[Security Solution] Enable button not working on rule details page for custom users

[muskangulati-qasource]

Describe the bug

• Enable button not working on rule details page for custom users

Build info

VERSION: 8.4.0
BUILD: 54789
COMMIT: af3a3cba9a7fa3b3e0d2e4766a1db11a5ff4f192

Preconditions

1. To have a user with a custom role:

• Role different from superuser
• superuser should not be part of the roles the user has
• The user should have customized kibana privileges

2. To have at least one detection rule disabled

Steps to Reproduce

1. Navigate to the rule details of one of the disabled rules
2. Enable the rule

Actual Result

• The user is not able to enable the rule

Expected Result

• The user should be able to enable the rule

Screen Recording
https://user-images.githubusercontent.com/60252716/180953989-d8427a6b-eda0-4bbc-b49f-5214e585e010.mp4

Workaround:

• The rule can be enabled from the Rules page

Extra information:

• This behaviour can be reproduced with different license types

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[muskangulati-qasource]

@manishgupta-qasource please review!

[manishgupta-qasource]

Reviewed & assigned to @MadameSheema

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[MadameSheema]

During a pair-testing session with @patrykkopycinski we faced the same behavior for an enterprise license with the following custom role.

{
  "test": {
    "cluster": [
      "all"
    ],
    "indices": [
      {
        "names": [
          "*"
        ],
        "privileges": [
          "all"
        ],
        "field_security": {
          "grant": [
            "*"
          ],
          "except": []
        },
        "allow_restricted_indices": false
      }
    ],
    "applications": [
      {
        "application": "kibana-.kibana",
        "privileges": [
          "feature_siem.all",
          "feature_securitySolutionCases.all",
          "feature_osquery.minimal_all",
          "feature_osquery.live_queries_read",
          "feature_osquery.run_saved_queries",
          "feature_osquery.saved_queries_all",
          "feature_osquery.saved_queries_read",
          "feature_osquery.packs_all",
          "feature_osquery.packs_read",
          "feature_actions.read"
        ],
        "resources": [
          "*"
        ]
      }
    ],
    "run_as": [],
    "metadata": {},
    "transient_metadata": {
      "enabled": true
    }
  }
}

[banderror]

Two reasons can cause this bug:

• Current user doesn't have ML admin privileges, i.e. Analytics -> Machine Learning -> All (despite the license, even if it's Platinum)
• Current license is basic (despite the ML privileges)

[banderror]

@muskangulati-qasource Fixed in #143252 (it has been merged in main which corresponds to 8.6.0, we're also targeting 8.5.1 and going to backport it to 8.5 branch when 8.5.0 will be released).

[banderror]

@maximpn Please backport the fix to the 8.5 branch soon after Elastic releases 8.5.0. Thanks!

[maximpn]

@muskangulati-qasource @banderror The fix has been backported to 8.5.1.

[muskangulati-qasource]

Hi Team,

We have validated this issue on 8.5.1 BC1 and found the issue is fixed now. ✔️

Build Details:

Version: 8.5.1 BC1
Commit:87149bfd06f4fe41dbfa7e95461294e9dadfb1d8
Build:57136

Screen Recording:

Rule.mp4

Please let us know if anything else is required from our end.

Thanks !!!

[ghost]

Hi Team,

We have validated this issue on 8.6.0 BC1 and found the issue is fixed now. ✔️

Build Details:

VERSION: 8.6.0 BC1
BUILD: 58392
COMMIT: 50a7feb0a5eb068d3acccc49c83b9ccb6db6734f

Screen Recording:

Rules.-.Kibana.Mozilla.Firefox.2022-11-17.15-37-45.mp4

Hence we are marking this as QA validated.

Thanks !