[Security Solution] Top-level Cases feature under the Security #112980

XavierM · 2021-09-23T14:18:07Z

Summary

Create new top-level Cases feature under the Security category just for 8.x, we will have a follow up PR for 7.x to deprecate the sub feature of cases into the top level feature

#109158

Checklist

Delete any items that are not applicable to this PR.

Unit or functional tests were updated or added to match the most common scenarios

elasticmachine · 2021-09-23T14:18:10Z

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

elasticmachine · 2021-09-23T14:18:11Z

Pinging @elastic/security-threat-hunting-cases (Team:Threat Hunting:Cases)

XavierM · 2021-09-23T18:06:41Z

@elasticmachine merge upstream

…M/kibana into upgrade-cases-security-privileges

…-security-privileges

XavierM · 2021-09-27T12:59:44Z

@elasticmachine merge upstream

semd · 2021-09-27T13:10:50Z

x-pack/plugins/security_solution/public/app/deep_links/index.ts

@@ -349,7 +350,7 @@ export function getDeepLinks(
      (deepLink) =>
        (deepLink.id !== SecurityPageName.case && deepLink.id !== SecurityPageName.ueba) || // is not cases or ueba
        (deepLink.id === SecurityPageName.case &&
-          (capabilities == null || capabilities.siem.read_cases === true)) || // is cases with at least read only caps
+          (capabilities == null || capabilities[CASES_FEATURE_ID].read_cases === true)) || // is cases with at least read only caps


I have a conflicting PR #113046 but no worries I will sync mine when this one is merged

jonathan-buttner

Code changes look good. I tested this locally too 👍

One thing I did notice that is slightly different behavior than before is that a user can have cases read or all and not have security and they will not be able to access cases because the entire security plugin will be disabled.

This is slightly different from how it worked as a sub feature because it was not possible to grant cases privileges when the security privilege was set to none

The toggle is grayed out:

XavierM · 2021-09-27T17:23:51Z

@jonathan-buttner that's a valid point, let me see what I can do here and let me talk to @semd and see if we can register cases routes outside.

semd · 2021-09-28T10:06:59Z

@XavierM
About that:

@jonathan-buttner that's a valid point, let me see what I can do here and let me talk to @semd and see if we can register cases routes outside.

Currently, the Cases routes are defined outside the plugin, the SecuritySolutions and O11y plugins define the Cases routes and deep links, and then they import and render the Cases pages accordingly. This is something we'd like to change and define all the routes within the Cases plugin, so there is only one entry point, but right now it is the parent plugin responsibility.
In addition, we would need to implement the main app components and logic in Cases plugin to render it as a "standalone" plugin, which does not exist right now.

So, maybe another option would be to register and mount SecuritySolutions plugin anyway (even I am not sure how to do it), and have only the Cases pages visible, hiding the rest of the sections.

Or otherwise, keep the same precedence and not show Cases if Security is disabled, while we prepare the Cases plugin to be rendered alone. 🤷‍♂️

What do you think? @cnasikas

…-security-privileges

jportner

LGTM, a couple minor nits below.
Discussed offline that a follow-on PR will be submitted to deal with a user who has access to Cases but not the Security Solution.

x-pack/plugins/security_solution/public/common/lib/kibana/hooks.ts

x-pack/plugins/security_solution/server/features.ts

…-security-privileges

kibanamachine · 2021-10-01T00:18:23Z

💛 Build succeeded, but was flaky

continuous-integration/kibana-ci/pull-request
Commit: 19897a7
Storybooks Preview
Documentation Changes
Flaky suites:
- xpack-securitySolutionCypressChrome

Test Failures

Kibana Pipeline / general / Should have the same query and open the timeline modal.Create a timeline from a template Should have the same query and open the timeline modal

Link to Jenkins

Stack Trace

Failed Tests Reporter:
  - Test has not failed recently on tracked branches

CypressError: Timed out retrying after 60050ms: `cy.click()` failed because this element:

`<button class="euiButtonIcon euiButtonIcon--text euiButtonIcon--empty euiButtonIcon--xSmall" type="button" aria-label="All actions" data-test-subj="euiCollapsedItemActionsButton">...</button>`

is being covered by another element:

`<div class="euiFlexGroup euiFlexGroup--alignItemsCenter euiFlexGroup--directionRow euiFlexGroup--responsive" aria-label="You are in group 1">...</div>`

Fix this problem, or use {force: true} to disable error checking.

https://on.cypress.io/element-cannot-be-interacted-with
    at $Cy.ensureDescendents (http://elastic:changeme@localhost:61161/__cypress/runner/cypress_runner.js:160669:87)
    at ensureDescendents (http://elastic:changeme@localhost:61161/__cypress/runner/cypress_runner.js:147543:8)
    at ensureDescendentsAndScroll (http://elastic:changeme@localhost:61161/__cypress/runner/cypress_runner.js:147550:14)
    at ensureElIsNotCovered (http://elastic:changeme@localhost:61161/__cypress/runner/cypress_runner.js:147684:5)
    at runAllChecks (http://elastic:changeme@localhost:61161/__cypress/runner/cypress_runner.js:147871:52)
    at retryActionability (http://elastic:changeme@localhost:61161/__cypress/runner/cypress_runner.js:147894:16)
    at tryCatcher (http://elastic:changeme@localhost:61161/__cypress/runner/cypress_runner.js:13212:23)
    at Function.Promise.attempt.Promise.try (http://elastic:changeme@localhost:61161/__cypress/runner/cypress_runner.js:10486:29)
    at tryFn (http://elastic:changeme@localhost:61161/__cypress/runner/cypress_runner.js:165329:61)
    at whenStable (http://elastic:changeme@localhost:61161/__cypress/runner/cypress_runner.js:165368:14)
    at http://elastic:changeme@localhost:61161/__cypress/runner/cypress_runner.js:164855:18
    at tryCatcher (http://elastic:changeme@localhost:61161/__cypress/runner/cypress_runner.js:13212:23)
    at Promise._settlePromiseFromHandler (http://elastic:changeme@localhost:61161/__cypress/runner/cypress_runner.js:11147:31)
    at Promise._settlePromise (http://elastic:changeme@localhost:61161/__cypress/runner/cypress_runner.js:11204:18)
    at Promise._settlePromise0 (http://elastic:changeme@localhost:61161/__cypress/runner/cypress_runner.js:11249:10)
    at Promise._settlePromises (http://elastic:changeme@localhost:61161/__cypress/runner/cypress_runner.js:11329:18)
From Your Spec Code:
    at Object.expandEventAction (http://localhost:61161/__cypress/tests?p=cypress/integration/timelines/creation.spec.ts:17235:61)
    at Context.eval (http://localhost:61161/__cypress/tests?p=cypress/integration/timelines/creation.spec.ts:15613:24)

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	4.3MB	4.3MB	-83.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	109.8KB	109.9KB	+64.0B

History

💚 Build #155740 succeeded 620e616d97be0892a98801a040a3363ce5ec0a6d
💚 Build #155575 succeeded d4d1575
💔 Build #155566 failed 2643199
💔 Build #155472 failed 7ac2d5b
💔 Build #155443 failed adbea89

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

kibanamachine · 2021-10-05T00:24:59Z

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create backports run node scripts/backport --pr 112980 or prevent reminders by adding the backport:skip label.

kibanamachine · 2021-10-06T00:35:00Z

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create backports run node scripts/backport --pr 112980 or prevent reminders by adding the backport:skip label.

add the new top cases feature in security

cca5504

XavierM added release_note:enhancement v8.0.0 Team:Threat Hunting Security Solution Threat Hunting Team Team:Threat Hunting:Cases labels Sep 23, 2021

XavierM requested a review from a team as a code owner September 23, 2021 14:18

kibanamachine and others added 6 commits September 23, 2021 14:06

Merge branch 'master' into upgrade-cases-security-privileges

adbea89

fix api intyegration and cypress

57eecfb

Merge branch 'upgrade-cases-security-privileges' of github.com:Xavier…

6a42a54

…M/kibana into upgrade-cases-security-privileges

Merge branch 'master' of github.com:elastic/kibana into upgrade-cases…

7ac2d5b

…-security-privileges

Merge branch 'master' of github.com:elastic/kibana into upgrade-cases…

1b6d534

…-security-privileges

fix api integration

fee2ab1

XavierM requested a review from a team as a code owner September 24, 2021 14:37

fix cypress roles test

2643199

XavierM requested review from jonathan-buttner, jportner and cnasikas September 24, 2021 15:40

missing api integration

d4d1575

semd reviewed Sep 27, 2021

View reviewed changes

jonathan-buttner approved these changes Sep 27, 2021

View reviewed changes

XavierM mentioned this pull request Sep 27, 2021

[Security Solutions] Search results deepLinks fix inconsistency #113046

Merged

2 tasks

XavierM added 2 commits September 29, 2021 10:14

Merge branch 'master' of github.com:elastic/kibana into upgrade-cases…

be15871

…-security-privileges

Merge branch 'master' of github.com:elastic/kibana into upgrade-cases…

51a3db7

…-security-privileges

jportner approved these changes Sep 30, 2021

View reviewed changes

x-pack/plugins/security_solution/public/common/lib/kibana/hooks.ts Outdated Show resolved Hide resolved

x-pack/plugins/security_solution/server/features.ts Outdated Show resolved Hide resolved

XavierM mentioned this pull request Sep 30, 2021

[SECURITY SOLUTION] [CASES] Allow cases to be there when security solutions privileges is none #113573

Merged

1 task

XavierM added 2 commits September 30, 2021 16:54

review Joe

449cabc

Merge branch 'master' of github.com:elastic/kibana into upgrade-cases…

19897a7

…-security-privileges

XavierM force-pushed the upgrade-cases-security-privileges branch from 620e616 to 19897a7 Compare September 30, 2021 21:24

XavierM enabled auto-merge (squash) September 30, 2021 21:26

XavierM merged commit 3b958e7 into elastic:master Oct 1, 2021

kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label Oct 5, 2021

jportner added the backport:skip This commit does not require backporting label Oct 6, 2021

kibanamachine removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label Oct 6, 2021

legrego mentioned this pull request Oct 14, 2021

Convert security solution -> cases sub feature to a top-level feature #109158

Closed

2 tasks

jportner mentioned this pull request Oct 14, 2021

[Meta] Platform Security team - 8.0 upgrade work #111160

Closed

nastasha-solomon mentioned this pull request Jan 13, 2022

[DOCS] Update case priv docs elastic/security-docs#1403

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] Top-level Cases feature under the Security #112980

[Security Solution] Top-level Cases feature under the Security #112980

XavierM commented Sep 23, 2021 •

edited

Loading

elasticmachine commented Sep 23, 2021

elasticmachine commented Sep 23, 2021

XavierM commented Sep 23, 2021

XavierM commented Sep 27, 2021

semd Sep 27, 2021

jonathan-buttner left a comment

XavierM commented Sep 27, 2021

semd commented Sep 28, 2021 •

edited

Loading

jportner left a comment

kibanamachine commented Oct 1, 2021

Stack Trace

kibanamachine commented Oct 5, 2021

kibanamachine commented Oct 6, 2021

[Security Solution] Top-level Cases feature under the Security #112980

[Security Solution] Top-level Cases feature under the Security #112980

Conversation

XavierM commented Sep 23, 2021 • edited Loading

Summary

Checklist

elasticmachine commented Sep 23, 2021

elasticmachine commented Sep 23, 2021

XavierM commented Sep 23, 2021

XavierM commented Sep 27, 2021

semd Sep 27, 2021

Choose a reason for hiding this comment

jonathan-buttner left a comment

Choose a reason for hiding this comment

XavierM commented Sep 27, 2021

semd commented Sep 28, 2021 • edited Loading

jportner left a comment

Choose a reason for hiding this comment

kibanamachine commented Oct 1, 2021

💛 Build succeeded, but was flaky

Test Failures

Stack Trace

Metrics [docs]

Async chunks

Page load bundle

History

kibanamachine commented Oct 5, 2021

kibanamachine commented Oct 6, 2021

XavierM commented Sep 23, 2021 •

edited

Loading

semd commented Sep 28, 2021 •

edited

Loading