Merge branch 'master' into alerting/alert-instances

* master: (34 commits)
  [Index management] Server-side NP ready (elastic#56829)
  Webhook action - make user and password secrets optional (elastic#56823)
  [DOCS] Removes reference to IRC (elastic#57245)
  [Monitoring] NP migration: Local angular module (elastic#51823)
  [SIEM] Adds ECS link to help menu (elastic#57104)
  Ensure http interceptors are shares across lifecycle methods (elastic#57150)
  [Remote clusters] Migrate server code out of legacy (elastic#56781)
  fixes render bug in alert list (elastic#57152)
  siem 7.6 updates (elastic#57169)
  Make the update alert API key API work when AAD is out of sync (elastic#56640)
  fix(NA): MaxListenersExceededWarning on getLoggerStream (elastic#57133)
  [Metrics UI] Setup commonly used time ranges in timepicker (elastic#56701)
  [Maps] set filter.meta.key to geoFieldName so query passes filterMatchesIndex when ignoreFilterIfFieldNotInIndex is true (elastic#56692)
  Create plugin mock for event log plugin (elastic#57048)
  fix ts error on master (elastic#57236)
  Don't create API key for disabled alerts when calling create API (elastic#57041)
  Fix enable and disable API to still work when AAD is out of sync (elastic#56634)
  [DOCS] Canvas embed objects (elastic#57156)
  Delete autocomplete namespace (elastic#57187)
  Security - Inject logout url (elastic#57201)
  ...

.eslintignore

@@ -11,7 +11,6 @@ bower_components
 /src/plugins/data/common/es_query/kuery/ast/_generated_/**
 /src/legacy/core_plugins/vis_type_timelion/public/_generated_/**
 src/legacy/core_plugins/vis_type_vislib/public/vislib/__tests__/lib/fixtures/mock_data
-/src/legacy/ui/public/angular-bootstrap
 /src/legacy/ui/public/flot-charts
 /test/fixtures/scenarios
 /src/legacy/core_plugins/console/public/webpackShims

.eslintrc.js

@@ -302,6 +302,8 @@ module.exports = {
                   'test/plugin_functional/plugins/**/public/np_ready/**/*',
                   'test/plugin_functional/plugins/**/server/np_ready/**/*',
                   'src/legacy/core_plugins/**/public/np_ready/**/*',
+                  'src/legacy/core_plugins/vis_type_*/public/**/*',
+                  '!src/legacy/core_plugins/vis_type_*/public/legacy*',
                   'src/legacy/core_plugins/**/server/np_ready/**/*',
                   'x-pack/legacy/plugins/**/public/np_ready/**/*',
                   'x-pack/legacy/plugins/**/server/np_ready/**/*',

docs/canvas/canvas-elements.asciidoc

@@ -20,7 +20,9 @@ When you add elements to your workpad, you can:
 [[add-canvas-element]]
 === Add elements to your workpad
 
-Choose the elements to display on your workpad, then familiarize yourself with the element using the preconfigured demo data. By default, every element you add to a workpad uses demo data until you change the data source. The demo data includes a small sample data set that you can use to experiment with your element.
+Choose the elements to display on your workpad, then familiarize yourself with the element using the preconfigured demo data. By default, most elements use demo data until you change the data source. The demo data includes a small sample data set that you can use to experiment with your element.
+
+To add a Canvas element:
 
 . Click *Add element*.
 
@@ -31,13 +33,26 @@ image::images/canvas-element-select.gif[Canvas elements]
 
 . Play around with the default settings and see what the element can do.
 
-TIP: Want to use a different element? You can delete the element by selecting it, clicking the *Element options* icon in the top right, then selecting *Delete*.
+To add a map:
+
+. Click *Embed object*.
+
+. Select the map you want to add to the workpad.
++
+[role="screenshot"]
+image::images/canvas-map-embed.gif[]
+
+NOTE: Demo data is only supported on Canvas elements. Maps do not support demo data.
+
+Want to use a different element? You can delete the element by selecting it, clicking the *Element options* icon in the top right, then selecting *Delete*.
 
 [float]
 [[connect-element-data]]
-=== Connect the element to your data
+=== Connect the Canvas element to your data
 
-When you have finished using the demo data, connect the element to a data source.
+When you have finished using the demo data, connect the Canvas element to a data source.
+
+NOTE: Maps do not support data sources. To change the map data, refer to <<maps, Elastic Maps>>.
 
 . Make sure that the element is selected, then select *Data*.
 
@@ -142,7 +157,7 @@ text.align: center;
 [[configure-auto-refresh-interval]]
 ==== Change the data auto-refresh interval
 
-Increase or decrease how often your data refreshes on your workpad.
+Increase or decrease how often your Canvas element data refreshes on your workpad.
 
 . In the top left corner, click the *Control settings* icon.
 
@@ -153,6 +168,17 @@ image::images/canvas-refresh-interval.png[Element data refresh interval]
 
 TIP: To manually refresh the data, click the *Refresh data* icon.
 
+[float]
+[[canvas-time-range]]
+==== Customize map time ranges
+
+Configure the maps on your workpad for a specific time range.
+
+From the panel menu, select *Customize time range* to expose a time filter dedicated to the map.
+
+[role="screenshot"]
+image::images/canvas_map-time-filter.gif[]
+
 [float]
 [[organize-element]]
 === Organize the elements on your workpad

docs/developer/plugin/development-plugin-resources.asciidoc

@@ -3,10 +3,6 @@
 
 Here are some resources that are helpful for getting started with plugin development.
 
-[float]
-==== Our IRC channel
-Many Kibana developers hang out on `irc.freenode.net` in the `#kibana` channel. We *want* to help you with plugin development. Even more than that, we *want your help* in understanding your plugin goals, so we can build a great plugin system for you! If you've never used IRC, welcome to the fun. You can get started with the http://webchat.freenode.net/?channels=kibana[Freenode Web Client].
-
 [float]
 ==== Some light reading
 Our {repo}blob/master/CONTRIBUTING.md[contributing guide] can help you get a development environment going.
@@ -50,7 +46,7 @@ You're welcome to use these components, but be aware that they are rapidly evolv
 
 [float]
 ==== TypeScript Support
-Plugin code can be written in http://www.typescriptlang.org/[TypeScript] if desired. 
+Plugin code can be written in http://www.typescriptlang.org/[TypeScript] if desired.
 To enable TypeScript support, create a `tsconfig.json` file at the root of your plugin that looks something like this:
 
 ["source","js"]
@@ -67,6 +63,6 @@ To enable TypeScript support, create a `tsconfig.json` file at the root of your
 }
 -----------
 
-TypeScript code is automatically converted into JavaScript during development, 
-but not in the distributable version of Kibana. If you use the 
+TypeScript code is automatically converted into JavaScript during development,
+but not in the distributable version of Kibana. If you use the
 {repo}blob/{branch}/packages/kbn-plugin-helpers[@kbn/plugin-helpers] to build your plugin, then your `.ts` and `.tsx` files will be permanently transpiled before your plugin is archived. If you have your own build process, make sure to run the TypeScript compiler on your source files and ship the compilation output so that your plugin will work with the distributable version of Kibana.

docs/management/advanced-options.asciidoc

@@ -220,8 +220,10 @@ might increase the search time. This setting is off by default. Users must opt-i
 [horizontal]
 `siem:defaultAnomalyScore`:: The threshold above which Machine Learning job anomalies are displayed in the SIEM app.
 `siem:defaultIndex`:: A comma-delimited list of Elasticsearch indices from which the SIEM app collects events.
-`siem:enableNewsFeed`:: Enables the News feed
-`siem:newsFeedUrl`:: News feed content will be retrieved from this URL
+`siem:enableNewsFeed`:: Enables the security news feed on the SIEM *Overview* 
+page.
+`siem:newsFeedUrl`:: The URL from which the security news feed content is 
+retrieved.
 `siem:refreshIntervalDefaults`:: The default refresh interval for the SIEM time filter, in milliseconds.
 `siem:timeDefaults`:: The default period of time in the SIEM time filter.
 

docs/siem/index.asciidoc

@@ -33,7 +33,8 @@ https://www.elastic.co/products/beats/packetbeat[{packetbeat}]
 send security events and other data to Elasticsearch.
 
 The default index patterns for SIEM events are `auditbeat-*`, `winlogbeat-*`,
-`filebeat-*`, `endgame-*`, and `packetbeat-*``. You can change the default index patterns in
+`filebeat-*`, `packetbeat-*`, `endgame-*`, and `apm-*-transaction*`. You can 
+change the default index patterns in
 *Kibana > Management > Advanced Settings > siem:defaultIndex*.
 
 [float]

docs/user/security/authentication/index.asciidoc

@@ -12,6 +12,7 @@
 - <<pki-authentication>>
 - <<saml>>
 - <<oidc>>
+- <<kerberos>>
 
 [[basic-authentication]]
 ==== Basic authentication
@@ -214,3 +215,26 @@ leaked, it can't be re-used after logout. This is known as "local" logout.
 {kib} can also initiate a "global" logout or _Single Logout_ if it's supported by the external authentication provider and not
 explicitly disabled by {es}. In this case, the user is redirected to the external authentication provider for log out of
 all applications associated with the active provider session.
+
+[[kerberos]]
+==== Kerberos single sign-on
+
+As with the previous SSOs, make sure that you have configured {es} first accordingly. See {ref}/kerberos-realm.html[Kerberos authentication].
+
+Next, to enable Kerberos in {kib}, you will need to enable the Kerberos authentication provider in the `kibana.yml` configuration file, as follows:
+
+[source,yaml]
+-----------------------------------------------
+xpack.security.authc.providers: [kerberos]
+-----------------------------------------------
+
+You may want to be able to authenticate with the basic authentication provider as a secondary mechanism or while you are setting up Kerberos for the stack:
+
+[source,yaml]
+-----------------------------------------------
+xpack.security.authc.providers: [kerberos, basic]
+-----------------------------------------------
+
+As a reminder, the order is important as it determines the order in which each authentication provider is attempted.
+
+Kibana uses SPNEGO, which wraps the Kerberos protocol for use with HTTP, extending it to web applications. At the end of the Kerberos handshake, Kibana will forward the service ticket to Elasticsearch. Elasticsearch will unpack it and it will respond with an access and refresh token which are then used for subsequent authentication.

src/core/public/core_system.ts

@@ -211,7 +211,7 @@ export class CoreSystem {
       const injectedMetadata = await this.injectedMetadata.start();
       const uiSettings = await this.uiSettings.start();
       const docLinks = await this.docLinks.start({ injectedMetadata });
-      const http = await this.http.start({ injectedMetadata, fatalErrors: this.fatalErrorsSetup! });
+      const http = await this.http.start();
       const savedObjects = await this.savedObjects.start({ http });
       const i18n = await this.i18n.start();
       const fatalErrors = await this.fatalErrors.start();

src/core/public/http/http_service.test.ts

@@ -25,13 +25,40 @@ import { fatalErrorsServiceMock } from '../fatal_errors/fatal_errors_service.moc
 import { injectedMetadataServiceMock } from '../injected_metadata/injected_metadata_service.mock';
 import { HttpService } from './http_service';
 
+describe('interceptors', () => {
+  afterEach(() => fetchMock.restore());
+
+  it('shares interceptors across setup and start', async () => {
+    fetchMock.get('*', {});
+    const injectedMetadata = injectedMetadataServiceMock.createSetupContract();
+    const fatalErrors = fatalErrorsServiceMock.createSetupContract();
+    const httpService = new HttpService();
+
+    const setup = httpService.setup({ fatalErrors, injectedMetadata });
+    const setupInterceptor = jest.fn();
+    setup.intercept({ request: setupInterceptor });
+
+    const start = httpService.start();
+    const startInterceptor = jest.fn();
+    start.intercept({ request: startInterceptor });
+
+    await setup.get('/blah');
+    expect(setupInterceptor).toHaveBeenCalledTimes(1);
+    expect(startInterceptor).toHaveBeenCalledTimes(1);
+
+    await start.get('/other-blah');
+    expect(setupInterceptor).toHaveBeenCalledTimes(2);
+    expect(startInterceptor).toHaveBeenCalledTimes(2);
+  });
+});
+
 describe('#stop()', () => {
   it('calls loadingCount.stop()', () => {
     const injectedMetadata = injectedMetadataServiceMock.createSetupContract();
     const fatalErrors = fatalErrorsServiceMock.createSetupContract();
     const httpService = new HttpService();
     httpService.setup({ fatalErrors, injectedMetadata });
-    httpService.start({ fatalErrors, injectedMetadata });
+    httpService.start();
     httpService.stop();
     expect(loadingServiceMock.stop).toHaveBeenCalled();
   });

src/core/public/http/http_service.ts

@@ -35,14 +35,15 @@ interface HttpDeps {
 export class HttpService implements CoreService<HttpSetup, HttpStart> {
   private readonly anonymousPaths = new AnonymousPathsService();
   private readonly loadingCount = new LoadingCountService();
+  private service?: HttpSetup;
 
   public setup({ injectedMetadata, fatalErrors }: HttpDeps): HttpSetup {
     const kibanaVersion = injectedMetadata.getKibanaVersion();
     const basePath = new BasePath(injectedMetadata.getBasePath());
     const fetchService = new Fetch({ basePath, kibanaVersion });
     const loadingCount = this.loadingCount.setup({ fatalErrors });
 
-    return {
+    this.service = {
       basePath,
       anonymousPaths: this.anonymousPaths.setup({ basePath }),
       intercept: fetchService.intercept.bind(fetchService),
@@ -56,10 +57,16 @@ export class HttpService implements CoreService<HttpSetup, HttpStart> {
       put: fetchService.put.bind(fetchService),
       ...loadingCount,
     };
+
+    return this.service;
   }
 
-  public start(deps: HttpDeps) {
-    return this.setup(deps);
+  public start() {
+    if (!this.service) {
+      throw new Error(`HttpService#setup() must be called first!`);
+    }
+
+    return this.service;
   }
 
   public stop() {

src/core/public/overlays/modal/modal_service.tsx

@@ -20,7 +20,7 @@
 /* eslint-disable max-classes-per-file */
 
 import { i18n as t } from '@kbn/i18n';
-import { EuiModal, EuiConfirmModal, EuiOverlayMask } from '@elastic/eui';
+import { EuiModal, EuiConfirmModal, EuiOverlayMask, EuiConfirmModalProps } from '@elastic/eui';
 import React from 'react';
 import { render, unmountComponentAtNode } from 'react-dom';
 import { Subject } from 'rxjs';
@@ -68,6 +68,7 @@ export interface OverlayModalConfirmOptions {
   className?: string;
   closeButtonAriaLabel?: string;
   'data-test-subj'?: string;
+  defaultFocusedButton?: EuiConfirmModalProps['defaultFocusedButton'];
 }
 
 /**

src/core/public/public.api.md

@@ -6,6 +6,7 @@
 
 import { Breadcrumb } from '@elastic/eui';
 import { EuiButtonEmptyProps } from '@elastic/eui';
+import { EuiConfirmModalProps } from '@elastic/eui';
 import { EuiGlobalToastListToast } from '@elastic/eui';
 import { ExclusiveUnion } from '@elastic/eui';
 import { IconType } from '@elastic/eui';

src/dev/precommit_hook/casing_check_config.js

@@ -88,7 +88,6 @@ export const IGNORE_DIRECTORY_GLOBS = [
   'src/babel-*',
   'packages/*',
   'packages/kbn-ui-framework/generator-kui',
-  'src/legacy/ui/public/angular-bootstrap',
   'src/legacy/ui/public/flot-charts',
   'src/legacy/ui/public/utils/lodash-mixins',
   'test/functional/fixtures/es_archiver/visualize_source-filters',
@@ -124,9 +123,6 @@ export const TEMPORARILY_IGNORED_PATHS = [
   'src/legacy/core_plugins/timelion/server/series_functions/__tests__/fixtures/tlConfig.js',
   'src/fixtures/config_upgrade_from_4.0.0_to_4.0.1-snapshot.json',
   'src/legacy/core_plugins/vis_type_vislib/public/vislib/__tests__/lib/fixtures/mock_data/terms/_seriesMultiple.js',
-  'src/legacy/ui/public/angular-bootstrap/bindHtml/bindHtml.js',
-  'src/legacy/ui/public/angular-bootstrap/tooltip/tooltip-html-unsafe-popup.html',
-  'src/legacy/ui/public/angular-bootstrap/tooltip/tooltip-popup.html',
   'src/legacy/ui/public/assets/favicons/android-chrome-192x192.png',
   'src/legacy/ui/public/assets/favicons/android-chrome-256x256.png',
   'src/legacy/ui/public/assets/favicons/android-chrome-512x512.png',

src/legacy/core_plugins/data/public/search/aggs/agg_config.ts

@@ -35,7 +35,7 @@ import { Schema } from './schemas';
 import {
   ISearchSource,
   FetchOptions,
-  fieldFormats,
+  FieldFormatsContentType,
   KBN_FIELD_TYPES,
 } from '../../../../../../plugins/data/public';
 
@@ -383,7 +383,7 @@ export class AggConfig {
     return this.aggConfigs.timeRange;
   }
 
-  fieldFormatter(contentType?: fieldFormats.ContentType, defaultFormat?: any) {
+  fieldFormatter(contentType?: FieldFormatsContentType, defaultFormat?: any) {
     const format = this.type && this.type.getFormat(this);
 
     if (format) {
@@ -393,7 +393,7 @@ export class AggConfig {
     return this.fieldOwnFormatter(contentType, defaultFormat);
   }
 
-  fieldOwnFormatter(contentType?: fieldFormats.ContentType, defaultFormat?: any) {
+  fieldOwnFormatter(contentType?: FieldFormatsContentType, defaultFormat?: any) {
     const fieldFormatsService = npStart.plugins.data.fieldFormats;
     const field = this.getField();
     let format = field && field.format;

src/legacy/core_plugins/data/public/search/aggs/agg_type.ts

@@ -29,7 +29,7 @@ import { BaseParamType } from './param_types/base';
 import { AggParamType } from './param_types/agg';
 import {
   KBN_FIELD_TYPES,
-  fieldFormats,
+  IFieldFormat,
   ISearchSource,
 } from '../../../../../../plugins/data/public';
 
@@ -58,7 +58,7 @@ export interface AggTypeConfig<
     inspectorAdapters: Adapters,
     abortSignal?: AbortSignal
   ) => Promise<any>;
-  getFormat?: (agg: TAggConfig) => fieldFormats.FieldFormat;
+  getFormat?: (agg: TAggConfig) => IFieldFormat;
   getValue?: (agg: TAggConfig, bucket: any) => any;
   getKey?: (bucket: any, key: any, agg: TAggConfig) => any;
 }
@@ -199,7 +199,7 @@ export class AggType<
    * @param  {agg} agg - the agg to pick a format for
    * @return {FieldFormat}
    */
-  getFormat: (agg: TAggConfig) => fieldFormats.FieldFormat;
+  getFormat: (agg: TAggConfig) => IFieldFormat;
 
   getValue: (agg: TAggConfig, bucket: any) => any;
 

src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/date_range.test.ts

@@ -19,7 +19,7 @@
 
 import moment from 'moment';
 import { createFilterDateRange } from './date_range';
-import { fieldFormats } from '../../../../../../../../plugins/data/public';
+import { fieldFormats, FieldFormatsGetConfigFn } from '../../../../../../../../plugins/data/public';
 import { AggConfigs } from '../../agg_configs';
 import { BUCKET_TYPES } from '../bucket_agg_types';
 import { IBucketAggConfig } from '../_bucket_agg_type';
@@ -28,7 +28,7 @@ jest.mock('ui/new_platform');
 
 describe('AggConfig Filters', () => {
   describe('Date range', () => {
-    const getConfig = (() => {}) as fieldFormats.GetConfigFn;
+    const getConfig = (() => {}) as FieldFormatsGetConfigFn;
     const getAggConfigs = () => {
       const field = {
         name: '@timestamp',

src/legacy/core_plugins/data/public/search/aggs/buckets/create_filter/histogram.test.ts

@@ -20,13 +20,13 @@ import { createFilterHistogram } from './histogram';
 import { AggConfigs } from '../../agg_configs';
 import { BUCKET_TYPES } from '../bucket_agg_types';
 import { IBucketAggConfig } from '../_bucket_agg_type';
-import { fieldFormats } from '../../../../../../../../plugins/data/public';
+import { fieldFormats, FieldFormatsGetConfigFn } from '../../../../../../../../plugins/data/public';
 
 jest.mock('ui/new_platform');
 
 describe('AggConfig Filters', () => {
   describe('histogram', () => {
-    const getConfig = (() => {}) as fieldFormats.GetConfigFn;
+    const getConfig = (() => {}) as FieldFormatsGetConfigFn;
     const getAggConfigs = () => {
       const field = {
         name: 'bytes',