Merge branch 'main' into RAM-add-maintenance-window-banner

.buildkite/ftr_configs.yml

@@ -46,6 +46,7 @@ disabled:
   - x-pack/plugins/apm/ftr_e2e/ftr_config.ts
   - x-pack/test_serverless/functional/test_suites/observability/cypress/config_headless.ts
   - x-pack/test_serverless/functional/test_suites/observability/cypress/config_runner.ts
+  - x-pack/test/security_solution_cypress/serverless_config.ts
   - x-pack/plugins/profiling/e2e/ftr_config_open.ts
   - x-pack/plugins/profiling/e2e/ftr_config_runner.ts
   - x-pack/plugins/profiling/e2e/ftr_config.ts

.buildkite/pipelines/pull_request/base.yml

@@ -94,13 +94,14 @@ steps:
       automatic:
         - exit_status: '-1'
           limit: 3
-
+  
   - command: .buildkite/scripts/steps/functional/security_serverless.sh
     label: 'Serverless Security Cypress Tests'
     agents:
       queue: n2-4-spot
     depends_on: build
     timeout_in_minutes: 40
+    parallelism: 10
     soft_fail:
       - exit_status: 10    
     retry:
@@ -110,8 +111,60 @@ steps:
         - exit_status: '*'
           limit: 1
     artifact_paths:
-      - "target/kibana-security-serverless/**/*"
+      - "target/kibana-security-solution/**/*"
 
+  - command: .buildkite/scripts/steps/functional/security_serverless_defend_workflows.sh
+    label: 'Serverless Security Defend Workflows Cypress Tests'
+    agents:
+      queue: n2-4-spot
+    depends_on: build
+    timeout_in_minutes: 40
+    soft_fail:
+      - exit_status: 10
+    retry:
+      automatic:
+        - exit_status: '-1'
+          limit: 3
+        - exit_status: '*'
+          limit: 1
+    artifact_paths:
+      - "target/kibana-security-solution/**/*"
+
+  - command: .buildkite/scripts/steps/functional/security_serverless_investigations.sh
+    label: 'Serverless Security Investigations Cypress Tests'
+    agents:
+      queue: n2-4-spot
+    depends_on: build
+    timeout_in_minutes: 40
+    parallelism: 4
+    soft_fail:
+      - exit_status: 10
+    retry:
+      automatic:
+        - exit_status: '-1'
+          limit: 3
+        - exit_status: '*'
+          limit: 1
+    artifact_paths:
+      - "target/kibana-security-solution/**/*"
+
+  - command: .buildkite/scripts/steps/functional/security_serverless_explore.sh
+    label: 'Serverless Security Explore Cypress Tests'
+    agents:
+      queue: n2-4-spot
+    depends_on: build
+    timeout_in_minutes: 40
+    parallelism: 2
+    soft_fail:
+      - exit_status: 10
+    retry:
+      automatic:
+        - exit_status: '-1'
+          limit: 3
+        - exit_status: '*'
+          limit: 1
+    artifact_paths:
+      - "target/kibana-security-solution/**/*"
 
   - command: .buildkite/scripts/steps/lint.sh
     label: 'Linting'

.buildkite/pipelines/pull_request/security_solution.yml

@@ -11,15 +11,4 @@ steps:
         - exit_status: '*'
           limit: 1
     artifact_paths:
-      - "target/kibana-security-solution/**/*"
-
-  - command: .buildkite/scripts/steps/functional/security_solution_burn.sh
-    label: 'Security Solution Cypress tests, burning changed specs'
-    agents:
-      queue: n2-4-spot
-    depends_on: build
-    timeout_in_minutes: 120
-    parallelism: 1
-    soft_fail: true
-    artifact_paths:
-      - "target/kibana-security-solution/**/*"
+      - "target/kibana-security-solution/**/*"

.buildkite/scripts/steps/functional/response_ops.sh

@@ -10,4 +10,4 @@ export KIBANA_INSTALL_DIR=${KIBANA_BUILD_LOCATION}
 
 echo "--- Response Ops Cypress Tests on Security Solution"
 
-yarn --cwd x-pack/plugins/security_solution cypress:run:respops
+yarn --cwd x-pack/test/security_solution_cypress cypress:run:respops:ess

.buildkite/scripts/steps/functional/response_ops_cases.sh

@@ -10,4 +10,4 @@ export KIBANA_INSTALL_DIR=${KIBANA_BUILD_LOCATION}
 
 echo "--- Response Ops Cases Cypress Tests on Security Solution"
 
-yarn --cwd x-pack/plugins/security_solution cypress:run:cases
+yarn --cwd x-pack/test/security_solution_cypress cypress:run:cases:ess

.buildkite/scripts/steps/functional/security_serverless.sh

@@ -10,4 +10,4 @@ export KIBANA_INSTALL_DIR=${KIBANA_BUILD_LOCATION}
 
 echo "--- Security Serverless Cypress"
 
-yarn --cwd x-pack/test_serverless/functional/test_suites/security/cypress cypress:run
+yarn --cwd x-pack/test/security_solution_cypress cypress:run:serverless

.buildkite/scripts/steps/functional/security_serverless_defend_workflows.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/scripts/steps/functional/common.sh
+source .buildkite/scripts/steps/functional/common_cypress.sh
+
+export JOB=kibana-serverless-security-cypress
+export KIBANA_INSTALL_DIR=${KIBANA_BUILD_LOCATION}
+
+echo "--- Security Defend Workflows Serverless Cypress"
+
+yarn --cwd x-pack/test_serverless/functional/test_suites/security/cypress cypress:run

.buildkite/scripts/steps/functional/security_serverless_explore.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/scripts/steps/functional/common.sh
+source .buildkite/scripts/steps/functional/common_cypress.sh
+
+export JOB=kibana-security-solution-chrome
+export KIBANA_INSTALL_DIR=${KIBANA_BUILD_LOCATION}
+
+echo "--- Explore Cypress Tests on Serverless"
+
+yarn --cwd x-pack/test/security_solution_cypress cypress:explore:run:serverless

.buildkite/scripts/steps/functional/security_serverless_investigations.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/scripts/steps/functional/common.sh
+source .buildkite/scripts/steps/functional/common_cypress.sh
+
+export JOB=kibana-security-solution-chrome
+export KIBANA_INSTALL_DIR=${KIBANA_BUILD_LOCATION}
+
+echo "--- Investigations Cypress Tests on Serverless"
+
+yarn --cwd x-pack/test/security_solution_cypress cypress:investigations:run:serverless

.buildkite/scripts/steps/functional/security_solution.sh

@@ -10,4 +10,4 @@ export KIBANA_INSTALL_DIR=${KIBANA_BUILD_LOCATION}
 
 echo "--- Security Solution Cypress tests (Chrome)"
 
-yarn --cwd x-pack/plugins/security_solution cypress:run
+yarn --cwd x-pack/test/security_solution_cypress cypress:run:ess

.buildkite/scripts/steps/functional/security_solution_burn.sh

@@ -12,4 +12,4 @@ buildkite-agent meta-data set "${BUILDKITE_JOB_ID}_is_test_execution_step" 'fals
 
 echo "--- Security Solution Cypress tests, burning changed specs (Chrome)"
 
-yarn --cwd x-pack/plugins/security_solution cypress:changed-specs-only
+yarn --cwd x-pack/test/security_solution_cypress cypress:changed-specs-only:ess

.buildkite/scripts/steps/functional/security_solution_explore.sh

@@ -10,4 +10,4 @@ export KIBANA_INSTALL_DIR=${KIBANA_BUILD_LOCATION}
 
 echo "--- Explore Cypress Tests on Security Solution"
 
-yarn --cwd x-pack/plugins/security_solution cypress:explore:run
+yarn --cwd x-pack/test/security_solution_cypress cypress:explore:run:ess

.buildkite/scripts/steps/functional/security_solution_investigations.sh

@@ -10,4 +10,4 @@ export KIBANA_INSTALL_DIR=${KIBANA_BUILD_LOCATION}
 
 echo "--- Investigations Cypress Tests on Security Solution"
 
-yarn --cwd x-pack/plugins/security_solution cypress:investigations:run
+yarn --cwd x-pack/test/security_solution_cypress cypress:investigations:run:ess

.github/CODEOWNERS

@@ -1087,7 +1087,7 @@ x-pack/plugins/cloud_integrations/cloud_full_story/server/config.ts @elastic/kib
 /x-pack/plugins/security_solution/common/search_strategy/timeline @elastic/security-threat-hunting-investigations
 /x-pack/plugins/security_solution/common/types/timeline @elastic/security-threat-hunting-investigations
 
-/x-pack/plugins/security_solution/cypress/e2e/investigations @elastic/security-threat-hunting-investigations
+/x-pack/test/security_solution_cypress/cypress/e2e/investigations @elastic/security-threat-hunting-investigations
 
 /x-pack/plugins/security_solution/public/common/components/alerts_viewer @elastic/security-threat-hunting-investigations
 /x-pack/plugins/security_solution/public/detections/components/alerts_table/timeline_action @elastic/security-threat-hunting-investigations
@@ -1111,12 +1111,11 @@ x-pack/plugins/cloud_integrations/cloud_full_story/server/config.ts @elastic/kib
 /x-pack/plugins/security_solution/common/search_strategy/security_solution/network @elastic/security-threat-hunting-explore
 /x-pack/plugins/security_solution/common/search_strategy/security_solution/user @elastic/security-threat-hunting-explore
 
-/x-pack/plugins/security_solution/cypress/e2e/explore @elastic/security-threat-hunting-explore
-/x-pack/plugins/security_solution/cypress/screens/hosts @elastic/security-threat-hunting-explore
-/x-pack/plugins/security_solution/cypress/screens/network @elastic/security-threat-hunting-explore
-/x-pack/plugins/security_solution/cypress/tasks/hosts @elastic/security-threat-hunting-explore
-/x-pack/plugins/security_solution/cypress/tasks/network @elastic/security-threat-hunting-explore
-/x-pack/plugins/security_solution/cypress/upgrade_e2e/threat_hunting/cases @elastic/security-threat-hunting-explore
+/x-pack/test/security_solution_cypress/cypress/e2e/explore @elastic/security-threat-hunting-explore
+/x-pack/test/security_solution_cypress/cypress/screens/hosts @elastic/security-threat-hunting-explore
+/x-pack/test/security_solution_cypress/cypress/screens/network @elastic/security-threat-hunting-explore
+/x-pack/test/security_solution_cypress/cypress/tasks/hosts @elastic/security-threat-hunting-explore
+/x-pack/test/security_solution_cypress/cypress/tasks/network @elastic/security-threat-hunting-explore
 
 /x-pack/plugins/security_solution/public/common/components/guided_onboarding_tour @elastic/security-threat-hunting-explore
 /x-pack/plugins/security_solution/public/common/components/charts @elastic/security-threat-hunting-explore
@@ -1168,8 +1167,8 @@ x-pack/plugins/cloud_integrations/cloud_full_story/server/config.ts @elastic/kib
 /x-pack/plugins/security_solution/common/detection_engine/rule_management @elastic/security-detection-rule-management
 /x-pack/plugins/security_solution/common/detection_engine/rule_monitoring @elastic/security-detection-rule-management
 
-/x-pack/plugins/security_solution/cypress/e2e/detection_response/prebuilt_rules @elastic/security-detection-rule-management
-/x-pack/plugins/security_solution/cypress/e2e/detection_response/rule_management @elastic/security-detection-rule-management
+/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/prebuilt_rules @elastic/security-detection-rule-management
+/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/rule_management @elastic/security-detection-rule-management
 
 /x-pack/plugins/security_solution/docs/testing/test_plans/detection_response/prebuilt_rules @elastic/security-detection-rule-management
 /x-pack/plugins/security_solution/docs/testing/test_plans/detection_response/rule_management @elastic/security-detection-rule-management
@@ -1216,12 +1215,12 @@ x-pack/plugins/cloud_integrations/cloud_full_story/server/config.ts @elastic/kib
 /x-pack/plugins/security_solution/server/lib/detection_engine/routes/index @elastic/security-detection-engine
 /x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals @elastic/security-detection-engine
 
-/x-pack/plugins/security_solution/cypress/e2e/data_sources @elastic/security-detection-engine
-/x-pack/plugins/security_solution/cypress/e2e/detection_response/rule_creation @elastic/security-detection-engine
-/x-pack/plugins/security_solution/cypress/e2e/detection_response/value_lists @elastic/security-detection-engine
-/x-pack/plugins/security_solution/cypress/e2e/entity_analytics @elastic/security-detection-engine
-/x-pack/plugins/security_solution/cypress/e2e/exceptions @elastic/security-detection-engine
-/x-pack/plugins/security_solution/cypress/e2e/overview @elastic/security-detection-engine
+/x-pack/test/security_solution_cypress/cypress/e2e/data_sources @elastic/security-detection-engine
+/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/rule_creation @elastic/security-detection-engine
+/x-pack/test/security_solution_cypress/cypress/e2e/detection_response/value_lists @elastic/security-detection-engine
+/x-pack/test/security_solution_cypress/cypress/e2e/entity_analytics @elastic/security-detection-engine
+/x-pack/test/security_solution_cypress/cypress/e2e/exceptions @elastic/security-detection-engine
+/x-pack/test/security_solution_cypress/cypress/e2e/overview @elastic/security-detection-engine
 
 /x-pack/plugins/security_solution/common/detection_engine/rule_exceptions @elastic/security-detection-engine
 
@@ -1240,14 +1239,14 @@ x-pack/plugins/cloud_integrations/cloud_full_story/server/config.ts @elastic/kib
 /x-pack/plugins/security_solution/public/common/components/threat_match @elastic/security-detection-engine
 
 ## Security Solution cross teams ownership
-/x-pack/plugins/security_solution/cypress/fixtures @elastic/security-detections-response @elastic/security-threat-hunting
-/x-pack/plugins/security_solution/cypress/helpers @elastic/security-detections-response @elastic/security-threat-hunting
-/x-pack/plugins/security_solution/cypress/e2e/detection_rules @elastic/security-detection-rule-management @elastic/security-detection-engine
-/x-pack/plugins/security_solution/cypress/objects @elastic/security-detections-response @elastic/security-threat-hunting
-/x-pack/plugins/security_solution/cypress/plugins @elastic/security-detections-response @elastic/security-threat-hunting
-/x-pack/plugins/security_solution/cypress/screens/common @elastic/security-detections-response @elastic/security-threat-hunting
-/x-pack/plugins/security_solution/cypress/support @elastic/security-detections-response @elastic/security-threat-hunting
-/x-pack/plugins/security_solution/cypress/urls @elastic/security-threat-hunting-investigations @elastic/security-detection-engine
+/x-pack/test/security_solution_cypress/cypress/fixtures @elastic/security-detections-response @elastic/security-threat-hunting
+/x-pack/test/security_solution_cypress/cypress/helpers @elastic/security-detections-response @elastic/security-threat-hunting
+/x-pack/test/security_solution_cypress/cypress/e2e/detection_rules @elastic/security-detection-rule-management @elastic/security-detection-engine
+/x-pack/test/security_solution_cypress/cypress/objects @elastic/security-detections-response @elastic/security-threat-hunting
+/x-pack/test/security_solution_cypress/cypress/plugins @elastic/security-detections-response @elastic/security-threat-hunting
+/x-pack/test/security_solution_cypress/cypress/screens/common @elastic/security-detections-response @elastic/security-threat-hunting
+/x-pack/test/security_solution_cypress/cypress/support @elastic/security-detections-response @elastic/security-threat-hunting
+/x-pack/test/security_solution_cypress/cypress/urls @elastic/security-threat-hunting-investigations @elastic/security-detection-engine
 
 /x-pack/plugins/security_solution/common/ecs @elastic/security-threat-hunting-investigations
 /x-pack/plugins/security_solution/common/test @elastic/security-detection-rule-management @elastic/security-detection-engine
@@ -1283,9 +1282,7 @@ x-pack/plugins/security_solution/server/usage/ @elastic/security-data-analytics
 x-pack/plugins/security_solution/server/lib/telemetry/ @elastic/security-data-analytics
 
 ## Security Solution sub teams - security-engineering-productivity
-x-pack/plugins/security_solution/cypress/ccs_e2e @elastic/security-engineering-productivity
-x-pack/plugins/security_solution/cypress/upgrade_e2e @elastic/security-engineering-productivity
-x-pack/plugins/security_solution/cypress/README.md @elastic/security-engineering-productivity
+x-pack/test/security_solution_cypress/cypress/README.md @elastic/security-engineering-productivity
 x-pack/test/security_solution_cypress @elastic/security-engineering-productivity
 
 ## Security Solution sub teams - adaptive-workload-protection

config/serverless.yml

@@ -97,3 +97,12 @@ xpack.graph.enabled: false
 
 # Disable cases in stack management
 xpack.cases.stack.enabled: false
+
+# Alerting and action circuit breakers
+xpack.alerting.rules.run.actions.max: 3000
+xpack.alerting.rules.run.timeout: 1m
+xpack.alerting.rules.run.ruleTypeOverrides:
+  - id: siem.indicatorRule
+    timeout: 1m
+xpack.alerting.rules.minimumScheduleInterval.enforce: true
+xpack.actions.run.maxAttempts: 10

docs/settings/reporting-settings.asciidoc

@@ -203,26 +203,40 @@ The `file:` protocol is always denied, even if no network policy is configured.
 ==== CSV settings
 
 [[xpack-reporting-csv]] `xpack.reporting.csv.maxSizeBytes` {ess-icon}::
-The maximum {byte-units}[byte size] of a CSV file before being truncated. This setting exists to prevent large exports from causing performance and storage issues. Can be specified as number of bytes. Defaults to `10mb`.
+The maximum {byte-units}[byte size] of a CSV file before being truncated. This setting exists to prevent large
+exports from causing performance and storage issues. Can be specified as number of bytes. Defaults to `250mb`.
 
 [NOTE]
 ============
-Setting `xpack.reporting.csv.maxSizeBytes` much larger than the default 10 MB limit has the potential to negatively affect the
-performance of {kib} and your {es} cluster. There is no enforced maximum for this setting, but a reasonable maximum value depends
-on multiple factors:
+We recommend using CSV reports to export moderate amounts of data only. The feature enables analysis of data in
+external tools, but it's not intended for bulk export or to backup {es} data. If you need to export more than
+250 MB of CSV, rather than increasing `xpack.reporting.csv.maxSizeBytes`, please use filters to create multiple
+smaller reports, or extract the data you need directly from {es}.
 
-* The `http.max_content_length` setting in {es}.
-* Network proxies, which are often configured by default to block large requests with a 413 error.
-* The amount of memory available to the {kib} server, which limits the size of CSV data that must be held temporarily.
+The following deployment configurations may lead to failed report jobs or incomplete reports:
 
-For information about {kib} memory limits, see <<production, using {kib} in a production environment>>.
+* Any shard needed for search is unavailable.
+* Data is stored on slow storage tiers. 
+* Network latency between nodes is high.
+* {ccs-cap} is used.
+
+To export large amounts of data we recommend using {es} APIs directly. See {ref}/point-in-time-api.html[Point
+in time API], or {ref}/sql-rest-format.html#_csv[SQL with CSV response data format].
 ============
 
 `xpack.reporting.csv.scroll.size`::
 Number of documents retrieved from {es} for each scroll iteration during a CSV export. Defaults to `500`.
+[NOTE]
+============
+You may need to lower this setting if the default number of documents creates a strain on network resources.
+============
 
 `xpack.reporting.csv.scroll.duration`::
  Amount of {time-units}[time] allowed before {kib} cleans the scroll context during a CSV export. Defaults to `30s`.
+[NOTE]
+============
+If search latency in {es} is sufficiently high, such as if you are using {ccs}, you may need to increase the setting.
+============
 
 `xpack.reporting.csv.checkForFormulas`::
 Enables a check that warns you when there's a potential formula included in the output (=, -, +, and @ chars). See OWASP: https://www.owasp.org/index.php/CSV_Injection. Defaults to `true`.
@@ -231,7 +245,11 @@ Enables a check that warns you when there's a potential formula included in the
 Escape formula values in cells with a `'`. See OWASP: https://www.owasp.org/index.php/CSV_Injection. Defaults to `true`.
 
 `xpack.reporting.csv.enablePanelActionDownload`::
-deprecated:[7.9.0,This setting has no effect.] Enables CSV export from a saved search on a dashboard. This action is available in the dashboard panel menu for the saved search. *NOTE*: This setting exists for backwards compatibility, but is unused and hardcoded to `true`. CSV export from a saved search on a dashboard is enabled when Reporting is enabled.
+deprecated:[7.9.0,This setting has no effect.] Enables CSV export from a saved search on a dashboard. This action is available in the dashboard panel menu for the saved search. 
+[NOTE]
+============
+This setting exists for backwards compatibility, and is hardcoded to `true`. CSV export from a saved search on a dashboard is enabled when Reporting is enabled.
+============
 
 `xpack.reporting.csv.useByteOrderMarkEncoding`::
 Adds a byte order mark (`\ufeff`) at the beginning of the CSV file. Defaults to `false`.

packages/core/chrome/core-chrome-browser/src/project_navigation.ts

@@ -45,7 +45,7 @@ export type AppDeepLinkId =
   | ObservabilityLink;
 
 /** @public */
-export type CloudLinkId = 'userAndRoles' | 'performance' | 'billingAndSub';
+export type CloudLinkId = 'userAndRoles' | 'performance' | 'billingAndSub' | 'deployment';
 
 export type GetIsActiveFn = (params: {
   /** The current path name including the basePath + hash value but **without** any query params */