[BUG] Add to detections permissions documentation some Kibana rights

[111andre111]

Documentation links

We have this documentation
https://www.elastic.co/guide/en/security/8.11/detections-permissions-section.html
There could happen an error Write role required to generate data.

Description

We should add that under the roles following privilege is needed.
Kibana privileges -> Management -> Data View Management

Which documentation set(s) does this bug apply to?

ESS and serverless

Release version

No response

Testing environment

To check if the error happens without the setting.

[jpdjere]

@111andre111 Hi André,

The Write role required to generate data. message in the referenced SDH was actually caused by missing permissions in the Kibana space itself rather than on the role. See this comment for reference.

[111andre111]

Sure, but isn't this still something we should reflect in our docs?

[jmikell821]

@111andre111 we need some more information please because I'm not understanding 100%:

• The following privilege you mentioned is required to do what exactly? We specify the permission required to enable Data view here.
• An error could happen when attempting to do what...?
• You have 8.11 in the URL. Was this applicable to other versions?

[itsjustshortj]

I have recently had a customer observe behavior similar to this comment. I actually used this reference to resolve the issue. The customer is on v.8.11.3 and they were getting a Write role required to generate data: Users with write permission need to access the Elastic Security App to initialize the app source data error. They had all of the permissions set as outlined in the documentation. I had the customer set the Data View Management space permission to all and then remove the permission immediately after and the error went away; that action legitimately fixed the issue. I am not sure how it would be documented but it seems to be a recurring issue.

[bmorelli25]

@111andre111 Do you know if this is still valid?

[benironside]

followed up w/ Andre over Slack today to ask if this is still needed

[benironside]

Following up again

[111andre111]

Ok, after exploring this, I don't know why this landed in the security-docs repo.
Maybe it has not been explored until the base ground where it comes from.
The issue itself comes the Sourcerer component which has been introduced in 8.1.0 elastic/kibana#121109.

I've not been able to reproduce in most recent 9.3.0.
After some exploration I found out that we went in 8.19.0 (backported PR elastic/kibana#223044) and as the original PR 9.1.0 (elastic/kibana#210585) introduced a new data view picker and bypasses the old sourcerer.

I have reproduced this under the most recent 8.18.x version with the following (Data in log-* data stream should exist):

1. Navigate to Stack Management → Kibana → Spaces
2. Edit the affected space
3. In the "Features" section of "Management", ensure the "Data View Management" checkbox is not checked
4. Save the space configuration
5. Reproduce the error in some Security apps (comes only once until completely reloading Kibana)
6. Then go back to space settings ensuring "Data View Management" checkbox is checked
7. Users can now access the Security app in that space without errors

So as a conclusion:
This is a bug most likely in 8.1.0 to 8.18.x and 9.0.x.
This is gone starting 8.19.0/9.1.0.

So I leave it to @yctercero if we want to document it somewhere (as I think we would not fix that bug any more given it's only in olver versions) or would like to close this issue.

[benironside]

Thank you very much Andre. Will follow up with Yara.

[benironside]

followed up with Yara today

[yctercero]

👋🏽 sourcerer is owned by threat hunting. Perhaps checking in with them would be best.