Merge branch 'main' into szaffarano/license-info-enrichment

.buildkite/pipelines/security_solution_quality_gate/mki_quality_gate/mki_quality_gate_rule_management.yml

@@ -22,7 +22,7 @@ steps:
               limit: 1
 
       - command: .buildkite/scripts/pipelines/security_solution_quality_gate/security_solution_cypress/mki_security_solution_cypress.sh cypress:run:qa:serverless:rule_management:prebuilt_rules
-        label: "Cypress MKI - Rule Management - Prebuilt Rules
+        label: "Cypress MKI - Rule Management - Prebuilt Rules"
         key: test_rule_management_prebuilt_rules
         env:
           BK_TEST_SUITE_KEY: "serverless-cypress-rule-management"

.github/CODEOWNERS

@@ -507,6 +507,7 @@ x-pack/plugins/integration_assistant @elastic/security-solution
 src/plugins/interactive_setup @elastic/kibana-security
 test/interactive_setup_api_integration/plugins/test_endpoints @elastic/kibana-security
 packages/kbn-interpreter @elastic/kibana-visualizations
+x-pack/plugins/observability_solution/investigate_app @elastic/obs-ai-assistant
 x-pack/plugins/observability_solution/investigate @elastic/obs-ux-management-team
 packages/kbn-io-ts-utils @elastic/obs-knowledge-team
 packages/kbn-ipynb @elastic/search-kibana

docs/developer/plugin-list.asciidoc

@@ -647,6 +647,10 @@ the infrastructure monitoring use-case within Kibana.
 |undefined
 
 
+|{kib-repo}blob/{branch}/x-pack/plugins/observability_solution/investigate_app/README.md[investigateApp]
+|undefined
+
+
 |{kib-repo}blob/{branch}/x-pack/plugins/kubernetes_security/README.md[kubernetesSecurity]
 |This plugin provides interactive visualizations of your Kubernetes workload and session data.
 

docs/management/action-types.asciidoc

@@ -16,6 +16,10 @@ a| <<cases-action-type,Cases>>
 
 | Add alerts to cases.
 
+a| <<crowdstrike-action-type,CrowdStrike>>
+
+| Send a request to CrowdStrike.
+
 a| <<d3security-action-type,D3 Security>>
 
 | Send a request to D3 Security.

docs/management/connectors/action-types/crowdstrike.asciidoc

@@ -0,0 +1,40 @@
+[[crowdstrike-action-type]]
+== CrowdStrike connector
+++++
+<titleabbrev>CrowdStrike</titleabbrev>
+++++
+:frontmatter-description: Add a connector that can use the CrowdStrike API to send actions.
+:frontmatter-tags-products: [kibana] 
+:frontmatter-tags-content-type: [how-to] 
+:frontmatter-tags-user-goals: [configure]
+
+preview::[]
+
+The CrowdStrike connector communicates with CrowdStrike Management Console via REST API.
+
+[float]
+[[define-crowdstrike-ui]]
+=== Create connectors in {kib}
+
+You can create connectors in *{stack-manage-app} > {connectors-ui}*. For example:
+
+[role="screenshot"]
+image::management/connectors/images/crowdstrike-connector.png[Crowdstrike connector]
+// NOTE: This is an autogenerated screenshot. Do not edit it directly.
+
+[float]
+[[crowdstrike-connector-configuration]]
+==== Connector configuration
+
+CrowdStrike connectors have the following configuration properties:
+
+CrowdStrike API URL:: The CrowdStrike tenant URL. If you are using the <<action-settings,`xpack.actions.allowedHosts`>> setting, make sure the hostname is added to the allowed hosts.
+CrowdStrike Client ID::  A CrowdStrike API client ID.
+Client Secret::  A CrowdStrike API client secret created by the user.
+
+
+[float]
+[[crowdstrike-action-parameters]]
+=== Test connectors
+
+At this time, you cannot test the CrowdStrike connector.

docs/management/connectors/index.asciidoc

@@ -1,5 +1,6 @@
 include::action-types/bedrock.asciidoc[leveloffset=+1]
 include::action-types/cases-action-type.asciidoc[leveloffset=+1]
+include::action-types/crowdstrike.asciidoc[leveloffset=+1]
 include::action-types/d3security.asciidoc[leveloffset=+1]
 include::action-types/email.asciidoc[leveloffset=+1]
 include::action-types/gemini.asciidoc[leveloffset=+1]

docs/settings/fleet-settings.asciidoc

@@ -311,4 +311,10 @@ List of proxies to access {fleet-server} that are configured when the {fleet} ap
 `xpack.fleet.enableExperimental`::
 List of experimental feature flag to enable in Fleet.
 
+[NOTE]
+====
+Experimental features should not be enabled in production environments.
+The features in this section are experimental and may be changed or removed completely in future releases.
+Elastic will make a best effort to fix any issues, but experimental features are not supported to the same level as generally available (GA) features.
+====
 

docs/user/ml/index.asciidoc

@@ -178,8 +178,6 @@ image::user/ml/images/ml-log-rate-analysis.png[Log rate spike explained]
 [[log-pattern-analysis]]
 === Log pattern analysis
 
-preview::[]
-
 // The following intro is used on the `run-pattern-analysis-discover` page.
 //tag::log-pattern-analysis-intro[]
 Log pattern analysis helps you to find patterns in unstructured log messages and 

examples/controls_example/public/react_controls/data_controls/data_control_editor.tsx

@@ -147,6 +147,7 @@ export const DataControlEditor = <State extends DataControlEditorState = DataCon
     initialState.controlType
   );
   const [controlEditorValid, setControlEditorValid] = useState<boolean>(false);
+
   /** TODO: Make `editorConfig`  work when refactoring the `ControlGroupRenderer` */
   // const editorConfig = controlGroup.getEditorConfig();
 
@@ -193,7 +194,6 @@ export const DataControlEditor = <State extends DataControlEditorState = DataCon
     const CustomSettings = controlFactory.CustomOptionsComponent;
 
     if (!CustomSettings) return;
-
     return (
       <EuiDescribedFormGroup
         ratio="third"
@@ -210,13 +210,13 @@ export const DataControlEditor = <State extends DataControlEditorState = DataCon
         data-test-subj="control-editor-custom-settings"
       >
         <CustomSettings
-          initialState={initialState}
+          currentState={editorState}
           updateState={(newState) => setEditorState({ ...editorState, ...newState })}
           setControlEditorValid={setControlEditorValid}
         />
       </EuiDescribedFormGroup>
     );
-  }, [fieldRegistry, selectedControlType, editorState, initialState]);
+  }, [fieldRegistry, selectedControlType, editorState]);
 
   return (
     <>

examples/controls_example/public/react_controls/data_controls/initialize_data_control.tsx

@@ -139,7 +139,7 @@ export const initializeDataControl = <EditorState extends object = {}>(
           );
         } else {
           // replace the control with a new one of the updated type
-          controlGroup.replacePanel(controlId, { panelType: newType, initialState });
+          controlGroup.replacePanel(controlId, { panelType: newType, initialState: newState });
         }
       },
       initialState: {

examples/controls_example/public/react_controls/data_controls/range_slider/get_range_slider_control_factory.test.tsx

@@ -248,7 +248,7 @@ describe('RangesliderControlApi', () => {
       const CustomSettings = factory.CustomOptionsComponent!;
       const component = render(
         <CustomSettings
-          initialState={{}}
+          currentState={{}}
           updateState={jest.fn()}
           setControlEditorValid={jest.fn()}
         />
@@ -263,7 +263,7 @@ describe('RangesliderControlApi', () => {
       const CustomSettings = factory.CustomOptionsComponent!;
       const component = render(
         <CustomSettings
-          initialState={{}}
+          currentState={{}}
           updateState={jest.fn()}
           setControlEditorValid={setControlEditorValid}
         />

examples/controls_example/public/react_controls/data_controls/range_slider/get_range_slider_control_factory.tsx

@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import React, { useEffect, useMemo, useState } from 'react';
+import React, { useEffect, useMemo } from 'react';
 import deepEqual from 'react-fast-compare';
 
 import { EuiFieldNumber, EuiFormRow } from '@elastic/eui';
@@ -38,17 +38,15 @@ export const getRangesliderControlFactory = (
     isFieldCompatible: (field) => {
       return field.aggregatable && field.type === 'number';
     },
-    CustomOptionsComponent: ({ initialState, updateState, setControlEditorValid }) => {
-      const [step, setStep] = useState(initialState.step ?? 1);
-
+    CustomOptionsComponent: ({ currentState, updateState, setControlEditorValid }) => {
+      const step = currentState.step ?? 1;
       return (
         <>
           <EuiFormRow fullWidth label={RangeSliderStrings.editor.getStepTitle()}>
             <EuiFieldNumber
               value={step}
               onChange={(event) => {
                 const newStep = event.target.valueAsNumber;
-                setStep(newStep);
                 updateState({ step: newStep });
                 setControlEditorValid(newStep > 0);
               }}

examples/controls_example/public/react_controls/data_controls/search_control/get_search_control_factory.tsx

@@ -6,7 +6,7 @@
  * Side Public License, v 1.
  */
 
-import React, { useEffect, useState } from 'react';
+import React, { useEffect } from 'react';
 import deepEqual from 'react-fast-compare';
 import { BehaviorSubject, combineLatest, debounceTime, distinctUntilChanged } from 'rxjs';
 
@@ -65,17 +65,15 @@ export const getSearchControlFactory = ({
         (field.spec.esTypes ?? []).includes('text')
       );
     },
-    CustomOptionsComponent: ({ initialState, updateState }) => {
-      const [searchTechnique, setSearchTechnique] = useState(initialState.searchTechnique);
-
+    CustomOptionsComponent: ({ currentState, updateState }) => {
+      const searchTechnique = currentState.searchTechnique ?? DEFAULT_SEARCH_TECHNIQUE;
       return (
         <EuiFormRow label={'Searching'} data-test-subj="searchControl__searchOptionsRadioGroup">
           <EuiRadioGroup
             options={allSearchOptions}
-            idSelected={searchTechnique ?? DEFAULT_SEARCH_TECHNIQUE}
+            idSelected={searchTechnique}
             onChange={(id) => {
               const newSearchTechnique = id as SearchControlTechniques;
-              setSearchTechnique(newSearchTechnique);
               updateState({ searchTechnique: newSearchTechnique });
             }}
           />

examples/controls_example/public/react_controls/data_controls/types.ts

@@ -30,7 +30,7 @@ export interface DataControlFactory<
 > extends ControlFactory<State, Api> {
   isFieldCompatible: (field: DataViewField) => boolean;
   CustomOptionsComponent?: React.FC<{
-    initialState: Omit<State, keyof DefaultDataControlState>;
+    currentState: Partial<State>;
     updateState: (newState: Partial<State>) => void;
     setControlEditorValid: (valid: boolean) => void;
   }>;

package.json

@@ -545,6 +545,7 @@
     "@kbn/interactive-setup-plugin": "link:src/plugins/interactive_setup",
     "@kbn/interactive-setup-test-endpoints-plugin": "link:test/interactive_setup_api_integration/plugins/test_endpoints",
     "@kbn/interpreter": "link:packages/kbn-interpreter",
+    "@kbn/investigate-app-plugin": "link:x-pack/plugins/observability_solution/investigate_app",
     "@kbn/investigate-plugin": "link:x-pack/plugins/observability_solution/investigate",
     "@kbn/io-ts-utils": "link:packages/kbn-io-ts-utils",
     "@kbn/ipynb": "link:packages/kbn-ipynb",
@@ -1058,6 +1059,7 @@
     "he": "^1.2.0",
     "history": "^4.9.0",
     "hjson": "3.2.1",
+    "html2canvas": "^1.4.1",
     "http-proxy-agent": "^5.0.0",
     "https-proxy-agent": "^5.0.1",
     "i18n-iso-countries": "^4.3.1",
@@ -1741,7 +1743,7 @@
     "svgo": "^2.8.0",
     "table": "^6.8.1",
     "tape": "^5.0.1",
-    "terser": "^5.31.1",
+    "terser": "^5.31.2",
     "terser-webpack-plugin": "^4.2.3",
     "tough-cookie": "^4.1.4",
     "tree-kill": "^1.2.2",

packages/deeplinks/observability/constants.ts

@@ -24,6 +24,8 @@ export const SLO_APP_ID = 'slo';
 
 export const AI_ASSISTANT_APP_ID = 'observabilityAIAssistant';
 
+export const INVESTIGATE_APP_ID = 'investigate';
+
 export const OBLT_UX_APP_ID = 'ux';
 
 export const OBLT_PROFILING_APP_ID = 'profiling';

packages/kbn-io-ts-utils/src/strict_keys_rt/index.test.ts

@@ -12,6 +12,7 @@ import { strictKeysRt } from '.';
 import { jsonRt } from '../json_rt';
 import { PathReporter } from 'io-ts/lib/PathReporter';
 import { isoToEpochRt } from '../iso_to_epoch_rt';
+import { toBooleanRt } from '../to_boolean_rt';
 
 describe('strictKeysRt', () => {
   it('correctly and deeply validates object keys', () => {
@@ -238,6 +239,33 @@ describe('strictKeysRt', () => {
     });
   });
 
+  it('deals with union types', () => {
+    const type = t.intersection([
+      t.type({
+        required: t.string,
+      }),
+      t.partial({
+        disable: t.union([
+          toBooleanRt,
+          t.type({
+            except: t.array(t.string),
+          }),
+        ]),
+      }),
+    ]);
+
+    const value = {
+      required: 'required',
+      disable: {
+        except: ['foo'],
+      },
+    };
+
+    const asStrictType = strictKeysRt(type);
+
+    expect(isRight(asStrictType.decode(value))).toBe(true);
+  });
+
   it('does not support piped types', () => {
     const typeA = t.type({
       query: t.type({ filterNames: jsonRt.pipe(t.array(t.string)) }),

packages/kbn-io-ts-utils/src/to_boolean_rt/index.ts

@@ -8,10 +8,23 @@
 
 import * as t from 'io-ts';
 
+export function isPrimitive(value: unknown): value is string | number | boolean | null | undefined {
+  return (
+    typeof value === 'string' ||
+    typeof value === 'number' ||
+    typeof value === 'boolean' ||
+    value === null ||
+    value === undefined
+  );
+}
+
 export const toBooleanRt = new t.Type<boolean, boolean, unknown>(
   'ToBoolean',
   t.boolean.is,
-  (input) => {
+  (input, context) => {
+    if (!isPrimitive(input)) {
+      return t.failure(input, context);
+    }
     let value: boolean;
     if (typeof input === 'string') {
       value = input === 'true';

packages/kbn-monaco/src/monaco_imports.ts

@@ -30,6 +30,8 @@ import 'monaco-editor/esm/vs/editor/contrib/codeAction/browser/codeActionContrib
 import 'monaco-editor/esm/vs/editor/contrib/codeAction/browser/codeActionMenu.js';
 import 'monaco-editor/esm/vs/editor/contrib/codeAction/browser/codeActionModel.js';
 
+import 'monaco-editor/esm/vs/editor/contrib/find/browser/findController'; // Needed for Search bar functionality
+
 import 'monaco-editor/esm/vs/language/json/monaco.contribution.js';
 import 'monaco-editor/esm/vs/basic-languages/javascript/javascript.contribution.js'; // Needed for basic javascript support
 import 'monaco-editor/esm/vs/basic-languages/xml/xml.contribution.js'; // Needed for basic xml support

packages/kbn-optimizer/limits.yml

@@ -86,6 +86,7 @@ pageLoadAssetSize:
   integrationAssistant: 19524
   interactiveSetup: 80000
   investigate: 17970
+  investigateApp: 91898
   kibanaOverview: 56279
   kibanaReact: 74422
   kibanaUsageCollection: 16463