Merge branch 'master' into datanode-opensearch-upgrade

Author: gally47

UPGRADING.md

@@ -81,3 +81,12 @@ The following REST API changes are a direct result of this rework:
 | `POST /plugins/org.graylog.plugins.securityapp.sigma/sigma/rules/import`       | Moved to `POST /plugins/org.graylog.plugins.securityapp.sigma/sigma/import/bulk/import`  |
 | `POST /plugins/org.graylog.plugins.securityapp.sigma/sigma/rules/upload`       | Moved to `POST /plugins/org.graylog.plugins.securityapp.sigma/sigma/import/bulk/upload`  |
 | All other `/plugins/org.graylog.plugins.securityapp.sigma/sigma/rules/...`     | Deleted                                                                                  |
+
+## Threat Coverage Percentages May Change After Upgrade
+
+Due to the migration of Sigma rules to Event Definitions in 7.2, the percentages displayed in the Threat
+Coverage widget may be different from what they were in 7.1. Coverage is now computed directly from Event
+Definitions rather than from the previous Sigma rules. Every Event Definition with MITRE tactics/techniques
+assigned is now included, and coverage reflects how many of them are enabled versus disabled (with no log
+source check that was previously present for Sigma rules). Therefore, a tactic may show a higher or lower
+percentage than it did in 7.1, without any change to the actual installed Event Definitions.

changelog/unreleased/pr-26657.toml

@@ -0,0 +1,4 @@
+type = "f"
+message = "Fix problem in `GET /messages/{index}/{messageId}`. Permission requirements introduced by previous security fix have been too strong, they have been relaxed."
+
+pulls = ["26657"]

graylog2-server/src/main/java/org/graylog2/rest/resources/messages/MessageResource.java

@@ -96,25 +96,21 @@ public MessageResource(Messages messages, CodecFactory codecFactory, IndexSetReg
     @Operation(summary = "Get a single message.")
     @ApiResponses(value = {
             @ApiResponse(responseCode = "200", description = "Returns the message", useReturnTypeSchema = true),
-            @ApiResponse(responseCode = "404", description = "Specified index does not exist."),
-            @ApiResponse(responseCode = "404", description = "Message does not exist.")
+            @ApiResponse(responseCode = "404", description = "Specified message does not exist or the user does not have the required permissions.")
     })
     public ResultMessage search(@Parameter(name = "index", description = "The index this message is stored in.", required = true)
                                 @PathParam("index") String index,
                                 @Parameter(name = "messageId", required = true)
                                 @PathParam("messageId") String messageId) throws IOException {
-        checkPermission(RestPermissions.INDICES_READ, index);
         checkPermission(RestPermissions.MESSAGES_READ, messageId);
         try {
             final ResultMessage resultMessage = messages.get(messageId, index);
             final Message message = resultMessage.getMessage();
             checkMessageReadPermission(message);
 
             return resultMessage;
-        } catch (DocumentNotFoundException e) {
-            throw new NotFoundException("Message " + messageId + " does not exist in index " + index, e);
-        } catch (IndexNotFoundException e) {
-            throw new NotFoundException("Index " + index + " does not exist.", e);
+        } catch (DocumentNotFoundException | IndexNotFoundException | ForbiddenException e) {
+            throw new NotFoundException("Specified message does not exist or the user does not have the required permissions");
         }
     }
 

graylog2-web-interface/src/components/collectors/overview/onboarding/PlatformIcons.test.tsx

@@ -23,7 +23,7 @@ describe('PlatformIcons', () => {
   it('renders an icon for each supported platform', () => {
     render(<PlatformIcons />);
 
-    ['Linux', 'Windows', 'macOS', 'Kubernetes', 'Docker'].forEach((label) => {
+    ['Linux', 'Windows', 'macOS'].forEach((label) => {
       expect(screen.getByTitle(label)).toBeInTheDocument();
     });
   });

graylog2-web-interface/src/components/collectors/overview/onboarding/PlatformIcons.tsx

@@ -17,7 +17,8 @@
 import * as React from 'react';
 import styled, { css } from 'styled-components';
 
-import { BrandIcon, Card, Icon } from 'components/common';
+import { BrandIcon, Icon } from 'components/common';
+import IconCard from 'components/welcome/IconCard';
 
 import PLATFORMS from './platforms';
 import type { PlatformIcon } from './platforms';
@@ -31,37 +32,12 @@ const Icons = styled.div(
   `,
 );
 
-const IconContainer = styled.span`
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  width: 24px;
-  height: 24px;
-
-  /* BrandIcon has its own 20x20 container — scale it to match */
-  > div {
-    width: 24px;
-    height: 24px;
-
-    svg {
-      width: 24px;
-      height: 24px;
-    }
-  }
-`;
-
 const MaterialIcon = styled(Icon)`
   && {
     font-size: 24px;
   }
 `;
 
-const PlatformCard = styled(Card)`
-  display: flex;
-  align-items: center;
-  justify-content: center;
-`;
-
 const renderPlatformIcon = (icon: PlatformIcon) => {
   if (icon.type === 'brand') {
     return <BrandIcon name={icon.name} />;
@@ -74,9 +50,7 @@ const renderPlatformIcon = (icon: PlatformIcon) => {
 const PlatformIcons = () => (
   <Icons>
     {PLATFORMS.map((platform) => (
-      <PlatformCard key={platform.id} padding="sm">
-        <IconContainer title={platform.label}>{renderPlatformIcon(platform.icon)}</IconContainer>
-      </PlatformCard>
+      <IconCard key={platform.id} title={platform.label}>{renderPlatformIcon(platform.icon)}</IconCard>
     ))}
   </Icons>
 );

graylog2-web-interface/src/components/collectors/overview/onboarding/PlatformPicker.test.tsx

@@ -33,8 +33,6 @@ describe('PlatformPicker', () => {
     expect(screen.getByRole('button', { name: /linux/i })).toBeInTheDocument();
     expect(screen.getByRole('button', { name: /windows/i })).toBeInTheDocument();
     expect(screen.getByRole('button', { name: /macos/i })).toBeInTheDocument();
-    expect(screen.getByRole('button', { name: /kubernetes/i })).toBeInTheDocument();
-    expect(screen.getByRole('button', { name: /docker/i })).toBeInTheDocument();
   });
 
   it('calls onSelect with the platform id when a card is clicked', async () => {

graylog2-web-interface/src/components/collectors/overview/onboarding/platforms.ts

@@ -53,20 +53,6 @@ const PLATFORMS: Platform[] = [
     commandTemplate: (host, port, token) =>
       `curl -fsSL https://${host}:${port}/collectors/install | ENROLLMENT_TOKEN=${token} bash`,
   },
-  {
-    id: 'kubernetes',
-    label: 'Kubernetes',
-    icon: { type: 'brand', name: 'kubernetes' },
-    commandTemplate: (host, port, token) =>
-      `helm install graylog-collector oci://${host}:${port}/collectors/charts/collector --set enrollmentToken=${token}`,
-  },
-  {
-    id: 'docker',
-    label: 'Docker',
-    icon: { type: 'brand', name: 'docker' },
-    commandTemplate: (host, port, token) =>
-      `docker run -d -e ENROLLMENT_TOKEN=${token} ${host}:${port}/collectors/collector:latest`,
-  },
 ];
 
 export default PLATFORMS;

graylog2-web-interface/src/components/common/ExternalLink.tsx

@@ -34,7 +34,7 @@ type Props = {
  */
 const ExternalLink = ({ children, className = '', href = '', iconName = 'open_in_new', target = '_blank' }: Props) => {
   const content = (
-    <span>
+    <span className="external-link-inner">
       {children}
       &nbsp;
       <Icon name={iconName} />

graylog2-web-interface/src/components/common/ExternalLinkButton.tsx

@@ -15,10 +15,20 @@
  * <http://www.mongodb.com/licensing/server-side-public-license>.
  */
 import React from 'react';
+import styled from 'styled-components';
 
 import { Button } from 'components/bootstrap';
 import ExternalLink from 'components/common/ExternalLink';
 
+export const EXTERNAL_LINK_INNER_CLASS = 'external-link-inner';
+
+const StyledButton = styled(Button)`
+  .${EXTERNAL_LINK_INNER_CLASS} {
+    display: flex;
+    align-items: center;
+  }
+`;
+
 /**
  * Component that renders a link to an external resource as a button.
  *
@@ -37,9 +47,9 @@ const ExternalLinkButton = ({
   children = undefined,
   ...props
 }: Props) => (
-  <Button bsStyle={bsStyle} target={target} className={className} disabled={disabled} {...props}>
+  <StyledButton bsStyle={bsStyle} target={target} className={className} disabled={disabled} {...props}>
     <ExternalLink iconName={iconName}>{children}</ExternalLink>
-  </Button>
+  </StyledButton>
 );
 
 export default ExternalLinkButton;

graylog2-web-interface/src/components/common/PageHeader.tsx

@@ -106,6 +106,7 @@ const LifecycleIndicator = ({
 type Props = {
   title: React.ReactNode;
   children?: React.ReactElement | Array<React.ReactElement>;
+  className?: string;
   actions?: React.ReactElement;
   topActions?: React.ReactElement;
   lifecycle?: 'experimental' | 'legacy';
@@ -127,12 +128,13 @@ const PageHeader = ({
   topActions = undefined,
   lifecycle = undefined,
   lifecycleMessage = undefined,
+  className = undefined,
   documentationLink = undefined,
 }: Props) => {
   const topLevelClassNames = subpage ? '' : 'content';
 
   return (
-    <ContentHeadRow className={topLevelClassNames}>
+    <ContentHeadRow className={`${className ?? ''} ${topLevelClassNames}`}>
       <Col sm={12}>
         <Container>
           <FlexRow>