Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution]Create Rule Button showing on Rule Group page with Read Security Privilege #163462

Closed
ghost opened this issue Aug 9, 2023 · 8 comments
Closed

[Security Solution]Create Rule Button showing on Rule Group page with Read Security Privilege #163462

ghost opened this issue Aug 9, 2023 · 8 comments
Assignees
@machadoum @semd
Labels
bug Fixes for quality problems that affect the customer experience fixed impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. QA:Validated Issue has been validated by QA Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Explore Team:Threat Hunting Security Solution Threat Hunting Team v8.10.0

Comments

@ghost
Copy link

ghost commented Aug 9, 2023

Describe the bug:
Create Rule Button showing on Rule Group page with Read Security Privilege

Kibana/Elasticsearch Stack version
Version: 8.10.0 SNAPSHOT
Commit: f9f2d37
Build: 65764

Browser and Browser OS Version:
Firefox for windows OS
Version: 116.0.2 (64-bit)

Elastic Endpoint Version:
v8.10.0-dev.0

Original install method:
Build summary: https://artifacts-api.elastic.co/v1/search/8.10.0-SNAPSHOT

Functional Area:
Security App side Navigation

Initial Setup:

  • Custom user with Customized privilege ( Set Security Feature to None ) in order to set read access to rule feature of security ( refer below attached screen-shot)

Steps to reproduce

  • Navigate to Rule Details Page page <kibanaurl>/app/security/rules/management
  • Validate the Read glassed icon on page header and crate new rule button to be disabled as user don't have access to create rule
  • Now move to Rule Group listing page <kibanaurl>/app/security/rules/landing
  • Observed that Create Rule button is enabled which is incorrect as user dont have access to create rule

Additional Observation

  • Moreover on clicking on Create Rule button on rule group page it is redirecting us to Rule Details page

Current behavior

  • Create rule button is enabled on Rule Grouping page with Read Access to Security App.

Expected behavior:

  • Create Rule button need to disabled on Rule Grouping page with Read Access to Security App.
  • Read Glasses needed to show in header

Screen-Cast:

SIEM.Rules.-.Kibana.Mozilla.Firefox.Private.Browsing.2023-08-09.12-53-15.mp4

Errors in browser console:
N/A

Any additional context (logs, chat logs, magical formulas, etc.):

N/A
@ghost ghost added bug Fixes for quality problems that affect the customer experience triage_needed Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. labels Aug 9, 2023
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@ghost ghost added impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team:Threat Hunting:Explore v8.10.0 labels Aug 9, 2023
@ghost
Copy link
Author

ghost commented Aug 9, 2023

@amolnater-qasource please review and assign

@amolnater-qasource
Copy link

Reviewed and assigned to @MadameSheema

@MadameSheema MadameSheema assigned semd and stephmilovic and unassigned MadameSheema Aug 9, 2023
@MadameSheema MadameSheema added the Team:Threat Hunting Security Solution Threat Hunting Team label Aug 9, 2023
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

@stephmilovic stephmilovic removed their assignment Aug 14, 2023
@machadoum machadoum self-assigned this Aug 17, 2023
@machadoum machadoum mentioned this issue Aug 17, 2023
Merged
1 task
machadoum added a commit that referenced this issue Aug 23, 2023
@machadoum
Remove 'Create Rule' button from Rule Group page (#164167)
9aafd1f 
issue: #163462

## Summary

Change of plan. We are going to delete the button.

~Disable the 'Create Rule' button on the Rule Group page and add the
read icon to the topbar when the user is on read mode.~
Delete 'Create Rule' button on the Rule Group page

### How to reproduce it
* ~Create a role with read access to the security solution feature~
* ~Login with a user that has the created role~
* Open the rule group page

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Aug 23, 2023
@machadoum
Remove 'Create Rule' button from Rule Group page (elastic#164167)
e37b34b 
issue: elastic#163462

## Summary

Change of plan. We are going to delete the button.

~Disable the 'Create Rule' button on the Rule Group page and add the
read icon to the topbar when the user is on read mode.~
Delete 'Create Rule' button on the Rule Group page

### How to reproduce it
* ~Create a role with read access to the security solution feature~
* ~Login with a user that has the created role~
* Open the rule group page

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

(cherry picked from commit 9aafd1f)
kibanamachine referenced this issue Aug 23, 2023
@kibanamachine @machadoum
[8.10] Remove 'Create Rule' button from Rule Group page (#164167) (#1…
7b1731d 
…64535)

# Backport

This will backport the following commits from `main` to `8.10`:
- [Remove 'Create Rule' button from Rule Group page
(#164167)](#164167)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Pablo
Machado","email":"[email protected]"},"sourceCommit":{"committedDate":"2023-08-23T08:20:32Z","message":"Remove
'Create Rule' button from Rule Group page (#164167)\n\nissue:
https://github.com/elastic/kibana/issues/163462\r\n\r\n##
Summary\r\n\r\nChange of plan. We are going to delete the
button.\r\n\r\n~Disable the 'Create Rule' button on the Rule Group page
and add the\r\nread icon to the topbar when the user is on read
mode.~\r\nDelete 'Create Rule' button on the Rule Group page\r\n\r\n###
How to reproduce it\r\n* ~Create a role with read access to the security
solution feature~\r\n* ~Login with a user that has the created
role~\r\n* Open the rule group page\r\n\r\n### Checklist\r\n\r\nDelete
any items that are not applicable to this PR.\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"9aafd1ff834c4609317846ed8643faf47a6fb6de","branchLabelMapping":{"^v8.11.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Threat
Hunting","Team: SecuritySolution","Team:Threat
Hunting:Explore","v8.10.0","v8.11.0"],"number":164167,"url":"https://github.com/elastic/kibana/pull/164167","mergeCommit":{"message":"Remove
'Create Rule' button from Rule Group page (#164167)\n\nissue:
https://github.com/elastic/kibana/issues/163462\r\n\r\n##
Summary\r\n\r\nChange of plan. We are going to delete the
button.\r\n\r\n~Disable the 'Create Rule' button on the Rule Group page
and add the\r\nread icon to the topbar when the user is on read
mode.~\r\nDelete 'Create Rule' button on the Rule Group page\r\n\r\n###
How to reproduce it\r\n* ~Create a role with read access to the security
solution feature~\r\n* ~Login with a user that has the created
role~\r\n* Open the rule group page\r\n\r\n### Checklist\r\n\r\nDelete
any items that are not applicable to this PR.\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"9aafd1ff834c4609317846ed8643faf47a6fb6de"}},"sourceBranch":"main","suggestedTargetBranches":["8.10"],"targetPullRequestStates":[{"branch":"8.10","label":"v8.10.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.11.0","labelRegex":"^v8.11.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/164167","number":164167,"mergeCommit":{"message":"Remove
'Create Rule' button from Rule Group page (#164167)\n\nissue:
https://github.com/elastic/kibana/issues/163462\r\n\r\n##
Summary\r\n\r\nChange of plan. We are going to delete the
button.\r\n\r\n~Disable the 'Create Rule' button on the Rule Group page
and add the\r\nread icon to the topbar when the user is on read
mode.~\r\nDelete 'Create Rule' button on the Rule Group page\r\n\r\n###
How to reproduce it\r\n* ~Create a role with read access to the security
solution feature~\r\n* ~Login with a user that has the created
role~\r\n* Open the rule group page\r\n\r\n### Checklist\r\n\r\nDelete
any items that are not applicable to this PR.\r\n\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common
scenarios","sha":"9aafd1ff834c4609317846ed8643faf47a6fb6de"}}]}]
BACKPORT-->

Co-authored-by: Pablo Machado <[email protected]>
@machadoum
Copy link
Member

Product and Design decided to remove the button.

@MadameSheema
Copy link
Member

@karanbirsingh-qasource this should be validated on BC3

@ghost
Copy link
Author

ghost commented Aug 25, 2023

ok @MadameSheema

@ghost
Copy link
Author

ghost commented Aug 31, 2023

Hi @MadameSheema

We have validated this issue on 8.10 BC3 and found the issue to be fixed now ✔️ . Create Rule button is not showing for read access to security.

Kibana/Elasticsearch Stack version

Version: 8.10.0 BC3
Commit: 56348fa0ed0719679e24d6c58dc3dbee03928c4e
Build: 66261

Screen-Cast:

Detection.rules.SIEM.-.Kibana.-.Google.Chrome.2023-08-31.17-21-30.mp4

Hence we are closing this issue and adding "QA:Validated" tag to it.

thanks !!

@ghost ghost closed this as completed Aug 31, 2023
@ghost ghost added the QA:Validated Issue has been validated by QA label Aug 31, 2023
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@machadoum machadoum

@semd semd

Labels
bug Fixes for quality problems that affect the customer experience fixed impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. QA:Validated Issue has been validated by QA Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Explore Team:Threat Hunting Security Solution Threat Hunting Team v8.10.0
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@machadoum @stephmilovic @elasticmachine @MadameSheema @semd @amolnater-qasource