Closed kpollich closed 1 week ago
Pinging @elastic/fleet (Team:Fleet)
From @simosilvestri (see Figma)
Add a shortcut to create a new space in the left Spaces description. The "Create space" CTA opens a new tab to the space creation wizard.
Add a Tour component to notify the customer of the new Fleet privileges integration. If a customer dismisses the Tour component, it should not be shown again. In Kibana privileges, change the text to "Customize Fleet privileges" instead of using sub-features.
It looks like there is no built in component for the space selector but we could easily build one by exposing and using the getSpaces
method from the space plugin https://elastic.slack.com/archives/C047ZAEUDM3/p1721235631477969 and using the already exposed getSpaceAvatar
UI component, example of a space selector in the space plugin
For the API part we should allow to set the space_id
through the PUT /api/fleet/agent_policy
API
That API should validate the user has the AgentPolicies:All
privilege in the destination space.
Changing an agent policy space should change the namespace for all the related documents:
What about the existing actions/action results should we update the namespace too? I think we should as it will allow a user to have the whole activity history for an agent.
What about the existing actions/action results should we update the namespace too? I think we should as it will allow a user to have the whole activity history for an agent.
How much data are we expecting this to be? We could have a maximum of 90 days worth of action results per the ILM policy we ship with ES, e.g. https://github.com/elastic/elasticsearch/blob/main/x-pack/plugin/core/template-resources/src/main/resources/fleet-actions-results-ilm-policy.json
I think backfilling the activity into the new space would be the right thing to do, but I am worried we could have performance issues related to data volume.
How much data are we expecting this to be? We could have a maximum of 90 days worth of action results per the ILM policy we ship with ES, e.g. https://github.com/elastic/elasticsearch/blob/main/x-pack/plugin/core/template-resources/src/main/resources/fleet-actions-results-ilm-policy.json
It's hard to predict, it will really depends on what user are doing with Fleet, but with 2 documents for each agents and each actions it could growth significantly, may be it's acceptable to not copy that data in the new namespace
My response actions are mostly EDR related and that would/should stay in place and be only available for th security team.
As a Fleet administrator adopting Fleet's new space awareness feature, I need to be able to easily move my existing global Fleet policies (and their "child" data) to my users' spaces. To facilitate this process, Fleet should provide a seamless UX for moving policies between spaces.
Implementation
namespaces
value orspace_id
value