{
+describe('ALL - Custom space', () => {
testSpaces.forEach((testSpace) => {
describe(`[${testSpace.name}]`, { tags: testSpace.tags }, () => {
let packName: string;
diff --git a/x-pack/plugins/security_solution/public/app/home/template_wrapper/global_kql_header/index.tsx b/x-pack/plugins/security_solution/public/app/home/template_wrapper/global_kql_header/index.tsx
index f5f9b55e59e7c..80ddc7769e91e 100644
--- a/x-pack/plugins/security_solution/public/app/home/template_wrapper/global_kql_header/index.tsx
+++ b/x-pack/plugins/security_solution/public/app/home/template_wrapper/global_kql_header/index.tsx
@@ -12,7 +12,7 @@ import { useGlobalHeaderPortal } from '../../../../common/hooks/use_global_heade
const StyledStickyWrapper = styled.div`
position: sticky;
z-index: ${(props) => props.theme.eui.euiZHeaderBelowDataGrid};
- top: var(--euiFixedHeadersOffset, 0);
+ top: var(--kbnAppHeadersOffset, var(--euiFixedHeadersOffset, 0));
`;
export const GlobalKQLHeader = React.memo(() => {
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/helpers.test.ts b/x-pack/plugins/security_solution/public/detections/components/alerts_table/helpers.test.ts
index 09c54ba2057f1..79c93d0d32ba3 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/helpers.test.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/helpers.test.ts
@@ -545,7 +545,7 @@ describe('helpers', () => {
range: {
'@timestamp': {
gte: '2020-10-29T21:06:10.192Z',
- lt: '2020-10-29T21:07:38.774Z',
+ lte: '2020-10-29T21:07:38.774Z',
format: 'strict_date_optional_time',
},
},
@@ -557,7 +557,7 @@ describe('helpers', () => {
key: '@timestamp',
params: {
gte: from,
- lt: to,
+ lte: to,
format: 'strict_date_optional_time',
},
},
diff --git a/x-pack/plugins/security_solution/public/detections/components/alerts_table/helpers.ts b/x-pack/plugins/security_solution/public/detections/components/alerts_table/helpers.ts
index 19fcd17cd3c93..7221a9ede2785 100644
--- a/x-pack/plugins/security_solution/public/detections/components/alerts_table/helpers.ts
+++ b/x-pack/plugins/security_solution/public/detections/components/alerts_table/helpers.ts
@@ -224,7 +224,7 @@ export const buildTimeRangeFilter = (from: string, to: string): Filter[] => [
range: {
'@timestamp': {
gte: from,
- lt: to,
+ lte: to,
format: 'strict_date_optional_time',
},
},
@@ -236,7 +236,7 @@ export const buildTimeRangeFilter = (from: string, to: string): Filter[] => [
key: '@timestamp',
params: {
gte: from,
- lt: to,
+ lte: to,
format: 'strict_date_optional_time',
},
},
diff --git a/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/automated_response_actions.cy.ts b/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/automated_response_actions.cy.ts
index 4186317a18e26..6f337adfc35fa 100644
--- a/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/automated_response_actions.cy.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/automated_response_actions.cy.ts
@@ -20,7 +20,8 @@ import { createEndpointHost } from '../../tasks/create_endpoint_host';
import { deleteAllLoadedEndpointData } from '../../tasks/delete_all_endpoint_data';
import { enableAllPolicyProtections } from '../../tasks/endpoint_policy';
-describe(
+// FLAKY: https://github.com/elastic/kibana/issues/168340
+describe.skip(
'Automated Response Actions',
{ tags: ['@ess', '@serverless', '@brokenInServerless'] },
() => {
diff --git a/x-pack/plugins/security_solution/public/management/pages/policy/view/protection_updates/protection_updates_layout.tsx b/x-pack/plugins/security_solution/public/management/pages/policy/view/protection_updates/protection_updates_layout.tsx
index af2932e305576..cf7012f901974 100644
--- a/x-pack/plugins/security_solution/public/management/pages/policy/view/protection_updates/protection_updates_layout.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/policy/view/protection_updates/protection_updates_layout.tsx
@@ -191,6 +191,16 @@ export const ProtectionUpdatesLayout = React.memo
(
[automaticUpdatesEnabled, selectedDate, today]
);
+ const updateDatepickerSelectedDate = useCallback(
+ (date: Moment | null) => {
+ if (date?.isAfter(cutoffDate) && date?.isSameOrBefore(today)) {
+ setSelectedDate(date || today);
+ setManifestVersion(date?.format(internalDateFormat) || 'latest');
+ }
+ },
+ [cutoffDate, today]
+ );
+
const renderVersionToDeployPicker = () => {
return (
<>
@@ -216,10 +226,7 @@ export const ProtectionUpdatesLayout = React.memo(
selected={selectedDate}
maxDate={today}
minDate={cutoffDate}
- onChange={(date) => {
- setSelectedDate(date || today);
- setManifestVersion(date?.format(internalDateFormat) || 'latest');
- }}
+ onChange={updateDatepickerSelectedDate}
/>
) : (
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/open_close_signals_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/open_close_signals_route.ts
index c3060fcc93b88..ce6e19d4706fe 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/open_close_signals_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/open_close_signals_route.ts
@@ -131,7 +131,7 @@ const updateSignalsStatusByIds = async (
) =>
esClient.updateByQuery({
index: `${DEFAULT_ALERTS_INDEX}-${spaceId}`,
- refresh: false,
+ refresh: true,
body: {
script: getUpdateSignalStatusScript(status),
query: {
@@ -158,7 +158,7 @@ const updateSignalsStatusByQuery = async (
esClient.updateByQuery({
index: `${DEFAULT_ALERTS_INDEX}-${spaceId}`,
conflicts: options.conflicts,
- refresh: false,
+ refresh: true,
body: {
script: getUpdateSignalStatusScript(status),
query: {
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/set_alert_tags_route.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/set_alert_tags_route.ts
index 36d3e57169cce..8b7e81f9bf812 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/set_alert_tags_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/routes/signals/set_alert_tags_route.ts
@@ -100,7 +100,7 @@ export const setAlertTagsRoute = (router: SecuritySolutionPluginRouter) => {
try {
const body = await esClient.updateByQuery({
index: `${DEFAULT_ALERTS_INDEX}-${spaceId}`,
- refresh: false,
+ refresh: true,
body: {
script: painlessScript,
query: {
diff --git a/x-pack/plugins/security_solution/server/lib/risk_engine/routes/risk_score_calculation_route.ts b/x-pack/plugins/security_solution/server/lib/risk_engine/routes/risk_score_calculation_route.ts
index 75c88678fd070..1b02c4a10fd25 100644
--- a/x-pack/plugins/security_solution/server/lib/risk_engine/routes/risk_score_calculation_route.ts
+++ b/x-pack/plugins/security_solution/server/lib/risk_engine/routes/risk_score_calculation_route.ts
@@ -23,14 +23,14 @@ export const riskScoreCalculationRoute = (router: SecuritySolutionPluginRouter,
router.versioned
.post({
path: RISK_SCORE_CALCULATION_URL,
- access: 'public',
+ access: 'internal',
options: {
tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
},
})
.addVersion(
{
- version: '2023-10-31',
+ version: '1',
validate: { request: { body: buildRouteValidation(riskScoreCalculationRequestSchema) } },
},
async (context, request, response) => {
diff --git a/x-pack/plugins/security_solution_serverless/common/pli/pli_config.ts b/x-pack/plugins/security_solution_serverless/common/pli/pli_config.ts
index 62acff6857a8e..3dcb800dc7a74 100644
--- a/x-pack/plugins/security_solution_serverless/common/pli/pli_config.ts
+++ b/x-pack/plugins/security_solution_serverless/common/pli/pli_config.ts
@@ -22,6 +22,7 @@ export const PLI_APP_FEATURES: PliAppFeatures = {
AppFeatureKey.investigationGuide,
AppFeatureKey.threatIntelligence,
AppFeatureKey.casesConnectors,
+ AppFeatureKey.externalRuleActions,
],
},
endpoint: {
diff --git a/x-pack/plugins/security_solution_serverless/kibana.jsonc b/x-pack/plugins/security_solution_serverless/kibana.jsonc
index 3756c1114c009..975aaebe45af8 100644
--- a/x-pack/plugins/security_solution_serverless/kibana.jsonc
+++ b/x-pack/plugins/security_solution_serverless/kibana.jsonc
@@ -19,7 +19,8 @@
"serverless",
"taskManager",
"cloud",
- "fleet"
+ "fleet",
+ "actions"
],
"optionalPlugins": [
"securitySolutionEss"
diff --git a/x-pack/plugins/security_solution_serverless/server/plugin.ts b/x-pack/plugins/security_solution_serverless/server/plugin.ts
index fc77d2829d9f4..99f9fbf4a1e7b 100644
--- a/x-pack/plugins/security_solution_serverless/server/plugin.ts
+++ b/x-pack/plugins/security_solution_serverless/server/plugin.ts
@@ -32,6 +32,7 @@ import {
endpointMeteringService,
setEndpointPackagePolicyServerlessFlag,
} from './endpoint/services';
+import { enableRuleActions } from './rules/enable_rule_actions';
export class SecuritySolutionServerlessPlugin
implements
@@ -54,6 +55,7 @@ export class SecuritySolutionServerlessPlugin
public setup(coreSetup: CoreSetup, pluginsSetup: SecuritySolutionServerlessPluginSetupDeps) {
this.config = createConfig(this.initializerContext, pluginsSetup.securitySolution);
+ const enabledAppFeatures = getProductAppFeatures(this.config.productTypes);
// securitySolutionEss plugin should always be disabled when securitySolutionServerless is enabled.
// This check is an additional layer of security to prevent double registrations when
@@ -63,12 +65,14 @@ export class SecuritySolutionServerlessPlugin
const productTypesStr = JSON.stringify(this.config.productTypes, null, 2);
this.logger.info(`Security Solution running with product types:\n${productTypesStr}`);
const appFeaturesConfigurator = getProductAppFeaturesConfigurator(
- getProductAppFeatures(this.config.productTypes),
+ enabledAppFeatures,
this.config
);
pluginsSetup.securitySolution.setAppFeaturesConfigurator(appFeaturesConfigurator);
}
+ enableRuleActions({ actions: pluginsSetup.actions, appFeatureKeys: enabledAppFeatures });
+
this.cloudSecurityUsageReportingTask = new SecurityUsageReportingTask({
core: coreSetup,
logFactory: this.initializerContext.logger,
diff --git a/x-pack/plugins/security_solution_serverless/server/rules/enable_rule_actions.ts b/x-pack/plugins/security_solution_serverless/server/rules/enable_rule_actions.ts
new file mode 100644
index 0000000000000..45e851540b286
--- /dev/null
+++ b/x-pack/plugins/security_solution_serverless/server/rules/enable_rule_actions.ts
@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import { AppFeatureSecurityKey } from '@kbn/security-solution-features/keys';
+import {
+ IndexConnectorTypeId,
+ SlackWebhookConnectorTypeId,
+ EmailConnectorTypeId,
+} from '@kbn/stack-connectors-plugin/server/connector_types';
+import { EnabledActionTypes } from '@kbn/actions-plugin/server/config';
+import type { AppFeatureKeys } from '@kbn/security-solution-features/src/types';
+
+import type { PluginSetupContract as ActionsPluginSetupContract } from '@kbn/actions-plugin/server';
+
+const INTERNAL_RULE_ACTIONS = [
+ IndexConnectorTypeId,
+ SlackWebhookConnectorTypeId,
+ EmailConnectorTypeId,
+];
+
+/**
+ * enable rule actions based on AppFeature Config
+ */
+export const enableRuleActions = ({
+ actions,
+ appFeatureKeys,
+}: {
+ actions: ActionsPluginSetupContract;
+ appFeatureKeys: AppFeatureKeys;
+}) => {
+ if (appFeatureKeys.includes(AppFeatureSecurityKey.externalRuleActions)) {
+ // enables all rule actions
+ actions.setEnabledConnectorTypes([EnabledActionTypes.Any]);
+ } else {
+ actions.setEnabledConnectorTypes(INTERNAL_RULE_ACTIONS);
+ }
+};
diff --git a/x-pack/plugins/security_solution_serverless/server/types.ts b/x-pack/plugins/security_solution_serverless/server/types.ts
index 6f9c87dd92b18..44a86f534ebdf 100644
--- a/x-pack/plugins/security_solution_serverless/server/types.ts
+++ b/x-pack/plugins/security_solution_serverless/server/types.ts
@@ -18,6 +18,7 @@ import type {
import type { CloudSetup } from '@kbn/cloud-plugin/server';
import type { SecuritySolutionEssPluginSetup } from '@kbn/security-solution-ess/server';
import type { FleetStartContract } from '@kbn/fleet-plugin/server';
+import type { PluginSetupContract as ActionsPluginSetupContract } from '@kbn/actions-plugin/server';
import type { ServerlessPluginSetup } from '@kbn/serverless/server';
import type { ProductTier } from '../common/product';
@@ -37,6 +38,7 @@ export interface SecuritySolutionServerlessPluginSetupDeps {
features: PluginSetupContract;
taskManager: TaskManagerSetupContract;
cloud: CloudSetup;
+ actions: ActionsPluginSetupContract;
}
export interface SecuritySolutionServerlessPluginStartDeps {
diff --git a/x-pack/plugins/security_solution_serverless/tsconfig.json b/x-pack/plugins/security_solution_serverless/tsconfig.json
index 77481caa489fb..ef6c4009f345e 100644
--- a/x-pack/plugins/security_solution_serverless/tsconfig.json
+++ b/x-pack/plugins/security_solution_serverless/tsconfig.json
@@ -44,6 +44,8 @@
"@kbn/usage-collection-plugin",
"@kbn/cloud-defend-plugin",
"@kbn/core-logging-server-mocks",
- "@kbn/shared-ux-chrome-navigation"
+ "@kbn/shared-ux-chrome-navigation",
+ "@kbn/stack-connectors-plugin",
+ "@kbn/actions-plugin"
]
}
diff --git a/x-pack/plugins/serverless_search/public/application/components/api_key/api_key.tsx b/x-pack/plugins/serverless_search/public/application/components/api_key/api_key.tsx
index 164bdacd5f985..e3aecb517f947 100644
--- a/x-pack/plugins/serverless_search/public/application/components/api_key/api_key.tsx
+++ b/x-pack/plugins/serverless_search/public/application/components/api_key/api_key.tsx
@@ -82,7 +82,7 @@ export const ApiKeyPanel = ({ setClientApiKey }: { setClientApiKey: (value: stri