Mysql datasource

.buildkite/scripts/steps/security/third_party_packages.txt

@@ -44,6 +44,7 @@ lightningcss
 tar-fs
 browserslist
 react-day-picker
+mysql2
 jszip
 @rsdoctor/rspack-plugin
 @rspack/core

.github/CODEOWNERS

@@ -2623,6 +2623,8 @@ src/platform/packages/shared/kbn-connector-specs/src/auth_types/kubernetes_* @el
 # Connector Specs
 src/platform/packages/shared/kbn-connector-specs/src/all_specs.ts
 src/platform/packages/shared/kbn-connector-specs/src/connector_icons_map.ts
+src/platform/packages/shared/kbn-connector-specs/src/lib/clients/** @elastic/workchat-eng
+src/platform/packages/shared/kbn-connector-specs/src/lib/generic_db_connector* @elastic/workchat-eng
 src/platform/packages/shared/kbn-connector-specs/src/lib/mcp/** @elastic/workchat-eng
 src/platform/packages/shared/kbn-connector-specs/src/specs/**
 src/platform/packages/shared/kbn-connector-specs/src/specs/abuseipdb/** @elastic/workflows-eng
@@ -2664,6 +2666,7 @@ src/platform/packages/shared/kbn-connector-specs/src/specs/kubernetes/** @elasti
 src/platform/packages/shared/kbn-connector-specs/src/specs/microsoft_teams/** @elastic/workchat-eng
 src/platform/packages/shared/kbn-connector-specs/src/specs/misp/** @elastic/workflows-eng
 src/platform/packages/shared/kbn-connector-specs/src/specs/monday_com/** @elastic/workchat-eng
+src/platform/packages/shared/kbn-connector-specs/src/specs/mysql/** @elastic/workchat-eng
 src/platform/packages/shared/kbn-connector-specs/src/specs/notion/** @elastic/workchat-eng
 src/platform/packages/shared/kbn-connector-specs/src/specs/okta/** @elastic/workflows-eng
 src/platform/packages/shared/kbn-connector-specs/src/specs/one_drive/** @elastic/workchat-eng

docs/reference/connectors-kibana/_snippets/data-context-sources-connectors-list.md

@@ -33,6 +33,7 @@
 - [Kubernetes](/reference/connectors-kibana/kubernetes-action-type.md): Read and modify resources in a Kubernetes cluster through its REST API.
 - [Microsoft Teams](/reference/connectors-kibana/microsoft-teams-action-type.md): Search messages and browse teams, channels, and chats in Microsoft Teams.
 - [Monday.com](/reference/connectors-kibana/monday-com-action-type.md): Search boards, read and create items, post updates, and manage workspaces in Monday.com.
+- [MySQL](/reference/connectors-kibana/mysql-action-type.md): Query tables, search rows, explore schema, and execute SQL in a MySQL database.
 - [New Relic](/reference/connectors-kibana/new-relic-action-type.md): Acknowledge and resolve AI issues, manage muting rules, and run NRQL queries.
 - [Notion](/reference/connectors-kibana/notion-action-type.md): Explore content and databases in Notion.
 - [OneDrive](/reference/connectors-kibana/one-drive-action-type.md): Search files and folders, browse drives, read file content, and list files shared with you in Microsoft OneDrive.

docs/reference/connectors-kibana/mysql-action-type.md

@@ -0,0 +1,133 @@
+---
+navigation_title: "MySQL"
+type: reference
+description: "Use the MySQL connector to query, explore schema, and execute SQL against a MySQL database."
+applies_to:
+  stack: preview 9.6
+  serverless: preview
+---
+
+# MySQL connector [mysql-action-type]
+
+The MySQL connector connects directly to a MySQL database so you can search, query, and explore schema from chat conversations. Workflow authors can also run write or DDL statements through **Execute SQL**.
+
+## Requirements [mysql-requirements]
+
+The MySQL connector connects directly to MySQL over the native MySQL protocol (default port 3306). Your MySQL server must be network-accessible from your Kibana instance. TLS is required by default.
+
+To use the MySQL connector, you need:
+
+1. A MySQL server accessible from your Kibana instance.
+2. A MySQL user with access to the databases you want to query.
+3. The server hostname, port, database name, and credentials.
+
+## Get connection details [mysql-api-credentials]
+
+To configure the connector:
+
+1. Identify the hostname or IP address of your MySQL server.
+2. Create a MySQL user with the appropriate permissions for your use case (see [Database user permissions](#mysql-security)).
+3. Note the server port (default: 3306) and the default database name.
+
+## Create connectors in {{kib}} [define-mysql-ui]
+
+You can create connectors in **{{stack-manage-app}} > {{connectors-ui}}**.
+
+### Connector configuration [mysql-connector-configuration]
+
+MySQL connectors have the following configuration properties:
+
+Host
+:   The hostname or IP address of the MySQL server (for example, `mysql.example.com`, `192.168.1.1`, `localhost`). Do not include a protocol prefix.
+
+Port
+:   The port number of the MySQL server (default: 3306).
+
+Database
+:   The name of the default database to query.
+
+Username
+:   The MySQL user to authenticate as.
+
+Password
+:   The password for the MySQL user.
+
+TLS
+:   Whether to encrypt the connection. **Required** (default) uses Kibana TLS settings. **Disabled** is only for servers that do not support TLS.
+
+
+## Test connectors [mysql-action-configuration]
+
+You can test connectors as you're creating or editing the connector in {{kib}}.
+
+## MySQL Connector actions [mysql-connector-actions]
+
+The MySQL connector has the following actions:
+
+Query
+:   Run a read-only SQL query against the MySQL database.
+    - **sql** (required): The SQL query to run. Include a `LIMIT` clause to bound the result size. Do not include a trailing semicolon.
+
+List Databases
+:   List all databases accessible to the authenticated user.
+
+List Tables
+:   List all tables in a database.
+    - **database** (optional): The database name. Uses the configured default if omitted.
+
+Describe Table
+:   Describe the schema of a table, including column names, types, and constraints.
+    - **table** (required): The table name to describe.
+    - **database** (optional): The database name. Uses the configured default if omitted.
+
+Search Rows
+:   Search rows in a table by matching a search term against specified columns.
+    - **table** (required): The table to search.
+    - **searchTerm** (required): The text to search for.
+    - **columns** (required): Array of column names to search in. Use `describeTable` to discover available columns.
+    - **maxRows** (optional): Maximum number of rows to return (1-1000, default: 100).
+    - **database** (optional): The database name. Uses the configured default if omitted.
+
+Execute SQL
+:   Run any SQL statement against the MySQL database. No restrictions — `INSERT`, `UPDATE`, `DELETE`, `DROP`, and DDL are all permitted. Use only when the workflow explicitly requires a write or destructive operation. Prefer **Query** for read-only access.
+    - **sql** (required): The SQL statement to execute.
+
+
+## Database user permissions [mysql-security]
+
+The permissions you grant to the MySQL user determine what the connector can do. Configure them to match your intended use case.
+
+### Read-only chat use case (recommended)
+
+For chat conversations, where the goal is to query and explore data, use a dedicated user with only `SELECT` access. This is the recommended configuration and provides the strongest protection against unintended modifications.
+
+```sql
+-- Create a read-only user and grant SELECT on the target databases
+CREATE USER 'kibana_reader'@'%' IDENTIFIED BY '<password>';
+GRANT SELECT ON my_database.* TO 'kibana_reader'@'%';
+FLUSH PRIVILEGES;
+```
+
+The `query` action enforces read-only access at the application level by accepting only `SELECT` and `WITH` statements and by blocking multi-statement input. Use **List Tables** and **Describe Table** for schema discovery.
+
+::::{note}
+The application-level read-only check is not a security guarantee. Prompt injection and other techniques may craft inputs that bypass it. The only reliable protection is granting the database user read-only permissions. Application-level enforcement is a defense-in-depth measure, not a substitute for least-privilege credentials.
+::::
+
+Using a least-privilege database user adds a second, independent layer of enforcement. Note: the `executeSql` action bypasses these restrictions and can run any statement — do not grant write privileges unless your use case requires them.
+
+You can further restrict the user to connections from your Kibana host's IP address:
+
+```sql
+CREATE USER 'kibana_reader'@'<kibana-host-ip>' IDENTIFIED BY '<password>';
+```
+
+### Broader access
+
+If your use case requires write access or access across multiple databases, grant the appropriate privileges to the MySQL user. Scope permissions as narrowly as possible for your use case.
+
+```sql
+-- Example: grant read/write access to a specific database
+GRANT SELECT, INSERT, UPDATE, DELETE ON my_database.* TO 'kibana_user'@'%';
+FLUSH PRIVILEGES;
+```

docs/reference/toc.yml

@@ -1,3 +1,3 @@
 project: 'Kibana reference'
 toc:
   - file: index.md
@@ -118,6 +118,7 @@
           - file: connectors-kibana/microsoft-teams-action-type.md
           - file: connectors-kibana/monday-com-action-type.md
           - file: connectors-kibana/misp-action-type.md
+          - file: connectors-kibana/mysql-action-type.md
           - file: connectors-kibana/new-relic-action-type.md
           - file: connectors-kibana/notion-action-type.md
           - file: connectors-kibana/okta-action-type.md

package.json

@@ -1562,6 +1562,7 @@
     "monaco-yaml": "5.1.0",
     "murmurhash": "2.0.1",
     "mustache": "4.2.0",
+    "mysql2": "3.24.3",
     "node-diff3": "3.1.2",
     "node-fetch": "2.7.0",
     "node-forge": "1.4.0",

packages/kbn-optimizer/src/worker/webpack.config.ts

@@ -90,6 +90,8 @@ export function getWebpackConfig(
         }
         const sharedExternals: Record<string, string> = {
           'node:crypto': 'commonjs crypto',
+          mysql2: 'commonjs mysql2',
+          'mysql2/promise': 'commonjs mysql2/promise',
           ...UiSharedDepsSrc.externals,
         };
         if (request && request in sharedExternals) {

packages/kbn-rspack-optimizer/src/config/externals.test.ts

@@ -14,7 +14,7 @@ import { getExternals, isKeaReactReduxImport } from './externals';
  * Rspack-specific externals that are NOT in UiSharedDepsSrc.externals.
  * Any addition here must be intentional and documented.
  */
-const RSPACK_ONLY_EXTERNALS = ['node:crypto'];
+const RSPACK_ONLY_EXTERNALS = ['node:crypto', 'mysql2', 'mysql2/promise'];
 
 describe('externals configuration', () => {
   const rspackExternals = getExternals();

packages/kbn-rspack-optimizer/src/config/externals.ts

@@ -39,5 +39,8 @@ export function getExternals(): Record<string, string> {
 
     // Node.js built-ins (rspack-specific, for browser compatibility)
     'node:crypto': 'commonjs crypto',
+    // Native MySQL driver — keep out of the browser bundle (mirrors webpack).
+    mysql2: 'commonjs mysql2',
+    'mysql2/promise': 'commonjs mysql2/promise',
   };
 }

renovate.json

@@ -2555,6 +2555,15 @@
       "enabled": true,
       "minimumReleaseAge": "14 days"
     },
+    {
+      "groupName": "mysql2",
+      "matchDepNames": ["mysql2"],
+      "reviewers": ["team:response-ops"],
+      "matchBaseBranches": ["main"],
+      "addLabels": ["Team:ResponseOps"],
+      "minimumReleaseAge": "14 days",
+      "enabled": true
+    },
     {
       "groupName": "react-day-picker",
       "matchDepNames": ["react-day-picker"],

src/platform/packages/shared/kbn-connector-specs/index.ts

@@ -94,7 +94,6 @@ export {
 } from './src/auth_mode_by_auth_type_id';
 export { getMeta, setMeta, addMeta } from './src/connector_spec_ui';
 export type { BaseMetadata } from './src/connector_spec_ui';
-export { clientTypes } from './src/lib/clients';
 export type {
   ClientTypeSpec,
   BuildContext,

src/platform/packages/shared/kbn-connector-specs/server.ts

@@ -22,3 +22,5 @@ export const authTypeSpecs = {
   KubernetesEksAuth,
   KubernetesGkeAuth,
 };
+
+export { clientTypes } from './src/lib/clients';

src/platform/packages/shared/kbn-connector-specs/src/all_specs.ts

@@ -46,6 +46,7 @@ export * from './specs/google_cloud_storage/google_cloud_storage';
 export * from './specs/sharepoint_server/sharepoint_server';
 export * from './specs/microsoft_teams/microsoft_teams';
 export * from './specs/monday_com/monday_com';
+export * from './specs/mysql/mysql';
 export * from './specs/outlook/outlook';
 export * from './specs/tavily/tavily';
 export * from './specs/pagerduty/pagerduty';