georgii
March 24, 2023, 9:55am
4
@j91321 Thank you for checking this. Folks on our team confirmed that this is a bug and opened a PR with a fix for it:
elastic:main ← dplumlee:preview-index-permission-bug
opened 06:45PM - 23 Mar 23 UTC
## Summary
Addresses a [problem found via the community slack](https://discus… s.elastic.co/t/rule-preview-not-working/327737/2) where rule preview doesn't properly recognize permissions granted to it when using a kibana `space-id` which is correctly documented [here](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui) as something to include in the permissions.
To test:
- Create a role with the usual detection alerts index permissions in the `default` space, using `.preview.alerts-security.alerts-default` and/or `.internal.preview.alerts-security.alerts-default-*` instead of the normal preview indices.
- Attempt to use the rule preview feature within rule creation
- You are now able to use the rule preview without index permission error (this won't currently work in `main`/kibana dev)
### Checklist
Delete any items that are not applicable to this PR.
- [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials
- [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
### For maintainers
- [ ] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
1 Like