Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution][Endpoint][Response Actions] Show Actions history on Endpoint Details for platinum users #145837

Merged
merged 4 commits into from
Nov 21, 2022
Merged

[Security Solution][Endpoint][Response Actions] Show Actions history on Endpoint Details for platinum users #145837

merged 4 commits into from
Nov 21, 2022

Conversation

ashokaditya
Copy link
Member

@ashokaditya ashokaditya commented Nov 21, 2022 •
edited by kibanamachine
Loading

Summary

Fixes a bug where response actions history was not shown for platinum users with Actions Log RBAC privileges.

Checklist

For maintainers

@ashokaditya ashokaditya self-assigned this Nov 21, 2022
@ashokaditya ashokaditya force-pushed the fix/olm-response-actions-history-5489 branch from d016de4 to f5ecbf1 Compare November 21, 2022 11:32
@ashokaditya
Show actions history on endpoint details for plat+
d119193 
Endpoint details flyout should show response actions history tab for platinum+ users with Actions Log management RBAC permission.

fixes elastic/security-team/issues/5489
@ashokaditya
update test
8e042a5 
fixes elastic/issues/145204
@ashokaditya
update test
bcbc279 
fixes elastic/issues/145635
@ashokaditya
update test that depends on license check
d043c42 
fixes elastic/security-team/issues/5489
@ashokaditya ashokaditya force-pushed the fix/olm-response-actions-history-5489 branch from a26ca5a to d043c42 Compare November 21, 2022 12:43
@ashokaditya ashokaditya marked this pull request as ready for review November 21, 2022 12:43
@ashokaditya ashokaditya requested review from a team as code owners November 21, 2022 12:43
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-onboarding-and-lifecycle-mgt (Team:Onboarding and Lifecycle Mgt)

@ashokaditya ashokaditya requested review from paul-tavares and kevinlog and removed request for joeypoon November 21, 2022 12:43
ashokaditya
ashokaditya commented Nov 21, 2022
View reviewed changes
x-pack/plugins/security_solution/server/endpoint/routes/actions/list_handler.test.ts
@@ -38,7 +38,7 @@ jest.mock('../../services');
const mockGetActionList = getActionList as jest.Mock;
const mockGetActionListByStatus = getActionListByStatus as jest.Mock;

describe(' Action List Handler', () => {
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cleaned up typo here

ashokaditya
ashokaditya commented Nov 21, 2022
View reviewed changes
x-pack/plugins/security_solution/common/endpoint/service/authz/authz.ts
@@ -223,6 +225,7 @@ export const calculateEndpointAuthz = (
canReadPolicyManagement,
canWriteActionsLogManagement,
canReadActionsLogManagement: canReadActionsLogManagement && isEnterpriseLicense,
canAccessEndpointActionsLogManagement: canReadActionsLogManagement && isPlatinumPlusLicense,
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we could name this canAccessEndpointListActionsLog? @paul-tavares.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm ok introducing the additional property, but can we name it consistency with how other are named? So in this case, it would be something like canReadSingleEndpointAcitonLog (notice I also renamed it a bit).

Also, looking at this change, are we saying that Action logs can be seen in Endpoint Details panel if license is Platinum++, but Action Log page is Enterprise?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually - never mind. I think the naming you created is good. I see there is precedence. Sorry for the noise.

@kevinlog
Copy link
Contributor

Checked it out and tried it:

Platinum license is set ✅
image

No access to actions log management ✅
image

Can access actions log from Endpoint details ✅
image

LGTM!

@kibana-ci
Copy link
Collaborator

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 9.7MB 9.7MB +198.0B
Unknown metric groups

ESLint disabled in files

id before after diff
osquery 1 2 +1

ESLint disabled line counts

id before after diff
enterpriseSearch 19 21 +2
fleet 59 65 +6
osquery 109 115 +6
securitySolution 442 449 +7
total +21

References to deprecated APIs

id before after diff
securitySolution 161 163 +2

Total ESLint disabled count

id before after diff
enterpriseSearch 20 22 +2
fleet 67 73 +6
osquery 110 117 +7
securitySolution 519 526 +7
total +22

History

  • 💔 Build #89613 failed f5ecbf1301ccd2a8ab1c54b1c0fae47a9d284729
  • 💔 Build #89604 failed d016de40fffcd64e5f793c3ee32f8d70ada98801

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @ashokaditya

dasansol92
dasansol92 approved these changes Nov 21, 2022
View reviewed changes
Copy link
Contributor

@dasansol92 dasansol92 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

...on/public/management/components/endpoint_response_actions_list/response_actions_log.test.tsx
@@ -138,8 +139,7 @@ jest.mock('../../hooks/response_actions/use_get_file_info', () => {

const mockUseGetEndpointsList = useGetEndpointsList as jest.Mock;

// FLAKY https://github.com/elastic/kibana/issues/145635
describe.skip('Response actions history', () => {
describe('Response actions history', () => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Assuming these tests (and the others below) are not flaky anymore because these changes.

paul-tavares
paul-tavares approved these changes Nov 21, 2022
View reviewed changes
Copy link
Contributor

@paul-tavares paul-tavares left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.
I have some question around the APIs/UI side and the intersection between Enterprise license and Platinum+ but I think our discussion offline helped.

👍

@ashokaditya ashokaditya merged commit 7e5c361 into elastic:main Nov 21, 2022
@ashokaditya ashokaditya deleted the fix/olm-response-actions-history-5489 branch November 21, 2022 15:33
@kibanamachine
Copy link
Contributor

💔 All backports failed

Status Branch Result
❌ 8.6 Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 145837

Questions ?

Please refer to the Backport tool documentation

@ashokaditya ashokaditya mentioned this pull request Nov 21, 2022
Merged
@ashokaditya
Copy link
Member Author

💚 All backports created successfully

Status Branch Result
✅ 8.6

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

ashokaditya added a commit to ashokaditya/kibana that referenced this pull request Nov 21, 2022
@ashokaditya
[Security Solution][Endpoint][Response Actions] Show Actions history …
d361ee7 
…on Endpoint Details for platinum users (elastic#145837)

## Summary

Fixes a bug where response actions history was not shown for platinum
users with Actions Log RBAC privileges.

### Checklist
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### For maintainers

- [x] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

(cherry picked from commit 7e5c361)

# Conflicts:
#	x-pack/plugins/security_solution/public/common/components/user_privileges/endpoint/use_endpoint_privileges.test.ts
#	x-pack/plugins/security_solution/public/management/pages/integration_tests/index.test.tsx
#	x-pack/plugins/security_solution/server/endpoint/routes/actions/list.test.ts
ashokaditya added a commit that referenced this pull request Nov 21, 2022
@ashokaditya
[8.6] [Security Solution][Endpoint][Response Actions] Show Actions hi…
87ac652 
…story on Endpoint Details for platinum users (#145837) (#145890)

# Backport

This will backport the following commits from `main` to `8.6`:
- [[Security Solution][Endpoint][Response Actions] Show Actions history
on Endpoint Details for platinum users
(#145837)](#145837)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT
[{"author":{"name":"Ashokaditya","email":"[email protected]"},"sourceCommit":{"committedDate":"2022-11-21T15:33:03Z","message":"[Security
Solution][Endpoint][Response Actions] Show Actions history on Endpoint
Details for platinum users (#145837)\n\n## Summary\r\n\r\nFixes a bug
where response actions history was not shown for platinum\r\nusers with
Actions Log RBAC privileges.\r\n\r\n### Checklist\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n\r\n### For
maintainers\r\n\r\n- [x] This was checked for breaking API changes and
was
[labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"7e5c361e3820ca9831bc25b6fb50e75a3010b318","branchLabelMapping":{"^v8.7.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["backport","release_note:fix","Team:Onboarding
and Lifecycle Mgt","OLM
Sprint","v8.6.0","v8.7.0"],"number":145837,"url":"https://github.com/elastic/kibana/pull/145837","mergeCommit":{"message":"[Security
Solution][Endpoint][Response Actions] Show Actions history on Endpoint
Details for platinum users (#145837)\n\n## Summary\r\n\r\nFixes a bug
where response actions history was not shown for platinum\r\nusers with
Actions Log RBAC privileges.\r\n\r\n### Checklist\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n\r\n### For
maintainers\r\n\r\n- [x] This was checked for breaking API changes and
was
[labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"7e5c361e3820ca9831bc25b6fb50e75a3010b318"}},"sourceBranch":"main","suggestedTargetBranches":["8.6"],"targetPullRequestStates":[{"branch":"8.6","label":"v8.6.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.7.0","labelRegex":"^v8.7.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/145837","number":145837,"mergeCommit":{"message":"[Security
Solution][Endpoint][Response Actions] Show Actions history on Endpoint
Details for platinum users (#145837)\n\n## Summary\r\n\r\nFixes a bug
where response actions history was not shown for platinum\r\nusers with
Actions Log RBAC privileges.\r\n\r\n### Checklist\r\n- [x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n\r\n### For
maintainers\r\n\r\n- [x] This was checked for breaking API changes and
was
[labeled\r\nappropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"7e5c361e3820ca9831bc25b6fb50e75a3010b318"}}]}]
BACKPORT-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@paul-tavares paul-tavares paul-tavares approved these changes

@kevinlog kevinlog kevinlog approved these changes

@dasansol92 dasansol92 dasansol92 approved these changes

Assignees

@ashokaditya ashokaditya

Labels
backport OLM Sprint release_note:fix Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.6.0 v8.7.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@ashokaditya @elasticmachine @kevinlog @kibana-ci @kibanamachine @dasansol92 @paul-tavares