Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution][Detections] Handle RBAC edge case for Related Integration on the FE side #134299

Merged

Conversation

banderror
Copy link
Contributor

@banderror banderror commented Jun 14, 2022

Summary

Some users won't be able to get additional information about rule's related integrations, such as which of them are installed, enabled, etc. In order to have access to integrations' data in Fleet, a user needs either of these 3 Kibana privileges:

  • Integrations: Read or All
  • Fleet: All
  • Saved Objects Management: Read or All

If all of them are None, the Related Integrations feature incorrectly shows all integrations as Not Installed even if some of them may be:

Screenshot 2022-06-14 at 04 41 35

This PR adds a client-side privilege check and falls back to the basic UI that just shows the integration name+link and not any install information.

Test instructions

To test, configure a role with the 3 mentioned privileges as None, e.g.

Then UI should fall back to no installed information:

Rule Details

Rule Management

TODO

In follow-up PRs:

  • Handle the same RBAC edge case for Related Integration on the BE side. Return 403 from the endpoint.
  • A test to exercise this fallback (either unit or cypress w/ specific role should do)
  • Ensure docs mention the required privileges for this feature

Checklist

Delete any items that are not applicable to this PR.

@banderror banderror added bug Fixes for quality problems that affect the customer experience release_note:skip Skip the PR/issue when compiling release notes impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. Feature:Detection Rules Anything related to Security Solution's Detection Rules Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. auto-backport Deprecated - use backport:version if exact versions are needed Feature:Rule Management Security Solution Detection Rule Management Team:Detection Rule Management Security Detection Rule Management Team v8.3.0 Feature:Rule Details Security Solution Detection Rule Details v8.4.0 labels Jun 14, 2022
@banderror banderror requested a review from a team as a code owner June 14, 2022 02:48
@banderror banderror self-assigned this Jun 14, 2022
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

Copy link
Member

@spong spong left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checked out, tested locally, and code reviewed -- LGTM! 👍

Great cleanup and fixes here @banderror! So much easier to grok with everything broken out into smaller, pure functions. Nice that the privilege checks are in their own hook and composed into the useInstalledIntegrations hook directly, and even better composability now with separate components for the Link/StatusBadge/VersionMismatchIcon.

I tested all the permutations of privileges between SOM/Fleet/Integrations, and each is working as expected. Even tested the error scenario by throwing within useInstalledIntegrations and looks like we're falling back as expected there as well 🙂.

Thank you for the tag-team here and all your efforts in getting these final fixes in -- LGTM! 🚀

@spong spong enabled auto-merge (squash) June 14, 2022 03:35
@kibana-ci
Copy link
Collaborator

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
securitySolution 3097 3102 +5

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 5.2MB 5.2MB +1.2KB

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @banderror

@spong spong merged commit f9aa32d into elastic:main Jun 14, 2022
kibanamachine pushed a commit that referenced this pull request Jun 14, 2022
…egration on the FE side (#134299)

## Summary

Some users won't be able to get additional information about rule's related integrations, such as which of them are installed, enabled, etc. In order to have access to integrations' data in Fleet, a user needs either of these 3 Kibana privileges:

- `Integrations`: `Read` or `All`
- `Fleet`: `All`
- `Saved Objects Management`: `Read` or `All`

If all of them are `None`, the Related Integrations feature incorrectly shows all integrations as `Not Installed` even if some of them may be:

<img width="1549" alt="Screenshot 2022-06-14 at 04 41 35" src="https://user-images.githubusercontent.com/7359339/173484715-291fa9dd-a1f1-4b91-a752-b7eb64bba2d4.png">

This PR adds a client-side privilege check and falls back to the basic UI that just shows the integration name+link and not any install information.

## Test instructions

To test, configure a role with the 3 mentioned privileges as `None`, e.g.

<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/173156872-dfaece7e-a6ef-4774-b01d-e2fa7b66a068.png" />
</p>

Then UI should fall back to no installed information:

**Rule Details**
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/173156901-572c4eb3-661f-4edf-974d-ec8ee13d849c.png" />
</p>

**Rule Management**
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/173156924-fbfec8ef-cbff-4966-8bee-bf3e29678cb9.png" />
</p>

## TODO

In follow-up PRs:

- [ ] Handle the same RBAC edge case for Related Integration on the BE side. Return 403 from the endpoint.
- [ ] A test to exercise this fallback (either unit or cypress w/ specific role should do)
- [ ] Ensure docs mention the required privileges for this feature

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials
- [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

(cherry picked from commit f9aa32d)
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
8.3

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Jun 14, 2022
…egration on the FE side (#134299) (#134300)

## Summary

Some users won't be able to get additional information about rule's related integrations, such as which of them are installed, enabled, etc. In order to have access to integrations' data in Fleet, a user needs either of these 3 Kibana privileges:

- `Integrations`: `Read` or `All`
- `Fleet`: `All`
- `Saved Objects Management`: `Read` or `All`

If all of them are `None`, the Related Integrations feature incorrectly shows all integrations as `Not Installed` even if some of them may be:

<img width="1549" alt="Screenshot 2022-06-14 at 04 41 35" src="https://user-images.githubusercontent.com/7359339/173484715-291fa9dd-a1f1-4b91-a752-b7eb64bba2d4.png">

This PR adds a client-side privilege check and falls back to the basic UI that just shows the integration name+link and not any install information.

## Test instructions

To test, configure a role with the 3 mentioned privileges as `None`, e.g.

<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/173156872-dfaece7e-a6ef-4774-b01d-e2fa7b66a068.png" />
</p>

Then UI should fall back to no installed information:

**Rule Details**
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/173156901-572c4eb3-661f-4edf-974d-ec8ee13d849c.png" />
</p>

**Rule Management**
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/173156924-fbfec8ef-cbff-4966-8bee-bf3e29678cb9.png" />
</p>

## TODO

In follow-up PRs:

- [ ] Handle the same RBAC edge case for Related Integration on the BE side. Return 403 from the endpoint.
- [ ] A test to exercise this fallback (either unit or cypress w/ specific role should do)
- [ ] Ensure docs mention the required privileges for this feature

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials
- [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

(cherry picked from commit f9aa32d)

Co-authored-by: Georgii Gorbachev <georgii.gorbachev@elastic.co>
@banderror banderror deleted the related-integrations-adds-fleet-privilege-check branch June 14, 2022 11:03
banderror pushed a commit that referenced this pull request Jun 20, 2022
…ute to use Internal SO Client (#134373)

## Summary

Follow up to #134299 that updates the `Get Installed Integrations` route to use the Internal SO Client and removes client-side privilege checks. This change ensures the `Related Integrations` feature works regardless of client users Fleet/Integration/SOM privileges, enabling all Security Solution users the ability to see which integrations are installed/configured with relation to their Detection Rules.

This change is helpful for low privilege users like T1/T2 Analysts that may not have more broad privileges like SOM or Fleet to still see which of their Detection Rules have the necessary integrations.

### Test instructions

To test, configure a role with the 3 mentioned privileges (SOM/Integrations/Fleet) as `None`, e.g.

<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/173156872-dfaece7e-a6ef-4774-b01d-e2fa7b66a068.png" />
</p>


Then the UI should _still show_ installed details (installed/not installed badges):

##### Rules Table
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/173658501-9b384ce6-ddef-4643-a36e-3da3082c8972.png" />
</p>


##### Rules Details
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/173658533-a60b6e96-7283-441a-8faa-ed186476c1ac.png" />
</p>


### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials
  * Working docs as part of elastic/security-docs#2015
- [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

### Risk Ma
kibanamachine pushed a commit that referenced this pull request Jun 20, 2022
…ute to use Internal SO Client (#134373)

## Summary

Follow up to #134299 that updates the `Get Installed Integrations` route to use the Internal SO Client and removes client-side privilege checks. This change ensures the `Related Integrations` feature works regardless of client users Fleet/Integration/SOM privileges, enabling all Security Solution users the ability to see which integrations are installed/configured with relation to their Detection Rules.

This change is helpful for low privilege users like T1/T2 Analysts that may not have more broad privileges like SOM or Fleet to still see which of their Detection Rules have the necessary integrations.

### Test instructions

To test, configure a role with the 3 mentioned privileges (SOM/Integrations/Fleet) as `None`, e.g.

<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/173156872-dfaece7e-a6ef-4774-b01d-e2fa7b66a068.png" />
</p>

Then the UI should _still show_ installed details (installed/not installed badges):

##### Rules Table
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/173658501-9b384ce6-ddef-4643-a36e-3da3082c8972.png" />
</p>

##### Rules Details
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/173658533-a60b6e96-7283-441a-8faa-ed186476c1ac.png" />
</p>

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials
  * Working docs as part of elastic/security-docs#2015
- [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

### Risk Ma

(cherry picked from commit 01b8482)
kibanamachine added a commit that referenced this pull request Jun 20, 2022
…ute to use Internal SO Client (#134373) (#134734)

## Summary

Follow up to #134299 that updates the `Get Installed Integrations` route to use the Internal SO Client and removes client-side privilege checks. This change ensures the `Related Integrations` feature works regardless of client users Fleet/Integration/SOM privileges, enabling all Security Solution users the ability to see which integrations are installed/configured with relation to their Detection Rules.

This change is helpful for low privilege users like T1/T2 Analysts that may not have more broad privileges like SOM or Fleet to still see which of their Detection Rules have the necessary integrations.

### Test instructions

To test, configure a role with the 3 mentioned privileges (SOM/Integrations/Fleet) as `None`, e.g.

<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/173156872-dfaece7e-a6ef-4774-b01d-e2fa7b66a068.png" />
</p>

Then the UI should _still show_ installed details (installed/not installed badges):

##### Rules Table
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/173658501-9b384ce6-ddef-4643-a36e-3da3082c8972.png" />
</p>

##### Rules Details
<p align="center">
  <img width="500" src="https://user-images.githubusercontent.com/2946766/173658533-a60b6e96-7283-441a-8faa-ed186476c1ac.png" />
</p>

### Checklist

Delete any items that are not applicable to this PR.

- [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials
  * Working docs as part of elastic/security-docs#2015
- [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

### Risk Ma

(cherry picked from commit 01b8482)

Co-authored-by: Garrett Spong <spong@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
auto-backport Deprecated - use backport:version if exact versions are needed bug Fixes for quality problems that affect the customer experience Feature:Detection Rules Anything related to Security Solution's Detection Rules Feature:Rule Details Security Solution Detection Rule Details Feature:Rule Management Security Solution Detection Rule Management impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. release_note:skip Skip the PR/issue when compiling release notes Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.3.0 v8.4.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants