[Security Solution] Error When Assigning an Alert

[pborgonovi]

Describe the bug:

When users with maintenance, write, read, and view_index_metadata privileges for the indices .alerts-security.alerts-* and .internal.alerts-security.alerts-* and Read access to Security in Kibana select an alert in the Alerts Table or the Alert Detail Flyout and tries to assign the alert to a user, the system shows two messages:

1. “Successfully updated assignees for 1 alert.”

• This message indicates the assignment was processed successfully.

2. “Failed to find users”

• This message shows an error related to the API call:
  API [POST /internal/security/user_profile/_bulk_get] is unauthorized for user, this action is granted by the Kibana privileges [bulkGetUserProfiles] (403)

Despite the success message, the assignment does not seem to work properly.

Kibana/Elasticsearch Stack version:

8.17

Server OS version:

Browser and Browser OS versions:

Elastic Endpoint version:

Original install method (e.g. download page, yum, from source, etc.):

Functional Area (e.g. Endpoint management, timelines, resolver, etc.):

Pre requisites:

Create a new role in Kibana with the following settings:

1. Index Privileges:

• Privileges: read, write, maintenance, view_index_metadata

2. Kibana Privileges:

• Feature Privileges:
  Security: Read Access Only

Steps to reproduce:

1. Create an user and assign to the custom role
2. Login with the new user
3. Navigate to the Alerts Table or open the Alert Detail Flyout.
4. Select an alert.
5. Attempt to assign the alert to a user.
6. Observe the messages displayed by the system.

Current behavior:

• The system displays two conflicting messages:

1. A success message indicating the alert was assigned.
2. An error message indicating the user does not have the necessary privileges to retrieve user profiles.

Expected behavior:

• The system should assign the alert without errors, provided the user has sufficient privileges.
• If the user lacks the necessary privileges, the system should display a single, clear error message explaining the issue.

Screenshots (if relevant):

Screen.Recording.2024-11-27.at.10.09.43.AM.mov

Screen.Recording.2024-11-27.at.10.11.22.AM.mov

Errors in browser console (if relevant):

{
    "statusCode": 403,
    "error": "Forbidden",
    "message": "API [POST /internal/security/user_profile/_bulk_get] is unauthorized for user, this action is granted by the Kibana privileges [bulkGetUserProfiles]"
}

Provide logs and/or server output (if relevant):

Any additional context (logs, chat logs, magical formulas, etc.):

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detection-engine (Team:Detection Engine)

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[vitaliidm]

Few observations:

1. User can update assignees in alert(i.e. update any alert details, which is handled by SecuritySolution priv)
2. User can see suggested users in searchbox
3. User can not see assignees details(name, avatar) in alerts table column and alerts flyout(that's where error toast originates from)

Why this happens?
2 different APIs used to show users in searchbox and user details in alerts table column:

1. API to show users in searchbox: /internal/detection_engine/users/_find
   It requires securitySolution privilege
2. API for alerts table cell: /internal/security/user_profile/_bulk_get
   It requires bulkGetUserProfiles privilege

User was configured with read only Security Feature, that covers only first API, that's why we see error

API [POST /internal/security/user_profile/_bulk_get] is unauthorized for user, this action is granted by the Kibana privileges [bulkGetUserProfiles] (403)

However bulkGetUserProfiles is covered by Cases feature already. If Cases access will be set to read, user would be able to see assignees details through /internal/security/user_profile/_bulk_get API.
It happens, because cases API tags include bulkGetUserProfiles privilege: https://github.com/elastic/kibana/blob/8.18/x-pack/platform/plugins/shared/cases/common/utils/api_tags.ts#L32, https://github.com/elastic/kibana/blob/8.18/x-pack/solutions/security/packages/features/src/cases/types.ts#L7

I propose to include bulkGetUserProfiles privilege in Security Feature: #211824. Since, it's already present in Cases feature, and user profiles available through Security Solution /internal/detection_engine/users/_find API

[vitaliidm]

addressed in #211824

[pborgonovi]

Fix has been successfully verified. Bug no longer reproducible. Closing this out.

Screen.Recording.2025-03-05.at.11.24.28.AM.mov