[ExtraHop][Qualys GAV] - Fix Cannot execute ILM policy delete step

[ShourieG]

This PR focuses on the short term solution which add the logs-extrahop.investigation-* and logs-qualys_gav.asset-* indices under the kibana_system role with deletion privileges to prevent a failed deletion error when the index enters the deletion phase for the ILM lifecycle, in upcoming PRs.

Current behavior:

• It shows permission issue while deleting the index

For Qualys GAV:

{
  "failed_step": "delete",
  "step_info": {
    "type": "security_exception",
    "reason": "action [indices:admin/delete] is unauthorized for user [found-internal-kibana4-server] with effective roles [found-internal-kibana4-server,kibana_system] on indices [.ds-logs-qualys_gav.asset-default-2025.07.24-000001], this action is granted by the index privileges [delete_index,manage,all]"
  }
}

For ExtraHop:

{
  "failed_step": "delete",
  "step_info": {
    "type": "security_exception",
    "reason": "action [indices:admin/delete] is unauthorized for user [found-internal-kibana4-server] with effective roles [found-internal-kibana4-server, kibana_system] on indices [.ds-logs-extrahop.investigation-default-2025.07.23-000001], this action is granted by the index privileges [delete_index, manage, all]"
  }
}

Closes - #131825
Similar Issues : elastic/kibana#197390, #116982

[elasticsearchmachine]

Pinging @elastic/es-security (Team:Security)

[gmarouli]

Hi @ShourieG , I do not think that I am qualified to review this, it looks like github has already selected the a team to review.

My only comment is the wrong version. I removed the 8.18.0 and put back the 9.2.0. Changes in this branch only make it to 9.2.0, if you need it backported to other versions let me know and I can add the necessary the labels.

[ShourieG]

Hi @gmarouli, we would need this to be backported to at least 8.18 and above

[gmarouli]

@ShourieG I recommend running ./gradlew precommit before pushing, this way you can find the compilation and format errors and fix them before pushing. You can also see how to run it locally: https://github.com/elastic/elasticsearch/blob/main/CONTRIBUTING.md#contributing-to-the-elasticsearch-codebase

[slobodanadamovic]

LGTM (from es-security side - pending green CI and compilation resolving)

Please make sure to get approval from @elastic/kibana-security team as well.

[ShourieG]

Hi @elastic/kibana-security, could I get a review/approval on this.

[ShourieG]

💚 All backports created successfully

Status	Branch	Result
✅	9.1
✅	9.0
✅	8.19
✅	8.18

Questions ?

Please refer to the Backport tool documentation

[ShourieG]

@janvi-elastic, We are unblocked from 8.19 and above, 8.18 should be unblocked after discovering reasons for ci-failure