[Alerting] Exempt Alerts pre 7.10 from RBAC on their Action execution until updated #75563

gmmorris · 2020-08-20T14:44:02Z

Summary

Mark all Alerts with a versionApiKeyLastmodified field that tracks what version the alert's Api Key was last updated in. We then use this field to exempt legacy alerts (created pre 7.10.0) in order to use a dialed down version of RBAC which should allow old alerts to continue to function after the upgrade, until they are updates (at which point they will no longer be Legacy).

More details here: #74858 (comment)

Checklist

Delete any items that are not applicable to this PR.

Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios

For maintainers

This was checked for breaking API changes and was labeled appropriately

This reverts commit 04054fb.

* master: (340 commits) [data.search.SearchSource] Remove legacy ES client APIs. (elastic#75943) [release notes] automatically retry on Github API 5xx errors (elastic#76447) [es_ui_shared] Fix eslint exhaustive deps rule (elastic#76392) [i18n] Integrate 7.9.1 Translations (elastic#76391) [APM] Update aggregations to support script sources (elastic#76429) [Security Solution] Refactor Network Top Countries to use Search Strategy (elastic#76244) Document security settings available on ESS (elastic#76513) [Ingest Manager] Add input revision to the config send to the agent (elastic#76327) [DOCS] Identifies cloud settings for Monitoring (elastic#76579) [DOCS] Identifies Cloud settings in Dev Tools (elastic#76583) [Ingest Manager] Better default value for fleet long polling timeout (elastic#76393) [data.indexPatterns] Fix broken rollup index pattern creation (elastic#76593) [Ingest Manager] Split Registry errors into Connection & Response (elastic#76558) [Security Solution] add an excess validation instead of the exact match (elastic#76472) Introduce TS incremental builds & move src/test_utils to TS project (elastic#76082) fix bad merge (elastic#76629) [Newsfeed] Ensure the version format when calling the API (elastic#76381) remove server_extensions mixin (elastic#76606) Remove legacy applications and legacy mode (elastic#75987) [Discover] Fix sidebar element focus behavior when adding / removing columns (elastic#75749) ...

* master: (47 commits) Do not require id & description when creating a logstash pipeline (elastic#76616) Remove commented src/core/tsconfig file (elastic#76792) Replaced whitelistedHosts with allowedHosts in actions ascii docs (elastic#76731) [Dashboard First] Genericize Attribute Service (elastic#76057) [ci-metrics] unify distributable file count metrics (elastic#76448) [Security Solution][Detections] Handle conflicts on alert status update (elastic#75492) [eslint] convert to @typescript-eslint/no-unused-expressions (elastic#76471) [DOCS] Add default time range filter to advanced settings (elastic#76414) [Security Solution] Refactor NetworkTopNFlow to use Search Strategy (elastic#76249) [Dashboard] Update Index Patterns when Child Index Patterns Change (elastic#76356) [ML] Add option to Advanced Settings to set default time range filter for AD jobs (elastic#76347) Add CSM app to CODEOWNERS (elastic#76793) [Security Solution][Exceptions] - Updates exception item find sort field (elastic#76685) [Security Solution][Detections][Tech Debt] - Move to using common io-ts types (elastic#75009) [Lens] Drag dimension to replace (elastic#75895) URI encode the index names we fetch in the fetchIndices lib function. (elastic#76584) [Security Solution] Resolver retrieve entity id of documents without field mapped (elastic#76562) [Ingest Manager] validate agent route using AJV instead kbn-config-schema (elastic#76546) Updated non-dev usages of node-forge (elastic#76699) [Ingest Pipelines] Processor forms for processors K-S (elastic#75638) ...

* master: [APM] Use observer.hostname instead of observer.name (elastic#76074) Legacy logging: fix remoteAddress being duplicated in userAgent field (elastic#76751) Remove legacy deprecation adapter (elastic#76753) [Security Solution][Detections] Rule forms cleanup (elastic#76138) Adds back in custom images for reporting + tests (elastic#76810) [APM] Fix overlapping transaction names (elastic#76083) [Ingest Pipelines] Add descriptions for ingest processors A-D (elastic#75975)

elasticmachine · 2020-09-07T12:41:33Z

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

gmmorris · 2020-09-07T13:09:35Z

x-pack/plugins/actions/server/actions_client.ts

+    if (!(await shouldLegacyRbacApplyBySource(this.unsecuredSavedObjectsClient, source))) {
+      await this.authorization.ensureAuthorized('execute');
+    }


I was hoping to keep this kind of check limited to the Authorization class itself, but as this authorization will have been initialized prior to us knowing what the source is, that isn't really possible without adding the source as an argument to the ensureAuthorized method, which actually felt like a worse solution as most operations won't have that.
Considering we'll be able to remove this all together in 8.0.0 I think it's best to keep this check here as is.

gmmorris · 2020-09-07T13:10:49Z

x-pack/plugins/actions/server/authorization/actions_authorization.ts

-        this.auditLogger.actionsAuthorizationSuccess(username, operation, actionTypeId);
+      if (this.isOperationExemptDueToLegacyRbac(operation)) {
+        this.auditLogger.actionsAuthorizationSuccess(
+          this.authentication?.getCurrentUser(this.request)?.username ?? '',
+          operation,
+          actionTypeId
+        );


Even if we skip the auth check - we should log this to the audit log!

gmmorris · 2020-09-07T13:12:07Z

x-pack/plugins/actions/server/create_execute_function.ts

  spaceId: string;
  apiKey: string | null;
 }

 export type ExecutionEnqueuer = (
-  savedObjectsClient: SavedObjectsClientContract,
+  unsecuredSavedObjectsClient: SavedObjectsClientContract,


This was unsecured before, but it wasn't named as such. As we've marked the other ones in this way, it felt like we should do that here too.

gmmorris · 2020-09-07T13:20:55Z

x-pack/plugins/alerts/server/saved_objects/migrations.ts

-    '7.10.0': (doc: SavedObjectUnsanitizedDoc<RawAlert>, context: SavedObjectMigrationContext) => {
-      if (doc.attributes.consumer === 'alerting') {
-        return executeMigration(doc, context, alertsMigration);
-      } else if (doc.attributes.consumer === 'metrics') {
-        return executeMigration(doc, context, infrastructureMigration);
-      }
-      return doc;
-    },


As we now migrate every single Saved Object as part of this upgrade, it felt cleaner to flatten this out.

gmmorris · 2020-09-07T13:22:48Z

x-pack/plugins/alerts/server/types.ts

@@ -122,7 +126,7 @@ export interface RawAlert extends SavedObjectAttributes {
  schedule: SavedObjectAttributes;
  actions: RawAlertAction[];
  params: SavedObjectAttributes;
-  scheduledTaskId?: string;
+  scheduledTaskId?: string | null;


Seems we were setting this as Null in some places, but the type system got confused and didn't notice it.
Adding the updateMeta call revealed the mistake and forced this addition.

mikecote · 2020-09-08T19:44:34Z

I did a quick view at the core changes and it seems to be heading in the right direction 👍

mikecote

Changes LGTM once the alerts client changes are applied.

I am also curious on the performance impact this will have when migrating > 2000 alerts (ex: SIEM rules).

x-pack/plugins/actions/README.md

x-pack/plugins/alerts/server/alerts_client.ts

x-pack/plugins/alerts/server/saved_objects/migrations.ts

* master: (68 commits) a11y tests on spaces home page including feature control (elastic#76515) [ML] Transforms list: persist pagination through refresh interval (elastic#76786) [ML] Replace all use of date_histogram interval with fixed_interval (elastic#76876) [Timelion] Update timelion deprecation links (elastic#77008) [Security Solution] Refactor Network Details to use Search Strategy (elastic#76928) Upgrade elastic charts to 21.1.2 (elastic#76939) [Alerting][Connectors] Refactor Jira: Generic Implementation (phase one) (elastic#73778) [Snapshot & Restore] fix pre existing policy with no existing repository (elastic#76861) Update saved object management UI text (elastic#76826) [Form lib] Add validations prop to UseArray and expose "moveItem" handler (elastic#76949) [Logs UI] Use fields api in log stream (elastic#76919) [UI Metrics] Support multi-colon keys (elastic#76913) [APM] Script for creating functional test archive (elastic#76926) [ENDPOINT] First version of the trusted apps list. (elastic#76304) Correct field for rum page url (elastic#76916) [Security Solution] Fix redirect properly old SIEM App routes (elastic#76868) Bump http-proxy from 1.17.0 to 1.18.1 (elastic#76924) [RUM Dashboard] Visitor breakdown usability (elastic#76834) [Search] Add a new advanced setting searchTimeout (elastic#75728) [DOCS] Adds timelion deprecation to new visualize docs structure (elastic#76959) ...

gmmorris · 2020-09-10T07:48:43Z

@elasticmachine merge upstream

* master: (25 commits) [bugfix] Replace panel flyout opens 2 flyouts (elastic#76931) clean up test (elastic#76887) [Enterprise Search] Update shared API request handler (elastic#77112) [Maps] convert ESAggSource to TS (elastic#76999) Add plugin status API - take 2 (elastic#76732) Adds lens as a readable saved object for read-only dashboard users (elastic#77067) Skip checking for the reserved realm (elastic#76687) Reporting/diagnostics (elastic#74314) Reporting/Test: unskip non-screenshot tests (elastic#77088) Move metrics to setup and add cgroup metrics (elastic#76730) [Enterprise Search] Add Overview landing page/plugin (elastic#76734) First pass. Change TS type. Update OpenAPI (elastic#76434) [CI] Balance xpack ci groups a bit (elastic#77068) [Security_solution][Detections] Refactor signal ancestry to allow multiple parents (elastic#76531) [Maps] convert MetricsEditor to TS (elastic#76727) IndexMigrator: fix non blocking migration wrapper promise rejection (elastic#77018) [Enterprise Search] Update config data endpoint to v2 (elastic#76970) [ML] Add decision path charts to exploration results table (elastic#73561) Bump eventemitter3 from 4.0.0 to 4.0.7 (elastic#77016) [Ingest Pipelines] Add descriptions for ingest processors K-S (elastic#76981) ...

gmmorris · 2020-09-14T08:31:39Z

@elasticmachine merge upstream

* master: (26 commits) updating datatable type (elastic#77320) [ML] Fix custom URLs processing for security app (elastic#76957) [telemetry] add schema guideline + schema_check new check for --path config (elastic#75747) [ML] Transforms: API schemas and integration tests (elastic#75164) [Mappings editor] Add support for wildcard field type (elastic#76574) [Ingest Manager] Fix flyout instruction selection (elastic#77071) [Telemetry Tools] update lodash to 4.17 (elastic#77317) [APM] Service inventory redesign (elastic#76744) Hide management sections based on cluster/index privileges (elastic#67791) [Snapshot Restore] Disable steps when form is invalid (elastic#76540) [Mappings editor] Add support for positive_score_impact to rank_feature (elastic#76824) Update apm.ts (elastic#77310) [OBS] Remove beta badge, change news feed size and add external icon to news feed link (elastic#77164) [Discover] Convert legacy sort to be compatible with multi sort (elastic#76986) [APM] API Snapshot Testing (elastic#77229) [ML] Functional tests - increase wait time for DFA start (elastic#77307) [UiActions][Drilldowns] Fix actions sorting in context menu (elastic#77162) [Drilldowns] Wire up new links to new docs (elastic#77154) Fix APM issue template [Ingest Pipelines] Drop into an empty tree (elastic#76885) ...

YulNaumenko

LGTM

* master: (25 commits) [Security Solution] Add unit tests for Network search strategy (elastic#77416) [Alerting] Improves performance of the authorization filter in AlertsClient.find by skipping KQL parsing (elastic#77040) [Ingest Manager] Add route for package installation by upload (elastic#77044) [APM-UI][E2E] filter PRs from the uptime GH team (elastic#77359) [APM] Remove useLocation and some minor route improvements (elastic#76343) [Enterprise Search] Update enterpriseSearchRequestHandler to manage range of errors + add handleAPIErrors helper (elastic#77258) [SECURITY_SOLUTION] Task/hostname policy response ux updates (elastic#76444) Move remaining uses of serviceName away from urlParams (elastic#77248) [Lens] Move configuration popover to flyout (elastic#76046) [Ingest Manager] Manually build Fleet kuery with Node arguments (elastic#76589) skip flaky suite (elastic#59975) Neutral-naming in reporting plugin (elastic#77371) [Enterprise Search] Add UserIcon styles (elastic#77385) [RUM Dashboard] Added loading state to visitor breakdown pie charts (elastic#77201) [Ingest Manager] Fix polling for new agent action (elastic#77339) Remote cluster - Functional UI test to change the superuser to a test_user with limited role (elastic#77212) Stacked headers and navigational search (elastic#72331) [ML] DF Analytics creation wizard: Fixing field loading race condition (elastic#77326) [Monitoring] Handle no mappings found for sort and collapse fields (elastic#77099) Add Lens to Recently Accessed (elastic#77249) ...

pmuellr

LGTM, made some comments, none seem critical

pmuellr · 2020-09-08T17:37:45Z

x-pack/plugins/alerts/server/alerts_client.ts

@@ -160,7 +162,8 @@ export class AlertsClient {
  private readonly getActionsClient: () => Promise<ActionsClient>;
  private readonly actionsAuthorization: ActionsAuthorization;
  private readonly getEventLogClient: () => Promise<IEventLogClient>;
-  encryptedSavedObjectsClient: EncryptedSavedObjectsClient;
+  private readonly encryptedSavedObjectsClient: EncryptedSavedObjectsClient;
+  private readonly kibanaVersion!: PluginInitializerContext['env']['packageInfo']['version'];


I'm curious if this returns, in a dev launch, 8.0.0 or the relevant 7.x version. And if that matters. Presumably it's correct for the official packaged versions of Kibana, wondering if this could affect devs somehow.

Yeah, on trunk it's 8.0.0 which threw me the first time I saw it.
For now it shouldn't cause any issues but it might come up in the future 🤷

pmuellr · 2020-09-09T12:26:50Z

x-pack/plugins/actions/server/actions_client.ts

@@ -298,13 +299,19 @@ export class ActionsClient {
  public async execute({
    actionId,
    params,
+    source,


nice! Looking forward to plumbing this through to the event log, we'll finally be able to track and action execution to an alert, which we can't do today.

pmuellr · 2020-09-15T17:33:06Z

x-pack/plugins/actions/README.md

@@ -324,6 +328,10 @@ const result = await actionsClient.execute({
    subject: 'My email subject',
    body: 'My email body',
  },
+  source: asSavedObjectExecutionSource({
+    id: '573891ae-8c48-49cb-a197-0cd5ec34a88b',


The spaceId is not in here - presumably not needed today since alerts are space-specific and we will have the space via some other context. I don't think we need to pass it along here, but not completely sure. I think once we start using this value in the event log, we'll definitely need the spaceId, but again I think we can get that from some other context.

Yeah, that's a fair point... the reference object doesn't support spaceId at the moment so we wouldn't be able to use it even if we add it in.
Once SOs can reference SOs in other spaces, that'll make sense here too.

x-pack/plugins/actions/server/authorization/actions_authorization.ts

pmuellr · 2020-09-15T17:59:28Z

x-pack/plugins/actions/server/lib/action_executor.ts

  encryptedSavedObjectsClient: EncryptedSavedObjectsClient;
  actionTypeRegistry: ActionTypeRegistryContract;
  eventLogger: IEventLogger;
  preconfiguredActions: PreConfiguredAction[];
  proxySettings?: ProxySettings;
 }

-export interface ExecuteOptions {
+export interface ExecuteOptions<Source = unknown> {


slightly curious if we have cases where the source isn't provided - seems like we shouldn't - execution via an alert (saved object reference) or http request - but that's just today anyway. Maybe no source make sense in other future action usages ...

It shouldn't but as we've added it exiting executions (that might exist at upgrade time) won't have it and I wanted to make sure we don't cause breakages on upgrade by assuming it must exist.

pmuellr · 2020-09-15T18:27:36Z

x-pack/plugins/actions/server/plugin.ts

@@ -298,8 +315,13 @@ export class ActionsPlugin implements Plugin<Promise<PluginSetupContract>, Plugi
      });
    };

+    // Ensure the public API cannot be used to circumvent authorization
+    // using our legacy exemption mechanism
+    const secureGetActionsClientWithRequest = (request: KibanaRequest) =>


Not clear what value this function provides, other than the more explicit name. There are only two usages of it, both look like they could be replaced with getActionsClientWithRequest. Maybe it's a left-over, previously it did a few more things?

It's preventing external executions from associating their ActionsClient with a legacy source to circumvent RBAC... but that might not be clear enough 🤔

One of the drawbacks of the current design of the ActionsClient is that when you perform an operation like get you don't really have a way of asking what the context of the operation is (as in, you're getting an Action from the context of a Legacy Alert), so we instantiate the whole client in this dialed down RBAC mode.
We don't want users to be able to do this, only the plugin itself... so we don't expose the a version of getActionsClientWithRequest which can also set the context......

I'll try to rename things to make this clearer, as it clearly isn't clear enough 😬

pmuellr · 2020-09-15T18:52:52Z

x-pack/plugins/alerts/server/saved_objects/mappings.json

+      "meta": {
+        "properties": {
+          "versionApiKeyLastmodified": {
+            "type": "keyword"


do we want enabled: false on here? IOW, does this field need to be searchable? Might be useful, but also contributing to the saved object indexed field bloat

That's a good question.. 🤔
I feel this will be useful in the future, the question is - is there a reason we can't enable it later?

x-pack/test/alerting_api_integration/common/fixtures/plugins/alerts/server/routes.ts

x-pack/plugins/actions/server/authorization/should_legacy_rbac_apply_by_source.test.ts

dhurley14

Tested out with two scenarios. One where a user with the superuser role created a rule (alert) + action in 7.9. Checked out this PR and kibana migrated that rule and the action kicked off 👍.

The other scenario was with a user who had the minimum Security Solution Detections permissions. Created a rule (alert) + action in 7.9 branch. Checked out this PR and kibana successfully migrated that as well. Only caveat was it took around 10 minutes of waiting until task manager picked up the rule (which was set to run at an interval of every 30 seconds) upon which the action began firing.

These changes are definitely getting the job done as far as my testing is concerned. Thank you for these changes!!! LGTM!

Co-authored-by: Patrick Mueller <pmuellr@gmail.com>

gmmorris · 2020-09-16T09:19:46Z

Only caveat was it took around 10 minutes of waiting until task manager picked up the rule (which was set to run at an interval of every 30 seconds) upon which the action began firing.

That means the rule tried to run a failed, going into retry mode, which currently ignores the scheduling (this should be addressed by this issue: #46001). I'm not sure why it failed, but this does sometimes happen as part of an upgrade. Task manager recovers after the retry interval (5 minutes for every attempt) passes.

kibanamachine · 2020-09-16T09:54:30Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: b486243

Build metrics

distributable file count

id	value	diff	baseline
default	45549	+2	45547

Saved Objects .kibana field count

id	value	diff	baseline
alert	24	+2	22

History

💚 Build #74526 succeeded b32e62e
💚 Build #74376 succeeded 696a7cb
💚 Build #74245 succeeded 332d14a
💔 Build #74174 failed a0fa54e
💚 Build #74036 succeeded e0a6050

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

… until updated (elastic#75563) Marks all Alerts with a `versionApiKeyLastmodified ` field that tracks what version the alert's Api Key was last updated in. We then use this field to exempt legacy alerts (created pre `7.10.0`) in order to use a _dialed down_ version of RBAC which should allow old alerts to continue to function after the upgrade, until they are updates (at which point they will no longer be **Legacy**). More details here: elastic#74858 (comment)

…xecution until updated (#75563)" This reverts commit efe7612.

* master: (55 commits) [Grok] Fix missing error message in error toasts (elastic#77499) [Alerting] Exempt Alerts pre 7.10 from RBAC on their Action execution until updated (elastic#75563) [ML] fix type in apply_influencer_filters_action (elastic#77495) [Lens] create reusable component for filters and range aggregation (elastic#77453) fix eslint violations Collapse alert chart previews by default (elastic#77479) [ML] Fixing field caps wrapper endpoint (elastic#77546) showing service maps when filte by environment not defined (elastic#77483) [Lens] Settings panel redesign and separate settings per y axis (elastic#76373) log request body in new ES client (elastic#77150) use `navigateToUrl` to navigate to recent nav links (elastic#77446) Move core config service to `kbn/config` package (elastic#76874) [UBI] Copy license to /licenses folder (elastic#77563) Skip flaky Events Viewer Cypress test [Lens] Remove dynamic names in telemetry fields (elastic#76988) [Maps] Add DynamicStyleProperty#getMbPropertyName and DynamicStyleProperty#getMbPropertyValue (elastic#77366) [Enterprise Search] Add flag to restrict width of layout (elastic#77539) [Security Solutions][Cases - Timeline] Fix bug when adding a timeline to a case (elastic#76967) [Security Solution][Detections] Integration test for Editing a Rule (elastic#77090) [Ingest pipelines] Polish pipeline debugging workflow (elastic#76058) ...

* master: (54 commits) [Grok] Fix missing error message in error toasts (elastic#77499) [Alerting] Exempt Alerts pre 7.10 from RBAC on their Action execution until updated (elastic#75563) [ML] fix type in apply_influencer_filters_action (elastic#77495) [Lens] create reusable component for filters and range aggregation (elastic#77453) fix eslint violations Collapse alert chart previews by default (elastic#77479) [ML] Fixing field caps wrapper endpoint (elastic#77546) showing service maps when filte by environment not defined (elastic#77483) [Lens] Settings panel redesign and separate settings per y axis (elastic#76373) log request body in new ES client (elastic#77150) use `navigateToUrl` to navigate to recent nav links (elastic#77446) Move core config service to `kbn/config` package (elastic#76874) [UBI] Copy license to /licenses folder (elastic#77563) Skip flaky Events Viewer Cypress test [Lens] Remove dynamic names in telemetry fields (elastic#76988) [Maps] Add DynamicStyleProperty#getMbPropertyName and DynamicStyleProperty#getMbPropertyValue (elastic#77366) [Enterprise Search] Add flag to restrict width of layout (elastic#77539) [Security Solutions][Cases - Timeline] Fix bug when adding a timeline to a case (elastic#76967) [Security Solution][Detections] Integration test for Editing a Rule (elastic#77090) [Ingest pipelines] Polish pipeline debugging workflow (elastic#76058) ...

… until updated (#75563) (#77595) Marks all Alerts with a `versionApiKeyLastmodified ` field that tracks what version the alert's Api Key was last updated in. We then use this field to exempt legacy alerts (created pre `7.10.0`) in order to use a _dialed down_ version of RBAC which should allow old alerts to continue to function after the upgrade, until they are updates (at which point they will no longer be **Legacy**). More details here: #74858 (comment)

* master: (76 commits) Fixing service maps API test (elastic#77586) [Grok] Fix missing error message in error toasts (elastic#77499) [Alerting] Exempt Alerts pre 7.10 from RBAC on their Action execution until updated (elastic#75563) [ML] fix type in apply_influencer_filters_action (elastic#77495) [Lens] create reusable component for filters and range aggregation (elastic#77453) fix eslint violations Collapse alert chart previews by default (elastic#77479) [ML] Fixing field caps wrapper endpoint (elastic#77546) showing service maps when filte by environment not defined (elastic#77483) [Lens] Settings panel redesign and separate settings per y axis (elastic#76373) log request body in new ES client (elastic#77150) use `navigateToUrl` to navigate to recent nav links (elastic#77446) Move core config service to `kbn/config` package (elastic#76874) [UBI] Copy license to /licenses folder (elastic#77563) Skip flaky Events Viewer Cypress test [Lens] Remove dynamic names in telemetry fields (elastic#76988) [Maps] Add DynamicStyleProperty#getMbPropertyName and DynamicStyleProperty#getMbPropertyValue (elastic#77366) [Enterprise Search] Add flag to restrict width of layout (elastic#77539) [Security Solutions][Cases - Timeline] Fix bug when adding a timeline to a case (elastic#76967) [Security Solution][Detections] Integration test for Editing a Rule (elastic#77090) ...

gmmorris added 14 commits August 19, 2020 23:31

Revert "removed ESO migration from alerting"

917c17d

This reverts commit 04054fb.

add meta field to Alert and mark pre 7.10 alerts as legacy

e2df4b5

exempt legacy alerts from rbac

5a7ee01

test legacy for superuser and none actions user

6f7f628

test legacy for space_1_all and restricted users

b226e32

added test for global read user

0714965

migrate as legacy

f661e32

simplified migration as we now migrate all alerts pre 7.10

a184efa

cleaned up migration code

5e58006

fixed tests

b0a5c87

added docs and cleaned up code

a58eb4e

gmmorris marked this pull request as ready for review September 7, 2020 12:29

gmmorris requested a review from a team as a code owner September 7, 2020 12:29

gmmorris added Feature:Alerting release_note:fix Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) v7.10.0 v8.0.0 labels Sep 7, 2020

gmmorris added release_note:enhancement and removed release_note:fix labels Sep 7, 2020

gmmorris commented Sep 7, 2020

View reviewed changes

gmmorris added 2 commits September 7, 2020 14:12

corrected name of variable

c8b8815

use constant where possible

2330880

gmmorris commented Sep 7, 2020

View reviewed changes

added docs

5afd31d

mikecote approved these changes Sep 9, 2020

View reviewed changes

gmmorris added 2 commits September 9, 2020 15:41

update meta field only when api key is updated

2a9694f

elasticmachine and others added 2 commits September 14, 2020 02:31

Merge branch 'master' into alerting-exempt-rbac

e0a6050

YulNaumenko approved these changes Sep 14, 2020

View reviewed changes

gmmorris added 3 commits September 14, 2020 18:43

fixed merge issue

332d14a

migrate siem consumer

b32e62e

pmuellr approved these changes Sep 15, 2020

View reviewed changes

dhurley14 approved these changes Sep 16, 2020

View reviewed changes

typo

b486243

Co-authored-by: Patrick Mueller <pmuellr@gmail.com>

gmmorris merged commit efe7612 into elastic:master Sep 16, 2020

gmmorris mentioned this pull request Sep 16, 2020

[7.x] [Alerting] Exempt Alerts pre 7.10 from RBAC on their Action execution until updated (#75563) #77595

Merged

gmmorris added a commit that referenced this pull request Sep 16, 2020

Revert "[Alerting] Exempt Alerts pre 7.10 from RBAC on their Action e…

3b59cf7

…xecution until updated (#75563)" This reverts commit efe7612.

gmmorris mentioned this pull request Sep 16, 2020

[Alerting] renames code in alerting RBAC exemption to make it easier to maintain #77598

Merged

2 tasks

dhurley14 mentioned this pull request Sep 21, 2020

Kibana alerting RBAC - impact on detection rules' actions #74170

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Alerting] Exempt Alerts pre 7.10 from RBAC on their Action execution until updated #75563

[Alerting] Exempt Alerts pre 7.10 from RBAC on their Action execution until updated #75563

gmmorris commented Aug 20, 2020 •

edited

Loading

elasticmachine commented Sep 7, 2020

gmmorris Sep 7, 2020

gmmorris Sep 7, 2020

gmmorris Sep 7, 2020

gmmorris Sep 7, 2020

gmmorris Sep 7, 2020

mikecote commented Sep 8, 2020

mikecote left a comment

gmmorris commented Sep 10, 2020

gmmorris commented Sep 14, 2020

YulNaumenko left a comment

pmuellr left a comment

pmuellr Sep 8, 2020

gmmorris Sep 16, 2020

pmuellr Sep 9, 2020

pmuellr Sep 15, 2020

gmmorris Sep 16, 2020

pmuellr Sep 15, 2020

gmmorris Sep 16, 2020

pmuellr Sep 15, 2020

gmmorris Sep 16, 2020

pmuellr Sep 15, 2020

gmmorris Sep 16, 2020

dhurley14 left a comment •

edited

Loading

gmmorris commented Sep 16, 2020

kibanamachine commented Sep 16, 2020

[Alerting] Exempt Alerts pre 7.10 from RBAC on their Action execution until updated #75563

[Alerting] Exempt Alerts pre 7.10 from RBAC on their Action execution until updated #75563

Conversation

gmmorris commented Aug 20, 2020 • edited Loading

Summary

Checklist

For maintainers

elasticmachine commented Sep 7, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mikecote commented Sep 8, 2020

mikecote left a comment

Choose a reason for hiding this comment

gmmorris commented Sep 10, 2020

gmmorris commented Sep 14, 2020

YulNaumenko left a comment

Choose a reason for hiding this comment

pmuellr left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dhurley14 left a comment • edited Loading

Choose a reason for hiding this comment

gmmorris commented Sep 16, 2020

kibanamachine commented Sep 16, 2020

💚 Build Succeeded

Build metrics

distributable file count

Saved Objects .kibana field count

History

gmmorris commented Aug 20, 2020 •

edited

Loading

dhurley14 left a comment •

edited

Loading