Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[DOCS]: Update related integration documentation for RBAC and Definition #3035

Open
111andre111 opened this issue Mar 3, 2023 · 2 comments
Assignees
Labels
Effort: Large Issues that require significant planning, research, writing, and testing Feature: Rules Priority: Medium Issues that have relevance, but aren't urgent Team: Detections/Response Detections and Response Team: Docs

Comments

@111andre111
Copy link

Description

We can do a better job to describe the related integrations feature helping the customer better what it goes

Acceptance Test Criteria

At the end I'd like to see some screenshots from the feature as well as especially what the enabled/configured numbers mean and what are the required privileges what is needed as of RBAC point of view.

Notes

I think the most important answers are hidden in these 2 comments:
#2015 (comment)
#2015 (comment)

As of the required privileges these would be like:
Maybe we could refer to that here:
https://www.elastic.co/guide/en/security/master/rules-ui-management.html#rule-prerequisites

  Integrations: Read or All
  Fleet: All
  Saved Objects Management: Read or All

When it comes to the number of integrations we should describe what is the meaning
https://www.elastic.co/guide/en/security/master/rules-ui-management.html#rules-ui-management
Maybe we could invent a separate Anchor point for related integrations describing a bit what it means exactly.
:

  0/2 integrations 
  1/2 integrations

When it comes to our API documentation we expose already the fields related_integrations and required_fields:
https://www.elastic.co/guide/en/security/master/rules-api-create.html#_response_payload
https://www.elastic.co/guide/en/security/master/rules-api-get.html#_response_payload_2
https://www.elastic.co/guide/en/security/master/rules-api-find.html#_response_payload_3
https://www.elastic.co/guide/en/security/master/rules-api-update.html#_response_payload_4
However is there any need to hide the content of these fields how these could as of today look like from a content perspective?

@banderror
Copy link
Contributor

Thanks @111andre111 for opening this one.

When it comes to our API documentation we expose already the fields related_integrations and required_fields:
https://www.elastic.co/guide/en/security/master/rules-api-create.html#_response_payload
https://www.elastic.co/guide/en/security/master/rules-api-get.html#_response_payload_2
https://www.elastic.co/guide/en/security/master/rules-api-find.html#_response_payload_3
https://www.elastic.co/guide/en/security/master/rules-api-update.html#_response_payload_4
However is there any need to hide the content of these fields how these could as of today look like from a content perspective?

I can answer this question. When we developed this feature it was quite raw, a lot of edge cases were not covered, and our confidence in this implementation and API design was low. This is why we marked the related_integrations, required_fields, and setup rule fields as dev:

This functionality is in development and may be changed or removed completely in a future release. These features are unsupported and not subject to the support SLA of official GA features.

We will revisit this label once all the bugs in the epic (internal issue) are fixed, edge cases are addressed, the feature is covered by tests, and we have high confidence in its stability and API design. When we remove this label we will document the response format for the fields.

@banderror
Copy link
Contributor

cc @elastic/security-docs

@joepeeples joepeeples self-assigned this May 10, 2023
@joepeeples joepeeples added Priority: Medium Issues that have relevance, but aren't urgent Effort: Large Issues that require significant planning, research, writing, and testing labels Jul 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Effort: Large Issues that require significant planning, research, writing, and testing Feature: Rules Priority: Medium Issues that have relevance, but aren't urgent Team: Detections/Response Detections and Response Team: Docs
Projects
None yet
Development

No branches or pull requests

3 participants