[Security Solution][Detections] Manage Alerts persona can only manage alerts on Rule Details, not the Alerts page

[spong]

Verified on 7.17.0 cloud (and later verified in 8.x), when having read Kibana Space Security feature privileges (along with the ES index privileges outlined in the docs for the manage alerts action) the user should be able to mark alerts as open/ack/closed. In testing I'm seeing that on the main Alerts page the checkbox and utility bar action is missing (and so you can't interact with alerts), however when navigating to a specific Rule Details, you can indeed interact with the alerts.

Alerts Page

Rule Details

Note: there is an open 7.x docs issue for clarifying that read Kibana Space Security feature privileges are required to prevent the managing of Rules but still allow managing alerts.

cc @MadameSheema @peluja1012 @jethr0null @rylnd

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[ghost]

Hi @spong,

We have validated above issue on 8.1.0 BC2 build and it is occurring here as well.

Build Info:
Version: 8.1.0
Build: 50222
Commit: ee89ebfddeda3baaf6cd87c0299247c5248cb952

Screenshots:

Thanks !

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[spong]

Linking @dhurley14's POC around improving privilege checks in code: #126165.

[MadameSheema]

@marshallmain as the last 8.1.0BC has been already built, please update version labels ;)

[marshallmain]

Closing as the linked PR fixes this issue

[marshallmain]

@karanverma-qasource Can you verify the fix on 7.17.2, 8.1.1, and 8.2?

[ghost]

Hi @marshallmain ,

we have validated above issue on 7.17.2, 8.1.1 and 8.2.0 builds, and it's working fine. 🟢

Build Details:

Version: 7.17.2
Build: 46734
Commit: 07cff2b713ccaea7caa78c054848de6cc2ba0331

Version: 8.1.1
Build: 50609
Commit: 0a94c82a3656a1600666ba9beb0f0b18ceb7464f

Version: 8.2.0
Build: 52005
Commit: 9a5003d8cf0062bf24ef64d6712b44823888cc03

Screenshots:

7.17.2

8.1.1

8.2.0

Ticket got missed from our tracking so got delayed to share the observation.

Thanks!