[Security Solution][Endpoint] Add ability for users to `release` an isolated host in serverless tiers where Response Actions are not available #163616

paul-tavares · 2023-08-10T14:30:52Z

Summary

Fixes the loading of the Host Isolation sub-feature control into kibana - should always be loaded and includes only the release privilege in it
Fixes the "Take action" menu items for Host Isolation (displayed in alert details) to ensure release is displayed when host is isolated and user has release privilege only
Endpoint Response console will now NOT be available to users who only have release response action (this is a downgrade scenario where the user is still allowed to release isolated hosts)

…anAccessResponseConsole`

…feature ids

…less-access-to-isolate-release

paul-tavares · 2023-08-11T12:58:57Z

x-pack/plugins/security_solution/common/endpoint/service/authz/authz.ts

+  // of the response actions with exception of `release`. Sole access to `release` is something
+  // that is supported for a user in a license downgrade scenario, and in that case we don't want
+  // to allow access to Response Console.
+  authz.canAccessResponseConsole =


enables Response Console access if the user has Authz to any response action with the exception of un-isolate. Users that have only permission to unisolate occurs when the Kibana license is downgraded or in serverless when running a non Endpoint Complete tier. It will allow users to continue to release their isolated hosts if any.

Also - this change here will ensure that as we add more response actions, that access to Response console will continue to pick those up and enable this option.

paul-tavares · 2023-08-11T12:59:24Z

.../security_solution/public/detections/components/host_isolation/use_host_isolation_action.tsx

-    ]
-  );
-  return hostIsolationAction;
+    return canIsolateHost || (isHostIsolated && canUnIsolateHost) ? menuItems : [];


This fixes a bug were before it was not showing release in a downgrade scenario.

paul-tavares · 2023-08-11T13:01:15Z

x-pack/plugins/security_solution/server/lib/app_features/security_kibana_sub_features.ts

          id: 'host_isolation_all',
          includeIn: 'none',
          name: 'All',
          savedObject: {
            all: [],
            read: [],
          },
+          // FYI: The current set of values below (`api`, `ui`) cover only `release` response action.


I'm hopping that tidbits of info like this can help along understanding how the framework around loading different privileges into existing Sub-Features

…esting

…ss PLI testing" This reverts commit 58d3121

….essentials (already in base tier)

…less-access-to-isolate-release # Conflicts: # x-pack/test_serverless/functional/test_suites/security/cypress/e2e/endpoint_management/roles/complete_with_endpoint_roles.cy.ts # x-pack/test_serverless/functional/test_suites/security/cypress/e2e/endpoint_management/roles/essentials_with_endpoint.roles.cy.ts

elasticmachine · 2023-08-14T13:40:05Z

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

pzl

well-commented. Thanks for that, there is a good amount of overlap with licenses and privileges and enabled things that make a complex situation here.

pointed out some typos that were in test names only. All the 'unisolate' or 'release' strings in the code were correct. Though maybe we should make them string constants more so there is no chance of typos

pzl · 2023-08-14T14:19:21Z

...unctional/test_suites/security/cypress/e2e/endpoint_management/feature_access/complete.cy.ts

      it(`should not allow access to Response Action: ${actionName}`, () => {
        ensureResponseActionAuthzAccess('none', actionName, username, password);
      });
    }
+
+    it('should have access to `unisoalte` api', () => {


typo: unisolate

pzl · 2023-08-14T14:19:37Z

...ctional/test_suites/security/cypress/e2e/endpoint_management/feature_access/essentials.cy.ts

        ensureResponseActionAuthzAccess('none', actionName, username, password);
      });
    }
+
+    it('should have access to `unisoalte` api', () => {


copy/paste typo

pzl · 2023-08-14T14:19:48Z

...uites/security/cypress/e2e/endpoint_management/feature_access/essentials_with_endpoint.cy.ts

      it(`should not allow access to Response Action: ${actionName}`, () => {
        ensureResponseActionAuthzAccess('none', actionName, username, password);
      });
    }

+    it('should have access to `unisoalte` api', () => {


…less-access-to-isolate-release

ashokaditya · 2023-08-14T16:50:38Z

x-pack/plugins/security_solution/common/endpoint/service/authz/authz.ts

@@ -122,6 +124,20 @@ export const calculateEndpointAuthz = (
    canWriteEventFilters,
    canReadEventFilters,
  };
+
+  // Response console is only accessible when is license is Enterprise and user has access to any
+  // of the response actions with exception of `release`. Sole access to `release` is something


nit: ... with the exception to ...

ashokaditya · 2023-08-14T16:51:39Z

x-pack/plugins/security_solution/common/endpoint/service/authz/authz.ts

@@ -122,6 +124,20 @@ export const calculateEndpointAuthz = (
    canWriteEventFilters,
    canReadEventFilters,
  };
+
+  // Response console is only accessible when is license is Enterprise and user has access to any


nit: ..when license is...

ashokaditya · 2023-08-14T16:51:52Z

x-pack/plugins/security_solution/common/endpoint/service/authz/authz.ts

+
+  // Response console is only accessible when is license is Enterprise and user has access to any
+  // of the response actions with exception of `release`. Sole access to `release` is something
+  // that is supported for a user in a license downgrade scenario, and in that case we don't want


nit: ...in that case, we...

ashokaditya · 2023-08-14T16:58:26Z

x-pack/plugins/security_solution/common/endpoint/service/authz/authz.ts

+    Object.values(omit(RESPONSE_CONSOLE_ACTION_COMMANDS_TO_REQUIRED_AUTHZ, 'release')).some(
+      (responseActionAuthzKey) => {
+        return authz[responseActionAuthzKey];
+      }
+    );


ashokaditya · 2023-08-14T16:59:03Z

.../security_solution/public/detections/components/host_isolation/use_host_isolation_action.tsx

    agentStatus,
    capabilities,
  } = useHostIsolationStatus({
    agentId,
  });

-  const isolationSupported = useMemo(() => {
+  const doesHostSupportIsolation = useMemo(() => {


ashokaditya · 2023-08-14T16:59:52Z

.../security_solution/public/detections/components/host_isolation/use_host_isolation_action.tsx

  const isolateHostHandler = useCallback(() => {
    closePopover();
-    if (isolationStatus === false) {
+    if (isHostIsolated === false) {


nit: !isHostIsolated

…less-access-to-isolate-release

…lease

kevinlog · 2023-08-14T22:55:38Z

@elasticmachine merge upstream

…lease

kevinlog · 2023-08-15T00:04:23Z

@elasticmachine merge upstream

…lease

kibana-ci · 2023-08-15T01:20:56Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 3989f83

Failed CI Steps

Security Solution Cypress Tests #6

Test Failures

[job] [logs] Security Solution Cypress Tests #6 / Custom query rules Custom detection rules deletion and edition Deletion Deletes one rule from detail page Deletes one rule from detail page

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	15.6MB	15.6MB	-3.6KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolutionServerless`	25.4KB	25.4KB	-80.0B

History

💔 Build #150349 failed e759009
💔 Build #150319 failed ecb8f4c
💔 Build #150281 failed 9277f99
💚 Build #150193 succeeded 5ad3ce3
💔 Build #150086 failed 5b21022

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @paul-tavares

…solated host in serverless tiers where Response Actions are not available (#163616) ## Summary - Fixes the loading of the Host Isolation sub-feature control into kibana - should always be loaded and includes only the `release` privilege in it - Fixes the "Take action" menu items for Host Isolation (displayed in alert details) to ensure `release` is displayed when host is isolated and user has `release` privilege only - Endpoint Response console will now NOT be available to users who only have `release` response action (this is a downgrade scenario where the user is still allowed to `release` isolated hosts)

paul-tavares added 3 commits August 9, 2023 09:01

add writeHostIsolationRelease privilege to Endpoint List all

835f427

Update endpoint authz to remove release from the checks done for `c…

fd00892

…anAccessResponseConsole`

Fix bug: Take Action menu does not show Release on downgrade scenarios

cbe5984

paul-tavares added release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.10.0 labels Aug 10, 2023

paul-tavares self-assigned this Aug 10, 2023

paul-tavares added 3 commits August 10, 2023 17:20

Move Host Isolation sub-feature to the Security Solution base set of …

9e0d797

…feature ids

Merge remote-tracking branch 'upstream/main' into task/olm-fix-server…

30a8c09

…less-access-to-isolate-release

add some jsdocs around privileges for isolation

9a88e46

paul-tavares commented Aug 11, 2023

View reviewed changes

paul-tavares added 11 commits August 11, 2023 10:03

Fix tests for Authz

5bfb543

fix cypress tests

983ae60

centralized definition of the valid combinations for serverless PLI t…

58d3121

…esting

Renamed test file + added indexEndpointHosts() task

9f61fac

Serverless cypress tests for endpoint list in security essentials

9b45976

Revert "centralized definition of the valid combinations for serverle…

4b30fb5

…ss PLI testing" This reverts commit 58d3121

fix spelling

842da17

Fix test for endpoint list

f012ad1

remove endpointManagement and policyManagement features from endpoint…

7389212

….essentials (already in base tier)

fix test

dac3c55

paul-tavares marked this pull request as ready for review August 14, 2023 13:40

paul-tavares requested review from a team as code owners August 14, 2023 13:40

paul-tavares requested review from patrykkopycinski and dasansol92 August 14, 2023 13:40

paul-tavares requested review from tomsonpl and removed request for dasansol92 August 14, 2023 13:54

pzl approved these changes Aug 14, 2023

View reviewed changes

paul-tavares added 3 commits August 14, 2023 12:05

fix types

b599f28

Merge remote-tracking branch 'upstream/main' into task/olm-fix-server…

abcfb85

…less-access-to-isolate-release

correct spellings

5ad3ce3

ashokaditya approved these changes Aug 14, 2023

View reviewed changes

paul-tavares added 2 commits August 14, 2023 15:10

small adjustments from code review (ash)

8f1c936

Merge remote-tracking branch 'upstream/main' into task/olm-fix-server…

9277f99

…less-access-to-isolate-release

paul-tavares enabled auto-merge (squash) August 14, 2023 19:11

Merge branch 'main' into task/olm-fix-serverless-access-to-isolate-re…

ecb8f4c

…lease

Merge branch 'main' into task/olm-fix-serverless-access-to-isolate-re…

e759009

…lease

Merge branch 'main' into task/olm-fix-serverless-access-to-isolate-re…

3989f83

…lease

paul-tavares merged commit 8366d5f into elastic:main Aug 15, 2023

kibanamachine added the backport:skip This commit does not require backporting label Aug 15, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Endpoint] Add ability for users to `release` an isolated host in serverless tiers where Response Actions are not available #163616

[Security Solution][Endpoint] Add ability for users to `release` an isolated host in serverless tiers where Response Actions are not available #163616

paul-tavares commented Aug 10, 2023 •

edited

Loading

paul-tavares Aug 11, 2023

paul-tavares Aug 11, 2023

paul-tavares Aug 11, 2023

elasticmachine commented Aug 14, 2023

pzl left a comment

pzl Aug 14, 2023

pzl Aug 14, 2023

pzl Aug 14, 2023

ashokaditya Aug 14, 2023

ashokaditya Aug 14, 2023

ashokaditya Aug 14, 2023

ashokaditya Aug 14, 2023

ashokaditya Aug 14, 2023

ashokaditya Aug 14, 2023

kevinlog commented Aug 14, 2023

kevinlog commented Aug 15, 2023

kibana-ci commented Aug 15, 2023

[Security Solution][Endpoint] Add ability for users to release an isolated host in serverless tiers where Response Actions are not available #163616

[Security Solution][Endpoint] Add ability for users to release an isolated host in serverless tiers where Response Actions are not available #163616

Conversation

paul-tavares commented Aug 10, 2023 • edited Loading

Summary

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Aug 14, 2023

pzl left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kevinlog commented Aug 14, 2023

kevinlog commented Aug 15, 2023

kibana-ci commented Aug 15, 2023

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Async chunks

Page load bundle

History

[Security Solution][Endpoint] Add ability for users to `release` an isolated host in serverless tiers where Response Actions are not available #163616

[Security Solution][Endpoint] Add ability for users to `release` an isolated host in serverless tiers where Response Actions are not available #163616

paul-tavares commented Aug 10, 2023 •

edited

Loading