[SecuritySolution] Fix Risk score Insufficient privileges warning missing cluster privileges #212405

machadoum · 2025-02-25T16:08:23Z

Summary

Fixes Bug: User with no cluster privileges should not be able to enable the risk score
When users with no cluster privileges open the risk score page, they don't see any errors and are able to click the install button.

This happened because we were only checking for index privileges in the UI, but for the enablement flow we also need to check cluster privileges. I also introduced a new parameter to the missing privileges hook so pages that only need to check for read privileges can work as before.

Nov-13-2024.10-38-35.mp4

Fixed Bug: The install button was enabled when all toggles were disabled
There were too many booleans in the panel, which was confusing and led me to introduce more bugs while trying to fix this one, so I refactored the code to understand it before fixing it.
I also simplified the logic to display the modal. Now, it only shows when one of the engines' status is "not_installed"

To Reproduce

Create a user with security privileges and index privileges but no cluster privileges
Go to the risk score page and enable the toggle

Checklist

Check the PR satisfies following conditions.

Unit or functional tests were updated or

elasticmachine · 2025-02-25T16:13:23Z

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine · 2025-02-25T16:13:24Z

Pinging @elastic/security-entity-analytics (Team:Entity Analytics)

tiansivive

🚀

CAWilson94

🚢

semd

LGTM

…eges

The install button was enabled when all toggles were disabled

CAWilson94 · 2025-02-28T13:04:47Z

...ity_solution/public/entity_analytics/components/entity_store/components/enablement_modal.tsx

+  useEffect(() => {
+    setToggleState({
+      riskScore: canInstallRiskScore,
+      entityStore: canInstallEntityStore,


CAWilson94

Big 🪭 !! Nice job 🚀

…eadonly

kibanamachine · 2025-03-06T09:51:30Z

Starting backport for target branches: 8.17, 8.18, 8.x, 9.0

https://github.com/elastic/kibana/actions/runs/13695860038

elasticmachine · 2025-03-06T09:52:11Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 44620e7

Failed CI Steps

FTR Configs #92

Test Failures

[job] [logs] FTR Configs #92 / Visualizations - Group 3 lens app - TSVB Open in Lens Table should convert group by field with custom label

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	8.9MB	8.9MB	+40.0B

History

💚 Build #280769 succeeded 7cc985e
💔 Build #280379 failed ba03603
💚 Build #280299 succeeded 0fb3261
💔 Build #279955 failed 0e82705
💔 Build #279684 failed 0de798e
💔 Build #279166 failed caeb02a

cc @machadoum

…sing cluster privileges (elastic#212405) ## Summary ### * Fixes Bug: User with no cluster privileges should not be able to enable the risk score When users with no cluster privileges open the risk score page, they don't see any errors and are able to click the install button. This happened because we were only checking for index privileges in the UI, but for the enablement flow we also need to check cluster privileges. I also introduced a new parameter to the missing privileges hook so pages that only need to check for `read` privileges can work as before. https://github.com/user-attachments/assets/fe162005-ee2b-497d-8744-6262e4511d2d * Fixed Bug: The install button was enabled when all toggles were disabled There were too many booleans in the panel, which was confusing and led me to introduce more bugs while trying to fix this one, so I refactored the code to understand it before fixing it. I also simplified the logic to display the modal. Now, it only shows when one of the engines' status is "not_installed" <img width="300" src="https://github.com/user-attachments/assets/a2e8fbba-ac64-4c97-9ef0-ef6fe61e60cd" /> ### To Reproduce 1. Create a user with security privileges and index privileges but no cluster privileges 2. Go to the risk score page and enable the toggle ### Checklist Check the PR satisfies following conditions. - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or (cherry picked from commit b69b696)

kibanamachine · 2025-03-06T09:57:29Z

💔 Some backports could not be created

Status	Branch	Result
❌	8.17	Backport failed because of merge conflicts
❌	8.18	Backport failed because of merge conflicts
❌	8.x	Backport failed because of merge conflicts
✅	9.0

Note: Successful backport PRs will be merged automatically after passing CI.

Manual backport

To create the backport manually run:

node scripts/backport --pr 212405

Questions ?

Please refer to the Backport tool documentation

…sing cluster privileges (elastic#212405) ## Summary ### * Fixes Bug: User with no cluster privileges should not be able to enable the risk score When users with no cluster privileges open the risk score page, they don't see any errors and are able to click the install button. This happened because we were only checking for index privileges in the UI, but for the enablement flow we also need to check cluster privileges. I also introduced a new parameter to the missing privileges hook so pages that only need to check for `read` privileges can work as before. https://github.com/user-attachments/assets/fe162005-ee2b-497d-8744-6262e4511d2d * Fixed Bug: The install button was enabled when all toggles were disabled There were too many booleans in the panel, which was confusing and led me to introduce more bugs while trying to fix this one, so I refactored the code to understand it before fixing it. I also simplified the logic to display the modal. Now, it only shows when one of the engines' status is "not_installed" <img width="300" src="https://github.com/user-attachments/assets/a2e8fbba-ac64-4c97-9ef0-ef6fe61e60cd" /> ### To Reproduce 1. Create a user with security privileges and index privileges but no cluster privileges 2. Go to the risk score page and enable the toggle ### Checklist Check the PR satisfies following conditions. - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or (cherry picked from commit b69b696) # Conflicts: # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/entity_analytics_risk_score/index.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/entity_store/components/dashboard_enablement_panel.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_details_tab_body/index.tsx # x-pack/solutions/security/plugins/security_solution/public/explore/hosts/pages/navigation/host_risk_score_tab_body.tsx

…sing cluster privileges (elastic#212405) ## Summary ### * Fixes Bug: User with no cluster privileges should not be able to enable the risk score When users with no cluster privileges open the risk score page, they don't see any errors and are able to click the install button. This happened because we were only checking for index privileges in the UI, but for the enablement flow we also need to check cluster privileges. I also introduced a new parameter to the missing privileges hook so pages that only need to check for `read` privileges can work as before. https://github.com/user-attachments/assets/fe162005-ee2b-497d-8744-6262e4511d2d * Fixed Bug: The install button was enabled when all toggles were disabled There were too many booleans in the panel, which was confusing and led me to introduce more bugs while trying to fix this one, so I refactored the code to understand it before fixing it. I also simplified the logic to display the modal. Now, it only shows when one of the engines' status is "not_installed" <img width="300" src="https://github.com/user-attachments/assets/a2e8fbba-ac64-4c97-9ef0-ef6fe61e60cd" /> ### To Reproduce 1. Create a user with security privileges and index privileges but no cluster privileges 2. Go to the risk score page and enable the toggle ### Checklist Check the PR satisfies following conditions. - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or (cherry picked from commit b69b696) # Conflicts: # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/entity_analytics_risk_score/index.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_details_tab_body/index.tsx # x-pack/solutions/security/plugins/security_solution/public/explore/hosts/pages/navigation/host_risk_score_tab_body.tsx

…sing cluster privileges (elastic#212405) ## Summary ### * Fixes Bug: User with no cluster privileges should not be able to enable the risk score When users with no cluster privileges open the risk score page, they don't see any errors and are able to click the install button. This happened because we were only checking for index privileges in the UI, but for the enablement flow we also need to check cluster privileges. I also introduced a new parameter to the missing privileges hook so pages that only need to check for `read` privileges can work as before. https://github.com/user-attachments/assets/fe162005-ee2b-497d-8744-6262e4511d2d * Fixed Bug: The install button was enabled when all toggles were disabled There were too many booleans in the panel, which was confusing and led me to introduce more bugs while trying to fix this one, so I refactored the code to understand it before fixing it. I also simplified the logic to display the modal. Now, it only shows when one of the engines' status is "not_installed" <img width="300" src="https://github.com/user-attachments/assets/a2e8fbba-ac64-4c97-9ef0-ef6fe61e60cd" /> ### To Reproduce 1. Create a user with security privileges and index privileges but no cluster privileges 2. Go to the risk score page and enable the toggle ### Checklist Check the PR satisfies following conditions. - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or (cherry picked from commit b69b696) # Conflicts: # x-pack/plugins/security_solution/public/entity_analytics/components/entity_analytics_risk_score/index.tsx # x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/components/enablement_modal.test.tsx # x-pack/plugins/security_solution/public/entity_analytics/components/entity_store/components/enablement_modal.tsx # x-pack/plugins/security_solution/public/explore/hosts/pages/navigation/host_risk_score_tab_body.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/entity_store/components/dashboard_enablement_panel.tsx # x-pack/solutions/security/plugins/security_solution/public/entity_analytics/components/risk_details_tab_body/index.tsx

machadoum · 2025-03-06T13:40:16Z

💚 All backports created successfully

Status	Branch	Result
✅	8.x
✅	8.18
✅	8.17

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…sing cluster privileges (elastic#212405) * Fixes Bug: User with no cluster privileges should not be able to enable the risk score When users with no cluster privileges open the risk score page, they don't see any errors and are able to click the install button. This happened because we were only checking for index privileges in the UI, but for the enablement flow we also need to check cluster privileges. I also introduced a new parameter to the missing privileges hook so pages that only need to check for `read` privileges can work as before. https://github.com/user-attachments/assets/fe162005-ee2b-497d-8744-6262e4511d2d * Fixed Bug: The install button was enabled when all toggles were disabled There were too many booleans in the panel, which was confusing and led me to introduce more bugs while trying to fix this one, so I refactored the code to understand it before fixing it. I also simplified the logic to display the modal. Now, it only shows when one of the engines' status is "not_installed" <img width="300" src="https://github.com/user-attachments/assets/a2e8fbba-ac64-4c97-9ef0-ef6fe61e60cd" /> 1. Create a user with security privileges and index privileges but no cluster privileges 2. Go to the risk score page and enable the toggle Check the PR satisfies following conditions. - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or (cherry picked from commit b69b696)

machadoum self-assigned this Feb 25, 2025

machadoum marked this pull request as ready for review February 25, 2025 16:13

machadoum requested a review from a team as a code owner February 25, 2025 16:13

machadoum requested a review from CAWilson94 February 25, 2025 16:13

tiansivive approved these changes Feb 25, 2025

View reviewed changes

CAWilson94 approved these changes Feb 25, 2025

View reviewed changes

CAWilson94 reviewed Feb 25, 2025

View reviewed changes

machadoum requested a review from a team as a code owner February 27, 2025 11:53

semd approved these changes Feb 27, 2025

View reviewed changes

Fix Risk score Insufficient privileges warning missing cluster privil…

c4b91f5

…eges

machadoum force-pushed the siem-ea-11138 branch from 9fe663c to fa9ded6 Compare February 27, 2025 12:11

Refactor enablement model and fix install button

0de798e

The install button was enabled when all toggles were disabled

machadoum force-pushed the siem-ea-11138 branch from fa9ded6 to 0de798e Compare February 27, 2025 12:13

machadoum requested review from tiansivive and CAWilson94 February 27, 2025 12:20

Fix unit tests

0e82705

CAWilson94 reviewed Feb 28, 2025

View reviewed changes

CAWilson94 approved these changes Feb 28, 2025

View reviewed changes

machadoum added 2 commits March 3, 2025 13:52

Merge branch 'main' into siem-ea-11138

0fb3261

Update missing privileges callout to not show cluster privileges on r…

ba03603

…eadonly

machadoum enabled auto-merge (squash) March 4, 2025 14:12

machadoum added 2 commits March 4, 2025 15:13

Merge branch 'main' into siem-ea-11138

7cc985e

Merge branch 'main' into siem-ea-11138

44620e7

machadoum merged commit b69b696 into elastic:main Mar 6, 2025
10 checks passed

kibanamachine added the v9.1.0 label Mar 6, 2025

kibanamachine mentioned this pull request Mar 6, 2025

[9.0] [SecuritySolution] Fix Risk score Insufficient privileges warning missing cluster privileges (#212405) #213344

Open

This was referenced Mar 6, 2025

[OBX-UX-MGMT] Test plan for Rules and alerts, Overview page, and Cases #212097

Merged

[ObsUX] [APM] [OTel] Runtime metrics show dashboards with different ingest path #211822

Merged

This was referenced Mar 6, 2025

[8.x] [SecuritySolution] Fix Risk score Insufficient privileges warning missing cluster privileges (#212405) #213377

Open

[8.18] [SecuritySolution] Fix Risk score Insufficient privileges warning missing cluster privileges (#212405) #213378

Open

machadoum mentioned this pull request Mar 6, 2025

[8.17] [SecuritySolution] Fix Risk score Insufficient privileges warning missing cluster privileges (#212405) #213387

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SecuritySolution] Fix Risk score Insufficient privileges warning missing cluster privileges #212405

[SecuritySolution] Fix Risk score Insufficient privileges warning missing cluster privileges #212405

machadoum commented Feb 25, 2025 •

edited by kibanamachine

Loading

elasticmachine commented Feb 25, 2025

elasticmachine commented Feb 25, 2025

tiansivive left a comment

CAWilson94 left a comment

semd left a comment

CAWilson94 Feb 28, 2025

CAWilson94 left a comment

kibanamachine commented Mar 6, 2025

elasticmachine commented Mar 6, 2025

kibanamachine commented Mar 6, 2025

machadoum commented Mar 6, 2025

[SecuritySolution] Fix Risk score Insufficient privileges warning missing cluster privileges #212405

[SecuritySolution] Fix Risk score Insufficient privileges warning missing cluster privileges #212405

Conversation

machadoum commented Feb 25, 2025 • edited by kibanamachine Loading

Summary

To Reproduce

Checklist

elasticmachine commented Feb 25, 2025

elasticmachine commented Feb 25, 2025

tiansivive left a comment

Choose a reason for hiding this comment

CAWilson94 left a comment

Choose a reason for hiding this comment

semd left a comment

Choose a reason for hiding this comment

CAWilson94 Feb 28, 2025

Choose a reason for hiding this comment

CAWilson94 left a comment

Choose a reason for hiding this comment

kibanamachine commented Mar 6, 2025

elasticmachine commented Mar 6, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Async chunks

History

kibanamachine commented Mar 6, 2025

💔 Some backports could not be created

Manual backport

Questions ?

machadoum commented Mar 6, 2025

💚 All backports created successfully

Questions ?

machadoum commented Feb 25, 2025 •

edited by kibanamachine

Loading