[Security Solution] No error/warning message is displayed when using an index connector without index privileges

[MadameSheema]

Describe the bug:

• No error/warning message is displayed when using an index connector without index privileges

Kibana/Elasticsearch Stack version:

• 7.16.0 BC2

Initial setup:

• Create a kibana index pattern
  • The document should have @timestamp field
• Create a role with:
  • Read privileges on that index pattern
  • All the privileges in order to create and modify rule with actions.

i.e.

• Create a new user using the created role

Steps to reproduce:

1. Login with the created user
2. Create a new rule with an action
3. As action frequency select On each rule execution
4. Select Index type
5. Click on Create a new connector
6. Add a name
7. Select the index you created previously
8. Select Define time filed for each document
9. Select @timestamp
10. Click on Save
11. Add a document to index: i.e.:
12. Click on Create & activate rule
13. Generate alerts for the created rule

Current behavior:

• Alerts are generated
• No error/warning message is displayed
• Nothing is tracked on the Failure History tab
• Nothing is written in the action index

Expected behavior:

• An error message is displayed during the connector creation informing the user does not have read permissions on the index connector OR
• An error/warning message is displayed during the rule execution informing about the current situation

Any additional context (logs, chat logs, magical formulas, etc.):

• When you test the connector, an error is displayed

  

• When the rule is modified (i.e. activates and deactivates rule) the action works well

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[banderror]

I just read the description properly, and I think "An error/warning message is displayed during the rule execution informing about the current situation" is a great idea and we could actually try to do both:

• Enhance the Rule Create/Edit UI with a warning in the described case - if that's possible.
• AND enhance the monitoring part. When we have an improved Rule Execution Log UI we will be able to show more items in the log + generic messages (in addition to status changes). That's where we could expose logs from actions of a particular rule. I think errors from executing actions are not available to Security rule executors, but should be available to read later from Event Log. So we could read both our own execution logs and Alerting Framework's logs and show them on the Rule Details page.

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)