Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution][Investigations] - Add check for changing alert status from bulk options #170584

Merged
merged 4 commits into from
Nov 7, 2023
Merged

[Security Solution][Investigations] - Add check for changing alert status from bulk options #170584

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a19cc15
add alert table check for changing alert status
michaelolo24 Oct 24, 2023
05b18fd
add check for alert tags
michaelolo24 Oct 24, 2023
36ff150
skip current test
michaelolo24 Nov 3, 2023
4b0f44e
Merge branch 'main' into fix-alert-status-readonly
kibanamachine Nov 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions ...solution/public/common/components/toolbar/bulk_actions/use_bulk_alert_tags_items.test.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,12 @@ import { useUiSetting$ } from '../../../lib/kibana';

jest.mock('./use_set_alert_tags');
jest.mock('../../../lib/kibana');
jest.mock(
'../../../../detections/containers/detection_engine/alerts/use_alerts_privileges',
() => ({
useAlertsPrivileges: jest.fn().mockReturnValue({ hasIndexWrite: true }),
})
);

const defaultProps: UseBulkAlertTagsItemsProps = {
refetch: () => {},
Expand Down
49 changes: 30 additions & 19 deletions ...rity_solution/public/common/components/toolbar/bulk_actions/use_bulk_alert_tags_items.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
import { EuiFlexGroup, EuiIconTip, EuiFlexItem } from '@elastic/eui';
import type { RenderContentPanelProps } from '@kbn/triggers-actions-ui-plugin/public/types';
import React, { useCallback, useMemo } from 'react';
import { useAlertsPrivileges } from '../../../../detections/containers/detection_engine/alerts/use_alerts_privileges';
import { BulkAlertTagsPanel } from './alert_bulk_tags';
import * as i18n from './translations';
import { useSetAlertTags } from './use_set_alert_tags';
Expand All @@ -24,6 +25,7 @@ export interface UseBulkAlertTagsPanel {
}

export const useBulkAlertTagsItems = ({ refetch }: UseBulkAlertTagsItemsProps) => {
const { hasIndexWrite } = useAlertsPrivileges();
const setAlertTags = useSetAlertTags();
const handleOnAlertTagsSubmit = useCallback(
async (tags, ids, onSuccess, setIsLoading) => {
Expand All @@ -34,16 +36,22 @@ export const useBulkAlertTagsItems = ({ refetch }: UseBulkAlertTagsItemsProps) =
[setAlertTags]
);

const alertTagsItems = [
{
key: 'manage-alert-tags',
'data-test-subj': 'alert-tags-context-menu-item',
name: i18n.ALERT_TAGS_CONTEXT_MENU_ITEM_TITLE,
panel: 1,
label: i18n.ALERT_TAGS_CONTEXT_MENU_ITEM_TITLE,
disableOnQuery: true,
},
];
const alertTagsItems = useMemo(
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess I will need to do the same in my PR here https://github.com/elastic/kibana/pull/170579/files#diff-0ae8cbf7c5c94adb495f9faff8a4ace978f69f2e048018ae8c1b9767d0b738d8R39 for alert assignments.

() =>
hasIndexWrite
? [
{
key: 'manage-alert-tags',
'data-test-subj': 'alert-tags-context-menu-item',
name: i18n.ALERT_TAGS_CONTEXT_MENU_ITEM_TITLE,
panel: 1,
label: i18n.ALERT_TAGS_CONTEXT_MENU_ITEM_TITLE,
disableOnQuery: true,
},
]
: [],
[hasIndexWrite]
);

const TitleContent = useMemo(
() => (
Expand Down Expand Up @@ -79,15 +87,18 @@ export const useBulkAlertTagsItems = ({ refetch }: UseBulkAlertTagsItemsProps) =
);

const alertTagsPanels: UseBulkAlertTagsPanel[] = useMemo(
() => [
{
id: 1,
title: TitleContent,
'data-test-subj': 'alert-tags-context-menu-panel',
renderContent,
},
],
[TitleContent, renderContent]
() =>
hasIndexWrite
? [
{
id: 1,
title: TitleContent,
'data-test-subj': 'alert-tags-context-menu-panel',
renderContent,
},
]
: [],
[TitleContent, hasIndexWrite, renderContent]
);

return {
Expand Down
10 changes: 7 additions & 3 deletions ...curity_solution/public/detections/hooks/trigger_actions_alert_table/use_alert_actions.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ import type { AlertWorkflowStatus } from '../../../common/types';
import { FILTER_CLOSED, FILTER_OPEN, FILTER_ACKNOWLEDGED } from '../../../../common/types';
import * as i18n from '../translations';
import { buildTimeRangeFilter } from '../../components/alerts_table/helpers';
import { useAlertsPrivileges } from '../../containers/detection_engine/alerts/use_alerts_privileges';

interface UseBulkAlertActionItemsArgs {
/* Table ID for which this hook is being used */
Expand All @@ -41,6 +42,7 @@ export const useBulkAlertActionItems = ({
to,
refetch: refetchProp,
}: UseBulkAlertActionItemsArgs) => {
const { hasIndexWrite } = useAlertsPrivileges();
const { startTransaction } = useStartTransaction();

const { addSuccess, addError, addWarning } = useAppToasts();
Expand Down Expand Up @@ -172,7 +174,9 @@ export const useBulkAlertActionItems = ({
[getOnAction]
);

return [FILTER_OPEN, FILTER_CLOSED, FILTER_ACKNOWLEDGED].map((status) =>
getUpdateAlertStatusAction(status as AlertWorkflowStatus)
);
return hasIndexWrite
? [FILTER_OPEN, FILTER_CLOSED, FILTER_ACKNOWLEDGED].map((status) =>
getUpdateAlertStatusAction(status as AlertWorkflowStatus)
)
: [];
};
46 changes: 41 additions & 5 deletions ...urity_solution_cypress/cypress/e2e/detection_response/detection_alerts/alert_status.cy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,16 @@
* 2.0.
*/

import { ROLES } from '@kbn/security-solution-plugin/common/test';
import { getNewRule } from '../../../objects/rule';
import { ALERTS_COUNT, SELECTED_ALERTS } from '../../../screens/alerts';
import {
ALERTS_COUNT,
CLOSE_SELECTED_ALERTS_BTN,
MARK_ALERT_ACKNOWLEDGED_BTN,
SELECTED_ALERTS,
TAKE_ACTION_POPOVER_BTN,
TIMELINE_CONTEXT_MENU_BTN,
} from '../../../screens/alerts';

import {
selectNumberOfAlerts,
Expand All @@ -30,12 +38,12 @@ import { visit } from '../../../tasks/navigation';
import { ALERTS_URL } from '../../../urls/navigation';

// FLAKY: https://github.com/elastic/kibana/issues/169091
describe('Changing alert status', { tags: ['@ess', '@serverless'] }, () => {
describe('Changing alert status', () => {
before(() => {
cy.task('esArchiverLoad', { archiveName: 'auditbeat_big' });
});

context('Opening alerts', () => {
context('Opening alerts', { tags: ['@ess', '@serverless'] }, () => {
beforeEach(() => {
login();
deleteAlertsAndRules();
Expand Down Expand Up @@ -116,7 +124,7 @@ describe('Changing alert status', { tags: ['@ess', '@serverless'] }, () => {
});
});

context('Marking alerts as acknowledged', () => {
context('Marking alerts as acknowledged', { tags: ['@ess', '@serverless'] }, () => {
beforeEach(() => {
login();
deleteAlertsAndRules();
Expand Down Expand Up @@ -167,7 +175,7 @@ describe('Changing alert status', { tags: ['@ess', '@serverless'] }, () => {
});
});

context('Closing alerts', () => {
context('Closing alerts', { tags: ['@ess', '@serverless'] }, () => {
beforeEach(() => {
login();
deleteAlertsAndRules();
Expand Down Expand Up @@ -228,4 +236,32 @@ describe('Changing alert status', { tags: ['@ess', '@serverless'] }, () => {
});
});
});

// This test is unable to be run in serverless as `reader` is not available and viewer is currently reserved
// https://github.com/elastic/kibana/pull/169723#issuecomment-1793191007
// https://github.com/elastic/kibana/issues/170583
context('User is readonly', { tags: ['@ess', '@brokenInServerless'] }, () => {
beforeEach(() => {
login();
visit(ALERTS_URL);
deleteAlertsAndRules();
createRule(getNewRule());
login(ROLES.reader);
visit(ALERTS_URL, { role: ROLES.reader });
waitForAlertsToPopulate();
});
it('should not allow users to change a single alert status', () => {
// This is due to the reader role which makes everything in security 'read only'
cy.get(TIMELINE_CONTEXT_MENU_BTN).should('not.exist');
});

it('should not allow users to bulk change the alert status', () => {
selectNumberOfAlerts(2);
cy.get(TAKE_ACTION_POPOVER_BTN).first().click();
cy.get(TAKE_ACTION_POPOVER_BTN).should('be.visible');

cy.get(CLOSE_SELECTED_ALERTS_BTN).should('not.exist');
cy.get(MARK_ALERT_ACKNOWLEDGED_BTN).should('not.exist');
});
});
});
Loading