From bb8c5057f4da2e47875d1949389f995069825e88 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Tue, 18 Nov 2025 13:44:02 +0530 Subject: [PATCH] Add prisma_cloud data streams to kibana_system role permissions --- .../authz/store/KibanaOwnedReservedRoleDescriptors.java | 2 ++ .../core/security/authz/store/ReservedRolesStoreTests.java | 2 ++ 2 files changed, 4 insertions(+) diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java index de63ea1d30012..e234d51b870e7 100644 --- a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java +++ b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java @@ -542,6 +542,8 @@ static RoleDescriptor kibanaSystem(String name) { "logs-m365_defender.vulnerability-*", "logs-microsoft_defender_endpoint.vulnerability-*", "logs-microsoft_defender_cloud.assessment-*", + "logs-prisma_cloud.misconfiguration-*", + "logs-prisma_cloud.vulnerability-*", "logs-sentinel_one.application_risk-*" ) .privileges( diff --git a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java index 4b854d2f50641..982f72f34db37 100644 --- a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java +++ b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java @@ -1778,6 +1778,8 @@ public void testKibanaSystemRole() { "logs-m365_defender.vulnerability-" + randomAlphaOfLength(randomIntBetween(0, 13)), "logs-microsoft_defender_endpoint.vulnerability-" + randomAlphaOfLength(randomIntBetween(0, 13)), "logs-microsoft_defender_cloud.assessment-" + randomAlphaOfLength(randomIntBetween(0, 13)), + "logs-prisma_cloud.misconfiguration-" + randomAlphaOfLength(randomIntBetween(0, 13)), + "logs-prisma_cloud.vulnerability-" + randomAlphaOfLength(randomIntBetween(0, 13)), "logs-sentinel_one.application_risk-" + randomAlphaOfLength(randomIntBetween(0, 13)) ).forEach(indexName -> { final IndexAbstraction indexAbstraction = mockIndexAbstraction(indexName);