Commits on Feb 2, 2021

1. Fixes the permissions to require cluster.manage in order to create an… …

   … index and in order to update an index (elastic#89947)
   
   ## Summary
   
   Fixes error toaster on signals upgrades as well as creation of new signals if you have a user without a cluster manage privilege.
   
   Simplest way to manually test both situations of a user on creating a new signal as well as upgrade is to first create a new role like so in dev tools:
   
   ```ts
   PUT _security/role/reduced_permissions
   {
      "indices":[
         {
            "names":[
               ".siem-signals-*",
               ".lists-*",
               ".items-*"
            ],
            "privileges":[
               "all"
            ],
            "field_security":{
               "grant":[
                  "*"
               ]
            },
            "allow_restricted_indices":false
         }
      ],
      "applications":[
         {
            "application":"kibana-.kibana",
            "privileges":[
               "space_all"
            ],
            "resources":[
               "space:default"
            ]
         }
      ]
   }
   ```
   
   You might have to change this line above to match what your `kibana.index` is set to if it is set:
   ```ts
    "application" : "kibana-.kibana-hassanabad8",
   ```
   
   Double check things in Stack Management to ensure you have access to at least default space:
   <img width="1304" alt="Screen Shot 2021-02-01 at 5 45 54 PM" src="https://user-images.githubusercontent.com/1151048/106536383-906f3f00-64b5-11eb-97d3-060fa6f6206e.png">
   
   Next add a user which has this role of `reduced_permissions` to login as that user. Next for testing that this causes an error toaster when there is no signals index is to either manually delete your signals index or change your `kibana.dev.yml` so that it thinks you have a new index:
   
   ```ts
   xpack.securitySolution.signalsIndex: .siem-signals-some-new-index-name
   ```
   
   Start up Kibana, login with the new user and visit any page and notice you get an error toaster like below:
   <img width="808" alt="Screen Shot 2021-02-01 at 5 04 17 PM" src="https://user-images.githubusercontent.com/1151048/106535815-4afe4200-64b4-11eb-89b3-947b0e4ff7d5.png">
   
   And also notice that you are blocked from viewing signals at this point:
   <img width="1195" alt="Screen Shot 2021-02-01 at 5 04 43 PM" src="https://user-images.githubusercontent.com/1151048/106535835-56516d80-64b4-11eb-883c-2745b68843cf.png">
   
   For upgrading signals manually, you can change the version number from dev tools or increment the number directly within this file and restart Kibana:
   https://github.com/elastic/kibana/blob/master/x-pack/plugins/security_solution/server/lib/detection_engine/routes/index/get_signals_template.ts#L10
   
   When you visit the detection page you will see the same error toaster and also be blocked. With this PR you will no longer be blocked.
   
   ### Checklist
   
   Delete any items that are not applicable to this PR.
   
   - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

   

   FrankHassanabad committed Feb 2, 2021
   Configuration menu

   • View commit details
   • Copy full SHA for d466765
   • Browse repository at this point

   Copy the full SHA

   d466765 View commit details

   Browse the repository at this point in the history