Add manage_ingest_pipeline privilege check to Risk Engine enablement #215544

CAWilson94 · 2025-03-21T17:22:26Z

Summary

This PR adds the "manage_ingest_pipeline" cluster privilege to RISK_ENGINE_REQUIRED_ES_CLUSTER_PRIVILEGES.

The Entity Analytics Enablement modal now displays a warning when the user lacks this privilege and prevents Risk Engine installation, as required.

Screenshots

Enablement Modal (installing/enabling)

Risk Management Page

…ck for Risk Engine

elasticmachine · 2025-03-21T17:54:27Z

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine · 2025-03-21T17:54:27Z

Pinging @elastic/security-entity-analytics (Team:Entity Analytics)

jaredburgettelastic · 2025-03-21T19:12:08Z

Just curious (haven't tested): does this also work for the Risk Engine management page? I assume it does if the two pages share that component?

abhishekbhatia1710 · 2025-03-24T06:54:19Z

...olutions/security/plugins/security_solution/common/entity_analytics/risk_engine/constants.ts

 export const RISK_ENGINE_REQUIRED_ES_CLUSTER_PRIVILEGES = [
  'manage_index_templates',
  'manage_transform',
+  'manage_ingest_pipelines',
 ] as ClusterPrivilege[];


Installing the Risk Score Engine requires the following privileges:

manage_transform

manage_index_templates

Running the Risk Score Engine requires:

manage_transform

I believe we should define two separate constants for Risk Engine privileges since the required privileges differ for installation and running the engine.

If we're referring to the enablement modal, it's most likely related to installing the Risk Engine rather than running it.

Also, i think that manage_ingest_pipelines is only required for enabling (read as installing) the risk engine and not for running the risk engine.

Context

Users can perform these actions in the UI

Install the engine

Enable an installed but disabled engine

Run the transform for an enabled engine

Right now, we only verify the cluster privileges for number 1.
@abhishekbhatia1710 is adding a privileges check for number 3 here #213054
We agreed that for now, number 2 will keep using the same privileges check as number 1

Back to this PR

I agree with @abhishekbhatia1710. However, since we only have a privileges check for installing the engine. at this point, adding manage_ingest_pipeline to RISK_ENGINE_REQUIRED_ES_CLUSTER_PRIVILEGESVILEGES seems like the right thing to do.

++ @machadoum and thanks everyone for the detailed discussion!

As in the UI we don't make a distinction I think we are best to stick with checking the superset of permissions, I see these as the permissions needed to have a "full" risk scoring experience.

@CAWilson94 This does seem like an opportunity to put a comment next to (or near) this array, something like:

// These are the required privileges to install the risk engine, enabling and running require less privileges. // We check the superset of privileges to keep things simple and because in the UI there isn't difference between installing and enabling

Also loving that we have managed to have this discussion on a one line PR :D

Hey! Thanks Abhishek and Pablo for this, super helpful in filling in any context and understanding gaps. 🙇

[Nit] @CAWilson94 The RISK_ENGINE_REQUIRED_ES_CLUSTER_PRIVILEGES array contains manage_ingest_pipelines, which is not part of the ClusterPrivilege type. We can add the manage_ingest_pipelines in the ClusterPrivilege type to prevent type mismatch

Absolutely, lets get it in there. Good catch 🎣

@abhishekbhatia1710 actually, even better note. I was wondering why this actually worked. Sneaky assertion in the wild. Also TiL - the satisfies operator

Ah, that's even better. Thanks for sharing the link.
as forces a type, ignoring incorrect values.
satisfies validates the type without affecting inference.

Yah! In general I would always avoid using a type assertion because its telling TS compiler "hey buddy, I know better than you. This is type "whatever type", dont even question it". Probably in tests though it can be useful, although I try to avoid :D

machadoum

LGTM!

I desk-tested, and it works as expected:

CAWilson94 · 2025-03-24T14:11:06Z

Just curious (haven't tested): does this also work for the Risk Engine management page? I assume it does if the two pages share that component?

Good question, thanks! I can confirm, this works there too:

…nd preserving literal types

elasticmachine · 2025-03-25T13:29:03Z

💚 Build Succeeded

Buildkite Build
Commit: 175c65f

Metrics [docs]

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	88.3KB	88.3KB	+26.0B

History

💔 Build #286726 failed 1dcb170
💔 Build #286247 failed 74350ed

cc @CAWilson94

kibanamachine · 2025-03-25T14:20:49Z

Starting backport for target branches: 8.18, 8.x, 9.0

https://github.com/elastic/kibana/actions/runs/14062021138

…lastic#215544) ## Summary This PR adds the "manage_ingest_pipeline" cluster privilege to RISK_ENGINE_REQUIRED_ES_CLUSTER_PRIVILEGES. The Entity Analytics Enablement modal now displays a warning when the user lacks this privilege and prevents Risk Engine installation, as required. ### Screenshots #### Enablement Modal (installing/enabling) ![Screenshot 2025-03-21 at 17 15 15](https://github.com/user-attachments/assets/c5aba4b7-0850-4714-9df6-aee53e7b10df) #### Risk Management Page ![image](https://github.com/user-attachments/assets/5d9e7039-a316-4b72-91f3-31eef5dc8a3d) (cherry picked from commit a296d08)

kibanamachine · 2025-03-25T14:27:02Z

💚 All backports created successfully

Status	Branch	Result
✅	8.18
✅	8.x
✅	9.0

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…ement (#215544) (#215896) # Backport This will backport the following commits from `main` to `9.0`: - [Add manage_ingest_pipeline privilege check to Risk Engine enablement (#215544)](#215544)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Charlotte Alexandra Wilson <[email protected]>

…lement (#215544) (#215894) # Backport This will backport the following commits from `main` to `8.18`: - [Add manage_ingest_pipeline privilege check to Risk Engine enablement (#215544)](#215544)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Charlotte Alexandra Wilson <[email protected]>

…ement (#215544) (#215895) # Backport This will backport the following commits from `main` to `8.x`: - [Add manage_ingest_pipeline privilege check to Risk Engine enablement (#215544)](#215544)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Charlotte Alexandra Wilson <[email protected]>

Added manage_ingest_pipeline to support ingest pipeline privilege che…

74350ed

…ck for Risk Engine

CAWilson94 requested a review from a team as a code owner March 21, 2025 17:22

CAWilson94 requested a review from machadoum March 21, 2025 17:22

CAWilson94 self-assigned this Mar 21, 2025

abhishekbhatia1710 reviewed Mar 24, 2025

View reviewed changes

machadoum approved these changes Mar 24, 2025

View reviewed changes

comment for clarity on risk engine privilege use

8d44ad1

CAWilson94 added v9.0.0 backport:version Backport to applied version labels v8.18.0 v9.1.0 v8.19.0 and removed backport:skip This commit does not require backporting labels Mar 24, 2025

CAWilson94 added 3 commits March 24, 2025 14:26

Add 'manage_ingest_pipelines' to ClusterPrivilege type

41e72d1

Remove assertion, replacing with satisfies for proper type checking a…

b4b2c7d

…nd preserving literal types

Merge branch 'main' into ea-12010-pipeline-privs

bd16f83

CAWilson94 added the release_note:fix label Mar 24, 2025

CAWilson94 and others added 4 commits March 24, 2025 16:24

update tests to include manage_ingest_pipelines

bbccfd6

Merge branch 'main' into ea-12010-pipeline-privs

2b987a7

Merge branch 'main' into ea-12010-pipeline-privs

1dcb170

FTR config, adding in manage_ingest_pipeline to roles used

4745a91

Merge branch 'main' into ea-12010-pipeline-privs

175c65f

CAWilson94 merged commit a296d08 into elastic:main Mar 25, 2025
9 checks passed

kibanamachine mentioned this pull request Mar 25, 2025

[8.18] Add manage_ingest_pipeline privilege check to Risk Engine enablement (#215544) #215894

Merged

kibanamachine mentioned this pull request Mar 25, 2025

[8.x] Add manage_ingest_pipeline privilege check to Risk Engine enablement (#215544) #215895

Merged

kibanamachine mentioned this pull request Mar 25, 2025

[9.0] Add manage_ingest_pipeline privilege check to Risk Engine enablement (#215544) #215896

Merged

CAWilson94 deleted the ea-12010-pipeline-privs branch March 26, 2025 08:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add manage_ingest_pipeline privilege check to Risk Engine enablement #215544

Add manage_ingest_pipeline privilege check to Risk Engine enablement #215544

CAWilson94 commented Mar 21, 2025 •

edited by kibanamachine

Loading

elasticmachine commented Mar 21, 2025

elasticmachine commented Mar 21, 2025

jaredburgettelastic commented Mar 21, 2025

abhishekbhatia1710 Mar 24, 2025

machadoum Mar 24, 2025

hop-dev Mar 24, 2025

hop-dev Mar 24, 2025

CAWilson94 Mar 24, 2025

abhishekbhatia1710 Mar 24, 2025 •

edited

Loading

CAWilson94 Mar 24, 2025

CAWilson94 Mar 24, 2025

abhishekbhatia1710 Mar 25, 2025

CAWilson94 Mar 25, 2025

machadoum left a comment •

edited

Loading

CAWilson94 commented Mar 24, 2025

elasticmachine commented Mar 25, 2025

kibanamachine commented Mar 25, 2025

kibanamachine commented Mar 25, 2025

Add manage_ingest_pipeline privilege check to Risk Engine enablement #215544

Add manage_ingest_pipeline privilege check to Risk Engine enablement #215544

Conversation

CAWilson94 commented Mar 21, 2025 • edited by kibanamachine Loading

Summary

Screenshots

Enablement Modal (installing/enabling)

Risk Management Page

elasticmachine commented Mar 21, 2025

elasticmachine commented Mar 21, 2025

jaredburgettelastic commented Mar 21, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Context

Back to this PR

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

abhishekbhatia1710 Mar 24, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

machadoum left a comment • edited Loading

Choose a reason for hiding this comment

CAWilson94 commented Mar 24, 2025

elasticmachine commented Mar 25, 2025

💚 Build Succeeded

Metrics [docs]

Page load bundle

History

kibanamachine commented Mar 25, 2025

kibanamachine commented Mar 25, 2025

💚 All backports created successfully

Questions ?

CAWilson94 commented Mar 21, 2025 •

edited by kibanamachine

Loading

abhishekbhatia1710 Mar 24, 2025 •

edited

Loading

machadoum left a comment •

edited

Loading