Merge commit '6647f813c9fa03ac0378e3d4756246e8dc4b4c76' into lens_cps

* commit '6647f813c9fa03ac0378e3d4756246e8dc4b4c76': (33 commits)
  [Detection Engine] Extracts Rules/Alerts/Exceptions permission to new Rules feature privileges (elastic#239634)
  [Agent Builder] Add Intro Tour (elastic#245551)
  Add datastream lifecycle support to indices metadata (elastic#245548)
  [Serverless] Update preconfigured connectors (elastic#245445)
  [Metrics][Discover] Discover to prefer line chars for time series data (elastic#244595)
  Update dependency @elastic/ebt to ^1.4.1 (main) (elastic#241629)
  [One Workflow] fix: request bodies with oneof schemas (`kibana.SetAlertsStatus`, etc) (elastic#245344)
  Update dependency ai to v5 (elastic#244675)
  Fix Discover trace waterfall behavior with duplicate spans (elastic#244984)
  [FSH] Migrated fs usage to kbn/fs for sample ingest (elastic#244163)
  Streamlang: Unskip type coercion test (elastic#245519)
  [Response Ops][Reporting] Fixing error in calculating delay value between retries (elastic#245431)
  Add TopNavMenuBeta to navigation plugin (elastic#243578)
  [scout] support custom servers configuration (elastic#244306)
  [Fleet] Run agentless background sync without dry run (elastic#245286)
  Fix Change Password Flaky Test (elastic#245443)
  Add new gap fill status for rules (elastic#242595)
  [Kibana Search] Move SLOs higher up in search results (elastic#245518)
  feat(slo): introduce find SLO instances internal route (elastic#245333)
  [FSH] Dropped unnecessary `fs` persistence for synthetics project code (elastic#244338)
  ...

Author: mbondyra

.buildkite/scripts/steps/security/third_party_packages.txt

@@ -21,6 +21,7 @@ dompurify
 magic-bytes.js
 @axe-core/playwright
 @opentelemetry/exporter-trace-otlp-grpc
+@ai-sdk/langchain
 ink
 @hey-api/openapi-ts
 vscode-languageserver-textdocument

.eslintrc.js

@@ -1591,9 +1591,9 @@ module.exports = {
         'src/platform/packages/shared/kbn-scout/src/playwright/**/*.ts',
         'x-pack/solutions/observability/packages/kbn-scout-oblt/src/playwright/**/*.ts',
         'x-pack/solutions/security/packages/kbn-scout-security/src/playwright/**/*.ts',
-        'src/platform/{packages,plugins}/**/test/scout/**/*.ts',
-        'x-pack/platform/{packages,plugins}/**/test/scout/**/*.ts',
-        'x-pack/solutions/**/{packages,plugins}/**/test/scout/**/*.ts',
+        'src/platform/{packages,plugins}/**/test/{scout,scout_*}/**/*.ts',
+        'x-pack/platform/{packages,plugins}/**/test/{scout,scout_*}/**/*.ts',
+        'x-pack/solutions/**/{packages,plugins}/**/test/{scout,scout_*}/**/*.ts',
       ],
       excludedFiles: ['src/platform/packages/shared/kbn-scout/src/playwright/**/*.test.ts'],
       extends: ['plugin:playwright/recommended'],
@@ -2603,8 +2603,8 @@ module.exports = {
     },
     {
       files: [
-        'src/platform/plugins/**/test/scout/**/*.ts',
-        'x-pack/platform/**/plugins/**/test/scout/**/*.ts',
+        'src/platform/plugins/**/test/{scout,scout_*}/**/*.ts',
+        'x-pack/platform/**/plugins/**/test/{scout,scout_*}/**/*.ts',
       ],
       rules: {
         'no-restricted-imports': [
@@ -2625,7 +2625,7 @@ module.exports = {
       },
     },
     {
-      files: ['x-pack/solutions/observability/plugins/**/test/scout/**/*.ts'],
+      files: ['x-pack/solutions/observability/plugins/**/test/{scout,scout_*}/**/*.ts'],
       rules: {
         'no-restricted-imports': [
           'error',
@@ -2659,7 +2659,7 @@ module.exports = {
       },
     },
     {
-      files: ['x-pack/solutions/security/plugins/**/test/scout/**/*.ts'],
+      files: ['x-pack/solutions/security/plugins/**/test/{scout,scout_*}/**/*.ts'],
       rules: {
         'no-restricted-imports': [
           'error',
@@ -2695,9 +2695,9 @@ module.exports = {
     {
       // Custom rules for scout tests
       files: [
-        'src/platform/plugins/**/test/scout/**/*.ts',
-        'x-pack/platform/**/plugins/**/test/scout/**/*.ts',
-        'x-pack/solutions/**/plugins/test/scout/**/*.ts',
+        'src/platform/plugins/**/test/{scout,scout_*}/**/*.ts',
+        'x-pack/platform/**/plugins/**/test/{scout,scout_*}/**/*.ts',
+        'x-pack/solutions/**/plugins/**/test/{scout,scout_*}/**/*.ts',
       ],
       rules: {
         '@kbn/eslint/scout_no_describe_configure': 'error',

.github/CODEOWNERS

@@ -930,15 +930,15 @@ x-pack/platform/packages/shared/kbn-ai-tools-cli @elastic/appex-ai-infra
 x-pack/platform/packages/shared/kbn-alerting-comparators @elastic/response-ops
 x-pack/platform/packages/shared/kbn-apm-types @elastic/obs-presentation-team
 x-pack/platform/packages/shared/kbn-classic-stream-flyout @elastic/kibana-management
-x-pack/platform/packages/shared/kbn-content-packs-schema @elastic/streams-program-team
+x-pack/platform/packages/shared/kbn-content-packs-schema @elastic/obs-onboarding-team
 x-pack/platform/packages/shared/kbn-data-forge @elastic/obs-ux-management-team
 x-pack/platform/packages/shared/kbn-dissect-heuristics @elastic/obs-onboarding-team
 x-pack/platform/packages/shared/kbn-elastic-assistant @elastic/security-generative-ai
 x-pack/platform/packages/shared/kbn-elastic-assistant-common @elastic/security-generative-ai
 x-pack/platform/packages/shared/kbn-elastic-assistant-shared-state @elastic/security-generative-ai
 x-pack/platform/packages/shared/kbn-entities-schema @elastic/obs-entities
 x-pack/platform/packages/shared/kbn-evals @elastic/appex-ai-infra
-x-pack/platform/packages/shared/kbn-evals-suite-streams @elastic/streams-program-team
+x-pack/platform/packages/shared/kbn-evals-suite-streams @elastic/obs-onboarding-team @elastic/obs-sig-events-team
 x-pack/platform/packages/shared/kbn-event-stacktrace @elastic/obs-presentation-team @elastic/obs-exploration-team
 x-pack/platform/packages/shared/kbn-failure-store-modal @elastic/kibana-management
 x-pack/platform/packages/shared/kbn-fs @elastic/kibana-security
@@ -955,13 +955,13 @@ x-pack/platform/packages/shared/kbn-langchain @elastic/security-generative-ai
 x-pack/platform/packages/shared/kbn-langgraph-checkpoint-saver @elastic/security-generative-ai
 x-pack/platform/packages/shared/kbn-mcp-client @elastic/workchat-eng
 x-pack/platform/packages/shared/kbn-profiler-cli @elastic/obs-knowledge-team
-x-pack/platform/packages/shared/kbn-sample-parser @elastic/streams-program-team
+x-pack/platform/packages/shared/kbn-sample-parser @elastic/obs-onboarding-team @elastic/obs-sig-events-team
 x-pack/platform/packages/shared/kbn-search-index-documents @elastic/search-kibana
 x-pack/platform/packages/shared/kbn-slo-schema @elastic/obs-ux-management-team
 x-pack/platform/packages/shared/kbn-streamlang @elastic/obs-onboarding-team
 x-pack/platform/packages/shared/kbn-streamlang-tests @elastic/obs-onboarding-team
-x-pack/platform/packages/shared/kbn-streams-ai @elastic/streams-program-team
-x-pack/platform/packages/shared/kbn-streams-schema @elastic/streams-program-team
+x-pack/platform/packages/shared/kbn-streams-ai @elastic/obs-onboarding-team @elastic/obs-sig-events-team
+x-pack/platform/packages/shared/kbn-streams-schema @elastic/obs-onboarding-team @elastic/obs-sig-events-team
 x-pack/platform/packages/shared/logs-overview @elastic/obs-exploration-team
 x-pack/platform/packages/shared/ml/aiops_common @elastic/ml-ui
 x-pack/platform/packages/shared/ml/aiops_log_pattern_analysis @elastic/ml-ui
@@ -1079,8 +1079,8 @@ x-pack/platform/plugins/shared/serverless @elastic/appex-sharedux
 x-pack/platform/plugins/shared/spaces @elastic/kibana-security
 x-pack/platform/plugins/shared/stack_alerts @elastic/response-ops
 x-pack/platform/plugins/shared/stack_connectors @elastic/response-ops
-x-pack/platform/plugins/shared/streams @elastic/streams-program-team
-x-pack/platform/plugins/shared/streams_app @elastic/streams-program-team
+x-pack/platform/plugins/shared/streams @elastic/obs-onboarding-team @elastic/obs-sig-events-team
+x-pack/platform/plugins/shared/streams_app @elastic/obs-onboarding-team @elastic/obs-sig-events-team
 x-pack/platform/plugins/shared/task_manager @elastic/response-ops
 x-pack/platform/plugins/shared/timelines @elastic/security-threat-hunting-investigations
 x-pack/platform/plugins/shared/triggers_actions_ui @elastic/response-ops
@@ -1144,7 +1144,7 @@ x-pack/solutions/observability/plugins/apm @elastic/obs-presentation-team
 x-pack/solutions/observability/plugins/apm_data_access @elastic/obs-presentation-team
 x-pack/solutions/observability/plugins/apm/ftr_e2e @elastic/obs-presentation-team
 x-pack/solutions/observability/plugins/exploratory_view @elastic/obs-ux-management-team
-x-pack/solutions/observability/plugins/infra @elastic/obs-exploration-team @elastic/obs-presentation-team
+x-pack/solutions/observability/plugins/infra @elastic/obs-presentation-team
 x-pack/solutions/observability/plugins/metrics_data_access @elastic/obs-presentation-team
 x-pack/solutions/observability/plugins/observability @elastic/obs-ux-management-team
 x-pack/solutions/observability/plugins/observability_agent_builder @elastic/obs-ai-team
@@ -1247,9 +1247,9 @@ x-pack/platform/test/serverless/api_integration/test_suites/platform_security @e
 /src/platform/test/functional/apps/management @elastic/kibana-management
 
 # Metrics Experience
-/src/platform/plugins/shared/metrics_experience @elastic/obs-presentation-team
-/src/platform/test/api_integration/apis/metrics_experience @elastic/obs-presentation-team
-/src/platform/test/api_integration/fixtures/es_archiver/metrics_experience @elastic/obs-presentation-team
+/src/platform/plugins/shared/metrics_experience @elastic/obs-exploration-team
+/src/platform/test/api_integration/apis/metrics_experience @elastic/obs-exploration-team
+/src/platform/test/api_integration/fixtures/es_archiver/metrics_experience @elastic/obs-exploration-team
 
 # Data Discovery
 /x-pack/platform/test/api_integration/services/data_view_api.ts @elastic/kibana-data-discovery
@@ -1346,10 +1346,10 @@ x-pack/platform/test/serverless/api_integration/test_suites/platform_security @e
 /src/platform/plugins/shared/discover/public/context_awareness/profile_providers/common/deprecation_logs_data_source_profile @elastic/kibana-data-discovery @elastic/kibana-core
 /src/platform/plugins/shared/discover/public/context_awareness/profile_providers/common/patterns_data_source_profile @elastic/ml-ui
 /src/platform/plugins/shared/discover/public/context_awareness/profile_providers/observability @elastic/kibana-data-discovery @elastic/obs-exploration-team
-/src/platform/plugins/shared/discover/public/context_awareness/profile_providers/observability/observability_document_profile @elastic/obs-presentation-team
-/src/platform/plugins/shared/discover/public/context_awareness/profile_providers/observability/observability_root_profile @elastic/obs-exploration-team @elastic/obs-presentation-team
-/src/platform/plugins/shared/discover/public/context_awareness/profile_providers/observability/traces_data_source_profile @elastic/obs-presentation-team
-/src/platform/plugins/shared/discover/public/context_awareness/profile_providers/observability/traces_document_profile @elastic/obs-presentation-team
+/src/platform/plugins/shared/discover/public/context_awareness/profile_providers/observability/observability_document_profile @elastic/obs-exploration-team
+/src/platform/plugins/shared/discover/public/context_awareness/profile_providers/observability/observability_root_profile @elastic/obs-exploration-team
+/src/platform/plugins/shared/discover/public/context_awareness/profile_providers/observability/traces_data_source_profile @elastic/obs-exploration-team
+/src/platform/plugins/shared/discover/public/context_awareness/profile_providers/observability/traces_document_profile @elastic/obs-exploration-team
 /src/platform/plugins/shared/discover/public/context_awareness/profile_providers/security @elastic/kibana-data-discovery @elastic/security-threat-hunting-investigations
 
 # Platform Docs
@@ -1413,7 +1413,7 @@ x-pack/platform/test/serverless/api_integration/test_suites/platform_security @e
 /src/platform/test/functional/services/esql.ts @elastic/kibana-esql
 /src/platform/test/functional/page_objects/index_editor.ts @elastic/kibana-esql
 /src/platform/packages/shared/kbn-monaco/src/languages/esql @elastic/kibana-esql
-x-pack/solutions/observability/plugins/observability/server/lib/esql_extensions @elastic/obs-presentation-team @elastic/obs-exploration-team
+x-pack/solutions/observability/plugins/observability/server/lib/esql_extensions @elastic/obs-exploration-team
 
 # Global Experience
 
@@ -1556,12 +1556,10 @@ x-pack/solutions/observability/plugins/observability/server/lib/esql_extensions
 /x-pack/solutions/observability/plugins/infra/server/utils @elastic/obs-presentation-team
 /x-pack/solutions/observability/test/serverless/functional/test_suites/infra @elastic/obs-presentation-team
 /x-pack/solutions/observability/plugins/observability/public/pages/overview @elastic/obs-presentation-team # Assigned to this team since it mostly uses infra/APM components
-/src/platform/plugins/shared/unified_doc_viewer/public/components/observability/traces @elastic/obs-presentation-team
-/src/platform/plugins/shared/unified_doc_viewer/public/components/observability/generic @elastic/obs-presentation-team
-/src/platform/plugins/shared/unified_doc_viewer/public/components/observability/attributes @elastic/obs-presentation-team
-/src/platform/plugins/shared/unified_doc_viewer/public/components/content_framework @elastic/obs-presentation-team
-/src/platform/packages/shared/kbn-unified-metrics-grid @elastic/obs-presentation-team
-
+/src/platform/plugins/shared/unified_doc_viewer/public/components/observability/traces @elastic/obs-exploration-team
+/src/platform/plugins/shared/unified_doc_viewer/public/components/observability/generic @elastic/obs-exploration-team
+/src/platform/plugins/shared/unified_doc_viewer/public/components/observability/attributes @elastic/obs-exploration-team
+/src/platform/plugins/shared/unified_doc_viewer/public/components/content_framework @elastic/obs-exploration-team
 
 /x-pack/solutions/observability/test/functional/services/logs_ui @elastic/obs-exploration-team
 /x-pack/solutions/observability/test/functional/page_objects/observability_logs_explorer.ts @elastic/obs-exploration-team
@@ -1735,11 +1733,11 @@ x-pack/solutions/observability/plugins/observability/server/lib/esql_extensions
 /x-pack/plugins/observability_solution/observability/server/ui_settings.ts @elastic/obs-docs
 
 # Streams
-/x-pack/platform/test/api_integration_deployment_agnostic/apis/streams @elastic/streams-program-team @elastic/obs-onboarding-team
-/x-pack/platform/test/api_integration_deployment_agnostic/configs/serverless/oblt.streams.index.ts @elastic/streams-program-team @elastic/obs-onboarding-team
-/x-pack/platform/test/api_integration_deployment_agnostic/configs/serverless/oblt.streams.serverless.config.ts @elastic/streams-program-team @elastic/obs-onboarding-team
-/x-pack/platform/test/api_integration/fixtures/kbn_archives/streams @elastic/streams-program-team @elastic/obs-onboarding-team
-/x-pack/platform/plugins/shared/streams_app/test/scout/ui/tests @elastic/streams-program-team @elastic/obs-onboarding-team
+/x-pack/platform/test/api_integration_deployment_agnostic/apis/streams @elastic/obs-sig-events-team  @elastic/obs-onboarding-team
+/x-pack/platform/test/api_integration_deployment_agnostic/configs/serverless/oblt.streams.index.ts @elastic/obs-sig-events-team @elastic/obs-onboarding-team
+/x-pack/platform/test/api_integration_deployment_agnostic/configs/serverless/oblt.streams.serverless.config.ts @elastic/obs-sig-events-team @elastic/obs-onboarding-team
+/x-pack/platform/test/api_integration/fixtures/kbn_archives/streams @elastic/obs-sig-events-team @elastic/obs-onboarding-team
+/x-pack/platform/plugins/shared/streams_app/test/scout/ui/tests @elastic/obs-sig-events-team @elastic/obs-onboarding-team
 
 
 ### END Observability Plugins

config/serverless.es.yml

@@ -116,8 +116,8 @@ xpack.contentConnectors.ui.enabled: false
 
 # Elastic Managed LLMs
 xpack.actions.preconfigured:
-  General-Purpose-LLM-v1:
-    name: General Purpose LLM v1
+  Anthropic-Claude-Sonnet-3-7:
+    name: Anthropic Claude Sonnet 3.7
     actionTypeId: .inference
     exposeConfig: true
     config:
@@ -126,8 +126,8 @@ xpack.actions.preconfigured:
       inferenceId: ".rainbow-sprinkles-elastic"
       providerConfig:
         model_id: "rainbow-sprinkles"
-  General-Purpose-LLM-v2:
-    name: General Purpose LLM v2
+  Anthropic-Claude-Sonnet-4-5:
+    name: Anthropic Claude Sonnet 4.5
     actionTypeId: .inference
     exposeConfig: true
     config:
@@ -136,13 +136,13 @@ xpack.actions.preconfigured:
       inferenceId: ".gp-llm-v2-chat_completion"
       providerConfig:
         model_id: "gp-llm-v2"
-  General-Purpose-LLM-v3:
-    name: General Purpose LLM v3
+  OpenAI-GPT-OSS-120B:
+    name: OpenAI GPT-OSS 120B
     actionTypeId: .inference
     exposeConfig: true
     config:
       provider: "elastic"
       taskType: "chat_completion"
-      inferenceId: ".gp-llm-v3-chat_completion"
+      inferenceId: ".openai-gpt-oss-120b-chat_completion"
       providerConfig:
-        model_id: "gp-llm-v3"
+        model_id: "openai-gpt-oss-120b"

config/serverless.oblt.complete.yml

@@ -25,8 +25,8 @@ xpack.features.overrides:
 
 # Elastic Managed LLMs
 xpack.actions.preconfigured:
-  General-Purpose-LLM-v1:
-    name: General Purpose LLM v1
+  Anthropic-Claude-Sonnet-3-7:
+    name: Anthropic Claude Sonnet 3.7
     actionTypeId: .inference
     exposeConfig: true
     config:
@@ -35,8 +35,8 @@ xpack.actions.preconfigured:
       inferenceId: ".rainbow-sprinkles-elastic"
       providerConfig:
         model_id: "rainbow-sprinkles"
-  General-Purpose-LLM-v2:
-    name: General Purpose LLM v2
+  Anthropic-Claude-Sonnet-4-5:
+    name: Anthropic Claude Sonnet 4.5
     actionTypeId: .inference
     exposeConfig: true
     config:
@@ -45,13 +45,14 @@ xpack.actions.preconfigured:
       inferenceId: ".gp-llm-v2-chat_completion"
       providerConfig:
         model_id: "gp-llm-v2"
-  General-Purpose-LLM-v3:
-    name: General Purpose LLM v3
+  OpenAI-GPT-OSS-120B:
+    name: OpenAI GPT-OSS 120B
     actionTypeId: .inference
     exposeConfig: true
     config:
       provider: "elastic"
       taskType: "chat_completion"
-      inferenceId: ".gp-llm-v3-chat_completion"
+      inferenceId: ".openai-gpt-oss-120b-chat_completion"
       providerConfig:
-        model_id: "gp-llm-v3"
+        model_id: "openai-gpt-oss-120b"
+

config/serverless.security.complete.yml

@@ -9,8 +9,8 @@ xpack.features.overrides:
 
 # Elastic Managed LLMs
 xpack.actions.preconfigured:
-  General-Purpose-LLM-v1:
-    name: General Purpose LLM v1
+  Anthropic-Claude-Sonnet-3-7:
+    name: Anthropic Claude Sonnet 3.7
     actionTypeId: .inference
     exposeConfig: true
     config:
@@ -19,8 +19,8 @@ xpack.actions.preconfigured:
       inferenceId: ".rainbow-sprinkles-elastic"
       providerConfig:
         model_id: "rainbow-sprinkles"
-  General-Purpose-LLM-v2:
-    name: General Purpose LLM v2
+  Anthropic-Claude-Sonnet-4-5:
+    name: Anthropic Claude Sonnet 4.5
     actionTypeId: .inference
     exposeConfig: true
     config:
@@ -29,13 +29,13 @@ xpack.actions.preconfigured:
       inferenceId: ".gp-llm-v2-chat_completion"
       providerConfig:
         model_id: "gp-llm-v2"
-  General-Purpose-LLM-v3:
-    name: General Purpose LLM v3
+  OpenAI-GPT-OSS-120B:
+    name: OpenAI GPT-OSS 120B
     actionTypeId: .inference
     exposeConfig: true
     config:
       provider: "elastic"
       taskType: "chat_completion"
-      inferenceId: ".gp-llm-v3-chat_completion"
+      inferenceId: ".openai-gpt-oss-120b-chat_completion"
       providerConfig:
-        model_id: "gp-llm-v3"
+        model_id: "openai-gpt-oss-120b"

config/serverless.security.search_ai_lake.yml

@@ -27,6 +27,21 @@ xpack.features.overrides:
   securitySolutionSiemMigrations.hidden: true
 
   ## Fine-tune the security solution essentials feature privileges. These feature privilege overrides are set individually for each project type. Also, refer to `serverless.yml` for the project-agnostic overrides.
+  siemV5:
+    privileges:
+      all.composedOf:
+        ## Limited values so the fields from serverless.yml or serverless.security.yml are overwritten
+        ## We do not need to compose 4 from maps and visualizations because these functionalities are disabled in this tier
+        - feature: 'discover_v2'
+          privileges: ['all']
+          ## We need limited access to fleet (v1) in order to use integrations
+        - feature: 'fleet'
+          privileges: ['all']
+      read.composedOf:
+        - feature: 'discover_v2'
+          privileges: ['read']
+        - feature: 'fleet'
+          privileges: ['read']
   siemV4:
     privileges:
       all.composedOf:
@@ -96,8 +111,8 @@ xpack.fleet.internal.registry.searchAiLakePackageAllowlistEnabled: true
 
 # Elastic Managed LLMs
 xpack.actions.preconfigured:
-  General-Purpose-LLM-v1:
-    name: General Purpose LLM v1
+  Anthropic-Claude-Sonnet-3-7:
+    name: Anthropic Claude Sonnet 3.7
     actionTypeId: .inference
     exposeConfig: true
     config:
@@ -106,8 +121,8 @@ xpack.actions.preconfigured:
       inferenceId: ".rainbow-sprinkles-elastic"
       providerConfig:
         model_id: "rainbow-sprinkles"
-  General-Purpose-LLM-v2:
-    name: General Purpose LLM v2
+  Anthropic-Claude-Sonnet-4-5:
+    name: Anthropic Claude Sonnet 4.5
     actionTypeId: .inference
     exposeConfig: true
     config:
@@ -116,13 +131,13 @@ xpack.actions.preconfigured:
       inferenceId: ".gp-llm-v2-chat_completion"
       providerConfig:
         model_id: "gp-llm-v2"
-  General-Purpose-LLM-v3:
-    name: General Purpose LLM v3
+  OpenAI-GPT-OSS-120B:
+    name: OpenAI GPT-OSS 120B
     actionTypeId: .inference
     exposeConfig: true
     config:
       provider: "elastic"
       taskType: "chat_completion"
-      inferenceId: ".gp-llm-v3-chat_completion"
+      inferenceId: ".openai-gpt-oss-120b-chat_completion"
       providerConfig:
-        model_id: "gp-llm-v3"
+        model_id: "openai-gpt-oss-120b"