[Security Solution] Add additional privileges to Kibana System role for .endpoint-scripts-file* indexes

docs/changelog/139245.yaml

@@ -0,0 +1,6 @@
+pr: 139245
+summary: "[Security Solution] Add additional privileges to Kibana System role for\
+  \ `.endpoint-scripts-file*` indexes"
+area: Authorization
+type: enhancement
+issues: []

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java

@@ -339,16 +339,22 @@ static RoleDescriptor kibanaSystem(String name) {
                     )
                     .build(),
 
+                // Kibana Security Solution EDR workflows team
+                // - `.endpoint-script-file*`:
+                // indexes are used internally within Kibana in support of Elastic Defend scripts library.
+                RoleDescriptor.IndicesPrivileges.builder()
+                    .indices(".endpoint-script-file-meta-*", ".endpoint-script-file-data-*")
+                    .privileges("auto_configure", "read", "write", "delete", "create_index", "manage")
+                    .build(),
+
                 // Kibana Security Solution EDR workflows team
                 // 1.`.logs-endpoint.action.responses-*`:
                 // Endpoint specific action responses. Kibana reads and writes (for third party agents)
                 // to the index to display action responses to the user. `create_index`: is necessary
                 // in order to ensure that the DOT datastream index is created by Kibana in order to
                 // avoid errors on the Elastic Defend side when streaming documents to it.
-                // 2. `.endpoint-script-file*`:
-                // indexes are used internally within Kibana in support of Elastic Defend scripts library.
                 RoleDescriptor.IndicesPrivileges.builder()
-                    .indices(".logs-endpoint.action.responses-*", ".endpoint-script-file-meta-*", ".endpoint-script-file-data-*")
+                    .indices(".logs-endpoint.action.responses-*")
                     .privileges("auto_configure", "read", "write", "create_index")
                     .build(),
                 // Endpoint specific actions. Kibana reads and writes to this index to track new

x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java

@@ -991,10 +991,8 @@ public void testKibanaSystemRole() {
             final IndexAbstraction indexAbstraction = mockIndexAbstraction(index);
             assertThat(kibanaRole.indices().allowedIndicesMatcher("indices:foo").test(indexAbstraction), is(false));
             assertThat(kibanaRole.indices().allowedIndicesMatcher("indices:bar").test(indexAbstraction), is(false));
-            assertThat(
-                kibanaRole.indices().allowedIndicesMatcher(TransportDeleteIndexAction.TYPE.name()).test(indexAbstraction),
-                is(false)
-            );
+            assertThat(kibanaRole.indices().allowedIndicesMatcher(TransportDeleteIndexAction.TYPE.name()).test(indexAbstraction), is(true));
+
             assertThat(kibanaRole.indices().allowedIndicesMatcher(GetIndexAction.NAME).test(indexAbstraction), is(true));
             assertThat(kibanaRole.indices().allowedIndicesMatcher(TransportCreateIndexAction.TYPE.name()).test(indexAbstraction), is(true));
             assertThat(kibanaRole.indices().allowedIndicesMatcher(TransportIndexAction.NAME).test(indexAbstraction), is(true));
@@ -1003,6 +1001,7 @@ public void testKibanaSystemRole() {
             assertThat(kibanaRole.indices().allowedIndicesMatcher(TransportMultiSearchAction.TYPE.name()).test(indexAbstraction), is(true));
             assertThat(kibanaRole.indices().allowedIndicesMatcher(TransportGetAction.TYPE.name()).test(indexAbstraction), is(true));
             assertThat(kibanaRole.indices().allowedIndicesMatcher(READ_CROSS_CLUSTER_NAME).test(indexAbstraction), is(false));
+            assertThat(kibanaRole.indices().allowedIndicesMatcher("indices:admin/refresh*").test(indexAbstraction), is(true));
         });
 
         // Kibana Security Solution EDR workflows team