[Security Solution] Add supported field to ransomware #100135
Conversation
kevinlog
added
Team:Defend Workflows
|
@elasticmachine merge upstream |
|
Pinging @elastic/security-onboarding-and-lifecycle-mgt (Team:Onboarding and Lifecycle Mgt) |
| /** | ||
| * Strips paid features from an existing or new `PolicyConfig` for gold and below license | ||
| */ | ||
| export const policyFactoryWithSupportedFeatures = ( |
There was a problem hiding this comment.
is there a reason why you created another function as opposed to just updating the existing policyFactory (policy config with defaults for platinum licenses) and the policyFactoryWithoutPaidFeatures (policy config with defaults for gold and below licenses) windows.ransomware.supported fields?
There was a problem hiding this comment.
I also use this function to correctly set the supported when the license changes. I want to ensure that I'm only changing the fields that I want to. I broke it out to its own function so that I didn't resent everything to the default.
You can see how it's used here: https://github.com/elastic/kibana/pull/100135/files#diff-6a6ff8e750469752a4993b278b7023af4bef43a49ccee59c3933e3d7c68c78f5R26
Also here in a test: https://github.com/elastic/kibana/pull/100135/files#diff-861c70c43696ed0ea535a55a47a316c434a14510046d2eb623d6b228d32e4c8eR211
botelastic
bot
added
the
Team:Fleet
|
Pinging @elastic/fleet (Team:Fleet) |
|
@elasticmachine merge upstream |
💚 Build SucceededMetrics [docs]Async chunks
Unknown metric groupsReferences to deprecated APIs
History
To update your PR or re-run it, just comment with: |
| describe('7.14.0 Endpoint Package Policy migration', () => { | ||
| const migration = migrateEndpointPackagePolicyToV7140; | ||
| it('adds supported option for ransomware on migrations', () => { | ||
| const doc = { |
There was a problem hiding this comment.
Any chance you can collapse several of these document mocks into a builder function instead?
There was a problem hiding this comment.
@paul-tavares my next PR is Linux Malware and will build on this migration test, I'll address this there.
Summary
This PR adds a
supportedfield to the Ransomware protection.The
supportedfield indicates to the Endpoint via Policy config if the Ransomware protection is currently supported. Right now, this is controlled by the license level. If the user has Platinum, then Ransomware is supported. If they are below Platinum, the Ransomware is unsupported. The Endpoint needs this information in order to properly enable/disabled diagnostic Ransomware protections based on user input.Platinum license:
If you downgrade below Platinum, the Policy will update:
Checklist
Delete any items that are not applicable to this PR.