-
Notifications
You must be signed in to change notification settings - Fork 8.5k
Description
This was uncovered in updating demo.elastic.co from 7.7 -> 7.8, and was introduced in 7.8.
When navigating to any Detections page that queries for SIEM Jobs, the below SIEM job fetch failure error toast will be displayed if the user does not have Full ML License + access:ml:canCreateJob permissions.
This will happen for any use of the useSiemJobs hook, as the ml/modules/recognize API had its permissions tightened as part of #64662 for 7.8. Since the MlPopover component (which uses the useSiemJobs hook) is not wrapped in a ml permissions check, but rather its content is, any usage of this component will result in the below error for users without permissions.
There is no workaround for this issue, and to fix we will have to wrap the useSiemJobs hook in the same permissions check we use for the other ML API's.
Additionally, this use-case should be back-filled with tests to ensure future changes to API permissions do not result in similar issues.

