[Security Solution][Detections] Updates Get Installed Integrations route to use Internal SO Client #134373

spong · 2022-06-14T16:44:55Z

Summary

Follow up to #134299 that updates the Get Installed Integrations route to use the Internal SO Client and removes client-side privilege checks. This change ensures the Related Integrations feature works regardless of client users Fleet/Integration/SOM privileges, enabling all Security Solution users the ability to see which integrations are installed/configured with relation to their Detection Rules.

This change is helpful for low privilege users like T1/T2 Analysts that may not have more broad privileges like SOM or Fleet to still see which of their Detection Rules have the necessary integrations.

Test instructions

To test, configure a role with the 3 mentioned privileges (SOM/Integrations/Fleet) as None, e.g.

Then the UI should still show installed details (installed/not installed badges):

Rules Table

Rules Details

Checklist

Delete any items that are not applicable to this PR.

Documentation was added for features that require explanation or tutorials
- Working docs as part of [DOCS] Update documentation to include the new Rule fields: Related Integrations, Required Fields and Setup security-docs#2015
Unit or functional tests were updated or added to match the most common scenarios

Risk Ma

…e checks

spong · 2022-06-14T18:12:23Z

...lution/public/detections/components/rules/related_integrations/use_integration_privileges.ts

+/**
+ * Hook for determining if user has fleet/integrations/SOM privileges for fetching
+ * installed integrations. Initially used as we weren't using the fleet.internalReadonlySoClient
+ * for fetching integrations, but keeping this around for a release or two as we add more
+ * fleet/integration features within Security Solution in case it needs to be leveraged for those.
+ */


We can remove this hook, but figured it might be nice to have around for a release or two as we add more integrations features. I could see a feature like surfacing # of agents assigned this integration policy being limited by these privileges.

Sounds good!

spong · 2022-06-14T18:13:15Z

...detection_engine/routes/fleet/get_installed_integrations/get_installed_integrations_route.ts

        const set = createInstalledIntegrationSet();

-        const packagePolicies = await fleet.packagePolicy.list(soClient, {});
+        const packagePolicies = await fleet.packagePolicy.list(fleet.internalReadonlySoClient, {});


This is the actual functional change. The internalReadonlySoClient is already provided on the fleet services by endpoint and used for the endpoint metadata services.

…tions-using-internal-client

banderror · 2022-06-20T08:12:32Z

@elasticmachine merge upstream

banderror

Thank you for finding out that an internal SO client is available to us and for the quick fix @spong 🙏

Tested locally and reviewed the changes. LGTM! 🚢

banderror · 2022-06-20T09:07:50Z

...lution/public/detections/components/rules/related_integrations/use_integration_privileges.ts

+/**
+ * Hook for determining if user has fleet/integrations/SOM privileges for fetching
+ * installed integrations. Initially used as we weren't using the fleet.internalReadonlySoClient
+ * for fetching integrations, but keeping this around for a release or two as we add more
+ * fleet/integration features within Security Solution in case it needs to be leveraged for those.
+ */


Sounds good!

kibana-ci · 2022-06-20T09:50:10Z

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	3079	3078	-1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	5.3MB	5.3MB	-448.0B

History

💛 Build #51211 was flaky 9ab6449
💚 Build #50826 succeeded ac79dbd

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @spong

elasticmachine · 2022-06-20T10:38:16Z

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine · 2022-06-20T10:38:17Z

Pinging @elastic/security-detections-response (Team:Detections and Resp)

…ute to use Internal SO Client (#134373) ## Summary Follow up to #134299 that updates the `Get Installed Integrations` route to use the Internal SO Client and removes client-side privilege checks. This change ensures the `Related Integrations` feature works regardless of client users Fleet/Integration/SOM privileges, enabling all Security Solution users the ability to see which integrations are installed/configured with relation to their Detection Rules. This change is helpful for low privilege users like T1/T2 Analysts that may not have more broad privileges like SOM or Fleet to still see which of their Detection Rules have the necessary integrations. ### Test instructions To test, configure a role with the 3 mentioned privileges (SOM/Integrations/Fleet) as `None`, e.g. <img width="500" src="https://user-images.githubusercontent.com/2946766/173156872-dfaece7e-a6ef-4774-b01d-e2fa7b66a068.png" /> Then the UI should _still show_ installed details (installed/not installed badges): ##### Rules Table <img width="500" src="https://user-images.githubusercontent.com/2946766/173658501-9b384ce6-ddef-4643-a36e-3da3082c8972.png" /> ##### Rules Details <img width="500" src="https://user-images.githubusercontent.com/2946766/173658533-a60b6e96-7283-441a-8faa-ed186476c1ac.png" /> ### Checklist Delete any items that are not applicable to this PR. - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials * Working docs as part of elastic/security-docs#2015 - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### Risk Ma (cherry picked from commit 01b8482)

kibanamachine · 2022-06-20T10:42:42Z

💚 All backports created successfully

Status	Branch	Result
✅	8.3

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…ute to use Internal SO Client (#134373) (#134734) ## Summary Follow up to #134299 that updates the `Get Installed Integrations` route to use the Internal SO Client and removes client-side privilege checks. This change ensures the `Related Integrations` feature works regardless of client users Fleet/Integration/SOM privileges, enabling all Security Solution users the ability to see which integrations are installed/configured with relation to their Detection Rules. This change is helpful for low privilege users like T1/T2 Analysts that may not have more broad privileges like SOM or Fleet to still see which of their Detection Rules have the necessary integrations. ### Test instructions To test, configure a role with the 3 mentioned privileges (SOM/Integrations/Fleet) as `None`, e.g. <img width="500" src="https://user-images.githubusercontent.com/2946766/173156872-dfaece7e-a6ef-4774-b01d-e2fa7b66a068.png" /> Then the UI should _still show_ installed details (installed/not installed badges): ##### Rules Table <img width="500" src="https://user-images.githubusercontent.com/2946766/173658501-9b384ce6-ddef-4643-a36e-3da3082c8972.png" /> ##### Rules Details <img width="500" src="https://user-images.githubusercontent.com/2946766/173658533-a60b6e96-7283-441a-8faa-ed186476c1ac.png" /> ### Checklist Delete any items that are not applicable to this PR. - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials * Working docs as part of elastic/security-docs#2015 - [X] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### Risk Ma (cherry picked from commit 01b8482) Co-authored-by: Garrett Spong <spong@users.noreply.github.com>

Updates route to use internalSOClient and removes client side privleg…

ac79dbd

…e checks

spong self-assigned this Jun 14, 2022

spong marked this pull request as ready for review June 14, 2022 17:51

spong requested review from a team as code owners June 14, 2022 17:51

spong commented Jun 14, 2022

View reviewed changes

banderror mentioned this pull request Jun 14, 2022

[DOCS] Update documentation to include the new Rule fields: Related Integrations, Required Fields and Setup elastic/security-docs#2015

Closed

7 tasks

Merge branch 'main' of github.com:elastic/kibana into related-integra…

9ab6449

…tions-using-internal-client

Merge branch 'main' into related-integrations-using-internal-client

57c3314

banderror approved these changes Jun 20, 2022

View reviewed changes

banderror added Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. labels Jun 20, 2022

banderror merged commit 01b8482 into elastic:main Jun 20, 2022

kibanamachine mentioned this pull request Jun 20, 2022

[8.3] [Security Solution][Detections] Updates Get Installed Integrations route to use Internal SO Client (#134373) #134734

Merged

spong deleted the related-integrations-using-internal-client branch June 20, 2022 14:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Detections] Updates Get Installed Integrations route to use Internal SO Client #134373

[Security Solution][Detections] Updates Get Installed Integrations route to use Internal SO Client #134373

spong commented Jun 14, 2022 •

edited

Loading

spong Jun 14, 2022

banderror Jun 20, 2022

spong Jun 14, 2022

banderror commented Jun 20, 2022

banderror left a comment

banderror Jun 20, 2022

kibana-ci commented Jun 20, 2022

elasticmachine commented Jun 20, 2022

elasticmachine commented Jun 20, 2022

kibanamachine commented Jun 20, 2022

[Security Solution][Detections] Updates Get Installed Integrations route to use Internal SO Client #134373

[Security Solution][Detections] Updates Get Installed Integrations route to use Internal SO Client #134373

Conversation

spong commented Jun 14, 2022 • edited Loading

Summary

Test instructions

Rules Table

Rules Details

Checklist

Risk Ma

spong Jun 14, 2022

Choose a reason for hiding this comment

banderror Jun 20, 2022

Choose a reason for hiding this comment

spong Jun 14, 2022

Choose a reason for hiding this comment

banderror commented Jun 20, 2022

banderror left a comment

Choose a reason for hiding this comment

banderror Jun 20, 2022

Choose a reason for hiding this comment

kibana-ci commented Jun 20, 2022

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

History

elasticmachine commented Jun 20, 2022

elasticmachine commented Jun 20, 2022

kibanamachine commented Jun 20, 2022

💚 All backports created successfully

Questions ?

spong commented Jun 14, 2022 •

edited

Loading