[8.x] [ResponseOps][Alerting] Register anomaly detection and custom threshold rule types under stack alerts feature privilege (#194615) #195171
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ld rule types under stack alerts feature privilege (elastic#194615) ## Summary In the ES query, anomaly detection, and custom threshold rule types users can use the "Role visibility" dropdown to select where the rules should be accessible. The "Role visibility" dropdown sets the `consumer` which is paramount for alerting RBAC. For the anomaly detection and custom threshold rule types if the `consumer` is set to `stackAlerts` then the rules will not be accessible from any rule page even if the user has access to the "Stack alerts" feature privilege. This PR fixes this bug. Fixes elastic#193549 Fixes elastic#191075 Fixes elastic#184422 Fixes elastic#179082 ## Testing 1. Create an anomaly detection and custom threshold rule and set the "Role visibility" to "Stack alerts". 2. Create a user with access only to "Stack alerts". 3. Login with the user created in Step 2. 4. Verify that you can see the rules from the stack management page. 5. Verify that you can see the alerts generated from the rules. 6. Create a user with roles `kibana_admin` and verify the same. ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [x] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) ## Release notes Fix bug where rule types with "Stack alerts" role visibility are not being shown in the stack management page (cherry picked from commit 8d83a07)
3 tasks
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
💚 Build Succeeded
Metrics [docs]
To update your PR or re-run it, just comment with: cc @cnasikas |
cnasikas
added a commit
that referenced
this pull request
Oct 7, 2024
…threshold rule types under stack alerts feature privilege (#194615) (#195173) # Backport This will backport the following commits from `main` to `8.15`: - [[ResponseOps][Alerting] Register anomaly detection and custom threshold rule types under stack alerts feature privilege (#194615)](#194615) <!--- Backport version: 8.9.8 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Christos Nasikas","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-10-06T11:46:44Z","message":"[ResponseOps][Alerting] Register anomaly detection and custom threshold rule types under stack alerts feature privilege (#194615)\n\n## Summary\r\n\r\nIn the ES query, anomaly detection, and custom threshold rule types\r\nusers can use the \"Role visibility\" dropdown to select where the rules\r\nshould be accessible. The \"Role visibility\" dropdown sets the `consumer`\r\nwhich is paramount for alerting RBAC. For the anomaly detection and\r\ncustom threshold rule types if the `consumer` is set to `stackAlerts`\r\nthen the rules will not be accessible from any rule page even if the\r\nuser has access to the \"Stack alerts\" feature privilege. This PR fixes\r\nthis bug.\r\n\r\nFixes https://github.com/elastic/kibana/issues/193549\r\nFixes https://github.com/elastic/kibana/issues/191075\r\nFixes https://github.com/elastic/kibana/issues/184422\r\nFixes https://github.com/elastic/kibana/issues/179082\r\n\r\n## Testing\r\n\r\n1. Create an anomaly detection and custom threshold rule and set the\r\n\"Role visibility\" to \"Stack alerts\".\r\n2. Create a user with access only to \"Stack alerts\".\r\n3. Login with the user created in Step 2.\r\n4. Verify that you can see the rules from the stack management page.\r\n5. Verify that you can see the alerts generated from the rules.\r\n6. Create a user with roles `kibana_admin` and verify the same.\r\n\r\n\r\n### Checklist\r\n\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n- [x] [Flaky Test\r\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was\r\nused on any tests changed\r\n\r\n### For maintainers\r\n\r\n- [x] This was checked for breaking API changes and was [labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\r\n\r\n## Release notes\r\n\r\nFix bug where rule types with \"Stack alerts\" role visibility are not\r\nbeing shown in the stack management page","sha":"8d83a075f6228bb5a6e35a9bb4654fe29cee0cff","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["bug","release_note:fix","Team:ResponseOps","v9.0.0","Feature:Alerting/RulesFramework","backport:prev-major","v8.16.0","v8.15.3"],"number":194615,"url":"https://github.com/elastic/kibana/pull/194615","mergeCommit":{"message":"[ResponseOps][Alerting] Register anomaly detection and custom threshold rule types under stack alerts feature privilege (#194615)\n\n## Summary\r\n\r\nIn the ES query, anomaly detection, and custom threshold rule types\r\nusers can use the \"Role visibility\" dropdown to select where the rules\r\nshould be accessible. The \"Role visibility\" dropdown sets the `consumer`\r\nwhich is paramount for alerting RBAC. For the anomaly detection and\r\ncustom threshold rule types if the `consumer` is set to `stackAlerts`\r\nthen the rules will not be accessible from any rule page even if the\r\nuser has access to the \"Stack alerts\" feature privilege. This PR fixes\r\nthis bug.\r\n\r\nFixes https://github.com/elastic/kibana/issues/193549\r\nFixes https://github.com/elastic/kibana/issues/191075\r\nFixes https://github.com/elastic/kibana/issues/184422\r\nFixes https://github.com/elastic/kibana/issues/179082\r\n\r\n## Testing\r\n\r\n1. Create an anomaly detection and custom threshold rule and set the\r\n\"Role visibility\" to \"Stack alerts\".\r\n2. Create a user with access only to \"Stack alerts\".\r\n3. Login with the user created in Step 2.\r\n4. Verify that you can see the rules from the stack management page.\r\n5. Verify that you can see the alerts generated from the rules.\r\n6. Create a user with roles `kibana_admin` and verify the same.\r\n\r\n\r\n### Checklist\r\n\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n- [x] [Flaky Test\r\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was\r\nused on any tests changed\r\n\r\n### For maintainers\r\n\r\n- [x] This was checked for breaking API changes and was [labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\r\n\r\n## Release notes\r\n\r\nFix bug where rule types with \"Stack alerts\" role visibility are not\r\nbeing shown in the stack management page","sha":"8d83a075f6228bb5a6e35a9bb4654fe29cee0cff"}},"sourceBranch":"main","suggestedTargetBranches":["8.15"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","labelRegex":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/194615","number":194615,"mergeCommit":{"message":"[ResponseOps][Alerting] Register anomaly detection and custom threshold rule types under stack alerts feature privilege (#194615)\n\n## Summary\r\n\r\nIn the ES query, anomaly detection, and custom threshold rule types\r\nusers can use the \"Role visibility\" dropdown to select where the rules\r\nshould be accessible. The \"Role visibility\" dropdown sets the `consumer`\r\nwhich is paramount for alerting RBAC. For the anomaly detection and\r\ncustom threshold rule types if the `consumer` is set to `stackAlerts`\r\nthen the rules will not be accessible from any rule page even if the\r\nuser has access to the \"Stack alerts\" feature privilege. This PR fixes\r\nthis bug.\r\n\r\nFixes https://github.com/elastic/kibana/issues/193549\r\nFixes https://github.com/elastic/kibana/issues/191075\r\nFixes https://github.com/elastic/kibana/issues/184422\r\nFixes https://github.com/elastic/kibana/issues/179082\r\n\r\n## Testing\r\n\r\n1. Create an anomaly detection and custom threshold rule and set the\r\n\"Role visibility\" to \"Stack alerts\".\r\n2. Create a user with access only to \"Stack alerts\".\r\n3. Login with the user created in Step 2.\r\n4. Verify that you can see the rules from the stack management page.\r\n5. Verify that you can see the alerts generated from the rules.\r\n6. Create a user with roles `kibana_admin` and verify the same.\r\n\r\n\r\n### Checklist\r\n\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n- [x] [Flaky Test\r\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was\r\nused on any tests changed\r\n\r\n### For maintainers\r\n\r\n- [x] This was checked for breaking API changes and was [labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\r\n\r\n## Release notes\r\n\r\nFix bug where rule types with \"Stack alerts\" role visibility are not\r\nbeing shown in the stack management page","sha":"8d83a075f6228bb5a6e35a9bb4654fe29cee0cff"}},{"branch":"8.x","label":"v8.16.0","labelRegex":"^v8.16.0$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/195171","number":195171,"state":"MERGED","mergeCommit":{"sha":"a89a5388b4685304d2a1ec3e3d2ed8e75d833841","message":"[8.x] [ResponseOps][Alerting] Register anomaly detection and custom threshold rule types under stack alerts feature privilege (#194615) (#195171)\n\n# Backport\n\nThis will backport the following commits from `main` to `8.x`:\n- [[ResponseOps][Alerting] Register anomaly detection and custom\nthreshold rule types under stack alerts feature privilege\n(#194615)](https://github.com/elastic/kibana/pull/194615)\n\n<!--- Backport version: 9.4.3 -->\n\n### Questions ?\nPlease refer to the [Backport tool\ndocumentation](https://github.com/sqren/backport)\n\n<!--BACKPORT [{\"author\":{\"name\":\"Christos\nNasikas\",\"email\":\"[email protected]\"},\"sourceCommit\":{\"committedDate\":\"2024-10-06T11:46:44Z\",\"message\":\"[ResponseOps][Alerting]\nRegister anomaly detection and custom threshold rule types under stack\nalerts feature privilege (#194615)\\n\\n## Summary\\r\\n\\r\\nIn the ES query,\nanomaly detection, and custom threshold rule types\\r\\nusers can use the\n\\\"Role visibility\\\" dropdown to select where the rules\\r\\nshould be\naccessible. The \\\"Role visibility\\\" dropdown sets the\n`consumer`\\r\\nwhich is paramount for alerting RBAC. For the anomaly\ndetection and\\r\\ncustom threshold rule types if the `consumer` is set to\n`stackAlerts`\\r\\nthen the rules will not be accessible from any rule\npage even if the\\r\\nuser has access to the \\\"Stack alerts\\\" feature\nprivilege. This PR fixes\\r\\nthis bug.\\r\\n\\r\\nFixes\nhttps://github.com//issues/193549\\r\\nFixes\nhttps://github.com//issues/191075\\r\\nFixes\nhttps://github.com//issues/184422\\r\\nFixes\nhttps://github.com//issues/179082\\r\\n\\r\\n##\nTesting\\r\\n\\r\\n1. Create an anomaly detection and custom threshold rule\nand set the\\r\\n\\\"Role visibility\\\" to \\\"Stack alerts\\\".\\r\\n2. Create a\nuser with access only to \\\"Stack alerts\\\".\\r\\n3. Login with the user\ncreated in Step 2.\\r\\n4. Verify that you can see the rules from the\nstack management page.\\r\\n5. Verify that you can see the alerts\ngenerated from the rules.\\r\\n6. Create a user with roles `kibana_admin`\nand verify the same.\\r\\n\\r\\n\\r\\n### Checklist\\r\\n\\r\\n- [x] [Unit or\nfunctional\\r\\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\\r\\nwere\nupdated or added to match the most common scenarios\\r\\n- [x] [Flaky\nTest\\r\\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)\nwas\\r\\nused on any tests changed\\r\\n\\r\\n### For maintainers\\r\\n\\r\\n- [x]\nThis was checked for breaking API changes and was\n[labeled\\r\\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\\r\\n\\r\\n##\nRelease notes\\r\\n\\r\\nFix bug where rule types with \\\"Stack alerts\\\" role\nvisibility are not\\r\\nbeing shown in the stack management\npage\",\"sha\":\"8d83a075f6228bb5a6e35a9bb4654fe29cee0cff\",\"branchLabelMapping\":{\"^v9.0.0$\":\"main\",\"^v8.16.0$\":\"8.x\",\"^v(\\\\d+).(\\\\d+).\\\\d+$\":\"$1.$2\"}},\"sourcePullRequest\":{\"labels\":[\"bug\",\"release_note:fix\",\"Team:ResponseOps\",\"v9.0.0\",\"Feature:Alerting/RulesFramework\",\"backport:prev-major\",\"v8.16.0\",\"v8.15.3\"],\"title\":\"[ResponseOps][Alerting]\nRegister anomaly detection and custom threshold rule types under stack\nalerts feature\nprivilege\",\"number\":194615,\"url\":\"https://github.com/elastic/kibana/pull/194615\",\"mergeCommit\":{\"message\":\"[ResponseOps][Alerting]\nRegister anomaly detection and custom threshold rule types under stack\nalerts feature privilege (#194615)\\n\\n## Summary\\r\\n\\r\\nIn the ES query,\nanomaly detection, and custom threshold rule types\\r\\nusers can use the\n\\\"Role visibility\\\" dropdown to select where the rules\\r\\nshould be\naccessible. The \\\"Role visibility\\\" dropdown sets the\n`consumer`\\r\\nwhich is paramount for alerting RBAC. For the anomaly\ndetection and\\r\\ncustom threshold rule types if the `consumer` is set to\n`stackAlerts`\\r\\nthen the rules will not be accessible from any rule\npage even if the\\r\\nuser has access to the \\\"Stack alerts\\\" feature\nprivilege. This PR fixes\\r\\nthis bug.\\r\\n\\r\\nFixes\nhttps://github.com//issues/193549\\r\\nFixes\nhttps://github.com//issues/191075\\r\\nFixes\nhttps://github.com//issues/184422\\r\\nFixes\nhttps://github.com//issues/179082\\r\\n\\r\\n##\nTesting\\r\\n\\r\\n1. Create an anomaly detection and custom threshold rule\nand set the\\r\\n\\\"Role visibility\\\" to \\\"Stack alerts\\\".\\r\\n2. Create a\nuser with access only to \\\"Stack alerts\\\".\\r\\n3. Login with the user\ncreated in Step 2.\\r\\n4. Verify that you can see the rules from the\nstack management page.\\r\\n5. Verify that you can see the alerts\ngenerated from the rules.\\r\\n6. Create a user with roles `kibana_admin`\nand verify the same.\\r\\n\\r\\n\\r\\n### Checklist\\r\\n\\r\\n- [x] [Unit or\nfunctional\\r\\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\\r\\nwere\nupdated or added to match the most common scenarios\\r\\n- [x] [Flaky\nTest\\r\\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)\nwas\\r\\nused on any tests changed\\r\\n\\r\\n### For maintainers\\r\\n\\r\\n- [x]\nThis was checked for breaking API changes and was\n[labeled\\r\\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\\r\\n\\r\\n##\nRelease notes\\r\\n\\r\\nFix bug where rule types with \\\"Stack alerts\\\" role\nvisibility are not\\r\\nbeing shown in the stack management\npage\",\"sha\":\"8d83a075f6228bb5a6e35a9bb4654fe29cee0cff\"}},\"sourceBranch\":\"main\",\"suggestedTargetBranches\":[\"8.x\",\"8.15\"],\"targetPullRequestStates\":[{\"branch\":\"main\",\"label\":\"v9.0.0\",\"branchLabelMappingKey\":\"^v9.0.0$\",\"isSourceBranch\":true,\"state\":\"MERGED\",\"url\":\"https://github.com/elastic/kibana/pull/194615\",\"number\":194615,\"mergeCommit\":{\"message\":\"[ResponseOps][Alerting]\nRegister anomaly detection and custom threshold rule types under stack\nalerts feature privilege (#194615)\\n\\n## Summary\\r\\n\\r\\nIn the ES query,\nanomaly detection, and custom threshold rule types\\r\\nusers can use the\n\\\"Role visibility\\\" dropdown to select where the rules\\r\\nshould be\naccessible. The \\\"Role visibility\\\" dropdown sets the\n`consumer`\\r\\nwhich is paramount for alerting RBAC. For the anomaly\ndetection and\\r\\ncustom threshold rule types if the `consumer` is set to\n`stackAlerts`\\r\\nthen the rules will not be accessible from any rule\npage even if the\\r\\nuser has access to the \\\"Stack alerts\\\" feature\nprivilege. This PR fixes\\r\\nthis bug.\\r\\n\\r\\nFixes\nhttps://github.com//issues/193549\\r\\nFixes\nhttps://github.com//issues/191075\\r\\nFixes\nhttps://github.com//issues/184422\\r\\nFixes\nhttps://github.com//issues/179082\\r\\n\\r\\n##\nTesting\\r\\n\\r\\n1. Create an anomaly detection and custom threshold rule\nand set the\\r\\n\\\"Role visibility\\\" to \\\"Stack alerts\\\".\\r\\n2. Create a\nuser with access only to \\\"Stack alerts\\\".\\r\\n3. Login with the user\ncreated in Step 2.\\r\\n4. Verify that you can see the rules from the\nstack management page.\\r\\n5. Verify that you can see the alerts\ngenerated from the rules.\\r\\n6. Create a user with roles `kibana_admin`\nand verify the same.\\r\\n\\r\\n\\r\\n### Checklist\\r\\n\\r\\n- [x] [Unit or\nfunctional\\r\\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\\r\\nwere\nupdated or added to match the most common scenarios\\r\\n- [x] [Flaky\nTest\\r\\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)\nwas\\r\\nused on any tests changed\\r\\n\\r\\n### For maintainers\\r\\n\\r\\n- [x]\nThis was checked for breaking API changes and was\n[labeled\\r\\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\\r\\n\\r\\n##\nRelease notes\\r\\n\\r\\nFix bug where rule types with \\\"Stack alerts\\\" role\nvisibility are not\\r\\nbeing shown in the stack management\npage\",\"sha\":\"8d83a075f6228bb5a6e35a9bb4654fe29cee0cff\"}},{\"branch\":\"8.x\",\"label\":\"v8.16.0\",\"branchLabelMappingKey\":\"^v8.16.0$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"},{\"branch\":\"8.15\",\"label\":\"v8.15.3\",\"branchLabelMappingKey\":\"^v(\\\\d+).(\\\\d+).\\\\d+$\",\"isSourceBranch\":false,\"state\":\"NOT_CREATED\"}]}]\nBACKPORT-->\n\nCo-authored-by: Christos Nasikas <[email protected]>"}},{"branch":"8.15","label":"v8.15.3","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT-->
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport
This will backport the following commits from
mainto8.x:Questions ?
Please refer to the Backport tool documentation