[Security Solution][Endpoint] Update host isolation pending status API to work with new endpoint #115441

ashokaditya · 2021-10-18T19:22:19Z

Summary

Adds logic to finding pending isolation/release status for new (>=v7.16) endpoints.

Essentially, for <=v71.6 endpoints, the legacy logic follows for pending action status, where the action is considered pending when there is no response yet. For >=v7.16 endpoints, action is pending if there is a response with ack in it, but there's no endpoint response.

Checklist

Delete any items that are not applicable to this PR.

Unit or functional tests were updated or added to match the most common scenarios

x-pack/plugins/security_solution/server/endpoint/services/actions.ts

ashokaditya · 2021-10-19T11:26:13Z

@elasticmachine merge upstream

fixes elastic/security-team/issues/1705

…e has an `ack`

elasticmachine · 2021-10-19T14:03:50Z

Pinging @elastic/security-onboarding-and-lifecycle-mgt (Team:Onboarding and Lifecycle Mgt)

x-pack/plugins/security_solution/server/endpoint/services/actions.ts

dasansol92

Left some code suggestions, let me know if something doesn't work on your side 🙂
Btw, it looks great! 🔥

x-pack/plugins/security_solution/server/endpoint/services/actions.ts

academo

there is a problem with async code mixing with sync code.

pzl

the logic is there

some names were not very clear to me, but that's a nitpick at best

x-pack/plugins/security_solution/server/endpoint/services/actions.ts

pzl · 2021-10-19T18:45:54Z

x-pack/plugins/security_solution/server/endpoint/services/actions.ts

@@ -146,6 +147,45 @@ const getActivityLog = async ({
  return sortedData;
 };

+const hasAckInResponse = (response: EndpointActionResponse): boolean => {


x-pack/plugins/security_solution/server/endpoint/services/actions.ts

pzl · 2021-10-19T18:56:52Z

x-pack/plugins/security_solution/server/endpoint/services/actions.ts

+      return ackResponseActionIdList.includes(action.action_id) // if has ack
+        ? isLogsEndpointFilter({ action, agentId, indexedActionIds }) // then find responses in new index
+        : legacyFilterCallback({
+            // else use the legacy way


comments here are 🔥

x-pack/plugins/security_solution/server/endpoint/services/actions.ts

review changes

pzl

🐑 🐑 🐑

kibanamachine · 2021-10-19T21:29:00Z

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

💚 Build #162902 succeeded bcff747
💔 Build #162817 failed 60df7f1
💔 Build #162805 failed ba5a259
💚 Build #162716 succeeded adb3e76
💛 Build #162636 was flaky 0b0a59a4d3f84b6d2747879a75eb7e0d6457a73f

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @ashokaditya

…I to work with new endpoint (elastic#115441) * get the whole response when fetching responses by agentIds fixes elastic/security-team/issues/1705 * search new response index with actionId fixes elastic/security-team/issues/1705 * Find matching responses in new response index if fleet action response has an `ack` * review changes * hasIndexedDoc fix fetch logic * remove file * simplify code * add some acks to generator responses * meaningful names review changes Co-authored-by: Esteban Beltran <[email protected]>

kibanamachine · 2021-10-19T21:32:25Z

💚 Backport successful

Status	Branch	Result
✅	7.x

This backport PR will be merged automatically after passing CI.

…I to work with new endpoint (elastic#115441) * get the whole response when fetching responses by agentIds fixes elastic/security-team/issues/1705 * search new response index with actionId fixes elastic/security-team/issues/1705 * Find matching responses in new response index if fleet action response has an `ack` * review changes * hasIndexedDoc fix fetch logic * remove file * simplify code * add some acks to generator responses * meaningful names review changes Co-authored-by: Esteban Beltran <[email protected]>

…tus API to work with new endpoint (#115441) (#115691) * [Security Solution][Endpoint] Update host isolation pending status API to work with new endpoint (#115441) * get the whole response when fetching responses by agentIds fixes elastic/security-team/issues/1705 * search new response index with actionId fixes elastic/security-team/issues/1705 * Find matching responses in new response index if fleet action response has an `ack` * review changes * hasIndexedDoc fix fetch logic * remove file * simplify code * add some acks to generator responses * meaningful names review changes Co-authored-by: Esteban Beltran <[email protected]> * skip flakey test Co-authored-by: Ashokaditya <[email protected]> Co-authored-by: Esteban Beltran <[email protected]>

#115998) * add tests for pending status api changes related to /pull/115441 refs elastic/security-team/issues/1705 * update mock refs /pull/116214 Co-authored-by: Kibana Machine <[email protected]>

elastic#115998) * add tests for pending status api changes related to elastic/pull/115441 refs elastic/security-team/issues/1705 * update mock refs elastic/pull/116214 Co-authored-by: Kibana Machine <[email protected]>

#115998) (#116924) * add tests for pending status api changes related to /pull/115441 refs elastic/security-team/issues/1705 * update mock refs /pull/116214 Co-authored-by: Kibana Machine <[email protected]> Co-authored-by: Ashokaditya <[email protected]>

#115998) (#116925) * add tests for pending status api changes related to /pull/115441 refs elastic/security-team/issues/1705 * update mock refs /pull/116214 Co-authored-by: Kibana Machine <[email protected]> Co-authored-by: Ashokaditya <[email protected]>

When looking for completed responses for responses with ACK. refs elastic/pull/115441

ashokaditya added v8.0.0 Team:Defend Workflows “EDR Workflows” sub-team of Security Solution release_note:feature Makes this part of the condensed release notes auto-backport Deprecated - use backport:version if exact versions are needed v7.16.0 labels Oct 18, 2021

ashokaditya self-assigned this Oct 18, 2021

ashokaditya commented Oct 18, 2021

View reviewed changes

x-pack/plugins/security_solution/server/endpoint/services/actions.ts Show resolved Hide resolved

ashokaditya added 3 commits October 19, 2021 16:03

get the whole response when fetching responses by agentIds

e20788e

fixes elastic/security-team/issues/1705

search new response index with actionId

1d6bc5f

fixes elastic/security-team/issues/1705

Find matching responses in new response index if fleet action respons…

adb3e76

…e has an `ack`

ashokaditya marked this pull request as ready for review October 19, 2021 14:03

ashokaditya requested review from a team as code owners October 19, 2021 14:03

ashokaditya requested review from academo and dasansol92 October 19, 2021 14:03

ashokaditya requested a review from pzl October 19, 2021 14:04

academo reviewed Oct 19, 2021

View reviewed changes

x-pack/plugins/security_solution/server/endpoint/services/actions.ts Outdated Show resolved Hide resolved

academo reviewed Oct 19, 2021

View reviewed changes

x-pack/plugins/security_solution/server/endpoint/services/actions.ts Outdated Show resolved Hide resolved

academo reviewed Oct 19, 2021

View reviewed changes

x-pack/plugins/security_solution/server/endpoint/services/actions.ts Outdated Show resolved Hide resolved

dasansol92 reviewed Oct 19, 2021

View reviewed changes

academo suggested changes Oct 19, 2021

View reviewed changes

ashokaditya and others added 2 commits October 19, 2021 18:04

review changes

ba5a259

hasIndexedDoc fix fetch logic

20aab03

ashokaditya requested a review from a team as a code owner October 19, 2021 16:15

remove file

60df7f1

kevinlog requested a review from academo October 19, 2021 16:29

academo approved these changes Oct 19, 2021

View reviewed changes

simplify code

e9946ff

add some acks to generator responses

bcff747

pzl approved these changes Oct 19, 2021

View reviewed changes

ashokaditya commented Oct 19, 2021

View reviewed changes

x-pack/plugins/security_solution/server/endpoint/services/actions.ts Outdated Show resolved Hide resolved

ashokaditya commented Oct 19, 2021

View reviewed changes

x-pack/plugins/security_solution/server/endpoint/services/actions.ts Outdated Show resolved Hide resolved

ashokaditya commented Oct 19, 2021

View reviewed changes

x-pack/plugins/security_solution/server/endpoint/services/actions.ts Outdated Show resolved Hide resolved

meaningful names

4992c33

review changes

ashokaditya enabled auto-merge (squash) October 19, 2021 19:14

pzl approved these changes Oct 19, 2021

View reviewed changes

kevinlog removed the request for review from a team October 19, 2021 19:20

ashokaditya merged commit b1dd89e into elastic:master Oct 19, 2021

kibanamachine mentioned this pull request Oct 19, 2021

[7.x] [Security Solution][Endpoint] Update host isolation pending status API to work with new endpoint (#115441) #115661

Closed

kevinlog mentioned this pull request Oct 20, 2021

[7.x] [Security Solution][Endpoint] Update host isolation pending status API to work with new endpoint (#115441) #115691

Merged

ashokaditya mentioned this pull request Oct 21, 2021

[Security Solution][Endpoint] Add tests for pending status API changes #115998

Merged

1 task

ashokaditya added a commit to ashokaditya/kibana that referenced this pull request Nov 10, 2021

Pull more than 10 records

6ad30c6

When looking for completed responses for responses with ACK. refs elastic/pull/115441

ashokaditya mentioned this pull request Nov 10, 2021

[Security Solution][Endpoint] Look through max size when searching for completed responses #118198

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Endpoint] Update host isolation pending status API to work with new endpoint #115441

[Security Solution][Endpoint] Update host isolation pending status API to work with new endpoint #115441

ashokaditya commented Oct 18, 2021 •

edited

Loading

ashokaditya commented Oct 19, 2021

elasticmachine commented Oct 19, 2021

dasansol92 left a comment

academo left a comment

pzl left a comment

pzl Oct 19, 2021

pzl Oct 19, 2021

pzl left a comment

kibanamachine commented Oct 19, 2021

kibanamachine commented Oct 19, 2021

[Security Solution][Endpoint] Update host isolation pending status API to work with new endpoint #115441

[Security Solution][Endpoint] Update host isolation pending status API to work with new endpoint #115441

Conversation

ashokaditya commented Oct 18, 2021 • edited Loading

Summary

Checklist

ashokaditya commented Oct 19, 2021

elasticmachine commented Oct 19, 2021

dasansol92 left a comment

Choose a reason for hiding this comment

academo left a comment

Choose a reason for hiding this comment

pzl left a comment

Choose a reason for hiding this comment

pzl Oct 19, 2021

Choose a reason for hiding this comment

pzl Oct 19, 2021

Choose a reason for hiding this comment

pzl left a comment

Choose a reason for hiding this comment

kibanamachine commented Oct 19, 2021

💚 Build Succeeded

Metrics [docs]

History

kibanamachine commented Oct 19, 2021

💚 Backport successful

ashokaditya commented Oct 18, 2021 •

edited

Loading