Skip to content

[Security Solution] [Serverless Onboarding] t1_analyst role blocked from interacting with cards due to missing integration privileges #201799

Open
@agusruidiazgd

Description

Describe the bug:
When logging in with the t1_analyst role on Serverless, the Onboarding page incorrectly displays a callout message in the Dashboards, Alerts, and Rules cards: To add Elastic rules, add integrations first. This message appears even though the user lacks the necessary integration privileges and the integration card is not available.

Context: The t1_analyst role configuration can be found here: t1_analyst profile.

Due to the lack of privileges, the integration step is not displayed, making it impossible for the user to complete it. As a result, the user is unable to interact with the other cards (Dashboards, Rules, Alerts).

Kibana/Elasticsearch Stack version:
8.16

Steps to reproduce:

  1. Log in to Kibana Serverless using the t1_analyst role.
  2. Navigate to SecurityGet Started.
  3. Attempt to interact with the Dashboard, Rules, or Alerts cards.

Current behavior:
The Dashboards, Alerts, and Rules cards display the callout: To add Elastic rules, add integrations first, preventing any further interaction.

Expected behavior:
To be confirmed

Screenshots (if relevant):

Screen.Recording.2024-11-26.at.14.56.56.mov

Metadata

Assignees

Labels

Team: SecuritySolutionSecurity Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.Team:Threat Hunting:ExplorebugFixes for quality problems that affect the customer experiencetriage_needed

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions