diff --git a/docs/changelog/134636.yaml b/docs/changelog/134636.yaml new file mode 100644 index 0000000000000..fac059b120b4f --- /dev/null +++ b/docs/changelog/134636.yaml @@ -0,0 +1,6 @@ +pr: 134636 +summary: "[Island Browser] Add `manage`, `create_index`, `read`, `index`, `write`, `delete`, permission for third party agent indices `kibana_system`" +area: Authorization +type: enhancement +issues: + - 134136 diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java index 5bf438ce540f4..7c60ae20f593b 100644 --- a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java +++ b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java @@ -549,11 +549,17 @@ static RoleDescriptor kibanaSystem(String name) { TransportDeleteIndexAction.TYPE.name() ) .build(), - // For ExtraHop, QualysGAV, and SentinelOne Application Dataset specific actions. Kibana reads, writes and manages this - // index + // For ExtraHop, QualysGAV, SentinelOne Application Dataset and Island Browser specific actions. + // Kibana reads, writes and manages this index // for configured ILM policies. RoleDescriptor.IndicesPrivileges.builder() - .indices("logs-extrahop.investigation-*", "logs-qualys_gav.asset-*", "logs-sentinel_one.application-*") + .indices( + "logs-extrahop.investigation-*", + "logs-qualys_gav.asset-*", + "logs-sentinel_one.application-*", + "logs-island_browser.user-*", + "logs-island_browser.device-*" + ) .privileges( "manage", "create_index", diff --git a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java index 06bb32df2ae6d..8eae87cebb32d 100644 --- a/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java +++ b/x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java @@ -1976,12 +1976,15 @@ public void testKibanaSystemRole() { assertThat(kibanaRole.indices().allowedIndicesMatcher(RolloverAction.NAME).test(indexAbstraction), is(true)); }); - // Tests for third-party agent indices (ExtraHop, QualysGAV, SentinelOne) that `kibana_system` has full management access to + // Tests for third-party agent indices (ExtraHop, QualysGAV, SentinelOne, Island Browser) that `kibana_system` + // has full management access to // This includes read, write, create, delete, and all ILM-related management actions. Arrays.asList( "logs-extrahop.investigation-" + randomAlphaOfLength(randomIntBetween(1, 10)), "logs-qualys_gav.asset-" + randomAlphaOfLength(randomIntBetween(1, 10)), - "logs-sentinel_one.application-" + randomAlphaOfLength(randomIntBetween(1, 10)) + "logs-sentinel_one.application-" + randomAlphaOfLength(randomIntBetween(1, 10)), + "logs-island_browser.user-" + randomAlphaOfLength(randomIntBetween(1, 10)), + "logs-island_browser.device-" + randomAlphaOfLength(randomIntBetween(1, 10)) ).forEach((index_qualys_extra_hop) -> { final IndexAbstraction indexAbstraction = mockIndexAbstraction(index_qualys_extra_hop);