[Security Solution]Container workload protection showing with None Access to Security Sub Features #163562

karanbirsingh-qasource · 2023-08-10T08:36:45Z

Describe the bug:
Container workload protection showing with None Access to Security Sub Features

Kibana/Elasticsearch Stack version
Version: 8.10.0 SNAPSHOT
Commit: 4637b74
Build: 65796

Browser and Browser OS Version:
Firefox for windows OS
Version: 116.0.2 (64-bit)

Elastic Endpoint Version:
v8.10.0-dev.0

Original install method:
Build summary: https://artifacts-api.elastic.co/v1/search/8.10.0-SNAPSHOT

Functional Area:
Security App side Navigation

Initial Setup:

Create a custom rule with below kibana privilege (i.e Set Security to All , Security Sub Feature to None and Case to all)

Steps to reproduce

Navigate to Security App
Click on Setting Group
Observed that Cloud Posture Benchmarks page is showing under navigation which is incorrect
Click on Cloud Posture Benchmarks
Observed that page tries to load and in end the forbidden error is shown

Additional Observation

None

Current behavior

Container workload protection showing with None Access to Security Sub Features
Container workload protection tries to load however user should get instant forbidden banner

Expected behavior:

Rule Grouping navigation should not show when whole security sub-features is set to None Access

Screen-shots:

Settings.-.Kibana.Mozilla.Firefox.Private.Browsing.2023-08-10.13-35-28.mp4

Errors in browser console:

Console Logs

Content-Security-Policy: The page’s settings blocked the loading of a resource at inline (“script-src”). manage:286:177238 XHRGET https://973747bc0ef84b97832d269c9bbdcd2d.us-central1.gcp.qa.cld.elstc.co:9243/internal/cloud_defend/status [HTTP/1.1 403 Forbidden 317ms]

XHRGET
https://973747bc0ef84b97832d269c9bbdcd2d.us-central1.gcp.qa.cld.elstc.co:9243/internal/cloud_defend/policies?policy_name=&per_page=10&page=1&sort_field=package_policy.name&sort_order=asc
[HTTP/1.1 403 Forbidden 327ms]

XHRGET
https://973747bc0ef84b97832d269c9bbdcd2d.us-central1.gcp.qa.cld.elstc.co:9243/internal/cloud_defend/status
[HTTP/1.1 403 Forbidden 344ms]

Any additional context (logs, chat logs, magical formulas, etc.):

Cloud_Posture_Benchmark_HAR.zip

The text was updated successfully, but these errors were encountered:

elasticmachine · 2023-08-10T08:36:47Z

Pinging @elastic/security-solution (Team: SecuritySolution)

karanbirsingh-qasource · 2023-08-10T08:37:25Z

@amolnater-qasource please review and assign

amolnater-qasource · 2023-08-10T08:38:11Z

Reviewed and assigned to @MadameSheema

elasticmachine · 2023-08-10T08:56:13Z

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

semd · 2023-08-10T21:51:31Z

Rule Grouping navigation should not show when whole security sub-features is set to None Access

Not sure about that, I think Rules functionality is available as long as the main Security feature is enabled, it does not have any sub-feature associated.
I think that solving this one for the main feature will fix the issue

maxcold · 2023-08-14T08:30:40Z

@karanbirsingh-qasource The bug talks about Cloud Posture Benchmarks but the screenshot and the "steps to reproduce" seem to be related to "Container Workload Protection". Did you mention "Cloud Posture Benchmarks" by mistake? Because for "Security > Rules > Cloud Posture Benchmarks" I couldn't reproduce such behavior but for "Security > Settings > Container Workload Protection" I surely can, even though I'm not sure if it's a bug or not. cc @mitodrummer

karanbirsingh-qasource · 2023-08-14T08:42:52Z

yes @maxcold you are right, the bug is for Container workload protection not cloud posture benchmark.

we have updated the bug

elasticmachine · 2023-08-14T12:15:48Z

Pinging @elastic/kibana-cloud-security-posture (Team:Cloud Security)

machadoum · 2023-08-17T13:01:22Z

@karanbirsingh-qasource could you check if it was fixed by #163102?
More details here

MadameSheema · 2023-08-23T17:55:16Z

@karanbirsingh-qasource @sukhwindersingh-qasource can you please validate the fix on latest BC? Thanks!

karanbirsingh-qasource · 2023-08-25T04:21:06Z

Hi @MadameSheema

We have validated this issue on 8.10 BC2 and found the issue to be still occuring ❌ . Same error same state is shown in Container workload protection.

Kibana/Elasticsearch Stack version

Version: 8.10.0 BC2
Commit: fa3473f42d7c5e7a3c2d66026a153e01002f5d3c
Build: 66107

Screen-Cast:

Get.started.-.Kibana.Mozilla.Firefox.Private.Browsing.2023-08-25.09-48-05.mp4

MadameSheema · 2023-08-25T06:53:11Z

@machadoum can you please take a look at the above? Thanks!

machadoum · 2023-08-25T08:33:47Z

Hey!

I investigated the issue and discovered that it isn't new. I was able to reproduce it on 8.9

It happens because the menu item is guarded by the general security show capability: capabilities: [${SERVER_APP_ID}.show] here

But when the page renders it has extra license checks here. So, it isn't related to the menu changes introduced by Sergi. One possible solution is to declare the license type to the link configuration:

const commonLinkProperties: Partial<LinkItem> = {
  hideTimeline: true,
  capabilities: [`${SERVER_APP_ID}.show`],
+ licenseType: 'enterprise',
};

But that can be better accessed by the security-defend-workflows team which owns the feature.

elasticmachine · 2023-08-25T08:35:09Z

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

machadoum · 2023-08-25T08:45:27Z

Maybe I pinged the wrong team. It seems it was introduced here by cloud-native-integrations.
By the PR comments, it looks like this behaviour is intended.
Ping: @elastic/sec-cloudnative-integrations @elastic/sec-linux-platform

norrietaylor · 2023-08-30T19:11:17Z

Thanks for the ping @machadoum!

Kibana work that was owned by @elastic/sec-cloudnative-integrations now should go to @elastic/cloud-security

@kfirpeled is this on your radar?

mitodrummer · 2023-08-31T23:14:31Z

Maybe I pinged the wrong team. It seems it was introduced here by cloud-native-integrations. By the PR comments, it looks like this behaviour is intended. Ping: @elastic/sec-cloudnative-integrations @elastic/sec-linux-platform

PR is up, needs an approval from security-threat-hunting-explore team. cc @machadoum

…to csp), also add… (#165376) …ed d4c manage policies link to the list of excluded links when user does not have permission to read policies in security solution ## Summary Fixes: #163562

…to csp), also add… (elastic#165376) …ed d4c manage policies link to the list of excluded links when user does not have permission to read policies in security solution ## Summary Fixes: elastic#163562 (cherry picked from commit 7e82607) # Conflicts: # x-pack/packages/security-solution/features/src/constants.ts # x-pack/packages/security-solution/features/src/security/kibana_features.ts

…imilar to csp), also add… (#165376) (#165717) # Backport This will backport the following commits from `main` to `8.10`: - [[Cloud Security] added missing bits for backend route check (similar to csp), also add… (#165376)](#165376)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)

mitodrummer · 2023-09-05T18:29:31Z

fix and backport merged to 8.10 so will be ready for QA in the next BC

…to csp), also add… (elastic#165376) …ed d4c manage policies link to the list of excluded links when user does not have permission to read policies in security solution ## Summary Fixes: elastic#163562

karanbirsingh-qasource added bug Fixes for quality problems that affect the customer experience triage_needed Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. labels Aug 10, 2023

karanbirsingh-qasource added impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. v8.10.0 labels Aug 10, 2023

karanbirsingh-qasource assigned amolnater-qasource Aug 10, 2023

amolnater-qasource assigned MadameSheema and unassigned amolnater-qasource Aug 10, 2023

MadameSheema assigned stephmilovic and semd and unassigned MadameSheema Aug 10, 2023

MadameSheema added Team:Threat Hunting Security Solution Threat Hunting Team Team:Threat Hunting:Explore labels Aug 10, 2023

karanbirsingh-qasource changed the title ~~[Security Solution]Cloud Posture Benchmarks showing with None Access to Security Sub Features~~ [Security Solution]Container workload protection showing with None Access to Security Sub Features Aug 14, 2023

tehilashn added the Team:Cloud Security Cloud Security team related label Aug 14, 2023

stephmilovic removed the triage_needed label Aug 14, 2023

stephmilovic removed their assignment Aug 14, 2023

kfirpeled added the 8.11 candidate label Aug 14, 2023

mitodrummer self-assigned this Aug 15, 2023

machadoum added the fixed label Aug 17, 2023

machadoum self-assigned this Aug 17, 2023

MadameSheema removed the fixed label Aug 25, 2023

machadoum added the Team:Defend Workflows “EDR Workflows” sub-team of Security Solution label Aug 25, 2023

norrietaylor removed the Team: Cloud Native Integrations label Aug 30, 2023

mitodrummer mentioned this issue Aug 31, 2023

[Cloud Security] added missing bits for backend route check (similar to csp), also add… #165376

Merged

mitodrummer added 8.10 candidate and removed 8.11 candidate labels Aug 31, 2023

mitodrummer closed this as completed in #165376 Sep 5, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution]Container workload protection showing with None Access to Security Sub Features #163562

[Security Solution]Container workload protection showing with None Access to Security Sub Features #163562

karanbirsingh-qasource commented Aug 10, 2023 •

edited

Loading

elasticmachine commented Aug 10, 2023

karanbirsingh-qasource commented Aug 10, 2023

amolnater-qasource commented Aug 10, 2023

elasticmachine commented Aug 10, 2023

semd commented Aug 10, 2023

maxcold commented Aug 14, 2023

karanbirsingh-qasource commented Aug 14, 2023

elasticmachine commented Aug 14, 2023

machadoum commented Aug 17, 2023 •

edited

Loading

MadameSheema commented Aug 23, 2023

karanbirsingh-qasource commented Aug 25, 2023

MadameSheema commented Aug 25, 2023

machadoum commented Aug 25, 2023

elasticmachine commented Aug 25, 2023

machadoum commented Aug 25, 2023 •

edited

Loading

norrietaylor commented Aug 30, 2023

mitodrummer commented Aug 31, 2023 •

edited

Loading

mitodrummer commented Sep 5, 2023

[Security Solution]Container workload protection showing with None Access to Security Sub Features #163562

[Security Solution]Container workload protection showing with None Access to Security Sub Features #163562

Comments

karanbirsingh-qasource commented Aug 10, 2023 • edited Loading

elasticmachine commented Aug 10, 2023

karanbirsingh-qasource commented Aug 10, 2023

amolnater-qasource commented Aug 10, 2023

elasticmachine commented Aug 10, 2023

semd commented Aug 10, 2023

maxcold commented Aug 14, 2023

karanbirsingh-qasource commented Aug 14, 2023

elasticmachine commented Aug 14, 2023

machadoum commented Aug 17, 2023 • edited Loading

MadameSheema commented Aug 23, 2023

karanbirsingh-qasource commented Aug 25, 2023

MadameSheema commented Aug 25, 2023

machadoum commented Aug 25, 2023

elasticmachine commented Aug 25, 2023

machadoum commented Aug 25, 2023 • edited Loading

norrietaylor commented Aug 30, 2023

mitodrummer commented Aug 31, 2023 • edited Loading

mitodrummer commented Sep 5, 2023

karanbirsingh-qasource commented Aug 10, 2023 •

edited

Loading

machadoum commented Aug 17, 2023 •

edited

Loading

machadoum commented Aug 25, 2023 •

edited

Loading

mitodrummer commented Aug 31, 2023 •

edited

Loading