* [7.x] Add CCS integration test for security rules
* [7.x] More precise alerts matching
* Split out test preparation and cleanup
* Load data on the remote cluster
* Update the rule to the new (remote) data
Backport of #99042 and #99820.
* [Cases] RBAC (#95058)
* Adding feature flag for auth
* Hiding SOs and adding consumer field
* First pass at adding security changes
* Consumer as the app's plugin ID
* Create addConsumerToSO migration helper
* Fix mapping's SO consumer
* Add test for CasesActions
* Declare hidden types on SO client
* Restructure integration tests
* Init spaces_only integration tests
* Implementing the cases security string
* Adding security plugin tests for cases
* Rough concept for authorization class
* Adding comments
* Fix merge
* Get requiredPrivileges for classes
* Check privillages
* Ensure that all classes are available
* Success if hasAllRequested is true
* Failure if hasAllRequested is false
* Adding schema updates for feature plugin
* Seperate basic from trial
* Enable SIR on integration tests
* Starting the plumbing for authorization in plugin
* Unit tests working
* Move find route logic to case client
* Create integration test helper functions
* Adding auth to create call
* Create getClassFilter helper
* Add class attribute to find request
* Create getFindAuthorizationFilter
* Ensure savedObject is authorized in find method
* Include fields for authorization
* Combine authorization filter with cases & subcases filter
* Fix isAuthorized flag
* Fix merge issue
* Create/delete spaces & users before and after tests
* Add more user and roles
* [Cases] Convert filters from strings to KueryNode (#95288)
* [Cases] RBAC: Rename class to scope (#95535)
* [Cases][RBAC] Rename scope to owner (#96035)
* [Cases] RBAC: Create & Find integration tests (#95511)
* [Cases] Cases client enchantment (#95923)
* [Cases] Authorization and Client Audit Logger (#95477)
* Starting audit logger
* Finishing auth audit logger
* Fixing tests and types
* Adding audit event creator
* Renaming class to scope
* Adding audit logger messages to create and find
* Adding comments and fixing import issue
* Fixing type errors
* Fixing tests and adding username to message
* Addressing PR feedback
* Removing unneccessary log and generating id
* Fixing module issue and remove expect.anything
* [Cases] Migrate sub cases routes to a client (#96461)
* Adding sub cases client
* Move sub case routes to case client
* Throw when attempting to access the sub cases client
* Fixing throw and removing user ans soclients
* [Cases] RBAC: Migrate routes' unit tests to integration tests (#96374)
Co-authored-by: Jonathan Buttner <jonathan.buttner@elastic.co>
* [Cases] Move remaining HTTP functionality to client (#96507)
* Moving deletes and find for attachments
* Moving rest of comment apis
* Migrating configuration routes to client
* Finished moving routes, starting utils refactor
* Refactoring utilites and fixing integration tests
* Addressing PR feedback
* Fixing mocks and types
* Fixing integration tests
* Renaming status_stats
* Fixing test type errors
* Adding plugins to kibana.json
* Adding cases to required plugin
* [Cases] Refactoring authorization (#97483)
* Refactoring authorization
* Wrapping auth calls in helper for try catch
* Reverting name change
* Hardcoding the saved object types
* Switching ensure to owner array
* [Cases] Add authorization to configuration & cases routes (#97228)
* [Cases] Attachments RBAC (#97756)
* Starting rbac for comments
* Adding authorization to rest of comment apis
* Starting the comment rbac tests
* Fixing some of the rbac tests
* Adding some integration tests
* Starting patch tests
* Working tests for comments
* Working tests
* Fixing some tests
* Fixing type issues from pulling in master
* Fixing connector tests that only work in trial license
* Attempting to fix cypress
* Mock return of array for configure
* Fixing cypress test
* Cleaning up
* Addressing PR comments
* Reducing operations
* [Cases] Add RBAC to remaining Cases APIs (#98762)
* Starting rbac for comments
* Adding authorization to rest of comment apis
* Starting the comment rbac tests
* Fixing some of the rbac tests
* Adding some integration tests
* Starting patch tests
* Working tests for comments
* Working tests
* Fixing some tests
* Fixing type issues from pulling in master
* Fixing connector tests that only work in trial license
* Attempting to fix cypress
* Mock return of array for configure
* Fixing cypress test
* Cleaning up
* Working case update tests
* Addressing PR comments
* Reducing operations
* Working rbac push case tests
* Starting stats apis
* Working status tests
* User action tests and fixing migration errors
* Fixing type errors
* including error in message
* Addressing pr feedback
* Fixing some type errors
* [Cases] Add space only tests (#99409)
* Starting spaces tests
* Finishing space only tests
* Refactoring createCaseWithConnector
* Fixing spelling
* Addressing PR feedback and creating alert tests
* Fixing mocks
* [Cases] Add security only tests (#99679)
* Starting spaces tests
* Finishing space only tests
* Refactoring createCaseWithConnector
* Fixing spelling
* Addressing PR feedback and creating alert tests
* Fixing mocks
* Starting security only tests
* Adding remainder security only tests
* Using helper objects
* Fixing type error for null space
* Renaming utility variables
* Refactoring users and roles for security only tests
* Adding sub feature
* [Cases] Cleaning up the services and TODOs (#99723)
* Cleaning up the service intialization
* Fixing type errors
* Adding comments for the api
* Working test for cases client
* Fix type error
* Adding generated docs
* Adding more docs and cleaning up types
* Cleaning up readme
* More clean up and links
* Changing some file names
* Renaming docs
* Integration tests for cases privs and fixes (#100038)
* [Cases] RBAC on UI (#99478)
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* Fixing case ids by alert id route call
* [Cases] Fixing UI feature permissions and adding UI tests (#100074)
* Integration tests for cases privs and fixes
* Fixing ui cases permissions and adding tests
* Adding test for collection failure and fixing jest
* Renaming variables
* Fixing type error
* Adding some comments
* Validate cases features
* Fix new schema
* Adding owner param for the status stats
* Fix get case status tests
* Adjusting permissions text and fixing status
* Address PR feedback
* Adding top level feature back
* Fixing feature privileges
* Renaming
* Removing uneeded else
* Fixing tests and adding cases merge tests
* [Cases][Security Solution] Basic license security solution API tests (#100925)
* Cleaning up the fixture plugins
* Adding basic feature test
* renaming to unsecuredSavedObjectsClient (#101215)
* [Cases] RBAC Refactoring audit logging (#100952)
* Refactoring audit logging
* Adding unit tests for authorization classes
* Addressing feedback and adding util tests
* return undefined on empty array
* fixing eslint
* [Cases] Cleaning up RBAC integration tests (#101324)
* Adding tests for space permissions
* Adding tests for testing a disable feature
Co-authored-by: Christos Nasikas <christos.nasikas@elastic.co>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
# Conflicts:
# x-pack/plugins/cases/server/client/client.ts
# x-pack/plugins/cases/server/client/mocks.ts
# x-pack/plugins/cases/server/client/types.ts
# x-pack/plugins/cases/server/index.ts
# x-pack/plugins/cases/server/plugin.ts
# x-pack/plugins/security_solution/server/endpoint/endpoint_app_context_services.ts
# x-pack/plugins/security_solution/server/endpoint/mocks.ts
# x-pack/plugins/security_solution/server/endpoint/routes/actions/isolation.ts
* Fixing type errors
* Addressing plugin type errors
* Add invalidation to Attribute Value field when empty
Also added some missed i18n strings for the form row labels
* Disable forms if attribute value is invalid
* Move error from saving role mapping to inline form error
Flash message was rendering behind flyover.
*Best to view this commit with whitespace changes hidden
* Fix i18n
Copy/Paste FTW
* Attempt at fixing lint issue
My local linter seems to be broken
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Scotty Bollinger <scotty.bollinger@elastic.co>
## Summary
Test cases for signals and aliases, including a failure of where we do not copy alias data at the moment even if the target is an ECS compatible field.
For example with this mapping:
```json
{
"dynamic": "strict",
"properties": {
"@timestamp": {
"type": "date"
},
"host": {
"properties": {
"name": {
"type": "alias",
"path": "host_alias.name"
}
}
},
"host_alias": {
"properties": {
"name": {
"type": "keyword"
}
}
}
}
}
```
If we detect this as a signal hit we should be copying over both:
* `host_alias.name` -> `host.name`
* `host_alias.name` -> `host_alias.name`
to the target signal index, but we only copy:
* `host_alias.name` -> `host_alias.name`
### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
## Summary
We have a few bugs where when the source index for detections is not `"strict_date_optional_time"` it is possible that we will misinterpret the format to be epoch milliseconds when it could be epoch seconds or another ambiguous format or blow up when trying to write out the signals index. This fixes it to where we query for the source index format as an ISO8601 and when we copy the date time format we copy it back out as ISO8601 and insert it into the signal index as ISO8601.
See this [gist](https://gist.github.com/FrankHassanabad/f614ec9762d59cd1129b3269f5bae41c) for more details of how this was accidentally introduced when we added support for runtime fields and the general idea of the fix.
* Removes `docvalue_field` and we now only use `fields` in detection engine search requests
* Splits out the timestamp e2e tests into their own file for `timestamps` file
* Adds more tests to ensure we copy what we expect and we are converting to ISO8601 in the signals
* Removes `ts-expect-error` in a lot of areas including tests and then I fix the types and issues once it is removed.
### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
Co-authored-by: Frank Hassanabad <frank.hassanabad@elastic.co>
* Changed Upgrade Assistant test to reflect hiding the UI (#96714)
* Added test to verify the UI changes for hiding the app.
* Running tests on repeat.
* Tests passed. Removing only clause to allow full suite to run.
* Skipping firefox.
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
# Conflicts:
# x-pack/test/functional/apps/upgrade_assistant/upgrade_assistant.ts
* Changed placement of test suite due to it being destructive and causing other suites to fail.
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Because this isn't in a code block, MDX is trying to interpolate the
`{column1}` value, which is undefined.
Co-authored-by: Greg Back <1045796+gtback@users.noreply.github.com>
## Summary
Adds e2e tests for the `constant_keyword` regular `keyword` to compare between the two. Bugs found with these is one where we do not copy `constant_keyword` fields into signals which I added `.skip` to the tests now.
Tested these rule types:
* KQL
* EQL
* Threshold
For the mappings of the `constant_keyword` I use both the `constant_keyword` and the field `alias` like so:
```json
{
"properties": {
"@timestamp": {
"type": "date"
},
"data_stream": {
"properties": {
"dataset": {
"type": "constant_keyword",
"value": "dataset_name_1"
},
"module": {
"type": "constant_keyword",
"value": "module_name_1"
}
}
},
"event": {
"properties": {
"category": {
"type": "keyword"
},
"dataset": {
"type": "alias",
"path": "data_stream.dataset"
},
"module": {
"type": "alias",
"path": "data_stream.module"
}
}
}
}
}
```
To ensure we can detect against fields. I also mix them with regular const keyword fields in another index to ensure they work also in mixed use cases.
### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
Co-authored-by: Frank Hassanabad <frank.hassanabad@elastic.co>
* heatmap wip
* format values on X axis
* format values for cells
* show labels
* support legend configuration
* render preview
* add icon
* [ML] update visualization
* [ML] init suggestions
* [ML] fix preview
* [ML] fix groupPosition for the legend control
* [ML] add formatter for Y-axis
* [ML] filterOperations for cell value
* [ML] fill all available height
* [ML] delete unused file
* [ML] fix suggestion state
* [ML] update suggestion, add hiding logic
* [ML] suggestions unit tests
* [ML] rename legend interface
* [ML] unit tests for visualization, add error messages
* [ML] fix typos in xy visualization tests
* [ML] support click event
* [ML] add xDomain for time series data
* [ML] support empty Y axis
* [ML] change legend default position
* [ML] getTimeZone util
* [ML] hide suggestions for reorder
* [ML] support brush event
* [ML] update unit tests
* [ML] render grid lines in preview
* [ML] don't display errors on init
* [ML] utilize chartsThemeService
* [ML] support histogram for the vertical axis
* [ML] fix clearLayer
* [ML] show empty placeholder on no data
* [ML] fix X domain min
* [ML] reject suggestions for 3 or more buckets
* [ML] suggestions for histograms and histogram for Y-axis
* [ML] fix unit tests
* [ML] update suggestions for active heatmap
* [ML] chart data test for heatmap
* [ML] test for transitioning from heatmap to barchart
* [ML] disable xDomain
* [ML] support intervals in axes configurations
* [ML] hide label on the vertical axis when there is only a horizontal dimension
* [ML] set min cell height for better suggestions preview rendering
* [ML] fix tooltip for empty vertical axis config
* [ML] fix click and brushing for empty Y axis
* [ML] update functional test
* [ML] show beta label
* [ML] fix legend control
* [ML] dataIndex sort by default for the X axis
* [ML] use euiPaletteForTemperature with quantize color scale
* [ML] hide all suggestions
* [ML] fix chart data extension issue
* [ML] fix the caret symbol positioning
* [ML] update unit tests for the heatmap suggestions
* [ML] replace EuiBetaBadge with EuiBadge
* [ML] update functional test
* [ML] fix chart switch styles
* [ML] fix functional test
* [ML] return null instead of expression with a missing value accessor
* [ML] use table id as a chart id
* [ML] fix scale type for a single row of data
* [ML] filter out undefined values
* [ML] fix isXAxisLabelVisible
* [ML] update chart_switch styles
* show warning message for the array values
* remove unused code
* replace ts-ignore with manual type casting
* add unit tests for error and warning messages
* add css class for append, conditional flex group
Co-authored-by: Dima Arnautov <dmitrii.arnautov@elastic.co>
* Add RoleOptionLabel component
* Refactor RoleSelector to use EuiRadioGroup
Previously, we used individual radio buttons in a map in the component. However the new designs have a shared label and work best in the EuiRadioGroup component.
* Add reducer and actions to logic file for flyout visibility
* Remove redirects in favor of refreshing lists
With the existing multi-page view, we redirect after creating, editing or deleting a mapping. We now simply refresh the list after the action.
Also as a part of this commit, we show a hard-coded error message if a user tries to navigate to a non-existant mapping, instead of redirecting to a 404 page
* Add RoleMappingFlyout component
* Refactor AttributeSelector
No longer uses a panel or has the need for flex groups
- Also added a test for 100% coverage
* Refactor RoleMappingsTable
- Use EuiButtonIcons instead of Link
- Manage button now triggers flyout instead of linking to route
* Remove AddRoleMappingButton
We can just use an EuiButton to trigger the flyout
* Convert to use RoleSelector syntax
- Passes the entire array to the component instead of mapping.
- Uses ‘id’ instead of ‘type’ to match EUI component
- For App Search, as per design and PM direction, dropping labels for advanced and standard roles and showing them all in the same list.
- Removed unused constant and i18ns
* Move constants to shared
Will do a lot more of this in a future PR
* Remove DeleteMappingCallout
- This now an action in the row
- Also added tests for correct titles for 100% test coverage
* Remove routers and routes
- SPA FTW
* No longer pass isNew as prop
- Determine based on existence of Role Mapping instead
* No longer need to initialze role mapping in the component
This will become a flyout and the intialization will be triggered when the button in the table is clicked.
* Remove flash messages
This will be handled globally in the main component.
* Wrap components with flyout
Also add to main RoleMappings views
* Add form row validation for App Search
* Remove unnecessary layout components
- Don’t need the panel, headings, spacer, and Flex components
- Also removed constants and i18n from unused headings
* Wire up handleDeleteMapping to take ID param
The method now passes the ID directly from the table row action item
* Add EuiPortal wrapper for flyout
Without this, the flyout was was under the overlay. Hide whitespace changes on this commit
* Add spacer to better match design
* Update constants for new copy from design
* Replace all engines/groups radio and group/engine selectors
- The designs call for a radio group and a combo box, instead of separate radios and a list of checkboxes
- Also added a spacer to each layout
* Remove util that is no longer needed
- This was used for generating routes that are no longer there
- Also removed unused test file from a component deleted in an earlier PR
- Fix test since spacer was added
* Add missing i18n constant
* Add back missing scoped engine check
* Rename roleId -> roleMappingId
* Use shared constant for “Cancel”
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: Scotty Bollinger <scotty.bollinger@elastic.co>
* [ts] migrate root test dir to project refs (#99148)
Co-authored-by: spalger <spalger@users.noreply.github.com>
* include schema files in telemetry ts project
Co-authored-by: spalger <spalger@users.noreply.github.com>
* Add un-isolate form to the endpoint flyout
* Add Endpoint details flyout footer and action button
* Refactor hooks into a directory
* Refactor endpoint list actions into reusable list + add it to Take action on details
* Refactor Endpoint list row actions to use new common hook for items
* generate different values for isolation in endpoint generator
* move `isEndpointHostIsolated()` utility to a common folder
* refactor detections to also use common `isEndpointHostIsolated()`
* httpHandlerMockFactory can now handle API paths with params (`{id}`)
* Initial set of re-usable http mocks for endpoint hosts set of pages
* fix bug in `composeHttpHandlerMocks()`
* small improvements to test utilities
* Show API errors for isolate in Form standard place
Co-authored-by: Paul Tavares <56442535+paul-tavares@users.noreply.github.com>
* [Pie] New implementation of the vislib pie chart with es-charts (#83929)
* es lint fix
* Add formatter on the buckets labels
* Config the new plugin, toggle tooltip
* Aff filtering on slice click
* minor fixes
* fix eslint error
* use legacy palette for now
* Add color picker to legend colors
* Fix ts error
* Add legend actions
* Fix bug on Color Picker and remove local state as it is unecessary
* Fix some bugs on colorPicker
* Add setting for the user to select between the legacy palette or the eui ones
* small enhancements, treat empty labels with (empty)
* Fix color picker bugs with multiple layers
* fixes on internationalization
* Create migration script for pie chart and legacy palette
* Add unit tests (wip) and a small refactoring
* Add unit tests and move some things to utils, useMemo and useCallback where it should
* Add jest config file
* Fix jest test
* fix api integration failure
* Fix to_ast_esaggs for new pie plugin
* Close legendColorPicker popover when user clicks outside
* Fix warning
* Remove getter/setters and refactor
* Remove kibanaUtils from pie plugin as it is not needed
* Add new values to the migration script
* Fix bug on not changing color for expty string
* remove from migration script as they don't need it
* Fix editor settings for old and new implementation
* fix uistate type
* Disable split chart for the new plugin for now
* Remove temp folder
* Move translations to the pie plugin
* Fix CI failures
* Add unit test for the editor config
* Types cleanup
* Fix types vol2
* Minor improvements
* Display data on the inspector
* Cleanup translations
* Add telemetry for new editor pie options
* Fix missing translation
* Use Eui component to detect click outside the color picker popover
* Retrieve color picker from editor and syncColors on dashboard
* Lazy load palette service
* Add the new plugin to ts references, fix tests, refactor
* Fix ci failure
* Move charts library switch to vislib plugin
* Remove cyclic dependencies
* Modify license headers
* Move charts library switch to visualizations plugin
* Fix i18n on the switch moved to visualizations plugin
* Update license
* Fix tests
* Fix bugs created by new charts version
* Fix the i18n switch problem
* Update the migration script
* Identify if colorIsOverwritten or not
* Small multiples, missing the click event
* Fixes the UX for small multiples part1
* Distinct colors per slice implementation
* Fix ts references problem
* Fix some small multiples bugs
* Add unit tests
* Fix ts ref problem
* Fix TS problems caused by es-charts new version
* Update the sample pie visualizations with the new eui palette
* Allows filtering by the small multiples value
* Apply sortPredicate on partition layers
* Fix vilib test
* Enable functional tests for new plugin
* Fix some functional tests
* Minor fix
* Fix functional tests
* Fix dashboard tests
* Fix all dashboard tests
* Apply some improvements
* Explicit params instead of visConfig Json
* Fix i18n failure
* Add top level setting
* Minor fix
* Fix jest tests
* Address PR comments
* Fix i18n error
* fix functional test
* Add an icon tip on the distinct colors per slice switch
* Fix some of the PR comments
* Address more PR comments
* Small fix
* Functional test
* address some PR comments
* Add padding to the pie container
* Add a max width to the container
* Improve dashboard functional test
* Move the labels expression function to the pie plugin
* Fix i18n
* Fix functional test
* Apply PR comments
* Do not forget to also add the migration to them embeddable too :D
* Fix distinct colors for IP range layer
* Remove console errors
* Fix small mulitples colors with multiple layers
* Fix lint problem
* Fix problems created from merging with master
* Address PR comments
* Change the config in order the pie chart to not appear so huge on the editor
* Address PR comments
* Change the max percentage digits to 4
* Change the max size to 1000
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
# Conflicts:
# .github/CODEOWNERS
# packages/kbn-optimizer/limits.yml
# test/functional/apps/visualize/_pie_chart.ts
* Fix functional test
* Revert change - backport missing
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
