[pull] main from elastic:main #528
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![pull[bot]](https://avatars.githubusercontent.com/in/12910?s=60&v=4){kind=small}
After #163895 this PR forward ports the typescript-eslint packages to v5.62.0.
…e 1 (#164163) ## Summary Fixes #162618 There was an issue with setting pagination for the EUI table before models are fetched. Providing a page index while the items count is 0 caused pagination to reset with an uninitialized URL state callback. This PR adds a check to verify model list has been retrieved. Also, the Kibana `_stats` endpoint has been updated to provide a `size` parameter.
## Summary Removes a beta label from the "terminal output" feature in the linux settings for the endpoint integration. The beta tag was previously removed from the TTY player itself, but this spot was missed. Also, this PR changes codeowners of session_view, kubernetes_security and cloud_defend plugins to the **kibana-cloud-security-posture** team --------- Co-authored-by: kibanamachine <[email protected]>
…63784) > [!WARNING] > Sorry, I had to recreate the PR #157241 > Please submit your review again. - Closes #155019 Per docs https://www.elastic.co/guide/en/elasticsearch/reference/current/paginate-search-results.html <img width="851" alt="Screenshot 2023-05-10 at 10 25 20" src="https://github.com/elastic/kibana/assets/1415710/b4b9fef4-7dd8-40ed-8244-343889fc4367"> ## Summary 1. This PR improves `search_after` pagination for `date_nanos` time fields. `sort` value will be returned from ES as a string instead of a rounded and incorrect timestamp. This change allows to also simplify logic on Surrounding document page. Before: <img width="400" alt="Screenshot 2023-05-08 at 17 36 19" src="https://github.com/elastic/kibana/assets/1415710/fd9f45c4-5dc2-4103-83b9-8810e3a6e0df"> After: <img width="400" alt="Screenshot 2023-05-08 at 17 37 13" src="https://github.com/elastic/kibana/assets/1415710/fe9090c0-2116-4f77-9a57-a96ae6b00365"> 2. Also in this PR we now allow users to load more documents within the same time range. Once the button is pressed, it will load next portion of documents (same "sampleSize" value will be used). Currently, we limit max total loaded documents to 10000. "Load more" demo:  If refresh interval is on, the button becomes disabled:  Date nanos demo:  100x Flaky test runner https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/2801 --------- Co-authored-by: kibanamachine <[email protected]>
This PR is a simple update of our versions file after the recent bumps.
…nd repo (#164216) Automated by https://buildkite.com/elastic/cloud-defend/builds/2061 Co-authored-by: sec_cloudnative_integrations <[email protected]>
…utside timerange of global time picker (#163887) Closes #163614 PR resolves issue by only adding global time filter to CSV export body when saved search embeddable does not have time range. --------- Co-authored-by: kibanamachine <[email protected]>
… Anomaly explorer (#163625)
…server (#164225) ## Summary Increase the stability of Osquery Cypress by stopping the installation of Osquery on the Fleet server and creating another Agent policy and enrolling another elastic agent instead
## Summary Closes #121051 I'm not seeing flakiness in the test suite after enabling all the tests. Test suite: `test/api_integration/config.js` Test runs: * https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/2904 * https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/2917
## Summary This disables the crawler if Enterprise Search is not available on the new overview page.
… depending on the PLI (#163602) ## Summary Generates empty array when the PLI don't meet the requirement. It end up having empty fleet artifacts for those cannot be generated. It also adds new test cases --------- Co-authored-by: Kibana Machine <[email protected]>
…m `elasticInternalOrigin` (#163796) ## Summary Closes #163678 * Raise the notion of "internal" into `CoreKibanaRequest`. This enables us to share this with lifecycle handlers and control validation of query params * Added new `isInternalRequest` alongside `isSystemRequest` and `isFakeRequest` * Slight simplification to existing internal restriction check * Some other chores and minor fixes ## Test * Start ES with `yarn es serverless` and Kibana with `yarn start --serverless --server.restrictInternalApis=true` * Add the service account token to `kibana.dev.yml`: `elasticsearch.serviceAccountToken: <SAT>` * Send a request to an internal endpoint like: `curl -XPOST -uelastic:changeme http://localhost:5601/<base-path>/api/files/find -H 'kbn-xsrf: foo' -H 'content-type: application/json' -d '{}'` * Should give you a 400 result * message like `{"statusCode":400,"error":"Bad Request","message":"uri [http://localhost:5603/api/files/find] with method [post] exists but is not available with the current configuration"}` * Send the same request, but include the query param: `elasticInternalOrigin=true` * Should give you a 200 result --------- Co-authored-by: kibanamachine <[email protected]>
This PR drafts openAPI specifications for: - [Delete runtime field API](https://www.elastic.co/guide/en/kibana/master/data-views-runtime-field-api-delete.html). - [Update runtime field API](https://www.elastic.co/guide/en/kibana/master/data-views-runtime-field-api-update.html) Relates to #137240
## Summary Closes #164146 Changes the remaining TSVB panel to a by value Lens metric. <img width="1652" alt="Screenshot 2023-08-17 at 6 10 06 PM" src="https://github.com/elastic/kibana/assets/17003240/538b4bfb-5066-4a93-a16c-4d748b29ea7c"> ### How to test Remove the ecommerce dataset and reinstall it
## Summary Fixes #163971 Reduces the impact of the ES promotion issue coming from the ES TSDB downsampling bug to only downsampling tests and not the entire TSDB suite. ### Checklist Delete any items that are not applicable to this PR. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] Any UI touched in this PR is usable by keyboard only (learn more about [keyboard accessibility](https://webaim.org/techniques/keyboard/)) - [ ] Any UI touched in this PR does not create any new axe failures (run axe in browser: [FF](https://addons.mozilla.org/en-US/firefox/addon/axe-devtools/), [Chrome](https://chrome.google.com/webstore/detail/axe-web-accessibility-tes/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US)) - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This renders correctly on smaller devices using a responsive layout. (You can test this [in your browser](https://www.browserstack.com/guide/responsive-testing-on-local-server)) - [ ] This was checked for [cross-browser compatibility](https://www.elastic.co/support/matrix#matrix_browsers) ### Risk Matrix Delete this section if it is not applicable to this PR. Before closing this PR, invite QA, stakeholders, and other developers to identify risks that should be tested prior to the change/feature release. When forming the risk matrix, consider some of the following examples and how they may potentially impact the change: | Risk | Probability | Severity | Mitigation/Notes | |---------------------------|-------------|----------|-------------------------| | Multiple Spaces—unexpected behavior in non-default Kibana Space. | Low | High | Integration tests will verify that all features are still supported in non-default Kibana Space and when user switches between spaces. | | Multiple nodes—Elasticsearch polling might have race conditions when multiple Kibana nodes are polling for the same tasks. | High | Low | Tasks are idempotent, so executing them multiple times will not result in logical error, but will degrade performance. To test for this case we add plenty of unit tests around this logic and document manual testing procedure. | | Code should gracefully handle cases when feature X or plugin Y are disabled. | Medium | High | Unit tests will verify that any feature flag or plugin combination still results in our service operational. | | [See more potential risk examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) | ### For maintainers - [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
Removes `coming` tag from the 8.9.1 release notes.
Removes all clone by reference functionality on the Dashboard. This means that we no longer have any `savedObjectsClient` usage in the browser side.
…e case insensitive (#164200) ## Summary This fixes a bug where Windows and Mac Blocklist file path entries should be passed as case insensitive. This is because Mac and Windows are caseless for most use cases. Bug ticket: #158581 Here is how it will be displayed in the UI: <img width="1728" alt="image" src="https://github.com/elastic/kibana/assets/56395104/a3006397-f49e-4de0-818d-94e2de20dba3"> Here are the breakdown of the artifacts after the fix: Linux: ``` ------------------------------------------------------------------- Policy: Protect Manifest: 1.0.6 | v1 Artifact: endpoint-blocklist-linux-v1 Relative URL: /api/fleet/artifacts/endpoint-blocklist-linux-v1/f33e6890aeced00861c26a08121dd42d2d29ba08abfeb3c065d0447e32e18640 Encoded SHA256: a907835be40af89b8b7aa23a6efc66c01ceaa5a19622edd378139319f3ca5fa0 Decoded SHA256: f33e6890aeced00861c26a08121dd42d2d29ba08abfeb3c065d0447e32e18640 ------------------------------------------------------------------- { "entries": [ { "type": "simple", "entries": [ { "field": "file.path", "operator": "included", "type": "exact_cased_any", "value": [ "/opt/bin/bin.exe" ] } ] } ] } ``` Mac: ``` ------------------------------------------------------------------- Policy: Protect Manifest: 1.0.6 | v1 Artifact: endpoint-blocklist-macos-v1 Relative URL: /api/fleet/artifacts/endpoint-blocklist-macos-v1/b28e7978da4314ebc2c94770e0638fc4b2270f9dc17a11d6d32b8634b1fbec0f Encoded SHA256: 4f3e80d688f5cae4bf6a88b0704e37909f9fa4f47fe8325b7b154cddd46a2db9 Decoded SHA256: b28e7978da4314ebc2c94770e0638fc4b2270f9dc17a11d6d32b8634b1fbec0f ------------------------------------------------------------------- { "entries": [ { "type": "simple", "entries": [ { "field": "file.path", "operator": "included", "type": "exact_caseless_any", "value": [ "/opt/exe.exe" ] } ] } ``` Windows: ``` ------------------------------------------------------------------- Policy: Protect Manifest: 1.0.6 | v1 Artifact: endpoint-blocklist-windows-v1 Relative URL: /api/fleet/artifacts/endpoint-blocklist-windows-v1/2a6fcc67c696ad4e29d91f8b685bff46977198cd34b9a61e8003d55b78dff6ac Encoded SHA256: c6e045fce97651336eeb400f0123541475b940e3aa38ce721f299585683da288 Decoded SHA256: 2a6fcc67c696ad4e29d91f8b685bff46977198cd34b9a61e8003d55b78dff6ac ------------------------------------------------------------------- { "entries": [ { "type": "simple", "entries": [ { "field": "file.path", "operator": "included", "type": "exact_caseless_any", "value": [ "C:\\path\\path.exe" ] } ] } ] } ``` ### Checklist Delete any items that are not applicable to this PR. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: kibanamachine <[email protected]>
## Summary It adds 8.10 into the .backportrc config file Co-authored-by: Tiago Costa <[email protected]>
**Fixes:** #164056 ## Summary This PR fixes [value_lists.cy.ts](https://github.com/elastic/kibana/blob/main/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/value_lists/value_lists.cy.ts) tests flakiness. ## The flakiness reason Value list items are processed in a bulk via bulk creation and `refresh=wait_for` is [used](https://github.com/elastic/kibana/blob/main/x-pack/plugins/lists/server/services/items/create_list_items_bulk.ts#L87). The problem it returns sometimes earlier than data is available. [Bulk API docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-bulk.html#bulk-refresh) say the following > Only the shards that receive the bulk request will be affected by refresh. Imagine a _bulk?refresh=wait_for request with three documents in it that happen to be routed to different shards in an index with five shards. The request will only wait for those three shards to refresh. The other two shards that make up the index do not participate in the _bulk request at all. While (it seems) only one shard is used in tests but it still cause issues (approx. 1 test per 50 fails) so adding explicit index refresh helps to get rid of flakiness. ## Flaky test runner [value_lists.cy.ts (150 runs)](https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/2924) 🟢
Currently some on merge steps fetch labels from the merged pull request by parsing the first line of the commit message. This convention usually works, but it overlaps with the convention of skipping test suites linking to an issue instead of a pull request. Errors are thrown when a step attempts to pull metadata from an unset value. This sets a default value of an empty string if the label metadata is unset and cleans up the log message when an error occurs. Example error: https://buildkite.com/elastic/kibana-on-merge-unsupported-ftrs/builds/5821#018a1d62-fbd2-486d-afe3-9a448449bbf7/257-258
## Summary - remove duplicated buildkite pipeline steps - remove concurrency from parallel that was causing flakiness - cleanup package.json scripts --------- Co-authored-by: Tiago Costa <[email protected]>
Co-authored-by: James Rodewig <[email protected]> Co-authored-by: lcawl <[email protected]>
… bar to rule preview panel (#164650) ## Summary This PR adds `dataViewTitle` to rule preview panel -> define section when data view is available in a rule. This addresses #164529. **How to test** - Create a rule with data view - Generate some alerts, go to alerts page, pick a alert and open expandable flyout - Go to About, open `Rule summary` - Expand `Define` section, the content should match the define section in rule details page for that rule  ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
## Summary On some file systems or volume mounts, `rename` is not supported and throws a `EXDEV` error, which breaks our file rolling. This PR addresses it by defaulting to `copy` + `unlink` if the `rename` calls fails with an `EXDEV` error. Co-authored-by: Kibana Machine <[email protected]>
## Summary The wrong file path was being given for the pipeline, this fixes that. Also, the [serverless release end to end workflow](https://docs.google.com/document/d/15rx2Z-soL20An0nBUcXX0o_HHf1OU_IgrHXgz20NndI/edit) calls out some things that I missed on the first pass. Please refer to the "Kibana Release required testing" table.
…ing new flyout (#164653) ## Summary The alert flyout (expand button in data table) is available in a lot of places in the security app. When creating a new rule, in the rule preview section, there is an alert table where the flyout is present. In this scenario, the rule is not yet set up, sections like the rule summary and hover actions are not applicable in this state. This PR reverts the use of the new expandable flyout in the rule creation page -> rule preview section. This will revert the flyout to the older version and address bugs such as #164397 **How to test** - First generate some alerts - Create a new rule and finish the first section - Click continue to go to the right (rule preview section) - Pick an alert and click expand - The old flyout should appear  
## Summary Related PR: #161365 Related issue: elastic/platform-docs-team#153 This PR drafts documentation for the new data comparison feature under the Data Visualizer in Kibana.
## Summary Fix #164690 `migrationVersion` was removed from es mapping in 8.8: #154246 Replacing it with `typeMigrationVersion` using the same logic as in kibana core: https://github.com/elastic/kibana/blob/ba843882a7bb35aa3062efd6562ed85d5db157f4/packages/core/saved-objects/core-saved-objects-migration-server-internal/src/document_migrator/migrations/transform_migration_version.ts#L17 To verify: - add Kubernetes integration to a new policy - verify that it is added successfully ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
…163628) **Resolves:** [elastic/security-team#6949](elastic/security-team#6949) ## Summary This PR migrates all HTTP Endpoints under the ownership of @elastic/security-detection-rule-management to the [versioned router](https://docs.elastic.dev/kibana-dev-docs/versioning-http-apis#use-the-versioned-router). - Endpoints that are documented and start with `/api` were marked as `access: 'public'`. So in production, if accessed without the version header, they will be automatically resolved to the latest available version. - Endpoints that start with `/internal` are now flagged as `access: 'internal'`, implying a special origin header is needed to access them in a Serverless environment. The version header (`'elastic-api-version': '1'`) should always be provided for these endpoints to work. ### Migrated endpoints: - [x] Prebuilt Rules - [x] Rule Management - [x] Rule Monitoring - [x] Health For further reference, here's the [complete list of Security Solution APIs](https://docs.google.com/spreadsheets/d/1VCoJ74EkyGuj59VwWj_3v2ecB84pNCpzGqkYnS0SUKw/edit?pli=1#gid=0).
…ction and open session view and analyzer in timeline (#164111)
…able. (#164714) ## Summary Elasticsearch [legacy template API](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates-v1.html) isn't available in the Serverless offering (returns 410), but it shouldn't prevent session index initialization. ## How to test 1. Run ES Serverless with `./gradlew :run` 2. Run Kibana with `yarn start --serverless --elasticsearch.serviceAccountToken=AAEAAWVsYXN0aWMva2liYW5hL2tpYmFuYS1kZXY6VVVVVVVVTEstKiBaNA --no-dev-credentials`
Co-authored-by: James Rodewig <[email protected]>
…-> doc_root.package (ECS) (#164651) ## Summary Issue: #157674 This updates all instances of vulnerability.package to the ECS standard package fieldset. The new field has been populated by cloudbeat since 8.8 ### Checklist Delete any items that are not applicable to this PR. - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: kibanamachine <[email protected]>
## Summary Closes #157205 Add an extra attempt to this flky test. bonus: we were rejecting with strings which was giving us this funny error: ``` [Error: the string "action timed out" was thrown, throw an Error :)] ```
This PR bumps the Typescript version used on Kibana into v4.7.4. During the upgrade I got the impression the majority of the failures were too specific to the codebase so instead of making assumptions I choose to marked a lot of them with `@ts-expect-error` and let each team decide how to handle it. Next you can find a list of files with those comments and the teams to who they belong to. I would appreciate the collaboration from each team on fixing those. I'm not opposed on fixing those in subsequent PRs after this one have been merged, just wanted to elaborate that list for a good follow up: @elastic/kibana-core - [x] [packages/core/http/core-http-router-server-internal/src/request.ts](https://github.com/elastic/kibana/pull/162738/files#diff-c1f4a8c013c6ff9c5170803322414cb002f70331b23e45c55f075258c678410a) @elastic/kibana-data-discovery - [x] [src/plugins/discover/public/components/doc_table/components/table_row.tsx](https://github.com/elastic/kibana/pull/162738/files#diff-9106b254a57e73fc6f0b2e01f9aff1abbd26f1a0999e6fa998f1b45d3013038f) @elastic/kibana-visualizations - [x] [src/plugins/expressions/common/execution/execution.ts](https://github.com/elastic/kibana/pull/162738/files#diff-47bf3af7472c08ede90f86575ee7db4b8a2c949b1fb61400410ed16a8d819667) - [x] [src/plugins/expressions/common/expression_functions/expression_function_parameter.ts](https://github.com/elastic/kibana/pull/162738/files#diff-3bcaa3c50f2297ff990c7ac83a1c2d36a79e6706a09082c3c48a911713afe950) - [x] [src/plugins/vis_types/heatmap/public/editor/components/labels_panel.tsx](https://github.com/elastic/kibana/pull/162738/files#diff-345db24d53f4158414480b890fa43d1f8a454b67313de79602fda081279cbc4f) - [x] [src/plugins/vis_types/xy/public/editor/components/options/metrics_axes/label_options.tsx](https://github.com/elastic/kibana/pull/162738/files#diff-1c346b41cf025ff4f4e07b6d6dcdd1451cbaa758f9a9e8c72a9801d3fbbdfda2) @elastic/kibana-presentation - [x] [x-pack/plugins/canvas/public/components/workpad_page/workpad_interactive_page/event_handlers.ts](https://github.com/elastic/kibana/pull/162738/files#diff-56858ed9be77830ab218eab1960337240926609c5a1593b3960b35660ef81359) @elastic/response-ops - [x] [x-pack/plugins/cases/public/components/create/form.test.tsx](https://github.com/elastic/kibana/pull/162738/files#diff-c5c415f1f56ca986f4bb59e65490b5e0fc77a86092240c0c1a26c141dba07818) - [x] [x-pack/plugins/cases/public/components/markdown_editor/editable_markdown_renderer.test.tsx](https://github.com/elastic/kibana/pull/162738/files#diff-ab038916f6fed59e18b0a72ce8e823e88d115afdb2704010d0fa8656b66702df) - [x] [x-pack/plugins/rule_registry/server/alert_data_client/browser_fields/index.ts](https://github.com/elastic/kibana/pull/162738/files#diff-3f91aa93f7e6514c0479a37a76d6e9a53646d4eaf5dcd0db64437eadf1eee6b6) - [x] [x-pack/plugins/triggers_actions_ui/.storybook/decorator.tsx](https://github.com/elastic/kibana/pull/162738/files#diff-fbf1d6d0104c11c3f3690d29edf06000b5a63a858bb22b7d04d1f96a45133b07) - [x] [x-pack/plugins/triggers_actions_ui/common/experimental_features.ts](https://github.com/elastic/kibana/pull/162738/files#diff-8e2ca70700895b17125532779945a1d0ab9076b4d4db304c065b47f82b6628a5) - [x] [x-pack/plugins/triggers_actions_ui/public/common/get_experimental_features.test.tsx](https://github.com/elastic/kibana/pull/162738/files#diff-8e2ca70700895b17125532779945a1d0ab9076b4d4db304c065b47f82b6628a5) @elastic/fleet - [x] [x-pack/plugins/fleet/common/experimental_features.ts](https://github.com/elastic/kibana/pull/162738/files#diff-a852b157b5ff1d6dbf321ea8a25f0020d8f88cd458378cc9de8ef25ce28c9414) - [x] [x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/index.test.tsx](https://github.com/elastic/kibana/pull/162738/files#diff-9eea0be0f9341dd6369720ce7b11bff69dda51230337ebbae921f6abde187bd2) - [x] [x-pack/plugins/fleet/public/applications/fleet/sections/agent_policy/list_page/index.test.tsx](https://github.com/elastic/kibana/pull/162738/files#diff-844d5f9707b739d25f2b73bd34c45c21e2e5d573b3238c13130a0d1c1db092dc) - [x] [x-pack/plugins/fleet/public/applications/fleet/sections/agents/agent_list_page/index.test.tsx](https://github.com/elastic/kibana/pull/162738/files#diff-f88d92abbc549ddc95d693bf3a3bc9752613cf74f1e859a01ca61d572e031b11) - [x] [x-pack/plugins/fleet/server/mocks/index.ts](https://github.com/elastic/kibana/pull/162738/files#diff-d3f3e436b158ac2d877b7be9d57642855f89b0149cc28735811443da45bb079f) @elastic/security-detection-engine - [x] [x-pack/plugins/lists/server/services/extension_points/extension_point_storage_client.ts](https://github.com/elastic/kibana/pull/162738/files#diff-dbbf5a8541e06fd977c66e44d9ef59f738d953bdfda679ac838e098742c92f50) - [x] [x-pack/plugins/lists/server/services/extension_points/types.ts](https://github.com/elastic/kibana/pull/162738/files#diff-31186826bea8fdb286a25878fa06eeacad8f7a6c384d617fed905d4625821eef) @elastic/security-defend-workflows @gergoabraham - [x] [x-pack/plugins/security_solution/public/detection_engine/rule_response_actions/osquery/osquery_response_action.tsx](https://github.com/elastic/kibana/pull/162738/files#diff-049eeedef2a403ade7c636418e17fc9a3ffc7030eec2f3e013f459721c076470) @elastic/infra-monitoring-ui - [x] [x-pack/plugins/monitoring/public/application/pages/apm/overview.tsx](https://github.com/elastic/kibana/pull/162738/files#diff-4ab4fa150247d8f522741ae5ea1ea71c102c72f5439410ea869ec1c9dc9878ad) - [x] [x-pack/plugins/monitoring/public/application/pages/enterprise_search/overview.tsx](https://github.com/elastic/kibana/pull/162738/files#diff-285a67d9ec93651206608d308e5d1d20ccc98ccccb9bcbf3ee31fe35c1844b42) @elastic/kibana-security - [x] [x-pack/plugins/security/server/authentication/authenticator.ts](https://github.com/elastic/kibana/pull/162738/files#diff-bd369002fdfd0986f1ce3bf16263fb8b765e01a86832ccf5b4e521811d502038) - [x] [x-pack/plugins/security/server/session_management/session_index.ts](https://github.com/elastic/kibana/pull/162738/files#diff-10b76eb52a0e17564ad864def8270bb84a4eb87eb35851309bc36601086cbcd7) @elastic/security-threat-hunting-explore @gergoabraham - [x] [x-pack/plugins/security_solution/public/common/mock/endpoint/app_context_render.tsx](https://github.com/elastic/kibana/pull/162738/files#diff-7f130bdc9a954330d188aa25324910cf2f72baf76d1329bd36584f5bb153856b) @elastic/security-solution @gergoabraham - [x] [x-pack/plugins/security_solution/public/management/components/page_overlay/page_overlay.tsx](https://github.com/elastic/kibana/pull/162738/files#diff-e68a2799df17238257a86ce965369c525be901f6f882e518bde9e8c9bd7cd2c8) - [x] [x-pack/plugins/security_solution/public/management/pages/policy/view/policy_settings_form/components/event_collection_card.tsx](https://github.com/elastic/kibana/pull/162738/files#diff-edc756f655792f7dcaca0c707f35c6c022981be1873712f460ccb1d611e42568) - [x] [x-pack/plugins/security_solution/tsconfig.json](https://github.com/elastic/kibana/pull/162738/files#diff-844dde79a96b9e6c2bfdf21f8c80feb8b687577e21326da6bd15c6b95d8ec918) @elastic/uptime - [x] [x-pack/plugins/uptime/server/legacy_uptime/lib/alerts/duration_anomaly.test.ts](https://github.com/elastic/kibana/pull/162738/files#diff-6c7b63ce65aa17a2fe3219e1747ae051be88fb02edbe2f198ad6fd418a2bcc57) @elastic/security-detections-response-alerts @gergoabraham - [x] [x-pack/test/detection_engine_api_integration/security_and_spaces/group8/exception_operators_data_types/keyword_array.ts](https://github.com/elastic/kibana/pull/162738/files#diff-472ba2c7fe43448c8a4d04406703f755f71f6e60146bb2f090b4ca0f19ad0a0f) --------- Co-authored-by: kibanamachine <[email protected]> Co-authored-by: Michael Dokolin <[email protected]> Co-authored-by: Stratoula Kalafateli <[email protected]> Co-authored-by: Rudolf Meijering <[email protected]> Co-authored-by: Devon Thomson <[email protected]>
## Summary Closes #163901 Instead of one sleep lets try 3 times.
The check which decides what is shown on the memory usage page for serverless or stack versions of kibana is the wrong way round. The node list should be shown in non-serverless environments.
## Summary This PR is for changing how Cloud Shell flyout looks when adding agent. Previously it shows tabs for other installation method, now it no longer shows that (similar to what we have we Cloud Formation) We also updated the steps and command to copy. <img width="836" alt="Screenshot 2023-08-22 at 10 28 05 AM" src="https://github.com/elastic/kibana/assets/8703149/f312431a-e0fa-470e-896b-04324a160fdb"> <img width="857" alt="Screenshot 2023-08-22 at 10 29 12 AM" src="https://github.com/elastic/kibana/assets/8703149/51b33fcd-11b9-4691-946c-83cab6fd4f5a"> --------- Co-authored-by: kibanamachine <[email protected]>
…onds" (#164659) This PR solves the issue when a user is formatting fields that are "0" to be Human Friendly, then it shows "a few seconds" instead of "0.00 seconds" This PR changes it to say: "0.00 seconds". I have also updated the test-case for it. Video of the issue - tested on 8.11 snapshot: https://github.com/elastic/kibana/assets/108192783/082329bf-6c62-4eb5-b28e-212a848f6f65 Screenshot of the fix: <img width="1361" alt="Skærmbillede 2023-08-24 kl 10 36 15" src="https://github.com/elastic/kibana/assets/108192783/cc9a4490-e8b3-48a6-952e-61e9cd0aff81"> Fixes #101000 --------- Co-authored-by: kibanamachine <[email protected]> Co-authored-by: Matthias Wilhelm <[email protected]> Co-authored-by: Davis McPhee <[email protected]>
…Deploy Model' action (#163886) ## Summary Adds functional tests for deploy model action for DFA trained models with default config and with custom config. Part of #160712 Flaky test run: https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/2961 (updated) ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: Kibana Machine <[email protected]>
…ing - group1.x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/get_alert_summary·ts (#164759) ## Summary Fix: #156792 https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/2987
## What this PR does
* Adds a new Task Manager task, `risk_engine:risk_scoring`, responsible
for invoking the `calculateAndPersistRiskScores` API defined in the risk
scoring service.
* Unlike an alerting task, we do not encrypt/persist an API key for the
user. Instead, we use the internal kibana user to query all alerts in
the current space.
* The task configuration is stored as part of the existing
`risk-engine-configuration` Saved Object
* Extends the `risk-engine-configuration` SO to include more
configuration fields
* Management of this configuration is not currently exposed to the user.
They can only enable/disable the entire "Risk Engine" on the `Settings
-> Entity Risk Score` page
* The settings currently serve mainly as the "default" values for task
execution, but also as a way for a customer/SA to modify task execution
if necessary.
* We expect to be modifying these default values before release, as part
of our planned "tuning" stage.
### How to Review
* Setup:
* The risk engine acts on Detection engine alerts, and so you will need
to create:
1. some "source" data (logs, filebeat, auditbeat, etc)
2. Rules looking for the above "source" data, and generating alerts
* The risk engine requires two feature flags, currently:
`riskScoringPersistence` and `riskScoringRoutesEnabled`
* You will also need a Platinum or greater license.
1. Test that the task executes correctly
1. With the above data set up, navigate to `Settings -> Entity Risk
Score` page, and enable the task by toggling `Entity risk scoring` to
`On`
1. Within a few minutes, risk scores should be written to the risk score
datastream:
* `GET risk-score.risk-score-default/_search`
* Replace `default` with the name of your current space, as necessary.
1. Disabling/re-enabling the risk engine should trigger another
execution of the task (similar to disabling/enabling a DE rule)
1. Enable the risk engine in another space
* The engine (and task) can be enabled/executed in any kibana space.
* Because the engine only acts upon alerts in the current space, you
will need to first ensure alerts exist in that space.
1. Validate the data/mappings of persisted risk scores
* Scores are based on the Stage 1 [ECS
RFC](elastic/ecs#2236)
* There is no UI reading from these scores, currently (but that is
introduced in #163237)
### Risk Matrix
Delete this section if it is not applicable to this PR.
Before closing this PR, invite QA, stakeholders, and other developers to
identify risks that should be tested prior to the change/feature
release.
When forming the risk matrix, consider some of the following examples
and how they may potentially impact the change:
| Risk | Probability | Severity | Mitigation/Notes |
|---------------------------|-------------|----------|-------------------------|
| Multiple Spaces—unexpected behavior in non-default Kibana Space.
| Low | High | Integration tests will verify that all features are still
supported in non-default Kibana Space and when user switches between
spaces. |
| Multiple nodes—Elasticsearch polling might have race conditions
when multiple Kibana nodes are polling for the same tasks. | High | Low
| Tasks are idempotent, so executing them multiple times will not result
in logical error, but will degrade performance. To test for this case we
add plenty of unit tests around this logic and document manual testing
procedure. |
| Code should gracefully handle cases when feature X or plugin Y are
disabled. | Medium | High | Unit tests will verify that any feature flag
or plugin combination still results in our service operational. |
| [See more potential risk
examples](https://github.com/elastic/kibana/blob/main/RISK_MATRIX.mdx) |
### For maintainers
- [ ] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
---------
Co-authored-by: kibanamachine <[email protected]>
) resolves #164731 ## Summary This removes the check for a legacy index template for the event log for the current version it wants to create. This was presumably done this way, to allow for the switch from legacy to component templates. But it's not really needed, since each stack version creates new index templates. So, removing the check should be fine. ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios Co-authored-by: Tiago Costa <[email protected]> Co-authored-by: Kibana Machine <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot]
Can you help keep this open source service alive? 💖 Please sponsor : )