[Security Solution][Endpoint][Response Actions] Add license check to actions log management RBAC #142482

ashokaditya · 2022-10-03T15:07:33Z

Summary

Allows access to the response actions history page for platinum licenses and up.

iteration of /pull/142470 for >v8.6

Checklist

Unit or functional tests were updated or added to match the most common scenarios

fixes elastic/security-team/issues/5118 refs elastic/pull/142470

elasticmachine · 2022-10-03T15:08:47Z

Pinging @elastic/security-onboarding-and-lifecycle-mgt (Team:Onboarding and Lifecycle Mgt)

paul-tavares · 2022-10-03T16:14:57Z

x-pack/plugins/security_solution/public/management/pages/response_actions/index.tsx

+    SecurityPageName.responseActionsHistory
+  );
+
+  if (!canAccessResponseActionsHistoryNavLink) {


redirecting silently is not the best UX here. If the user does not have access to it, they should see a "not found" or "permission denied" type of message.

Should we instead change the Management page's index file to NOT register the route instead? Which would result in the user getting a 404 instead:

kibana/x-pack/plugins/security_solution/public/management/pages/index.tsx

Lines 96 to 114 in f336734

<Switch>

<Route path={MANAGEMENT_ROUTING_ENDPOINTS_PATH} component={EndpointTelemetry} />

<Route path={MANAGEMENT_ROUTING_POLICIES_PATH} component={PolicyTelemetry} />

<Route path={MANAGEMENT_ROUTING_TRUSTED_APPS_PATH} component={TrustedAppTelemetry} />

<Route path={MANAGEMENT_ROUTING_EVENT_FILTERS_PATH} component={EventFilterTelemetry} />

<Route

path={MANAGEMENT_ROUTING_HOST_ISOLATION_EXCEPTIONS_PATH}

component={HostIsolationExceptionsTelemetry}

/>

<Route path={MANAGEMENT_ROUTING_BLOCKLIST_PATH} component={BlocklistContainer} />

<Route

path={MANAGEMENT_ROUTING_RESPONSE_ACTIONS_HISTORY_PATH}

component={ResponseActionsTelemetry}

/>

<Route path={MANAGEMENT_PATH} exact>

<Redirect to={getEndpointListPath({ name: 'endpointList' })} />

</Route>

<Route path="*" component={NotFoundPage} />

</Switch>

I like that idea as well. A 404 page is better. What do you think @kevinlog

Although, HIE page also silently redirects. Maybe change that too?

paul-tavares · 2022-10-03T16:14:59Z

x-pack/plugins/security_solution/public/management/pages/response_actions/view/hooks.ts

+ * Checks if the current user should be able to see the response actions history
+ * menu item based on their current privileges
+ */
+export function useCanSeeResponseActionsHistoryMenu(): boolean {


(Optional) Seems like this hook is really only used once. should you just access:

useUserPrivileges().endpointPrivileges.canReadActionsLogManagement?

paul-tavares · 2022-10-03T16:16:17Z

x-pack/plugins/security_solution/public/management/pages/response_actions/view/hooks.ts

+ * menu item based on their current privileges
+ */
+export function useCanSeeResponseActionsHistoryMenu(): boolean {
+  const privileges = useEndpointPrivileges();


Can you use useUserPrivileges().endpointPrivileges instead?
The endpoint hook is really meant to be used internally by useUserPrivileges() hook

@paul-tavares

review changes (@paul-tavares)

@paul-tavares

review changes (@paul-tavares)

paul-tavares

Approving, but left a minor comment (optional)

paul-tavares · 2022-10-03T19:32:23Z

...solution/public/common/components/navigation/use_security_solution_navigation/index.test.tsx

@@ -117,6 +122,23 @@ describe('useSecuritySolutionNavigation', () => {
    ).toBeUndefined();
  });

+  it('should omit response actions history if hook reports false', () => {


being that the useUserPrivileges is being mocked via jest.mock(), should you add a afterEach() that resets the mock back to its default?

oh yes. Missed that. Will add it.

YulNaumenko

LGTM!

…actions-history

@paul-tavares

review changes (@paul-tavares)

…actions-history

kibana-ci · 2022-10-04T11:57:01Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 2e3f8e4

Failed CI Steps

FTR Configs #32

Test Failures

[job] [logs] FTR Configs #32 / analytics instrumented events from the browser Loaded Dashboard full loaded dashboard should emit the "Loaded Dashboard" event when done loading complex dashboard

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	6.6MB	6.6MB	+238.0B

History

💔 Build #77795 failed 3d93a26
💔 Build #77790 failed 324a63a
💛 Build #77691 was flaky 450f77b
💛 Build #77576 was flaky 233fe2e

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @ashokaditya

@paul-tavares

…actions log management RBAC (elastic#142482) * Add license check to actions log management RBAC fixes elastic/security-team/issues/5118 refs elastic/pull/142470 * useUSerPrivileges instead review changes (@paul-tavares) * Don't register route if no access review changes (@paul-tavares) * reset mocked privilege review changes (@paul-tavares)

@paul-tavares

…actions log management RBAC (elastic#142482) * Add license check to actions log management RBAC fixes elastic/security-team/issues/5118 refs elastic/pull/142470 * useUSerPrivileges instead review changes (@paul-tavares) * Don't register route if no access review changes (@paul-tavares) * reset mocked privilege review changes (@paul-tavares)

Add license check to actions log management RBAC

233fe2e

fixes elastic/security-team/issues/5118 refs elastic/pull/142470

ashokaditya self-assigned this Oct 3, 2022

ashokaditya added release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution OLM Sprint v8.6.0 labels Oct 3, 2022

ashokaditya requested a review from paul-tavares October 3, 2022 15:08

ashokaditya marked this pull request as ready for review October 3, 2022 15:08

ashokaditya requested review from a team as code owners October 3, 2022 15:08

ashokaditya requested a review from dasansol92 October 3, 2022 15:08

ashokaditya requested a review from kevinlog October 3, 2022 15:09

paul-tavares reviewed Oct 3, 2022

View reviewed changes

ashokaditya added 2 commits October 3, 2022 20:38

useUSerPrivileges instead

fc63aa8

review changes (@paul-tavares)

Don't register route if no access

450f77b

review changes (@paul-tavares)

ashokaditya requested a review from paul-tavares October 3, 2022 19:25

paul-tavares approved these changes Oct 3, 2022

View reviewed changes

kevinlog approved these changes Oct 3, 2022

View reviewed changes

YulNaumenko approved these changes Oct 3, 2022

View reviewed changes

ashokaditya and others added 2 commits October 4, 2022 09:12

Merge branch 'main' into task/olm-rbac-license-based-access-response-…

324a63a

…actions-history

reset mocked privilege

3d93a26

review changes (@paul-tavares)

ashokaditya enabled auto-merge (squash) October 4, 2022 07:46

ashokaditya added 2 commits October 4, 2022 11:57

Merge branch 'main' into task/olm-rbac-license-based-access-response-…

eebfb68

…actions-history

Merge branch 'main' into task/olm-rbac-license-based-access-response-…

2e3f8e4

…actions-history

ashokaditya merged commit 87dc1fa into elastic:main Oct 4, 2022

kibanamachine added the backport:skip This commit does not require backporting label Oct 4, 2022

ashokaditya deleted the task/olm-rbac-license-based-access-response-actions-history branch October 4, 2022 12:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Endpoint][Response Actions] Add license check to actions log management RBAC #142482

[Security Solution][Endpoint][Response Actions] Add license check to actions log management RBAC #142482

ashokaditya commented Oct 3, 2022 •

edited

Loading

elasticmachine commented Oct 3, 2022

paul-tavares Oct 3, 2022

ashokaditya Oct 3, 2022 •

edited

Loading

ashokaditya Oct 3, 2022 •

edited

Loading

ashokaditya Oct 3, 2022

paul-tavares Oct 3, 2022

ashokaditya Oct 3, 2022

paul-tavares Oct 3, 2022

ashokaditya Oct 3, 2022

paul-tavares left a comment

paul-tavares Oct 3, 2022

ashokaditya Oct 4, 2022

ashokaditya Oct 4, 2022

YulNaumenko left a comment

kibana-ci commented Oct 4, 2022

	<Switch>
	<Route path={MANAGEMENT_ROUTING_ENDPOINTS_PATH} component={EndpointTelemetry} />
	<Route path={MANAGEMENT_ROUTING_POLICIES_PATH} component={PolicyTelemetry} />
	<Route path={MANAGEMENT_ROUTING_TRUSTED_APPS_PATH} component={TrustedAppTelemetry} />
	<Route path={MANAGEMENT_ROUTING_EVENT_FILTERS_PATH} component={EventFilterTelemetry} />
	<Route
	path={MANAGEMENT_ROUTING_HOST_ISOLATION_EXCEPTIONS_PATH}
	component={HostIsolationExceptionsTelemetry}
	/>
	<Route path={MANAGEMENT_ROUTING_BLOCKLIST_PATH} component={BlocklistContainer} />
	<Route
	path={MANAGEMENT_ROUTING_RESPONSE_ACTIONS_HISTORY_PATH}
	component={ResponseActionsTelemetry}
	/>
	<Route path={MANAGEMENT_PATH} exact>
	<Redirect to={getEndpointListPath({ name: 'endpointList' })} />
	</Route>
	<Route path="*" component={NotFoundPage} />
	</Switch>

[Security Solution][Endpoint][Response Actions] Add license check to actions log management RBAC #142482

[Security Solution][Endpoint][Response Actions] Add license check to actions log management RBAC #142482

Conversation

ashokaditya commented Oct 3, 2022 • edited Loading

Summary

Checklist

elasticmachine commented Oct 3, 2022

Choose a reason for hiding this comment

ashokaditya Oct 3, 2022 • edited Loading

Choose a reason for hiding this comment

ashokaditya Oct 3, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

paul-tavares left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

YulNaumenko left a comment

Choose a reason for hiding this comment

kibana-ci commented Oct 4, 2022

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Async chunks

History

ashokaditya commented Oct 3, 2022 •

edited

Loading

ashokaditya Oct 3, 2022 •

edited

Loading

ashokaditya Oct 3, 2022 •

edited

Loading