[BUG] document maxsize for get-file response action

[111andre111]

Documentation links

https://www.elastic.co/guide/en/security/8.13/response-actions.html#_get_file

Description

At this time we only document the upload response action having a limit of 100MB.

We should do the same for get-file response action as that one has as well 100MB - hard coded and can't be changed:
https://github.com/elastic/kibana/blob/1be60ebd4c9d726581da2ce8131b6d41fa3c52db/x-pack/plugins/security_solution/public/management/components/endpoint_responder/lib/endpoint_action_response_codes.ts#L38-L42
It might be probably tied as well to the limit in Elasticsearch and we might link to it for description:
https://www.elastic.co/guide/en/elasticsearch/reference/8.13/general-recommendations.html#maximum-document-size

As of the Upload action I didn't find as well a documentation that with setting
xpack.securitySolution.maxUploadResponseActionFileBytes
the 100MB limit can be increased and what it means if we go over 100MB. So that could be added at the same time too.

Which documentation set(s) does this bug apply to?

ESS and serverless

Release version

Since get-file has been introduced in 8.7.

Testing environment

Doesn't really need one. It's hard coded.

[intxgo]

As of the Upload action I didn't find as well a documentation that with setting
xpack.securitySolution.maxUploadResponseActionFileBytes
the 100MB limit can be increased and what it means if we go over 100MB. So that could be added at the same time too.

I can see it clearly documented under the link you provided in description

[intxgo]

the get-file / upload 100MB limit comes from Elasticsearch. All uploaded and downloaded files are saved for some time in ES
https://opster.com/guides/elasticsearch/data-architecture/elasticsearch-document-size-limit/

related issue

• Uploading larger files than 100MB kibana#129730

[111andre111]

Yes, but that's the upload response action you are seeing @intxgo
I am aiming for the get-file response action.

[111andre111]

upload = from Kibana to Endpoint -> can be configured in Kibana via advanced setting fileUpload:maxFileSize or in kibana.yml with setting xpack.securitySolution.maxUploadResponseActionFileBytes it seems with a max of 1GB...

get-file = from Endpoint to Kibana -> hard coded to 100MB

[intxgo]

upload = from Kibana to Endpoint -> can be configured in Kibana via advanced setting fileUpload:maxFileSize or in kibana.yml with setting xpack.securitySolution.maxUploadResponseActionFileBytes it seems with a max of 1GB...

The documentation screenshot I posted above says max is 100MB 😉 Do you mean you have tried to set it to 1GB and it worked?

[111andre111]

@intxgo
Seems we are misaligned a bit.
We are documenting a size limitation for the upload response action where you shared the screenshot from:
https://www.elastic.co/guide/en/security/8.13/response-actions.html#_upload
which has the direction kibana -> endpoint.

However we don't document a size limiation for get-file response action:
https://www.elastic.co/guide/en/security/8.13/response-actions.html#_get_file
which has the direction endpoint -> kibana. -> This is the one we are talking about this one in this issue here

I hope that makes it more clear.

[intxgo]

Agree, to clarify the kibana flag xpack.securitySolution.maxUploadResponseActionFileBytes applies only to kibana -> endpoint direction and is documented. I don't know what happens if you try to set it to a value larger than 100MB ignoring the documentation.

There's no Kibana flag to alter the max file size for the other direction. It's enforced by Endpoint (Elastic Defend) because sending anything larger up the stack would certainly cause errors, but which would probably be difficult to understand.