Merge branch 'master' into fix/canvasServerSideFns

docs/canvas/canvas-elements.asciidoc

@@ -20,7 +20,9 @@ When you add elements to your workpad, you can:
 [[add-canvas-element]]
 === Add elements to your workpad
 
-Choose the elements to display on your workpad, then familiarize yourself with the element using the preconfigured demo data. By default, every element you add to a workpad uses demo data until you change the data source. The demo data includes a small sample data set that you can use to experiment with your element.
+Choose the elements to display on your workpad, then familiarize yourself with the element using the preconfigured demo data. By default, most elements use demo data until you change the data source. The demo data includes a small sample data set that you can use to experiment with your element.
+
+To add a Canvas element:
 
 . Click *Add element*.
 
@@ -31,13 +33,26 @@ image::images/canvas-element-select.gif[Canvas elements]
 
 . Play around with the default settings and see what the element can do.
 
-TIP: Want to use a different element? You can delete the element by selecting it, clicking the *Element options* icon in the top right, then selecting *Delete*.
+To add a map:
+
+. Click *Embed object*.
+
+. Select the map you want to add to the workpad.
++
+[role="screenshot"]
+image::images/canvas-map-embed.gif[]
+
+NOTE: Demo data is only supported on Canvas elements. Maps do not support demo data.
+
+Want to use a different element? You can delete the element by selecting it, clicking the *Element options* icon in the top right, then selecting *Delete*.
 
 [float]
 [[connect-element-data]]
-=== Connect the element to your data
+=== Connect the Canvas element to your data
 
-When you have finished using the demo data, connect the element to a data source.
+When you have finished using the demo data, connect the Canvas element to a data source.
+
+NOTE: Maps do not support data sources. To change the map data, refer to <<maps, Elastic Maps>>.
 
 . Make sure that the element is selected, then select *Data*.
 
@@ -142,7 +157,7 @@ text.align: center;
 [[configure-auto-refresh-interval]]
 ==== Change the data auto-refresh interval
 
-Increase or decrease how often your data refreshes on your workpad.
+Increase or decrease how often your Canvas element data refreshes on your workpad.
 
 . In the top left corner, click the *Control settings* icon.
 
@@ -153,6 +168,17 @@ image::images/canvas-refresh-interval.png[Element data refresh interval]
 
 TIP: To manually refresh the data, click the *Refresh data* icon.
 
+[float]
+[[canvas-time-range]]
+==== Customize map time ranges
+
+Configure the maps on your workpad for a specific time range.
+
+From the panel menu, select *Customize time range* to expose a time filter dedicated to the map.
+
+[role="screenshot"]
+image::images/canvas_map-time-filter.gif[]
+
 [float]
 [[organize-element]]
 === Organize the elements on your workpad

docs/developer/plugin/development-plugin-resources.asciidoc

@@ -3,10 +3,6 @@
 
 Here are some resources that are helpful for getting started with plugin development.
 
-[float]
-==== Our IRC channel
-Many Kibana developers hang out on `irc.freenode.net` in the `#kibana` channel. We *want* to help you with plugin development. Even more than that, we *want your help* in understanding your plugin goals, so we can build a great plugin system for you! If you've never used IRC, welcome to the fun. You can get started with the http://webchat.freenode.net/?channels=kibana[Freenode Web Client].
-
 [float]
 ==== Some light reading
 Our {repo}blob/master/CONTRIBUTING.md[contributing guide] can help you get a development environment going.
@@ -50,7 +46,7 @@ You're welcome to use these components, but be aware that they are rapidly evolv
 
 [float]
 ==== TypeScript Support
-Plugin code can be written in http://www.typescriptlang.org/[TypeScript] if desired. 
+Plugin code can be written in http://www.typescriptlang.org/[TypeScript] if desired.
 To enable TypeScript support, create a `tsconfig.json` file at the root of your plugin that looks something like this:
 
 ["source","js"]
@@ -67,6 +63,6 @@ To enable TypeScript support, create a `tsconfig.json` file at the root of your
 }
 -----------
 
-TypeScript code is automatically converted into JavaScript during development, 
-but not in the distributable version of Kibana. If you use the 
+TypeScript code is automatically converted into JavaScript during development,
+but not in the distributable version of Kibana. If you use the
 {repo}blob/{branch}/packages/kbn-plugin-helpers[@kbn/plugin-helpers] to build your plugin, then your `.ts` and `.tsx` files will be permanently transpiled before your plugin is archived. If you have your own build process, make sure to run the TypeScript compiler on your source files and ship the compilation output so that your plugin will work with the distributable version of Kibana.

docs/management/advanced-options.asciidoc

@@ -220,8 +220,10 @@ might increase the search time. This setting is off by default. Users must opt-i
 [horizontal]
 `siem:defaultAnomalyScore`:: The threshold above which Machine Learning job anomalies are displayed in the SIEM app.
 `siem:defaultIndex`:: A comma-delimited list of Elasticsearch indices from which the SIEM app collects events.
-`siem:enableNewsFeed`:: Enables the News feed
-`siem:newsFeedUrl`:: News feed content will be retrieved from this URL
+`siem:enableNewsFeed`:: Enables the security news feed on the SIEM *Overview* 
+page.
+`siem:newsFeedUrl`:: The URL from which the security news feed content is 
+retrieved.
 `siem:refreshIntervalDefaults`:: The default refresh interval for the SIEM time filter, in milliseconds.
 `siem:timeDefaults`:: The default period of time in the SIEM time filter.
 

docs/siem/index.asciidoc

@@ -33,7 +33,8 @@ https://www.elastic.co/products/beats/packetbeat[{packetbeat}]
 send security events and other data to Elasticsearch.
 
 The default index patterns for SIEM events are `auditbeat-*`, `winlogbeat-*`,
-`filebeat-*`, `endgame-*`, and `packetbeat-*``. You can change the default index patterns in
+`filebeat-*`, `packetbeat-*`, `endgame-*`, and `apm-*-transaction*`. You can 
+change the default index patterns in
 *Kibana > Management > Advanced Settings > siem:defaultIndex*.
 
 [float]

docs/user/security/authentication/index.asciidoc

@@ -12,6 +12,7 @@
 - <<pki-authentication>>
 - <<saml>>
 - <<oidc>>
+- <<kerberos>>
 
 [[basic-authentication]]
 ==== Basic authentication
@@ -214,3 +215,26 @@ leaked, it can't be re-used after logout. This is known as "local" logout.
 {kib} can also initiate a "global" logout or _Single Logout_ if it's supported by the external authentication provider and not
 explicitly disabled by {es}. In this case, the user is redirected to the external authentication provider for log out of
 all applications associated with the active provider session.
+
+[[kerberos]]
+==== Kerberos single sign-on
+
+As with the previous SSOs, make sure that you have configured {es} first accordingly. See {ref}/kerberos-realm.html[Kerberos authentication].
+
+Next, to enable Kerberos in {kib}, you will need to enable the Kerberos authentication provider in the `kibana.yml` configuration file, as follows:
+
+[source,yaml]
+-----------------------------------------------
+xpack.security.authc.providers: [kerberos]
+-----------------------------------------------
+
+You may want to be able to authenticate with the basic authentication provider as a secondary mechanism or while you are setting up Kerberos for the stack:
+
+[source,yaml]
+-----------------------------------------------
+xpack.security.authc.providers: [kerberos, basic]
+-----------------------------------------------
+
+As a reminder, the order is important as it determines the order in which each authentication provider is attempted.
+
+Kibana uses SPNEGO, which wraps the Kerberos protocol for use with HTTP, extending it to web applications. At the end of the Kerberos handshake, Kibana will forward the service ticket to Elasticsearch. Elasticsearch will unpack it and it will respond with an access and refresh token which are then used for subsequent authentication.

packages/kbn-config-schema/README.md

@@ -227,6 +227,9 @@ __Usage:__
 const valueSchema = schema.arrayOf(schema.number());
 ```
 
+__Notes:__
+* The `schema.arrayOf()` also supports a json string as input if it can be safely parsed using `JSON.parse` and if the resulting value is an array.
+
 #### `schema.object()`
 
 Validates input data as an object with a predefined set of properties.
@@ -249,6 +252,7 @@ const valueSchema = schema.object({
 __Notes:__
 * Using `allowUnknowns` is discouraged and should only be used in exceptional circumstances. Consider using `schema.recordOf()` instead.
 * Currently `schema.object()` always has a default value of `{}`, but this may change in the near future. Try to not rely on this behaviour and specify default value explicitly or use `schema.maybe()` if the value is optional.
+* `schema.object()` also supports a json string as input if it can be safely parsed using `JSON.parse` and if the resulting value is a plain object.
 
 #### `schema.recordOf()`
 
@@ -267,6 +271,7 @@ const valueSchema = schema.recordOf(schema.string(), schema.number());
 
 __Notes:__
 * You can use a union of literal types as a record's key schema to restrict record to a specific set of keys, e.g. `schema.oneOf([schema.literal('isEnabled'), schema.literal('name')])`.
+* `schema.recordOf()` also supports a json string as input if it can be safely parsed using `JSON.parse` and if the resulting value is a plain object.
 
 #### `schema.mapOf()`
 
@@ -283,6 +288,10 @@ __Usage:__
 const valueSchema = schema.mapOf(schema.string(), schema.number());
 ```
 
+__Notes:__
+* You can use a union of literal types as a record's key schema to restrict record to a specific set of keys, e.g. `schema.oneOf([schema.literal('isEnabled'), schema.literal('name')])`.
+* `schema.mapOf()` also supports a json string as input if it can be safely parsed using `JSON.parse` and if the resulting value is a plain object.
+
 ### Advanced types
 
 #### `schema.oneOf()`

packages/kbn-config-schema/src/internals/index.ts

@@ -250,22 +250,47 @@ export const internals = Joi.extend([
 
     base: Joi.object(),
     coerce(value: any, state: State, options: ValidationOptions) {
-      // If value isn't defined, let Joi handle default value if it's defined.
-      if (value !== undefined && !isPlainObject(value)) {
-        return this.createError('object.base', { value }, state, options);
+      if (value === undefined || isPlainObject(value)) {
+        return value;
       }
 
-      return value;
+      if (options.convert && typeof value === 'string') {
+        try {
+          const parsed = JSON.parse(value);
+          if (isPlainObject(parsed)) {
+            return parsed;
+          }
+          return this.createError('object.base', { value: parsed }, state, options);
+        } catch (e) {
+          return this.createError('object.parse', { value }, state, options);
+        }
+      }
+
+      return this.createError('object.base', { value }, state, options);
     },
     rules: [anyCustomRule],
   },
   {
     name: 'map',
 
     coerce(value: any, state: State, options: ValidationOptions) {
+      if (value === undefined) {
+        return value;
+      }
       if (isPlainObject(value)) {
         return new Map(Object.entries(value));
       }
+      if (options.convert && typeof value === 'string') {
+        try {
+          const parsed = JSON.parse(value);
+          if (isPlainObject(parsed)) {
+            return new Map(Object.entries(parsed));
+          }
+          return this.createError('map.base', { value: parsed }, state, options);
+        } catch (e) {
+          return this.createError('map.parse', { value }, state, options);
+        }
+      }
 
       return value;
     },
@@ -321,11 +346,23 @@ export const internals = Joi.extend([
   {
     name: 'record',
     pre(value: any, state: State, options: ValidationOptions) {
-      if (!isPlainObject(value)) {
-        return this.createError('record.base', { value }, state, options);
+      if (value === undefined || isPlainObject(value)) {
+        return value;
       }
 
-      return value as any;
+      if (options.convert && typeof value === 'string') {
+        try {
+          const parsed = JSON.parse(value);
+          if (isPlainObject(parsed)) {
+            return parsed;
+          }
+          return this.createError('record.base', { value: parsed }, state, options);
+        } catch (e) {
+          return this.createError('record.parse', { value }, state, options);
+        }
+      }
+
+      return this.createError('record.base', { value }, state, options);
     },
     rules: [
       anyCustomRule,
@@ -371,12 +408,23 @@ export const internals = Joi.extend([
 
     base: Joi.array(),
     coerce(value: any, state: State, options: ValidationOptions) {
-      // If value isn't defined, let Joi handle default value if it's defined.
-      if (value !== undefined && !Array.isArray(value)) {
-        return this.createError('array.base', { value }, state, options);
+      if (value === undefined || Array.isArray(value)) {
+        return value;
       }
 
-      return value;
+      if (options.convert && typeof value === 'string') {
+        try {
+          const parsed = JSON.parse(value);
+          if (Array.isArray(parsed)) {
+            return parsed;
+          }
+          return this.createError('array.base', { value: parsed }, state, options);
+        } catch (e) {
+          return this.createError('array.parse', { value }, state, options);
+        }
+      }
+
+      return this.createError('array.base', { value }, state, options);
     },
     rules: [anyCustomRule],
   },