Merge branch 'main' into elastic#136

renovate.json

@@ -23,7 +23,7 @@
     {
       "groupName": "GitHub actions",
       "matchManagers": ["github-actions"],
-      "reviewers": "[team:kibana-operations]",
+      "reviewers": ["team:kibana-operations"],
       "matchBaseBranches": ["main"],
       "labels": ["Team:Operations", "backport:all-open", "release_note:skip"],
       "enabled": true
@@ -434,5 +434,18 @@
       "labels": ["release_note:skip", "backport:all-open", "Team:Visualizations"],
       "enabled": true
     }
+  ],
+  "customManagers": [
+    {
+      "description": "Update Wolfi base image",
+      "customType": "regex",
+      "fileMatch": [
+        "^src/dev/build/tasks/os_packages/docker_generator/run\\.ts$"
+      ],
+      "matchStrings": [
+        "docker\\.elastic\\.co/wolfi/chainguard-base:(?<currentValue>[-a-zA-Z0-9.]+)?(?:@(?<currentDigest>sha256:[a-fA-F0-9]+))?"
+      ],
+      "datasourceTemplate": "docker"
+    }
   ]
 }

x-pack/plugins/observability_solution/observability_onboarding/public/application/onboarding_flow_form/use_custom_cards_for_category.ts

@@ -23,11 +23,7 @@ export function useCustomCardsForCategory(
   const history = useHistory();
   const location = useLocation();
   const {
-    services: {
-      application,
-      http,
-      context: { isServerless },
-    },
+    services: { application, http },
   } = useKibana<ObservabilityOnboardingAppServices>();
   const getUrlForApp = application?.getUrlForApp;
 
@@ -132,7 +128,7 @@ export function useCustomCardsForCategory(
           integration: '',
         },
         toFeaturedCard('docker'),
-        isServerless ? toFeaturedCard('prometheus') : otelCard,
+        otelCard,
         {
           id: 'azure-virtual',
           type: 'virtual',
@@ -213,7 +209,7 @@ export function useCustomCardsForCategory(
           version: '',
           integration: '',
         },
-        isServerless ? toFeaturedCard('nginx') : otelCard,
+        otelCard,
         {
           id: 'azure-logs-virtual',
           type: 'virtual',

x-pack/plugins/observability_solution/observability_onboarding/public/application/quickstart_flows/otel_logs/index.tsx

@@ -71,12 +71,8 @@ export const OtelLogsPanel: React.FC = () => {
     },
   } = useKibana<ObservabilityOnboardingAppServices>();
 
-  const AGENT_CDN_BASE_URL = isServerless
-    ? 'snapshots.elastic.co/8.15.0-bc431a00/downloads/beats/elastic-agent'
-    : 'artifacts.elastic.co/downloads/beats/elastic-agent';
-  // TODO change once otel flow is shown on serverless
-  // const agentVersion = isServerless ? setup?.elasticAgentVersion : stackVersion;
-  const agentVersion = isServerless ? '8.15.0-SNAPSHOT' : stackVersion;
+  const AGENT_CDN_BASE_URL = 'artifacts.elastic.co/downloads/beats/elastic-agent';
+  const agentVersion = isServerless ? setup?.elasticAgentVersion : stackVersion;
 
   const allDatasetsLocator =
     share.url.locators.get<AllDatasetsLocatorParams>(ALL_DATASETS_LOCATOR_ID);

x-pack/plugins/security_solution/common/experimental_features.ts

@@ -42,16 +42,6 @@ export const allowedExperimentalValues = Object.freeze({
    */
   socTrendsEnabled: false,
 
-  /**
-   * Enables the automated response actions in rule + alerts
-   */
-  responseActionsEnabled: true,
-
-  /**
-   * Enables the automated endpoint response action in rule + alerts
-   */
-  endpointResponseActionsEnabled: true,
-
   /**
    * Enables the `upload` endpoint response action (v8.9)
    */

x-pack/plugins/security_solution/public/common/components/event_details/response_actions_view.tsx

@@ -23,8 +23,6 @@ import { useGetAutomatedActionList } from '../../../management/hooks/response_ac
 import { EventsViewType } from './event_details';
 import * as i18n from './translations';
 
-import { useIsExperimentalFeatureEnabled } from '../../hooks/use_experimental_features';
-
 const TabContentWrapper = styled.div`
   height: 100%;
   position: relative;
@@ -75,14 +73,13 @@ export const useResponseActionsView = <T extends object = JSX.Element>({
     }),
     []
   );
-  const responseActionsEnabled = useIsExperimentalFeatureEnabled('endpointResponseActionsEnabled');
   const expandedEventFieldsObject = rawEventData
     ? (expandDottedObject((rawEventData as RawEventData).fields) as ExpandedEventFieldsObject)
     : undefined;
 
   const responseActions =
     expandedEventFieldsObject?.kibana?.alert?.rule?.parameters?.[0].response_actions;
-  const shouldEarlyReturn = !rawEventData || !responseActionsEnabled;
+  const shouldEarlyReturn = !rawEventData;
 
   const alertId = rawEventData?._id ?? '';
   const [isLive, setIsLive] = useState(false);

x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/step_rule_actions/index.tsx

@@ -18,7 +18,6 @@ import { UseArray } from '@kbn/es-ui-shared-plugin/static/forms/hook_form_lib';
 import type { Type } from '@kbn/securitysolution-io-ts-alerting-types';
 import type { RuleObjectId } from '../../../../../common/api/detection_engine/model/rule_schema';
 import { isQueryRule } from '../../../../../common/detection_engine/utils';
-import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
 import { ResponseActionsForm } from '../../../rule_response_actions/response_actions_form';
 import type {
   RuleStepProps,
@@ -85,8 +84,6 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
   const {
     services: { application },
   } = useKibana();
-  const responseActionsEnabled = useIsExperimentalFeatureEnabled('responseActionsEnabled');
-
   const displayActionsOptions = useMemo(
     () => (
       <>
@@ -120,7 +117,7 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
         <DisplayActionsHeader />
         {ruleId && <RuleSnoozeSection ruleId={ruleId} />}
         {displayActionsOptions}
-        {responseActionsEnabled && displayResponseActionsOptions}
+        {displayResponseActionsOptions}
         <UseField path="kibanaSiemAppUrl" component={GhostFormField} />
         <UseField path="enabled" component={GhostFormField} />
       </>
@@ -134,7 +131,6 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
     application.capabilities.actions.show,
     displayActionsOptions,
     displayResponseActionsOptions,
-    responseActionsEnabled,
   ]);
 
   return (

x-pack/plugins/security_solution/public/detection_engine/rule_response_actions/get_supported_response_actions.ts

@@ -24,12 +24,10 @@ interface EnabledFeatures {
 
 export const getSupportedResponseActions = (
   actionTypes: ResponseActionType[],
-  enabledFeatures: EnabledFeatures,
   userPermissions: EnabledFeatures
 ): ResponseActionType[] =>
   actionTypes.reduce((acc: ResponseActionType[], actionType) => {
     const isEndpointAction = actionType.id === ResponseActionTypesEnum['.endpoint'];
-    if (!enabledFeatures.endpoint && isEndpointAction) return acc;
     if (ResponseActionTypes.options.includes(actionType.id))
       return [
         ...acc,

x-pack/plugins/security_solution/public/detection_engine/rule_response_actions/use_supported_response_action_types.tsx

@@ -7,7 +7,6 @@
 
 import { useEffect, useMemo, useState } from 'react';
 import { useUserPrivileges } from '../../common/components/user_privileges';
-import { useIsExperimentalFeatureEnabled } from '../../common/hooks/use_experimental_features';
 import type { ResponseActionType } from './get_supported_response_actions';
 import { getSupportedResponseActions, responseActionTypes } from './get_supported_response_actions';
 
@@ -16,15 +15,8 @@ export const useSupportedResponseActionTypes = () => {
     ResponseActionType[] | undefined
   >();
 
-  const isEndpointEnabled = useIsExperimentalFeatureEnabled('endpointResponseActionsEnabled');
   const { canIsolateHost, canKillProcess, canSuspendProcess } =
     useUserPrivileges().endpointPrivileges;
-  const enabledFeatures = useMemo(
-    () => ({
-      endpoint: isEndpointEnabled,
-    }),
-    [isEndpointEnabled]
-  );
 
   const userHasPermissionsToExecute = useMemo(
     () => ({
@@ -36,11 +28,10 @@ export const useSupportedResponseActionTypes = () => {
   useEffect(() => {
     const supportedTypes = getSupportedResponseActions(
       responseActionTypes,
-      enabledFeatures,
       userHasPermissionsToExecute
     );
     setSupportedResponseActionTypes(supportedTypes);
-  }, [isEndpointEnabled, enabledFeatures, userHasPermissionsToExecute]);
+  }, [userHasPermissionsToExecute]);
 
   return supportedResponseActionTypes;
 };

x-pack/plugins/security_solution/public/flyout/document_details/left/components/response_details.test.tsx

@@ -12,7 +12,6 @@ import { DocumentDetailsContext } from '../../shared/context';
 import { rawEventData, TestProviders } from '../../../../common/mock';
 import { RESPONSE_DETAILS_TEST_ID } from './test_ids';
 import { ResponseDetails } from './response_details';
-import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
 
 jest.mock('../../../../common/hooks/use_experimental_features');
 jest.mock('../../../../common/lib/kibana', () => {
@@ -98,19 +97,6 @@ const renderResponseDetails = (contextValue: DocumentDetailsContext) =>
   );
 
 describe('<ResponseDetails />', () => {
-  let featureFlags: { endpointResponseActionsEnabled: boolean; responseActionsEnabled: boolean };
-
-  beforeEach(() => {
-    featureFlags = { endpointResponseActionsEnabled: true, responseActionsEnabled: true };
-
-    const useIsExperimentalFeatureEnabledMock = (feature: keyof typeof featureFlags) =>
-      featureFlags[feature];
-
-    (useIsExperimentalFeatureEnabled as jest.Mock).mockImplementation(
-      useIsExperimentalFeatureEnabledMock
-    );
-  });
-
   it('should render the view with response actions', () => {
     const wrapper = renderResponseDetails(contextWithResponseActions);
 
@@ -120,17 +106,6 @@ describe('<ResponseDetails />', () => {
     // TODO mock osquery results
   });
 
-  it('should render the view with osquery only', () => {
-    featureFlags.responseActionsEnabled = true;
-    featureFlags.endpointResponseActionsEnabled = false;
-
-    const wrapper = renderResponseDetails(contextWithResponseActions);
-
-    expect(wrapper.getByTestId(RESPONSE_DETAILS_TEST_ID)).toBeInTheDocument();
-    expect(wrapper.queryByTestId('responseActionsViewWrapper')).not.toBeInTheDocument();
-    expect(wrapper.getByTestId('osqueryViewWrapper')).toBeInTheDocument();
-  });
-
   it('should render the empty information', () => {
     const wrapper = renderResponseDetails(defaultContextValue);
 

x-pack/plugins/security_solution/public/flyout/document_details/left/components/response_details.tsx

@@ -11,8 +11,6 @@ import styled from 'styled-components';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { RESPONSE_DETAILS_TEST_ID } from './test_ids';
 import { useDocumentDetailsContext } from '../../shared/context';
-import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
-import { useOsqueryTab } from '../../../../common/components/event_details/osquery_tab';
 import { useResponseActionsView } from '../../../../common/components/event_details/response_actions_view';
 
 const ExtendedFlyoutWrapper = styled.div`
@@ -25,18 +23,11 @@ const ExtendedFlyoutWrapper = styled.div`
  */
 export const ResponseDetails: React.FC = () => {
   const { searchHit, dataAsNestedObject, isPreview } = useDocumentDetailsContext();
-  const endpointResponseActionsEnabled = useIsExperimentalFeatureEnabled(
-    'endpointResponseActionsEnabled'
-  );
 
   const responseActionsView = useResponseActionsView({
     rawEventData: searchHit,
     ecsData: dataAsNestedObject,
   });
-  const osqueryView = useOsqueryTab({
-    rawEventData: searchHit,
-    ecsData: dataAsNestedObject,
-  });
 
   return (
     <div data-test-subj={RESPONSE_DETAILS_TEST_ID}>
@@ -57,9 +48,7 @@ export const ResponseDetails: React.FC = () => {
           </EuiTitle>
           <EuiSpacer size="s" />
 
-          <ExtendedFlyoutWrapper>
-            {endpointResponseActionsEnabled ? responseActionsView?.content : osqueryView?.content}
-          </ExtendedFlyoutWrapper>
+          <ExtendedFlyoutWrapper>{responseActionsView?.content}</ExtendedFlyoutWrapper>
         </>
       )}
     </div>