],
5153
name: '.internal.alerts-test.alerts-default-000001',
5254
});
@@ -67,6 +69,8 @@ describe('getIndexTemplateAndPattern', () => {
6769
'.preview.alerts-',
6870
'.internal.preview.alerts-',
6971
'.reindexed-v8-internal.preview.alerts-',
72+
'.adhoc.alerts-',
73+
'.internal.adhoc.alerts-',
7074
],
7175
name: '.internal.alerts-test.alerts-special-000001',
7276
});
@@ -94,6 +98,8 @@ describe('getIndexTemplateAndPattern', () => {
9498
'.preview.alerts-',
9599
'.internal.preview.alerts-',
96100
'.reindexed-v8-internal.preview.alerts-',
101+
'.adhoc.alerts-',
102+
'.internal.adhoc.alerts-',
97103
],
98104
secondaryAlias: `siem.signals-special`,
99105
});

‎x-pack/platform/plugins/shared/alerting/server/alerts_service/resource_installer_utils.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ export const VALID_ALERT_INDEX_PREFIXES = [
2525
'.preview.alerts-',
2626
'.internal.preview.alerts-',
2727
'.reindexed-v8-internal.preview.alerts-',
28+
'.adhoc.alerts-',
29+
'.internal.adhoc.alerts-',
2830
];
2931

3032
export const getComponentTemplateName = ({ context, name }: GetComponentTemplateNameOpts = {}) =>

‎x-pack/solutions/security/plugins/security_solution/common/test/ess_roles.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,8 @@
185185
".alerts-security*",
186186
".preview.alerts-security*",
187187
".internal.preview.alerts-security*",
188+
".adhoc.alerts-security*",
189+
".internal.adhoc.alerts-security*",
188190
".siem-signals-*"
189191
],
190192
"privileges": ["read", "write", "manage"]
@@ -239,6 +241,8 @@
239241
".alerts-security*",
240242
".preview.alerts-security*",
241243
".internal.preview.alerts-security*",
244+
".adhoc.alerts-security*",
245+
".internal.adhoc.alerts-security*",
242246
".siem-signals-*"
243247
],
244248
"privileges": ["read", "write", "manage"]

‎x-pack/solutions/security/plugins/security_solution/scripts/endpoint/common/roles_users/endpoint_operations_analyst.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@ export const getEndpointOperationsAnalyst: () => Omit<Role, 'name'> = () => {
4040
'.siem-signals-*',
4141
'.preview.alerts-security*',
4242
'.internal.preview.alerts-security*',
43+
'.adhoc.alerts-security*',
44+
'.internal.adhoc.alerts-security*',
4345
],
4446
privileges: ['read', 'write'],
4547
},

‎x-pack/solutions/security/plugins/security_solution/scripts/endpoint/common/roles_users/serverless/es_serverless_resources/roles.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ viewer:
3535
- names:
3636
- '.alerts*'
3737
- '.preview.alerts*'
38+
- '.adhoc.alerts*'
3839
privileges:
3940
- 'read'
4041
- 'view_index_metadata'
@@ -113,6 +114,8 @@ editor:
113114
- '.alerts*'
114115
- '.internal.preview.alerts*'
115116
- '.preview.alerts*'
117+
- '.internal.adhoc.alerts*'
118+
- '.adhoc.alerts*'
116119
- 'risk-score.risk-score-*'
117120
privileges:
118121
- 'read'
@@ -435,6 +438,8 @@ rule_author:
435438
- .siem-signals-*
436439
- .internal.preview.alerts-security*
437440
- .preview.alerts-security*
441+
- .internal.adhoc.alerts-security*
442+
- .adhoc.alerts-security*
438443
privileges:
439444
- read
440445
- write
@@ -509,6 +514,8 @@ soc_manager:
509514
- .siem-signals-*
510515
- .preview.alerts-security*
511516
- .internal.preview.alerts-security*
517+
- .adhoc.alerts-security*
518+
- .internal.adhoc.alerts-security*
512519
privileges:
513520
- read
514521
- write
@@ -585,6 +592,8 @@ detections_admin:
585592
- .siem-signals-*
586593
- .preview.alerts-security*
587594
- .internal.preview.alerts-security*
595+
- .adhoc.alerts-security*
596+
- .internal.adhoc.alerts-security*
588597
privileges:
589598
- read
590599
- write
@@ -649,6 +658,8 @@ platform_engineer:
649658
- .siem-signals-*
650659
- .preview.alerts-security*
651660
- .internal.preview.alerts-security*
661+
- .adhoc.alerts-security*
662+
- .internal.adhoc.alerts-security*
652663
- risk-score.risk-score-*
653664
privileges:
654665
- all
@@ -727,6 +738,8 @@ endpoint_operations_analyst:
727738
- .siem-signals-*
728739
- .preview.alerts-security*
729740
- .internal.preview.alerts-security*
741+
- .adhoc.alerts-security*
742+
- .internal.adhoc.alerts-security*
730743
privileges:
731744
- read
732745
- write
@@ -810,6 +823,8 @@ endpoint_policy_manager:
810823
- .siem-signals-*
811824
- .preview.alerts-security*
812825
- .internal.preview.alerts-security*
826+
- .adhoc.alerts-security*
827+
- .internal.adhoc.alerts-security*
813828
privileges:
814829
- read
815830
- write

‎x-pack/test_serverless/shared/lib/security/kibana_roles/project_controller_security_roles.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ viewer:
1616
- names:
1717
- '.alerts*'
1818
- '.preview.alerts*'
19+
- '.adhoc.alerts*'
1920
privileges:
2021
- 'read'
2122
- 'view_index_metadata'
@@ -94,6 +95,8 @@ editor:
9495
- '.alerts*'
9596
- '.internal.preview.alerts*'
9697
- '.preview.alerts*'
98+
- '.internal.adhoc.alerts*'
99+
- '.adhoc.alerts*'
97100
- 'risk-score.risk-score-*'
98101
privileges:
99102
- 'read'
@@ -419,6 +422,8 @@ rule_author:
419422
- .siem-signals-*
420423
- .internal.preview.alerts-security*
421424
- .preview.alerts-security*
425+
- .internal.adhoc.alerts-security*
426+
- .adhoc.alerts-security*
422427
privileges:
423428
- read
424429
- write
@@ -494,6 +499,8 @@ soc_manager:
494499
- .siem-signals-*
495500
- .preview.alerts-security*
496501
- .internal.preview.alerts-security*
502+
- .adhoc.alerts-security*
503+
- .internal.adhoc.alerts-security*
497504
privileges:
498505
- read
499506
- write
@@ -573,6 +580,8 @@ detections_admin:
573580
- .siem-signals-*
574581
- .preview.alerts-security*
575582
- .internal.preview.alerts-security*
583+
- .adhoc.alerts-security*
584+
- .internal.adhoc.alerts-security*
576585
privileges:
577586
- read
578587
- write
@@ -637,6 +646,8 @@ platform_engineer:
637646
- .siem-signals-*
638647
- .preview.alerts-security*
639648
- .internal.preview.alerts-security*
649+
- .adhoc.alerts-security*
650+
- .internal.adhoc.alerts-security*
640651
- risk-score.risk-score-*
641652
privileges:
642653
- all
@@ -715,6 +726,8 @@ endpoint_operations_analyst:
715726
- .siem-signals-*
716727
- .preview.alerts-security*
717728
- .internal.preview.alerts-security*
729+
- .adhoc.alerts-security*
730+
- .internal.adhoc.alerts-security*
718731
privileges:
719732
- read
720733
- write
@@ -798,6 +811,8 @@ endpoint_policy_manager:
798811
- .siem-signals-*
799812
- .preview.alerts-security*
800813
- .internal.preview.alerts-security*
814+
- .adhoc.alerts-security*
815+
- .internal.adhoc.alerts-security*
801816
privileges:
802817
- read
803818
- write

0 commit comments

Comments
 (0)