[Security Solutions] Add PLI authorisation for Threat Intelligence #162562

machadoum · 2023-07-26T13:51:42Z

Summary

Add PLI authorization checks for the Intelligence page.
This PR restricts access to the features and creates a simplified Upselling page.

Rename threat_intelligence-indicators page name to threat_intelligence to simplify the code

Not included

Final Upselling/PLG design

How to test it?

ESS `yarn start`

Run ESS with a basic license
- It should not change
Run ESS with a platinum
- It should not change

Serverless `yarn serverless-security`

Run Serverless with security essentials (serverless.security.yml)
- It should show the new Threat Intelligence Upsell

xpack.serverless.security.productTypes:
  [
    { product_line: 'security', product_tier: 'essentials' }
  ]

Run Serverless with security complete (kibana/config/serverless.security.yml)
- It should show the Therat Intelligence page

xpack.serverless.security.productTypes:
  [
    { product_line: 'security', product_tier: 'complete' },
  ]

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios

machadoum · 2023-07-27T07:46:34Z

x-pack/plugins/security_solution/public/threat_intelligence/routes.tsx

@@ -85,10 +85,10 @@ const ThreatIntelligence = memo(() => {
  };

  return (
-    <TrackApplicationView viewId="threat_intelligence">
+    <SecurityRoutePageWrapper pageName={SecurityPageName.threatIntelligence}>


SecurityRoutePageWrapper is necessary for displaying the Upsell page.

elasticmachine · 2023-07-27T08:01:32Z

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

elasticmachine · 2023-07-27T08:01:33Z

Pinging @elastic/security-solution (Team: SecuritySolution)

angorayc · 2023-07-27T09:44:57Z

Thank you Pablo, tested locally, LGTM!

PhilippeOberti

tested LGTM, though I've got a couple of questions related to code consistency between ESS and Serverless

PhilippeOberti · 2023-07-27T13:03:48Z

.../plugins/security_solution_serverless/public/upselling/pages/threat_intelligence_paywall.tsx

I'm not aware of how we're going to handle things for ESS and Serverless, but I'm wondering why do we duplicate this component here? We already have a paywal component in the Threat Intelligence plugin. Shouldn't we make that one smarter and handle both ESS and Serverless?
With the current approach, we basically make the paywall component within the Threat Intelligence plugin useless when loaded in serverless mode... but the component is still there.
It seems confusing to me that we'd have similar things in different places

The approaches to authorization for ESS and Serverless are fundamentally different. ESS has several "if platinum" checks throughout the app, whereas Serverless has a centralized, privilege-based system. We can utilize the security_solutions_serverless plugin to register Upselling pages or components and retrieve them with hooks when the page is unauthorized.

While it's possible to repurpose the paywal component (if it's accessible on the serverless plugin) and make it more intelligent, the UX team is still working on the final design for serverless Upselling. It's conceivable that there will be a generic Upselling component for all features, so I don't believe it's necessary to refactor the paywal component at this time. But we need to revisit this decision after the designs are ready.

I understand, thanks for explaining!

I think ultimately we should aim at having a similar way to manage these paywall between ESS and Servesless, but I guess this is a discussion for another time :D

I am currently implementing your suggestion at the following PR: #163406.

.../plugins/security_solution_serverless/public/upselling/pages/threat_intelligence_paywall.tsx

…intell-pli

machadoum · 2023-07-31T09:18:26Z

@elasticmachine merge upstream

kibana-ci · 2023-08-01T11:59:21Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 5c5d6bd

Failed CI Steps

Test Failures

[job] [logs] Investigations - Security Solution Cypress Tests #1 / Alert details expandable flyout right panel overview tab insights section should display threat intelligence section should display threat intelligence section
[job] [logs] Threat Intelligence Cypress Tests #1 / Empty Page should render the empty page with link to docs and integrations, and navigate to integrations page

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolutionServerless`	230	232	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	15.6MB	15.6MB	-32.0B
`securitySolutionServerless`	101.9KB	103.4KB	+1.6KB
total			+1.5KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	57.3KB	57.3KB	+22.0B
`securitySolutionServerless`	23.1KB	23.5KB	+360.0B
`threatIntelligence`	27.3KB	27.3KB	-11.0B
total			+371.0B

Unknown metric groups

async chunk count

id	before	after	diff
`securitySolutionServerless`	19	20	+1

ESLint disabled line counts

id	before	after	diff
`securitySolutionServerless`	19	20	+1

Total ESLint disabled count

id	before	after	diff
`securitySolutionServerless`	19	20	+1

History

💔 Build #146290 failed a14bb09
💔 Build #145864 failed f38b681
💔 Build #145824 failed dba6942
💔 Build #145519 failed 9de2a6f
💛 Build #144983 was flaky 13d9cf2

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @machadoum

…lastic#162562) ## Summary Add PLI authorization checks for the Intelligence page. *This PR restricts access to the features* and creates a simplified Upselling page. * Rename `threat_intelligence-indicators` page name to `threat_intelligence` to simplify the code ### Not included * Final Upselling/PLG design ### How to test it? #### ESS `yarn start` * Run ESS with a basic license * It should not change * Run ESS with a platinum * It should not change #### Serverless `yarn serverless-security` * Run Serverless with security essentials (serverless.security.yml) * It should show the new Threat Intelligence Upsell ``` xpack.serverless.security.productTypes: [ { product_line: 'security', product_tier: 'essentials' } ] ``` * Run Serverless with security complete (kibana/config/serverless.security.yml) * It should show the Therat Intelligence page ``` xpack.serverless.security.productTypes: [ { product_line: 'security', product_tier: 'complete' }, ] ``` <img width="1785" alt="Screenshot 2023-07-26 at 15 59 52" src="https://github.com/elastic/kibana/assets/1490444/e8fb1bb4-ec26-477d-80e0-aecd4c15e7a2"> ### Checklist Delete any items that are not applicable to this PR. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

machadoum force-pushed the siem-explore-threat-intell-pli branch from 9f3b3cf to fe410d5 Compare July 26, 2023 14:22

machadoum self-assigned this Jul 26, 2023

Add PLI authorisation for Threat Intelligence

13d9cf2

machadoum force-pushed the siem-explore-threat-intell-pli branch from fe410d5 to 13d9cf2 Compare July 26, 2023 15:02

machadoum commented Jul 27, 2023

View reviewed changes

machadoum marked this pull request as ready for review July 27, 2023 08:01

machadoum requested review from a team as code owners July 27, 2023 08:01

machadoum added the release_note:skip Skip the PR/issue when compiling release notes label Jul 27, 2023

angorayc approved these changes Jul 27, 2023

View reviewed changes

PhilippeOberti reviewed Jul 27, 2023

View reviewed changes

machadoum added 2 commits July 28, 2023 13:53

Merge remote-tracking branch 'elastic/main' into siem-explore-threat-…

1dd8ef6

…intell-pli

Fix ThreatIntelligencePaywall UI

9de2a6f

PhilippeOberti approved these changes Jul 28, 2023

View reviewed changes

machadoum enabled auto-merge (squash) July 28, 2023 13:26

Merge branch 'main' into siem-explore-threat-intell-pli

dba6942

kibanamachine and others added 3 commits July 31, 2023 05:18

Merge branch 'main' into siem-explore-threat-intell-pli

f38b681

Merge branch 'main' into siem-explore-threat-intell-pli

a14bb09

Merge branch 'main' into siem-explore-threat-intell-pli

5c5d6bd

machadoum merged commit b95241f into elastic:main Aug 1, 2023

kibanamachine added the backport:skip This commit does not require backporting label Aug 1, 2023

semd mentioned this pull request Jul 22, 2024

[Security Solution] [Attack discovery] Attack Discovery RBAC / Display an upgrade CTA for the serverless essentials product tier #188788

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solutions] Add PLI authorisation for Threat Intelligence #162562

[Security Solutions] Add PLI authorisation for Threat Intelligence #162562

machadoum commented Jul 26, 2023 •

edited

Loading

machadoum Jul 27, 2023

elasticmachine commented Jul 27, 2023

elasticmachine commented Jul 27, 2023

angorayc commented Jul 27, 2023

PhilippeOberti left a comment

PhilippeOberti Jul 27, 2023

machadoum Jul 28, 2023

PhilippeOberti Jul 28, 2023

machadoum Aug 16, 2023

machadoum commented Jul 31, 2023

kibana-ci commented Aug 1, 2023

async chunk count

ESLint disabled line counts

Total ESLint disabled count

[Security Solutions] Add PLI authorisation for Threat Intelligence #162562

[Security Solutions] Add PLI authorisation for Threat Intelligence #162562

Conversation

machadoum commented Jul 26, 2023 • edited Loading

Summary

Not included

How to test it?

ESS yarn start

Serverless yarn serverless-security

Checklist

machadoum Jul 27, 2023

Choose a reason for hiding this comment

elasticmachine commented Jul 27, 2023

elasticmachine commented Jul 27, 2023

angorayc commented Jul 27, 2023

PhilippeOberti left a comment

Choose a reason for hiding this comment

PhilippeOberti Jul 27, 2023

Choose a reason for hiding this comment

machadoum Jul 28, 2023

Choose a reason for hiding this comment

PhilippeOberti Jul 28, 2023

Choose a reason for hiding this comment

machadoum Aug 16, 2023

Choose a reason for hiding this comment

machadoum commented Jul 31, 2023

kibana-ci commented Aug 1, 2023

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Async chunks

Page load bundle

async chunk count

ESLint disabled line counts

Total ESLint disabled count

History

machadoum commented Jul 26, 2023 •

edited

Loading

ESS `yarn start`

Serverless `yarn serverless-security`