Hide/Block the Wazuh app depending on the selected Kibana space

[jesusgn90]

Describe the solution you'd like
Certain complex environments are using custom spaces from Kibana, users want to restrict/filter the usage of the Wazuh app depending on the user's active space.

Describe alternatives you've considered

• Explore spaces feature, we might achieve it with no development.
• If the first idea doesn't work, let's develop some code in the Wazuh app for blocking users depending on the active space. This will probably be the solution.

Since we don't know the effort for this task yet, we can't tell you which version will be the release for this feature, however, I think we can reach it for the next minor (3.10) where the app is compatible with custom spaces. Stay updated tracking this ticket.

[jesusgn90]

Here is a tiny follow up about this task:

After some researching and with a 3.10 app (which is compatible with custom spaces), we've concluded that we may want to add a new setting for the config.yml file.

This new setting would be an array of namespaces, that's said, it would look like the next block by default (allow all spaces):

#spaces.allowed: ['*']

Possible customizations would be:

spaces.allowed: ['*'] --> all spaces are allowed
spaces.allowed: [ ]   --> same as '*' ?
spaces.allowed: ['default', 'staging'] --> only 'default' and 'staging' spaces are allowed
spaces.allowed: ['staging', '*'] --> all spaces are allowed ?
spaces.allowed: [-1, null, 'foo'] --> invalid content, all spaces are allowed? just the 'default' space is allowed?

The easy way would be to make the app be still visible, but users wouldn't see anything inside the app if their spaces are not allowed, something similar to the index patterns lock we are doing with X-Pack.

Another way would be to fully hide the Wazuh app, but I'm not sure if this would be possible from the app itself (the app would hide the app...).

Regards

[jesusgn90]

Update

After more researching, we've found a cleaner and simpler way to achieve this task.

If we put the next block on the init plugin function:

    init(server, options) {
      // Kibana spaces locker
      const xpackMainPlugin = server.plugins.xpack_main;
      xpackMainPlugin.registerFeature({
        id: 'wazuh',
        name: 'Wazuh',
        app: ['wazuh','kibana','elasticsearch'],
        navLinkId: 'wazuh',
        privileges: {}
      });

      return initApp(server, options);
    }

Our plugin would be available on the plugins list for any custom space:

Allowing us to enable/disable the app as native plugins do:

There is a tiny issue (elastic/kibana#43184) in the plugins list about the icon because it's a third-party app, the EUI icons don't know about our icon:

Next thing to explore is about the plugin space-related privileges:

privileges: {}

It only affects once security is enabled, we need to test it before adding more feedback here.

We also need to make it work on OSS distributions.

[cr0wg4n]

Hi! @jesusgn90, I try to remove Wazuh App in the kibana's features, but it doesn't appear to disable, I need Wazuh enabled and disabled by space, this behaviour is normal?, I'm using the wazuh/wazuh-kibana:3.13.2_7.9.1 image
.
Thank you.

[jsanchez91]

Kibana's last release has some changes and we lost this feature. We are currently working on adapting the plugin to Kibana's changes, we hope to have everything ready as soon as possible.

We will inform you with any updates

[cr0wg4n]

Kibana's last release has some changes and we lost this feature. We are currently working on adapting the plugin to Kibana's changes, we hope to have everything ready as soon as possible.

We will inform you with any updates

I'm using wazuh/wazuh-kibana:3.13.1_7.8.0 image right now and the feature that I want is there, thank you so much

[cruggieri]

Hi, any news on this?
We have a lot of kibana spaces but we need to have one dedicated to wazuh.

Do you have any preview when this feature could be fixed?
Thanks

[frankeros]

Hi @cruggieri
I´m afraid not.
But we'll try to improve a way to do this more simply.
I created this issue #3164 to carry on with the enhancement.
Thanks