Merge branch 'main' into elastic-agent-manifest-mounts

.buildkite/pipelines/es_snapshots/verify.yml

@@ -42,7 +42,7 @@ steps:
 
   - command: .buildkite/scripts/steps/functional/oss_cigroup.sh
     label: 'OSS CI Group'
-    parallelism: 11
+    parallelism: 12
     agents:
       queue: ci-group-4d
     depends_on: build

.buildkite/pipelines/on_merge.yml

@@ -66,7 +66,7 @@ steps:
 
   - command: .buildkite/scripts/steps/functional/oss_cigroup.sh
     label: 'OSS CI Group'
-    parallelism: 11
+    parallelism: 12
     agents:
       queue: n2-4-spot
     depends_on: build

.buildkite/pipelines/pull_request/base.yml

@@ -32,7 +32,7 @@ steps:
 
   - command: .buildkite/scripts/steps/functional/oss_cigroup.sh
     label: 'OSS CI Group'
-    parallelism: 11
+    parallelism: 12
     agents:
       queue: n2-4-spot
     depends_on: build

.buildkite/scripts/steps/functional/synthetics.sh

@@ -14,4 +14,4 @@ echo "--- Uptime @elastic/synthetics Tests"
 cd "$XPACK_DIR"
 
 checks-reporter-with-killswitch "Uptime @elastic/synthetics Tests" \
-  node plugins/uptime/scripts/e2e.js --kibana-install-dir "$KIBANA_BUILD_LOCATION" --grep "MonitorManagement-monitor*"
+  node plugins/synthetics/scripts/e2e.js --kibana-install-dir "$KIBANA_BUILD_LOCATION" --grep "MonitorManagement-monitor*"

.ci/ci_groups.yml

@@ -10,6 +10,7 @@ root:
   - ciGroup9
   - ciGroup10
   - ciGroup11
+  - ciGroup12
 
 xpack:
   - ciGroup1

.github/CODEOWNERS

@@ -415,6 +415,7 @@
 /x-pack/plugins/security_solution/cypress/integration/urls @elastic/security-threat-hunting-investigations
 
 /x-pack/plugins/security_solution/public/common/components/alerts_viewer @elastic/security-threat-hunting-investigations
+/x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_action @elastic/security-threat-hunting-investigations
 /x-pack/plugins/security_solution/public/common/components/event_details @elastic/security-threat-hunting-investigations
 /x-pack/plugins/security_solution/public/common/components/events_viewer @elastic/security-threat-hunting-investigations
 /x-pack/plugins/security_solution/public/common/components/markdown_editor @elastic/security-threat-hunting-investigations

docs/api/actions-and-connectors/create.asciidoc

@@ -74,6 +74,7 @@ The API returns the following:
     "executionTimeField": null
   },
   "is_preconfigured": false,
+  "is_deprecated": false,
   "is_missing_secrets": false
 }
 --------------------------------------------------

docs/api/actions-and-connectors/get.asciidoc

@@ -51,6 +51,7 @@ The API returns the following:
     "executionTimeField": null
   },
   "is_preconfigured": false,
+  "is_deprecated": false,
   "is_missing_secrets": false
 }
 --------------------------------------------------

docs/api/actions-and-connectors/get_all.asciidoc

@@ -44,6 +44,7 @@ The API returns the following:
     "connector_type_id": ".email",
     "name": "email: preconfigured-mail-connector",
     "is_preconfigured": true,
+    "is_deprecated": false,
     "referenced_by_count": 0 <1>
   },
   {
@@ -56,6 +57,7 @@ The API returns the following:
       "executionTimeField": null
     },
     "is_preconfigured": false,
+    "is_deprecated": false,
     "is_missing_secrets": false,
     "referenced_by_count": 3
   }

docs/api/actions-and-connectors/legacy/create.asciidoc

@@ -76,6 +76,7 @@ The API returns the following:
     "executionTimeField": null
   },
   "isPreconfigured": false,
+  "isDeprecated": false,
   "isMissingSecrets": false
 }
 --------------------------------------------------

docs/api/actions-and-connectors/legacy/get.asciidoc

@@ -53,6 +53,7 @@ The API returns the following:
     "executionTimeField": null
   },
   "isPreconfigured": false,
+  "isDeprecated": false,
   "isMissingSecrets": false
 }
 --------------------------------------------------

docs/api/actions-and-connectors/legacy/get_all.asciidoc

@@ -45,7 +45,8 @@ The API returns the following:
     "id": "preconfigured-mail-action",
     "actionTypeId": ".email",
     "name": "email: preconfigured-mail-action",
-    "isPreconfigured": true
+    "isPreconfigured": true,
+    "isDeprecated": false
   },
   {
     "id": "c55b6eb0-6bad-11eb-9f3b-611eebc6c3ad",
@@ -57,6 +58,7 @@ The API returns the following:
       "executionTimeField": null
     },
     "isPreconfigured": false,
+    "isDeprecated": false,
     "isMissingSecrets": false
   }
 ]

docs/api/actions-and-connectors/legacy/update.asciidoc

@@ -71,6 +71,7 @@ The API returns the following:
     "executionTimeField": null
   },
   "isPreconfigured": false,
+  "isDeprecated": false,
   "isMissingSecrets": false
 }
 --------------------------------------------------

docs/api/actions-and-connectors/update.asciidoc

@@ -69,6 +69,7 @@ The API returns the following:
     "executionTimeField": null
   },
   "is_preconfigured": false,
+  "is_deprecated": false,
   "is_missing_secrets": false
 }
 --------------------------------------------------

docs/api/cases/cases-api-find-connectors.asciidoc

@@ -55,6 +55,7 @@ The API returns a JSON object describing the connectors and their settings:
     "projectKey":"ES"
   },
   "isPreconfigured":false,
+  "isDeprecated": false,
   "referencedByCount":0
 }]
 --------------------------------------------------

docs/api/machine-learning/sync.asciidoc

@@ -47,9 +47,9 @@ it is added. This list contains the {dfeed} identifiers and indicates whether
 the synchronization was successful.
 
 `datafeedsRemoved`::
-(array) If saved objects exist for {dfeeds} that no longer exist, they are
-deleted. This list contains the {dfeed} identifiers and indicates whether the
-synchronization was successful.
+(array) If a saved object for an anomaly detection job references a datafeed
+that no longer exists, it is deleted. This list contains the {dfeed} identifiers 
+and indicates whether the synchronization was successful.
 
 `savedObjectsCreated`::
 (array) If saved objects are missing for {ml} jobs or trained models, they are

docs/management/connectors/action-types/email.asciidoc

@@ -9,6 +9,8 @@ The email connector uses the SMTP protocol to send mail messages, using an integ
 
 NOTE: For emails to have a footer with a link back to {kib}, set the <<server-publicBaseUrl, `server.publicBaseUrl`>> configuration setting.
 
+NOTE: When the <<action-config-email-domain-allowlist, `xpack.actions.email.domain_allowlist`>> configuration setting is used, the email addresses used for all of the Sender (from), To, CC, and BCC properties must have email domains specified in the configuration setting.
+
 [float]
 [[email-connector-configuration]]
 ==== Connector configuration

docs/settings/alert-action-settings.asciidoc

@@ -125,6 +125,11 @@ The contents of a PEM-encoded certificate file, or multiple files appended
 into a single string.  This configuration can be used for environments where
 the files cannot be made available.
 
+[[action-config-email-domain-allowlist]] `xpack.actions.email.domain_allowlist`  {ess-icon}::
+A list of allowed email domains which can be used with the email connector.  When this setting is not used, all email domains are allowed.  When this setting is used, if any email is attempted to be sent that includes an addressee with an email domain that is not in the allowlist, or the from address domain is not in the allowlist, the run of the connector will fail with a message indicating the emails not allowed.
+
+WARNING: This feature is available in {kib} 7.17.4 and 8.3.0 onwards but is not supported in {kib} 8.0, 8.1 or 8.2. As such this settings should be removed before upgrading from 7.17 to 8.0, 8.1 or 8.2. It is possible to configure the settings in 7.17.4 and then upgrade to 8.3.0 directly.
+
 `xpack.actions.enabledActionTypes` {ess-icon}::
 A list of action types that are enabled. It defaults to `[*]`, enabling all types. The names for built-in {kib} action types are prefixed with a `.` and include: `.email`, `.index`, `.jira`, `.pagerduty`, `.resilient`, `.server-log`, `.servicenow`, .`servicenow-itom`, `.servicenow-sir`, `.slack`, `.swimlane`, `.teams`, `.xmatters`, and `.webhook`. An empty list `[]` will disable all action types.
 +
@@ -211,13 +216,26 @@ For example, `20m`, `24h`, `7d`, `1w`. Default: `5m`.
 `xpack.alerting.rules.run.ruleTypeOverrides`::
 Overrides the configs under `xpack.alerting.rules.run` for the rule type with the given ID. List the rule identifier and its settings in an array of objects.
 +
---
 For example:
-```
+[source,yaml]
+--
 xpack.alerting.rules.run:
     timeout: '5m'
     ruleTypeOverrides:
         - id: '.index-threshold'
           timeout: '15m'
-```
---
+--
+
+`xpack.alerting.rules.run.actions.connectorTypeOverrides`::
+Overrides the configs under `xpack.alerting.rules.run.actions` for the connector type with the given ID. List the connector type identifier and its settings in an array of objects.
++
+For example:
+[source,yaml]
+--
+xpack.alerting.rules.run:
+    actions:
+        max: 10
+        connectorTypeOverrides:
+            - id: '.server-log'
+              max: 5
+--

docs/settings/general-infra-logs-ui-settings.asciidoc

@@ -1,28 +1,7 @@
 
-`xpack.infra.sources.default.logAlias`::
-Index pattern for matching indices that contain log data. Defaults to `filebeat-*,kibana_sample_data_logs*`. To match multiple wildcard patterns, use a comma to separate the names, with no space after the comma. For example, `logstash-app1-*,default-logs-*`.
-
-`xpack.infra.sources.default.metricAlias`::
-Index pattern for matching indices that contain Metricbeat data. Defaults to `metricbeat-*`. To match multiple wildcard patterns, use a comma to separate the names, with no space after the comma. For example, `logstash-app1-*,default-logs-*`.
-
-`xpack.infra.sources.default.fields.timestamp`::
-Timestamp used to sort log entries. Defaults to `@timestamp`.
-
 `xpack.infra.sources.default.fields.message`::
 Fields used to display messages in the Logs app. Defaults to `['message', '@message']`.
 
-`xpack.infra.sources.default.fields.tiebreaker`::
-Field used to break ties between two entries with the same timestamp. Defaults to `_doc`.
-
-`xpack.infra.sources.default.fields.host`::
-Field used to identify hosts. Defaults to `host.name`.
-
-`xpack.infra.sources.default.fields.container`::
-Field used to identify Docker containers. Defaults to `container.id`.
-
-`xpack.infra.sources.default.fields.pod`::
-Field used to identify Kubernetes pods. Defaults to `kubernetes.pod.uid`.
-
 `xpack.infra.alerting.inventory_threshold.group_by_page_size`::
 Controls the size of the composite aggregations used by the Inventory Threshold to retrieve all the hosts. Defaults to `10_000`.
 

docs/user/alerting/troubleshooting/testing-connectors.asciidoc

@@ -39,6 +39,7 @@ $ kbn-action ls
             "service": null
         },
         "isPreconfigured": false,
+        "isDeprecated": false,
         "referencedByCount": 0
     }
 ]

package.json

@@ -250,6 +250,7 @@
     "deepmerge": "^4.2.2",
     "del": "^5.1.0",
     "elastic-apm-node": "^3.31.0",
+    "email-addresses": "^5.0.0",
     "execa": "^4.0.2",
     "exit-hook": "^2.2.0",
     "expiry-js": "0.1.7",
@@ -739,7 +740,7 @@
     "@types/redux-logger": "^3.0.8",
     "@types/resolve": "^1.20.1",
     "@types/seedrandom": ">=2.0.0 <4.0.0",
-    "@types/selenium-webdriver": "^4.0.18",
+    "@types/selenium-webdriver": "^4.0.19",
     "@types/semver": "^7",
     "@types/set-value": "^2.0.0",
     "@types/sinon": "^7.0.13",

packages/kbn-ci-stats-reporter/src/ci_stats_reporter.ts

@@ -23,6 +23,18 @@ import type { CiStatsTestGroupInfo, CiStatsTestRun } from './ci_stats_test_group
 
 const BASE_URL = 'https://ci-stats.kibana.dev';
 
+function limitMetaStrings(meta: CiStatsMetadata) {
+  return Object.fromEntries(
+    Object.entries(meta).map(([key, value]) => {
+      if (typeof value === 'string' && value.length > 2000) {
+        return [key, value.slice(0, 2000)];
+      }
+
+      return [key, value];
+    })
+  );
+}
+
 /** A ci-stats metric record */
 export interface CiStatsMetric {
   /** Top-level categorization for the metric, e.g. "page load bundle size" */
@@ -138,7 +150,14 @@ export class CiStatsReporter {
     }
 
     const buildId = this.config?.buildId;
-    const timings = options.timings;
+    const timings = options.timings.map((timing) =>
+      timing.meta
+        ? {
+            ...timing,
+            meta: limitMetaStrings(timing.meta),
+          }
+        : timing
+    );
     const upstreamBranch = options.upstreamBranch ?? this.getUpstreamBranch();
     const kibanaUuid = options.kibanaUuid === undefined ? this.getKibanaUuid() : options.kibanaUuid;
     let email;

packages/kbn-optimizer/limits.yml

@@ -1,5 +1,6 @@
 pageLoadAssetSize:
   advancedSettings: 27596
+  actions: 20000
   alerting: 106936
   apm: 64385
   canvas: 1066647

packages/kbn-optimizer/src/babel_runtime_helpers/find_node_libs_browser_polyfills_in_entry_bundles.ts

@@ -0,0 +1,53 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import Path from 'path';
+
+import { run } from '@kbn/dev-utils';
+import { REPO_ROOT } from '@kbn/utils';
+
+import { OptimizerConfig } from '../optimizer';
+import { parseStats, inAnyEntryChunk } from './parse_stats';
+
+export async function runFindNodeLibsBrowserPolyfillsInEntryBundlesCli() {
+  run(async ({ log }) => {
+    const config = OptimizerConfig.create({
+      includeCoreBundle: true,
+      repoRoot: REPO_ROOT,
+    });
+
+    const paths = config.bundles.map((b) => Path.resolve(b.outputDir, 'stats.json'));
+
+    log.info('analyzing', paths.length, 'stats files');
+    log.verbose(paths);
+
+    const imports = new Set();
+    for (const path of paths) {
+      const stats = parseStats(path);
+
+      for (const module of stats.modules) {
+        if (!inAnyEntryChunk(stats, module)) {
+          continue;
+        }
+
+        // Relying on module name instead of actual imports because these are usual polyfills that assume the global
+        // Node.js environment when development (i.e.: Buffer doesn't require an import to be used).
+        if (module.name.includes('node-libs-browser/node_modules/')) {
+          imports.add(module.name);
+        }
+      }
+    }
+
+    log.success('found', imports.size, 'node-libs-browser/* imports in entry bundles');
+    log.write(
+      Array.from(imports, (i) => `'${i}',`)
+        .sort()
+        .join('\n')
+    );
+  });
+}

packages/kbn-optimizer/src/babel_runtime_helpers/index.ts

@@ -7,3 +7,4 @@
  */
 
 export * from './find_babel_runtime_helpers_in_entry_bundles';
+export * from './find_node_libs_browser_polyfills_in_entry_bundles';

packages/kbn-optimizer/src/babel_runtime_helpers/parse_stats.ts

@@ -20,6 +20,7 @@ const partialObject = <P extends Props>(props: P) => {
 export type Module = TypeOf<typeof moduleSchema>;
 const moduleSchema = partialObject({
   identifier: schema.string(),
+  name: schema.string(),
   chunks: schema.arrayOf(schema.oneOf([schema.string(), schema.number()])),
   reasons: schema.arrayOf(
     partialObject({