[Cloud Security] [Vulnerability Management] Vulnerabilities index transform

[opauloh]

Summary

Create a Transform for the vulnerability management index, use as reference the initializeCspTransforms already defined in the plugins.ts

Tasks

• Add kibana_system Index privileges for vulnerabilities index
• Create Ingest Pipeline for vulnerabilities
• Create Indices for vulnerabilities
• Confirm unique keys to build the latest vulnerabilities transform
• Create transform for vulnerabilities

References

Transform API
plugin.ts
Vulnerabilities Schema Discussion
Index privileges PR

[elasticmachine]

Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security)

[Omolola-Akinleye]

@amirbenun Do we want to use resource.id and vulnerabilities.id as the unique keys to build transform?

cc: @opauloh @kfirpeled @eyalkraft

[amirbenun]

Seems to me that these together are almost enough to point to a unique vulnerability.
Having said that, I realize that an EC2 instance (resource.id) can have the same vulnerability (vulnerability.id) more than once, for example, if an EC2 instance runs 2 projects.
Maybe another parameter that can help us here is the file on which we detect the vulnerability, but I am not sure that trivy provides that information.
Based my comment on the example result we see here https://github.com/elastic/security-team/issues/5690

[eyalkraft]

@amirbenun
You raise an interesting point.
I think using resource.id, vulnerability.id, and possibly also package.version would be enough for first iteration.

[Omolola-Akinleye]

Elasticsearch Index Privileges PR - elastic/elasticsearch#94255