Merge branch 'main' into security/attack-alerts-alignment/POC-adhoc-attacks

Author: e40pud

.agents/skills/evals-write-spec/SKILL.md

@@ -24,7 +24,7 @@ evaluate.describe('Suite name', { tag: tags.serverless.observability.complete },
 
   evaluate('test name', async ({ executorClient, connector }) => {
     await executorClient.runExperiment(
-      { dataset, task },
+      { datasets: [dataset], task },
       evaluators
     );
   });
@@ -202,7 +202,7 @@ export function createEvaluateDataset({
   return async ({ dataset }) => {
     await executorClient.runExperiment(
       {
-        dataset,
+        datasets: [dataset],
         task: async ({ input }) => {
           const response = await chatClient.converse({ messages: [{ message: input.question }] });
           return { messages: response.messages, steps: response.steps };

.agents/skills/evals-write-spec/references/evaluator-patterns.md

@@ -20,7 +20,7 @@ type MyTaskOutput = TaskOutput & {
 };
 
 await executorClient.runExperiment(
-  { dataset, task },
+  { datasets: [dataset], task },
   selectEvaluators<MyExample, MyTaskOutput>([
     {
       name: 'NonEmptyDocuments',
@@ -246,7 +246,7 @@ A common pattern passes both CODE and LLM evaluators to `runExperiment`:
 
 ```ts
 await executorClient.runExperiment(
-  { dataset, task },
+  { datasets: [dataset], task },
   [
     createCriteriaEvaluator({ evaluators }),
     createToolCallsEvaluator({ evaluators }),

.buildkite/scripts/common/setup_job_env.sh

@@ -130,7 +130,7 @@ EOF
 # Set up Kibana Evals secrets
 {
   if [[ "${KBN_EVALS:-}" =~ ^(1|true)$ ]]; then
-    echo "KBN_EVALS was set - exposing evals connectors and ES export credentials"
+    echo "KBN_EVALS was set - exposing evals connectors and export credentials"
 
     KBN_EVALS_CONFIG_JSON="$(vault_get kbn-evals config | base64 -d)"
     # Validate config shape (safe; does not print secrets)
@@ -145,10 +145,6 @@ EOF
     export KBN_EVALS_CONFIG_B64
     KBN_EVALS_CONFIG_B64="$(printf '%s' "$KBN_EVALS_CONFIG_JSON" | base64)"
 
-    # Elasticsearch cluster for evaluation results export
-    export EVALUATIONS_ES_URL="$(jq -r '.evaluationsEs.url // empty' <<<"$KBN_EVALS_CONFIG_JSON")"
-    export EVALUATIONS_ES_API_KEY="$(jq -r '.evaluationsEs.apiKey // empty' <<<"$KBN_EVALS_CONFIG_JSON")"
-
     # Optional: separate cluster for trace-based evaluators
     export TRACING_ES_URL="$(jq -r '.tracingEs.url // empty' <<<"$KBN_EVALS_CONFIG_JSON")"
     export TRACING_ES_API_KEY="$(jq -r '.tracingEs.apiKey // empty' <<<"$KBN_EVALS_CONFIG_JSON")"

.buildkite/scripts/steps/evals/run_suite.sh

@@ -18,10 +18,10 @@ fi
 # The value should be the platform-level `pluginId` use-case identifier.
 # `@kbn/evals` defaults this to `kbn_evals`, but you can override via KBN_EVALS_TELEMETRY_PLUGIN_ID.
 
-# Set a base run id from the Buildkite build. The evaluator fixture appends the
-# connector id to produce a unique run_id per model (e.g. bk-<build>-<connector>).
-# Correlation across models in the same build uses ci.buildkite.build_id which
-# is populated automatically from BUILDKITE_BUILD_ID in score_repository.ts.
+# Set a base build run ID from the Buildkite build. This is used as a seed for
+# generating deterministic per-task experiment IDs (not as the experiment_id itself).
+# Suite-run grouping in the UI uses metadata.ci.build_id which is populated
+# automatically from BUILDKITE_BUILD_ID in the Buildkite metadata.
 if [[ -z "${TEST_RUN_ID:-}" ]] && [[ -n "${BUILDKITE_BUILD_ID:-}" ]]; then
   export TEST_RUN_ID="bk-${BUILDKITE_BUILD_ID}"
 fi

.github/CODEOWNERS

@@ -1190,6 +1190,7 @@ x-pack/platform/plugins/shared/inbox @elastic/security-genai-research-and-develo
 x-pack/platform/plugins/shared/index_management @elastic/kibana-management
 x-pack/platform/plugins/shared/inference @elastic/search-kibana
 x-pack/platform/plugins/shared/inference_endpoint @elastic/search-kibana
+x-pack/platform/plugins/shared/inference_workflows @elastic/search-kibana
 x-pack/platform/plugins/shared/ingest_hub @elastic/obs-onboarding-team
 x-pack/platform/plugins/shared/ingest_pipelines @elastic/kibana-management
 x-pack/platform/plugins/shared/lens @elastic/kibana-visualizations

docs/extend/plugin-list.md

@@ -153,7 +153,7 @@ mapped_pages:
 | [enterpriseSearch](https://github.com/elastic/kibana/blob/main/x-pack/solutions/search/plugins/enterprise_search/README.md) | This plugin provides Kibana user interfaces for managing the Enterprise Search solution and its products, App Search and Workplace Search. |
 | [entityManager](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/entity_manager/README.md) | This plugin provides access to observed entity data, such as information about hosts, pods, containers, services, and more. |
 | [entityStore](https://github.com/elastic/kibana/blob/main/x-pack/solutions/security/plugins/entity_store/README.md) | Central place for Entities management and logs extraction. |
-| [evals](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/evals/README.md) | The Evals plugin provides an in-Kibana UI for browsing LLM evaluation run results, per-evaluator statistics, and OpenTelemetry traces produced by the @kbn/evals evaluation framework. |
+| [evals](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/evals/README.md) | The Evals plugin provides an in-Kibana UI for browsing LLM evaluation experiment results, per-evaluator statistics, and OpenTelemetry traces produced by the @kbn/evals evaluation framework. |
 | [eventLog](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/event_log/README.md) | The event log plugin provides a persistent history of alerting and action activities. |
 | [exploratoryView](https://github.com/elastic/kibana/blob/main/x-pack/solutions/observability/plugins/exploratory_view/README.md) | A shared component for visualizing observability data types via lens embeddable. For further details. |
 | [features](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/features/README.md) | The features plugin enhance Kibana with a per-feature privilege system. |
@@ -173,6 +173,7 @@ mapped_pages:
 | [indicesMetadata](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/private/indices_metadata/README.md) | Plugin for managing and retrieving metadata about indices in Kibana. This plugin collects and processes metadata from Elasticsearch indices, data streams, ILM policies, and index templates. |
 | [inference](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/inference/README.md) | The inference plugin is a central place to handle all interactions with the Elasticsearch Inference API and external LLM APIs. Its goals are: |
 | [inferenceEndpoint](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/inference_endpoint/README.md) | A Kibana plugin |
+| [inferenceWorkflows](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/inference_workflows/README.md) | Registers AI workflow steps (ai.prompt, ai.summarize, ai.classify) that use the inference plugin to power LLM-based automation in Kibana Workflows. |
 | [infra](https://github.com/elastic/kibana/blob/main/x-pack/solutions/observability/plugins/infra/README.md) | This is the home of the infra plugin, which aims to provide a solution for the infrastructure monitoring use-case within Kibana. |
 | [ingestHub](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ingest_hub/README.md) | Cross-solution onboarding page for adding data sources and integrations. Gated behind the ingestHub.enabled feature flag. |
 | [ingestPipelines](https://github.com/elastic/kibana/blob/main/x-pack/platform/plugins/shared/ingest_pipelines/README.md) | The ingest_pipelines plugin provides Kibana support for Elasticsearch's ingest pipelines. |

docs/reference/configuration-reference/internationalization-settings.md

@@ -30,8 +30,40 @@ When a user sets a preferred language, it is stored in their user profile and ta
 
 {{kib}} resolves the display language using the following priority chain:
 
-1. **User profile setting** — The language selected by the user in their profile or the user menu (must be one of `i18n.locales`).
-2. **`i18n.defaultLocale` config** — The server-wide default set in `kibana.yml`.
+1. **User profile setting** — The language selected by the user in their
+   profile or the user menu (must be one of `i18n.locales`).
+2. **`KBN_LOCALE` cookie** — The most recently rendered locale on this
+   browser. {{kib}} writes this cookie on every rendered response, so it
+   tracks profile changes automatically. The cookie is the fallback used
+   on surfaces where the profile isn't available — login pages, error
+   pages, and any browsing the user does after signing out. Only used
+   when the cookie value matches a locale {{kib}} can serve.
+3. **`Accept-Language` header** {applies_to}`serverless: ga` — On
+   serverless deployments, {{kib}} consults the browser's
+   `Accept-Language` preferences when neither the profile setting nor
+   the cookie produces a match. The first weighted preference that's an
+   exact match (region included) for an entry in `i18n.locales` wins.
+   This step is skipped on traditional/self-managed deployments to keep
+   existing users' language stable across upgrades.
+4. **`i18n.defaultLocale` config** — The server-wide default set in `kibana.yml`.
+
+#### About the `KBN_LOCALE` cookie
+
+{{kib}} sets a `KBN_LOCALE` cookie on every rendered response containing
+the resolved locale id (for example, `KBN_LOCALE=ja-JP`). Attributes:
+
+- Path scoped to the {{kib}} `serverBasePath`.
+- `SameSite=Lax`, `Max-Age` of one year, and `Secure` when the response is over HTTPS.
+- `HttpOnly`. The value is a preference, not a secret, but {{kib}} does not need browser-side JavaScript to read it.
+
+Privacy posture: `KBN_LOCALE` is a strictly-necessary preference cookie.
+It does not track the user, store identity, or enable cross-site activity.
+
+To disable the cookie entirely, set `i18n.allowLocaleCookie: false` in
+`kibana.yml`. When disabled, the per-user language selection still works via
+user profiles; however, anonymous pages and pages visited after signing out
+will always fall back to `i18n.defaultLocale` (or `Accept-Language` on
+serverless deployments) rather than remembering the previously resolved locale.
 
 ## Example configurations
 
@@ -51,4 +83,7 @@ i18n.defaultLocale: "en"
 
 # 4. Legacy form — still works, logs a deprecation warning at startup:
 i18n.locale: "ja-JP"
-```
+
+# 5. Disable the KBN_LOCALE cookie:
+i18n.allowLocaleCookie: false
+```

docs/reference/configuration-reference/internationalization-settings.yml

@@ -1,6 +1,6 @@
 ---
 # This file is used to generate "i18n settings" page in the product docs
-# For the schema and an example refer to the automated settings reference: 
+# For the schema and an example refer to the automated settings reference:
 # https://github.com/elastic/docs-builder/blob/main/docs/syntax/automated_settings.md
 
 product: Kibana
@@ -39,6 +39,19 @@ groups:
           ech: ga
           self: ga
 
+      - setting: i18n.allowLocaleCookie
+        description: |
+          When `true` (the default), {{kib}} writes a `KBN_LOCALE` cookie on every
+          rendered response so the browser remembers the resolved locale across
+          page loads, anonymous pages, and post-logout browsing. Set to `false`
+          to disable the cookie.
+        datatype: boolean
+        default: "true"
+        applies_to:
+          stack: ga 9.5+
+          ech: ga
+          self: ga
+
       - setting: i18n.locale
         description: |
           Set the {{kib}} interface language.
@@ -59,4 +72,4 @@ groups:
         applies_to:
           stack: deprecated 9.5+
           ech: ga
-          self: ga
+          self: ga

oas_docs/output/kibana.serverless.yaml

@@ -71975,6 +71975,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         rows:
           description: Array of operations to split the datatable rows by
@@ -73240,6 +73241,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         rows:
           description: Array of operations to split the datatable rows by
@@ -75705,6 +75707,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         sampling:
           default: 1
@@ -76588,6 +76591,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         sampling:
           default: 1
@@ -77772,6 +77776,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         sampling:
           default: 1
@@ -78470,6 +78475,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         sampling:
           default: 1
@@ -81597,6 +81603,7 @@ components:
                 references:
                   items:
                     $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+                  maxItems: 10000
                   type: array
                 time_range:
                   $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema'
@@ -82478,6 +82485,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         sampling:
           default: 1
@@ -83977,6 +83985,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         sampling:
           default: 1
@@ -84199,6 +84208,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         sampling:
           default: 1
@@ -87810,6 +87820,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         sampling:
           default: 1
@@ -88876,6 +88887,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         sampling:
           default: 1
@@ -92112,6 +92124,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         sampling:
           default: 1
@@ -93005,6 +93018,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         sampling:
           default: 1
@@ -93412,6 +93426,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         region:
           additionalProperties: false
@@ -93585,6 +93600,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         region:
           anyOf:
@@ -96748,6 +96764,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         sampling:
           default: 1
@@ -97343,6 +97360,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         sampling:
           default: 1
@@ -98206,6 +98224,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         sampling:
           default: 1
@@ -99099,6 +99118,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         sampling:
           default: 1
@@ -100624,6 +100644,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         sampling:
           default: 1
@@ -101523,6 +101544,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         sampling:
           default: 1
@@ -103404,6 +103426,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         styling:
           $ref: '#/components/schemas/Kibana_HTTP_APIs_xyStyling'
@@ -103543,6 +103566,7 @@ components:
         references:
           items:
             $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
+          maxItems: 10000
           type: array
         styling:
           $ref: '#/components/schemas/Kibana_HTTP_APIs_xyStyling'