Merge branch 'master' into reporting/docker-config-whitelist-2

.eslintignore

@@ -9,14 +9,14 @@ bower_components
 /built_assets
 /html_docs
 /src/plugins/data/common/es_query/kuery/ast/_generated_/**
-/src/legacy/core_plugins/vis_type_timelion/public/_generated_/**
+/src/plugins/vis_type_timelion/public/_generated_/**
 src/legacy/core_plugins/vis_type_vislib/public/vislib/__tests__/lib/fixtures/mock_data
 /src/legacy/ui/public/flot-charts
 /test/fixtures/scenarios
 /src/legacy/core_plugins/console/public/webpackShims
 /src/legacy/core_plugins/console/public/tests/webpackShims
 /src/legacy/ui/public/utils/decode_geo_hash.js
-/src/legacy/core_plugins/vis_type_timelion/public/webpackShims/jquery.flot.*
+/src/plugins/vis_type_timelion/public/webpackShims/jquery.flot.*
 /src/core/lib/kbn_internal_native_observable
 /packages/*/target
 /packages/eslint-config-kibana

.eslintrc.js

@@ -567,7 +567,7 @@ module.exports = {
     },
     {
       // typescript only for front and back end
-      files: ['x-pack/legacy/plugins/siem/**/*.{ts,tsx}'],
+      files: ['x-pack/{,legacy/}plugins/siem/**/*.{ts,tsx}'],
       rules: {
         // This will be turned on after bug fixes are complete
         // '@typescript-eslint/explicit-member-accessibility': 'warn',
@@ -613,7 +613,7 @@ module.exports = {
     // },
     {
       // typescript and javascript for front and back end
-      files: ['x-pack/legacy/plugins/siem/**/*.{js,ts,tsx}'],
+      files: ['x-pack/{,legacy/}plugins/siem/**/*.{js,ts,tsx}'],
       plugins: ['eslint-plugin-node', 'react'],
       env: {
         mocha: true,

.github/CODEOWNERS

@@ -13,8 +13,9 @@
 /src/legacy/core_plugins/kibana/public/dev_tools/ @elastic/kibana-app
 /src/legacy/core_plugins/vis_type_vislib/ @elastic/kibana-app
 /src/plugins/vis_type_xy/ @elastic/kibana-app
+/src/plugins/vis_type_table/ @elastic/kibana-app
 /src/plugins/kibana_legacy/ @elastic/kibana-app
-/src/plugins/timelion/ @elastic/kibana-app
+/src/plugins/vis_type_timelion/ @elastic/kibana-app
 /src/plugins/dashboard/ @elastic/kibana-app
 /src/plugins/discover/ @elastic/kibana-app
 /src/plugins/visualize/ @elastic/kibana-app
@@ -209,9 +210,12 @@
 # Endpoint
 /x-pack/plugins/endpoint/ @elastic/endpoint-app-team
 /x-pack/test/api_integration/apis/endpoint/ @elastic/endpoint-app-team
+/x-pack/test/endpoint_api_integration_no_ingest/ @elastic/endpoint-app-team
 /x-pack/test/functional_endpoint/ @elastic/endpoint-app-team
 /x-pack/test/functional_endpoint_ingest_failure/ @elastic/endpoint-app-team
 /x-pack/test/functional/es_archives/endpoint/ @elastic/endpoint-app-team
+/x-pack/test/plugin_functional/plugins/resolver_test/ @elastic/endpoint-app-team
+/x-pack/test/plugin_functional/test_suites/resolver/ @elastic/endpoint-app-team
 
 # SIEM
 /x-pack/legacy/plugins/siem/ @elastic/siem

.i18nrc.json

@@ -43,12 +43,12 @@
       "src/plugins/telemetry_management_section"
     ],
     "tileMap": "src/legacy/core_plugins/tile_map",
-    "timelion": ["src/legacy/core_plugins/timelion", "src/legacy/core_plugins/vis_type_timelion", "src/plugins/timelion"],
+    "timelion": ["src/legacy/core_plugins/timelion", "src/plugins/vis_type_timelion"],
     "uiActions": "src/plugins/ui_actions",
     "visDefaultEditor": "src/plugins/vis_default_editor",
     "visTypeMarkdown": "src/plugins/vis_type_markdown",
     "visTypeMetric": "src/plugins/vis_type_metric",
-    "visTypeTable": "src/legacy/core_plugins/vis_type_table",
+    "visTypeTable": "src/plugins/vis_type_table",
     "visTypeTagCloud": "src/legacy/core_plugins/vis_type_tagcloud",
     "visTypeTimeseries": ["src/legacy/core_plugins/vis_type_timeseries", "src/plugins/vis_type_timeseries"],
     "visTypeVega": "src/legacy/core_plugins/vis_type_vega",

CONTRIBUTING.md

@@ -22,6 +22,7 @@ A high level overview of our contributing guidelines.
     - [Setting Up SSL](#setting-up-ssl)
   - [Linting](#linting)
   - [Internationalization](#internationalization)
+  - [Localization](#localization)
   - [Testing and Building](#testing-and-building)
     - [Debugging server code](#debugging-server-code)
     - [Instrumenting with Elastic APM](#instrumenting-with-elastic-apm)
@@ -408,6 +409,11 @@ ReactDOM.render(
 There are a number of tools created to support internationalization in Kibana that would allow one to validate internationalized labels,
 extract them to a `JSON` file or integrate translations back to Kibana. To know more, please read corresponding [readme](src/dev/i18n/README.md) file.
 
+### Localization
+
+We cannot support accepting contributions to the translations from any source other than the translators we have engaged to do the work.
+We are still to develop a proper process to accept any contributed translations. We certainly appreciate that people care enough about the localization effort to want to help improve the quality. We aim to build out a more comprehensive localization process for the future and will notify you once contributions can be supported, but for the time being, we are not able to incorporate suggestions.
+
 ### Testing and Building
 
 To ensure that your changes will not break other functionality, please run the test suite and build process before submitting your Pull Request.

Jenkinsfile

@@ -41,7 +41,7 @@ kibanaPipeline(timeoutMinutes: 135, checkPrChanges: true) {
           'xpack-ciGroup10': kibanaPipeline.xpackCiGroupProcess(10),
           'xpack-accessibility': kibanaPipeline.functionalTestProcess('xpack-accessibility', './test/scripts/jenkins_xpack_accessibility.sh'),
           'xpack-siemCypress': { processNumber ->
-            whenChanged(['x-pack/legacy/plugins/siem/', 'x-pack/test/siem_cypress/']) {
+            whenChanged(['x-pack/plugins/siem/', 'x-pack/legacy/plugins/siem/', 'x-pack/test/siem_cypress/']) {
               kibanaPipeline.functionalTestProcess('xpack-siemCypress', './test/scripts/jenkins_siem_cypress.sh')(processNumber)
             }
           },

docs/api/saved-objects/create.asciidoc

@@ -57,12 +57,12 @@ any data that you send to the API is properly formed.
 
 [source,sh]
 --------------------------------------------------
-$ curl -X POST "localhost:5601/api/saved_objects/index-pattern/my-pattern"
+$ curl -X POST "localhost:5601/api/saved_objects/index-pattern/my-pattern"  -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d '
 {
   "attributes": {
     "title": "my-pattern-*"
   }
-}
+}'
 --------------------------------------------------
 // KIBANA
 

docs/api/saved-objects/export.asciidoc

@@ -68,46 +68,46 @@ Export all index pattern saved objects:
 
 [source,sh]
 --------------------------------------------------
-$ curl -X POST "localhost:5601/api/saved_objects/_export"
+$ curl -X POST "localhost:5601/api/saved_objects/_export" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d '
 {
   "type": "index-pattern"
-}
+}'
 --------------------------------------------------
 // KIBANA
 
 Export all index pattern saved objects and exclude the export summary from the stream:
 
 [source,sh]
 --------------------------------------------------
-$ curl -X POST "localhost:5601/api/saved_objects/_export"
+$ curl -X POST "localhost:5601/api/saved_objects/_export" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d '
 {
   "type": "index-pattern",
   "excludeExportDetails": true
-}
+}'
 --------------------------------------------------
 // KIBANA
 
 Export a specific saved object:
 
 [source,sh]
 --------------------------------------------------
-$ curl -X POST "localhost:5601/api/saved_objects/_export"
+$ curl -X POST "localhost:5601/api/saved_objects/_export" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d '
 {
   "objects": [
     {
       "type": "dashboard",
       "id": "be3733a0-9efe-11e7-acb3-3dab96693fab"
     }
   ]
-}
+}'
 --------------------------------------------------
 // KIBANA
 
 Export a specific saved object and it's related objects :
 
 [source,sh]
 --------------------------------------------------
-$ curl -X POST "localhost:5601/api/saved_objects/_export"
+$ curl -X POST "localhost:5601/api/saved_objects/_export" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d '
 {
   "objects": [
     {
@@ -116,6 +116,6 @@ $ curl -X POST "localhost:5601/api/saved_objects/_export"
     }
   ],
   "includeReferencesDeep": true
-}
+}'
 --------------------------------------------------
 // KIBANA

docs/development/core/server/kibana-plugin-core-server.savedobjectstype.md

@@ -25,6 +25,5 @@ This is only internal for now, and will only be public when we expose the regist
 |  [mappings](./kibana-plugin-core-server.savedobjectstype.mappings.md) | <code>SavedObjectsTypeMappingDefinition</code> | The [mapping definition](./kibana-plugin-core-server.savedobjectstypemappingdefinition.md) for the type. |
 |  [migrations](./kibana-plugin-core-server.savedobjectstype.migrations.md) | <code>SavedObjectMigrationMap</code> | An optional map of [migrations](./kibana-plugin-core-server.savedobjectmigrationfn.md) to be used to migrate the type. |
 |  [name](./kibana-plugin-core-server.savedobjectstype.name.md) | <code>string</code> | The name of the type, which is also used as the internal id. |
-|  [namespaceAgnostic](./kibana-plugin-core-server.savedobjectstype.namespaceagnostic.md) | <code>boolean</code> | Is the type global (true), or not (false). |
 |  [namespaceType](./kibana-plugin-core-server.savedobjectstype.namespacetype.md) | <code>SavedObjectsNamespaceType</code> | The [namespace type](./kibana-plugin-core-server.savedobjectsnamespacetype.md) for the type. |
 

docs/development/core/server/kibana-plugin-core-server.savedobjectstype.namespacetype.md

@@ -9,5 +9,5 @@ The [namespace type](./kibana-plugin-core-server.savedobjectsnamespacetype.md) f
 <b>Signature:</b>
 
 ```typescript
-namespaceType?: SavedObjectsNamespaceType;
+namespaceType: SavedObjectsNamespaceType;
 ```

docs/development/plugins/data/public/kibana-plugin-plugins-data-public.md

@@ -88,7 +88,6 @@
 |  [SavedQuery](./kibana-plugin-plugins-data-public.savedquery.md) |  |
 |  [SavedQueryService](./kibana-plugin-plugins-data-public.savedqueryservice.md) |  |
 |  [SearchSourceFields](./kibana-plugin-plugins-data-public.searchsourcefields.md) |  |
-|  [SearchStrategyProvider](./kibana-plugin-plugins-data-public.searchstrategyprovider.md) |  |
 |  [TabbedAggColumn](./kibana-plugin-plugins-data-public.tabbedaggcolumn.md) | \* |
 |  [TabbedTable](./kibana-plugin-plugins-data-public.tabbedtable.md) | \* |
 |  [TimeRange](./kibana-plugin-plugins-data-public.timerange.md) |  |

docs/ingest_manager/index-templates.asciidoc

@@ -0,0 +1,7 @@
+# Elasticsearch Index Templates
+
+## Generation
+
+* Index templates are generated from `YAML` files contained in the package.
+* There is one index template per dataset.
+* For the generation of an index template, all `yml` files contained in the package subdirectory `dataset/DATASET_NAME/fields/` are used.

docs/ingest_manager/index.asciidoc

@@ -199,3 +199,10 @@ The new ingest pipeline is expected to still work with the data coming from olde
 In case of a breaking change in the data structure, the new ingest pipeline is also expected to deal with this change. In case there are breaking changes which cannot be dealt with in an ingest pipeline, a new package has to be created.
 
 Each package lists its minimal required agent version. In case there are agents enrolled with an older version, the user is notified to upgrade these agents as otherwise the new configs cannot be rolled out.
+
+=== Generated assets
+
+When a package is installed or upgraded, certain Kibana and Elasticsearch assets are generated from . These follow the naming conventions explained above (see "indexing strategy") and contain configuration for the elastic stack that makes ingesting and displaying data work with as little user interaction as possible.
+
+* link:index-templates.asciidoc[Elasticsearch Index Templates]
+* Kibana Index Patterns

docs/management/advanced-options.asciidoc

@@ -217,6 +217,8 @@ might increase the search time. This setting is off by default. Users must opt-i
 [horizontal]
 `siem:defaultAnomalyScore`:: The threshold above which Machine Learning job anomalies are displayed in the SIEM app.
 `siem:defaultIndex`:: A comma-delimited list of Elasticsearch indices from which the SIEM app collects events.
+`siem:ipReputationLinks`:: A JSON array containing links for verifying the reputation of an IP address. The links are displayed on
+{siem-guide}/siem-ui-overview.html#network-ui[IP detail] pages.
 `siem:enableNewsFeed`:: Enables the security news feed on the SIEM *Overview*
 page.
 `siem:newsFeedUrl`:: The URL from which the security news feed content is

docs/management/managing-ccr.asciidoc

@@ -0,0 +1,73 @@
+[role="xpack"]
+[[managing-cross-cluster-replication]]
+== Cross-Cluster Replication
+
+Use *Cross-Cluster Replication* to reproduce indices in
+remote clusters on a local cluster. {ref}/xpack-ccr.html[Cross-cluster replication]
+is commonly used to provide remote backups for disaster recovery and for
+geo-proximite copies of data.
+
+To get started, go to *Management > Cross-Cluster Replication*.
+
+[role="screenshot"]
+image::images/cross-cluster-replication-list-view.png[][Cross-cluster replication list view]
+
+[float]
+=== Prerequisites
+
+* You must have a {ref}/modules-remote-clusters.html[remote cluster].
+* Leader indices must meet {ref}/ccr-requirements.html[these requirements].
+* The Elasticsearch version of the local cluster must be the same as or newer than the remote cluster.
+Refer to {ref}/ccr-overview.html[this document] for more information.
+
+[float]
+[[configure-replication]]
+=== Configure replication
+
+Replication requires a leader index, the index being replicated, and a
+follower index, which will contain the leader index's replicated data.
+The follower index is passive in that it can read requests and searches,
+but cannot accept direct writes. Only the leader index is active for direct writes.
+
+You can configure follower indices in two ways:
+
+* Create specific follower indices
+* Create follower indices from an auto-follow pattern
+
+[float]
+==== Create specific follower indices
+
+To replicate data from existing indices, or set up local followers on a case-by-case basis,
+go to *Follower indices*. When you create the follower index, you must reference the
+remote cluster and the leader index that you created in the remote cluster.
+
+[role="screenshot"]
+image::images/follower_indices.png[][UI for adding follower indices]
+
+[float]
+==== Create follower indices from an auto-follow pattern
+
+To automatically detect and follow new indices when they are created on a remote cluster,
+go to *Auto-follow patterns*. Creating an auto-follow pattern is useful when you have
+time series data, like event logs, on the remote cluster that is created or rolled over on a daily basis.
+
+When creating the pattern, you must reference the remote cluster that you
+connected to your local cluster. You must also specify a collection of index patterns
+that match the indices you want to automatically follow.
+
+Once you configure an
+auto-follow pattern, any time a new index with a name that matches the pattern is
+created in the remote cluster, a follower index is automatically configured in the local cluster.
+
+[role="screenshot"]
+image::images/auto_follow_pattern.png[UI for adding an auto-follow pattern]
+
+[float]
+[[manage-replication]]
+=== Manage replication
+
+Use the list views in *Cross-Cluster Replication* to monitor whether the replication is active and
+pause and resume replication.  You can also edit and remove the follower indices and auto-follow patterns.
+
+For an example of cross-cluster replication,
+refer to https://www.elastic.co/blog/bi-directional-replication-with-elasticsearch-cross-cluster-replication-ccr[Bi-directional replication with Elasticsearch cross-cluster replication].