[RAC][Timeline] - Add audit log to RBAC wrapped search strategy #112040

yctercero · 2021-09-14T00:54:13Z

Summary

Went back to add audit logging to the alerts table search strategy used to query RAC alerts. This PR also includes tests for the logging.

To Do

Unskip RBAC tests - saw that the RBAC tests, including those for timeline search strategy
- https://github.com/elastic/kibana/blob/master/x-pack/test/rule_registry/security_and_spaces/tests/trial/index.ts#L41
- Failing test: X-Pack Rule Registry Alerts Client API Integration Tests.x-pack/test/rule_registry/security_and_spaces/tests/basic/get_alerts_index·ts - rules security and spaces enabled: basic Alert - Get Index - RBAC - spaces Users: obs_only_all_spaces_all should be able to access the APM alert in space1 #110153

Checklist

Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
This was checked for breaking API changes and was labeled appropriately

…udit_log

yctercero · 2021-09-28T15:07:54Z

@elasticmachine merge upstream

kibanamachine · 2021-09-28T18:38:49Z

⏳ Build in-progress, with failures

continuous-integration/kibana-ci/pull-request
Commit: 17f6cdd
Storybooks Preview
This comment will update when the build is complete

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @yctercero

…udit_log

elasticmachine · 2021-10-20T21:25:30Z

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

yctercero · 2021-10-20T21:33:36Z

x-pack/test/timeline/security_and_spaces/tests/trial/events.ts

+    const logFilePath = Path.resolve(__dirname, '../../../common/fixtures/audit/audit.log');
+    const logFile = new FileWrapper(logFilePath);
+    const retry = getService('retry');
+


@dhurley14 @marshallmain @michaelolo24 - wasn't sure exactly who to ask, but as I've been away from RAC this cycle, wondering did anything change recently with giving users with minimal read access? These tests are now failing (they'd been removed sometime so weren't running for months now) but I know they were good back in August-ish about?

jportner

Auditing LGTM. Nice catch on the missing bits in the dev docs.

docs/user/security/audit-logging.asciidoc

weltenwort · 2021-10-21T10:59:50Z

This is not a code review, but I tested this PR a bit on the observability alerts table. I couldn't change the workflow status of an alert that I created with the same account even though it has the "logs" consumer:

yctercero · 2021-10-28T16:02:56Z

@elasticmachine merge upstream

yctercero · 2021-10-28T16:03:16Z

@elasticmachine merge upstream

kibanamachine · 2021-10-28T16:03:17Z

expected head sha didn’t match current head ref.

yctercero · 2021-10-29T12:47:34Z

@elasticmachine merge upstream

yctercero · 2021-10-29T17:38:49Z

@elasticmachine merge upstream

yctercero · 2021-11-01T20:56:57Z

@elasticmachine merge upstream

…nto searchstrat_audit_log

yctercero · 2021-11-03T15:18:36Z

@elasticmachine merge upstream

…nto searchstrat_audit_log

kibanamachine · 2021-11-03T20:33:55Z

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`ruleRegistry`	127	139	+12

Unknown metric groups

API count

id	before	after	diff
`ruleRegistry`	153	165	+12

History

💔 Build #4020 failed e47df03
💔 Build #3485 failed ad4db59
💔 Build #3411 failed 4f8e967
💔 Build #2868 failed a92dc54
💔 Build #2791 failed 9838392

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @yctercero

kibanamachine · 2021-11-03T20:34:29Z

The following labels were identified as gaps in your version labels and will be added automatically:

v8.1.0

If any of these should not be on your pull request, please manually remove them.

…tic#112040) ### Summary Went back to add audit logging to the alerts table search strategy used to query RAC alerts. This PR also includes tests for the logging.

kibanamachine · 2021-11-03T20:37:04Z

💔 Backport failed

Status	Branch	Result
✅	8.0
❌	7.16	Commit could not be cherrypicked due to conflicts

Successful backport PRs will be merged automatically after passing CI.

To backport manually run:
node scripts/backport --pr 112040

…tic#112040) ### Summary Went back to add audit logging to the alerts table search strategy used to query RAC alerts. This PR also includes tests for the logging. # Conflicts: # x-pack/test/timeline/common/config.ts # x-pack/test/timeline/security_and_spaces/tests/trial/events.ts

) (#117427) ### Summary Went back to add audit logging to the alerts table search strategy used to query RAC alerts. This PR also includes tests for the logging. Co-authored-by: Yara Tercero <yctercero@users.noreply.github.com>

) (#117435) ### Summary Went back to add audit logging to the alerts table search strategy used to query RAC alerts. This PR also includes tests for the logging. # Conflicts: # x-pack/test/timeline/common/config.ts # x-pack/test/timeline/security_and_spaces/tests/trial/events.ts

yctercero added 5 commits September 7, 2021 13:59

audit log added to rac alerts table search strategy

51079d6

remove console logs

1cdf6ad

Merge branch 'master' of github.com:elastic/kibana into searchstrat_a…

c7341e8

…udit_log

update security doc audit actions to include alert audit actions

cdf65c2

continued cleanup

ef26e9c

yctercero self-assigned this Sep 14, 2021

yctercero added Feature:Cases-RAC-RBAC Feature:RAC label obsolete v7.16.0 v8.0.0 Team:Threat Hunting Security Solution Threat Hunting Team release_note:skip Skip the PR/issue when compiling release notes labels Sep 14, 2021

yctercero added 3 commits September 21, 2021 17:11

fixing types

f861b5c

Merge branch 'master' of github.com:elastic/kibana into searchstrat_a…

151514d

…udit_log

Merge branch 'master' of github.com:elastic/kibana into searchstrat_a…

5a4a023

…udit_log

Merge branch 'master' into searchstrat_audit_log

17f6cdd

Merge branch 'master' of github.com:elastic/kibana into searchstrat_a…

0008855

…udit_log

yctercero added the bug Fixes for quality problems that affect the customer experience label Oct 20, 2021

fixed up tests and added logic to filter alerts table by consumer

d3bde9a

yctercero mentioned this pull request Oct 20, 2021

[Breaking change] Audit logging events have changed #82578

Closed

yctercero marked this pull request as ready for review October 20, 2021 21:25

yctercero requested a review from a team as a code owner October 20, 2021 21:25

yctercero commented Oct 20, 2021

View reviewed changes

yctercero requested a review from jportner October 20, 2021 21:34

jportner approved these changes Oct 20, 2021

View reviewed changes

docs/user/security/audit-logging.asciidoc Outdated Show resolved Hide resolved

removing added filter logic, just audit logging

7a6642f

Merge branch 'master' into searchstrat_audit_log

1e6e73e

yctercero added the auto-backport Deprecated - use backport:version if exact versions are needed label Oct 28, 2021

Merge branch 'master' into searchstrat_audit_log

9838392

Merge branch 'main' into searchstrat_audit_log

a92dc54

kibanamachine and others added 4 commits November 1, 2021 16:56

Merge branch 'main' into searchstrat_audit_log

4f8e967

update tests

a7f0c5d

Merge branch 'searchstrat_audit_log' of github.com:yctercero/kibana i…

ad4db59

…nto searchstrat_audit_log

updating test

b61e2cd

kibanamachine and others added 3 commits November 3, 2021 11:18

Merge branch 'main' into searchstrat_audit_log

e47df03

missed one change on test

3980a99

Merge branch 'searchstrat_audit_log' of github.com:yctercero/kibana i…

e22fc9b

…nto searchstrat_audit_log

yctercero merged commit c2d7f33 into elastic:main Nov 3, 2021

kibanamachine added the v8.1.0 label Nov 3, 2021

kibanamachine mentioned this pull request Nov 3, 2021

[8.0] [RAC][Timeline] - Add audit log to RBAC wrapped search strategy (#112040) #117427

Merged

yctercero mentioned this pull request Nov 3, 2021

[7.16] [RAC][Timeline] - Add audit log to RBAC wrapped search strategy (#112040) #117435

Merged

yctercero deleted the searchstrat_audit_log branch August 4, 2022 18:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[RAC][Timeline] - Add audit log to RBAC wrapped search strategy #112040

[RAC][Timeline] - Add audit log to RBAC wrapped search strategy #112040

yctercero commented Sep 14, 2021 •

edited

Loading

yctercero commented Sep 28, 2021

kibanamachine commented Sep 28, 2021

elasticmachine commented Oct 20, 2021

yctercero Oct 20, 2021

jportner left a comment

weltenwort commented Oct 21, 2021

yctercero commented Oct 28, 2021 •

edited

Loading

yctercero commented Oct 28, 2021

kibanamachine commented Oct 28, 2021

yctercero commented Oct 29, 2021

yctercero commented Oct 29, 2021

yctercero commented Nov 1, 2021

yctercero commented Nov 3, 2021

kibanamachine commented Nov 3, 2021

API count

kibanamachine commented Nov 3, 2021

kibanamachine commented Nov 3, 2021

[RAC][Timeline] - Add audit log to RBAC wrapped search strategy #112040

[RAC][Timeline] - Add audit log to RBAC wrapped search strategy #112040

Conversation

yctercero commented Sep 14, 2021 • edited Loading

Summary

To Do

Checklist

yctercero commented Sep 28, 2021

kibanamachine commented Sep 28, 2021

⏳ Build in-progress, with failures

History

elasticmachine commented Oct 20, 2021

yctercero Oct 20, 2021

Choose a reason for hiding this comment

jportner left a comment

Choose a reason for hiding this comment

weltenwort commented Oct 21, 2021

yctercero commented Oct 28, 2021 • edited Loading

yctercero commented Oct 28, 2021

kibanamachine commented Oct 28, 2021

yctercero commented Oct 29, 2021

yctercero commented Oct 29, 2021

yctercero commented Nov 1, 2021

yctercero commented Nov 3, 2021

kibanamachine commented Nov 3, 2021

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

API count

History

kibanamachine commented Nov 3, 2021

kibanamachine commented Nov 3, 2021

💔 Backport failed

yctercero commented Sep 14, 2021 •

edited

Loading

yctercero commented Oct 28, 2021 •

edited

Loading