[Security Solution] File paths for Blocklist Windows and Mac should be case insensitive #164200
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…e case insensitive
kevinlog
added
release_note:fix
Team:Defend Workflows
…-ref HEAD~1..HEAD --fix'
…f github.com:kevinlog/kibana into bug/blocklist-windows-mac-filepaths-case-insensitive
💛 Build succeeded, but was flaky
Failed CI Steps
Test Failures
Metrics [docs]Async chunks
History
To update your PR or re-run it, just comment with: |
|
Pinging @elastic/security-defend-workflows (Team:Defend Workflows) |
parkiino
approved these changes
Aug 21, 2023
kevinlog
deleted the
bug/blocklist-windows-mac-filepaths-case-insensitive
branch
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Aug 21, 2023
…e case insensitive (elastic#164200) ## Summary This fixes a bug where Windows and Mac Blocklist file path entries should be passed as case insensitive. This is because Mac and Windows are caseless for most use cases. Bug ticket: elastic#158581 Here is how it will be displayed in the UI: <img width="1728" alt="image" src="https://github.com/elastic/kibana/assets/56395104/a3006397-f49e-4de0-818d-94e2de20dba3"> Here are the breakdown of the artifacts after the fix: Linux: ``` ------------------------------------------------------------------- Policy: Protect Manifest: 1.0.6 | v1 Artifact: endpoint-blocklist-linux-v1 Relative URL: /api/fleet/artifacts/endpoint-blocklist-linux-v1/f33e6890aeced00861c26a08121dd42d2d29ba08abfeb3c065d0447e32e18640 Encoded SHA256: a907835be40af89b8b7aa23a6efc66c01ceaa5a19622edd378139319f3ca5fa0 Decoded SHA256: f33e6890aeced00861c26a08121dd42d2d29ba08abfeb3c065d0447e32e18640 ------------------------------------------------------------------- { "entries": [ { "type": "simple", "entries": [ { "field": "file.path", "operator": "included", "type": "exact_cased_any", "value": [ "/opt/bin/bin.exe" ] } ] } ] } ``` Mac: ``` ------------------------------------------------------------------- Policy: Protect Manifest: 1.0.6 | v1 Artifact: endpoint-blocklist-macos-v1 Relative URL: /api/fleet/artifacts/endpoint-blocklist-macos-v1/b28e7978da4314ebc2c94770e0638fc4b2270f9dc17a11d6d32b8634b1fbec0f Encoded SHA256: 4f3e80d688f5cae4bf6a88b0704e37909f9fa4f47fe8325b7b154cddd46a2db9 Decoded SHA256: b28e7978da4314ebc2c94770e0638fc4b2270f9dc17a11d6d32b8634b1fbec0f ------------------------------------------------------------------- { "entries": [ { "type": "simple", "entries": [ { "field": "file.path", "operator": "included", "type": "exact_caseless_any", "value": [ "/opt/exe.exe" ] } ] } ``` Windows: ``` ------------------------------------------------------------------- Policy: Protect Manifest: 1.0.6 | v1 Artifact: endpoint-blocklist-windows-v1 Relative URL: /api/fleet/artifacts/endpoint-blocklist-windows-v1/2a6fcc67c696ad4e29d91f8b685bff46977198cd34b9a61e8003d55b78dff6ac Encoded SHA256: c6e045fce97651336eeb400f0123541475b940e3aa38ce721f299585683da288 Decoded SHA256: 2a6fcc67c696ad4e29d91f8b685bff46977198cd34b9a61e8003d55b78dff6ac ------------------------------------------------------------------- { "entries": [ { "type": "simple", "entries": [ { "field": "file.path", "operator": "included", "type": "exact_caseless_any", "value": [ "C:\\path\\path.exe" ] } ] } ] } ``` ### Checklist Delete any items that are not applicable to this PR. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: kibanamachine <[email protected]> (cherry picked from commit 88bd71c)
kibanamachine
added a commit
that referenced
this pull request
Aug 21, 2023
…hould be case insensitive (#164200) (#164317) # Backport This will backport the following commits from `main` to `8.10`: - [[Security Solution] File paths for Blocklist Windows and Mac should be case insensitive (#164200)](#164200) <!--- Backport version: 8.9.7 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Kevin Logan","email":"[email protected]"},"sourceCommit":{"committedDate":"2023-08-21T14:00:53Z","message":"[Security Solution] File paths for Blocklist Windows and Mac should be case insensitive (#164200)\n\n## Summary\r\n\r\nThis fixes a bug where Windows and Mac Blocklist file path entries\r\nshould be passed as case insensitive. This is because Mac and Windows\r\nare caseless for most use cases.\r\n\r\nBug ticket: https://github.com/elastic/kibana/issues/158581\r\n\r\nHere is how it will be displayed in the UI:\r\n<img width=\"1728\" alt=\"image\"\r\nsrc=\"https://github.com/elastic/kibana/assets/56395104/a3006397-f49e-4de0-818d-94e2de20dba3\">\r\n\r\nHere are the breakdown of the artifacts after the fix:\r\n\r\nLinux:\r\n```\r\n-------------------------------------------------------------------\r\nPolicy: Protect\r\nManifest: 1.0.6 | v1\r\nArtifact: endpoint-blocklist-linux-v1\r\n Relative URL: /api/fleet/artifacts/endpoint-blocklist-linux-v1/f33e6890aeced00861c26a08121dd42d2d29ba08abfeb3c065d0447e32e18640\r\n Encoded SHA256: a907835be40af89b8b7aa23a6efc66c01ceaa5a19622edd378139319f3ca5fa0\r\n Decoded SHA256: f33e6890aeced00861c26a08121dd42d2d29ba08abfeb3c065d0447e32e18640\r\n-------------------------------------------------------------------\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"type\": \"simple\",\r\n \"entries\": [\r\n {\r\n \"field\": \"file.path\",\r\n \"operator\": \"included\",\r\n \"type\": \"exact_cased_any\",\r\n \"value\": [\r\n \"/opt/bin/bin.exe\"\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n}\r\n```\r\n\r\nMac:\r\n```\r\n-------------------------------------------------------------------\r\nPolicy: Protect\r\nManifest: 1.0.6 | v1\r\nArtifact: endpoint-blocklist-macos-v1\r\n Relative URL: /api/fleet/artifacts/endpoint-blocklist-macos-v1/b28e7978da4314ebc2c94770e0638fc4b2270f9dc17a11d6d32b8634b1fbec0f\r\n Encoded SHA256: 4f3e80d688f5cae4bf6a88b0704e37909f9fa4f47fe8325b7b154cddd46a2db9\r\n Decoded SHA256: b28e7978da4314ebc2c94770e0638fc4b2270f9dc17a11d6d32b8634b1fbec0f\r\n-------------------------------------------------------------------\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"type\": \"simple\",\r\n \"entries\": [\r\n {\r\n \"field\": \"file.path\",\r\n \"operator\": \"included\",\r\n \"type\": \"exact_caseless_any\",\r\n \"value\": [\r\n \"/opt/exe.exe\"\r\n ]\r\n }\r\n ]\r\n }\r\n```\r\n\r\nWindows:\r\n```\r\n-------------------------------------------------------------------\r\nPolicy: Protect\r\nManifest: 1.0.6 | v1\r\nArtifact: endpoint-blocklist-windows-v1\r\n Relative URL: /api/fleet/artifacts/endpoint-blocklist-windows-v1/2a6fcc67c696ad4e29d91f8b685bff46977198cd34b9a61e8003d55b78dff6ac\r\n Encoded SHA256: c6e045fce97651336eeb400f0123541475b940e3aa38ce721f299585683da288\r\n Decoded SHA256: 2a6fcc67c696ad4e29d91f8b685bff46977198cd34b9a61e8003d55b78dff6ac\r\n-------------------------------------------------------------------\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"type\": \"simple\",\r\n \"entries\": [\r\n {\r\n \"field\": \"file.path\",\r\n \"operator\": \"included\",\r\n \"type\": \"exact_caseless_any\",\r\n \"value\": [\r\n \"C:\\\\path\\\\path.exe\"\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n}\r\n```\r\n\r\n### Checklist\r\n\r\nDelete any items that are not applicable to this PR.\r\n\r\n- [x] Any text added follows [EUI's writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\r\nsentence case text and includes [i18n\r\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine <[email protected]>","sha":"88bd71c0773d158ed1e6312075633ed85abc575e","branchLabelMapping":{"^v8.10.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Defend Workflows","v8.10.0","v8.11.0","v8.9.2"],"number":164200,"url":"https://github.com/elastic/kibana/pull/164200","mergeCommit":{"message":"[Security Solution] File paths for Blocklist Windows and Mac should be case insensitive (#164200)\n\n## Summary\r\n\r\nThis fixes a bug where Windows and Mac Blocklist file path entries\r\nshould be passed as case insensitive. This is because Mac and Windows\r\nare caseless for most use cases.\r\n\r\nBug ticket: https://github.com/elastic/kibana/issues/158581\r\n\r\nHere is how it will be displayed in the UI:\r\n<img width=\"1728\" alt=\"image\"\r\nsrc=\"https://github.com/elastic/kibana/assets/56395104/a3006397-f49e-4de0-818d-94e2de20dba3\">\r\n\r\nHere are the breakdown of the artifacts after the fix:\r\n\r\nLinux:\r\n```\r\n-------------------------------------------------------------------\r\nPolicy: Protect\r\nManifest: 1.0.6 | v1\r\nArtifact: endpoint-blocklist-linux-v1\r\n Relative URL: /api/fleet/artifacts/endpoint-blocklist-linux-v1/f33e6890aeced00861c26a08121dd42d2d29ba08abfeb3c065d0447e32e18640\r\n Encoded SHA256: a907835be40af89b8b7aa23a6efc66c01ceaa5a19622edd378139319f3ca5fa0\r\n Decoded SHA256: f33e6890aeced00861c26a08121dd42d2d29ba08abfeb3c065d0447e32e18640\r\n-------------------------------------------------------------------\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"type\": \"simple\",\r\n \"entries\": [\r\n {\r\n \"field\": \"file.path\",\r\n \"operator\": \"included\",\r\n \"type\": \"exact_cased_any\",\r\n \"value\": [\r\n \"/opt/bin/bin.exe\"\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n}\r\n```\r\n\r\nMac:\r\n```\r\n-------------------------------------------------------------------\r\nPolicy: Protect\r\nManifest: 1.0.6 | v1\r\nArtifact: endpoint-blocklist-macos-v1\r\n Relative URL: /api/fleet/artifacts/endpoint-blocklist-macos-v1/b28e7978da4314ebc2c94770e0638fc4b2270f9dc17a11d6d32b8634b1fbec0f\r\n Encoded SHA256: 4f3e80d688f5cae4bf6a88b0704e37909f9fa4f47fe8325b7b154cddd46a2db9\r\n Decoded SHA256: b28e7978da4314ebc2c94770e0638fc4b2270f9dc17a11d6d32b8634b1fbec0f\r\n-------------------------------------------------------------------\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"type\": \"simple\",\r\n \"entries\": [\r\n {\r\n \"field\": \"file.path\",\r\n \"operator\": \"included\",\r\n \"type\": \"exact_caseless_any\",\r\n \"value\": [\r\n \"/opt/exe.exe\"\r\n ]\r\n }\r\n ]\r\n }\r\n```\r\n\r\nWindows:\r\n```\r\n-------------------------------------------------------------------\r\nPolicy: Protect\r\nManifest: 1.0.6 | v1\r\nArtifact: endpoint-blocklist-windows-v1\r\n Relative URL: /api/fleet/artifacts/endpoint-blocklist-windows-v1/2a6fcc67c696ad4e29d91f8b685bff46977198cd34b9a61e8003d55b78dff6ac\r\n Encoded SHA256: c6e045fce97651336eeb400f0123541475b940e3aa38ce721f299585683da288\r\n Decoded SHA256: 2a6fcc67c696ad4e29d91f8b685bff46977198cd34b9a61e8003d55b78dff6ac\r\n-------------------------------------------------------------------\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"type\": \"simple\",\r\n \"entries\": [\r\n {\r\n \"field\": \"file.path\",\r\n \"operator\": \"included\",\r\n \"type\": \"exact_caseless_any\",\r\n \"value\": [\r\n \"C:\\\\path\\\\path.exe\"\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n}\r\n```\r\n\r\n### Checklist\r\n\r\nDelete any items that are not applicable to this PR.\r\n\r\n- [x] Any text added follows [EUI's writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\r\nsentence case text and includes [i18n\r\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine <[email protected]>","sha":"88bd71c0773d158ed1e6312075633ed85abc575e"}},"sourceBranch":"main","suggestedTargetBranches":["8.11","8.9"],"targetPullRequestStates":[{"branch":"main","label":"v8.10.0","labelRegex":"^v8.10.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/164200","number":164200,"mergeCommit":{"message":"[Security Solution] File paths for Blocklist Windows and Mac should be case insensitive (#164200)\n\n## Summary\r\n\r\nThis fixes a bug where Windows and Mac Blocklist file path entries\r\nshould be passed as case insensitive. This is because Mac and Windows\r\nare caseless for most use cases.\r\n\r\nBug ticket: https://github.com/elastic/kibana/issues/158581\r\n\r\nHere is how it will be displayed in the UI:\r\n<img width=\"1728\" alt=\"image\"\r\nsrc=\"https://github.com/elastic/kibana/assets/56395104/a3006397-f49e-4de0-818d-94e2de20dba3\">\r\n\r\nHere are the breakdown of the artifacts after the fix:\r\n\r\nLinux:\r\n```\r\n-------------------------------------------------------------------\r\nPolicy: Protect\r\nManifest: 1.0.6 | v1\r\nArtifact: endpoint-blocklist-linux-v1\r\n Relative URL: /api/fleet/artifacts/endpoint-blocklist-linux-v1/f33e6890aeced00861c26a08121dd42d2d29ba08abfeb3c065d0447e32e18640\r\n Encoded SHA256: a907835be40af89b8b7aa23a6efc66c01ceaa5a19622edd378139319f3ca5fa0\r\n Decoded SHA256: f33e6890aeced00861c26a08121dd42d2d29ba08abfeb3c065d0447e32e18640\r\n-------------------------------------------------------------------\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"type\": \"simple\",\r\n \"entries\": [\r\n {\r\n \"field\": \"file.path\",\r\n \"operator\": \"included\",\r\n \"type\": \"exact_cased_any\",\r\n \"value\": [\r\n \"/opt/bin/bin.exe\"\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n}\r\n```\r\n\r\nMac:\r\n```\r\n-------------------------------------------------------------------\r\nPolicy: Protect\r\nManifest: 1.0.6 | v1\r\nArtifact: endpoint-blocklist-macos-v1\r\n Relative URL: /api/fleet/artifacts/endpoint-blocklist-macos-v1/b28e7978da4314ebc2c94770e0638fc4b2270f9dc17a11d6d32b8634b1fbec0f\r\n Encoded SHA256: 4f3e80d688f5cae4bf6a88b0704e37909f9fa4f47fe8325b7b154cddd46a2db9\r\n Decoded SHA256: b28e7978da4314ebc2c94770e0638fc4b2270f9dc17a11d6d32b8634b1fbec0f\r\n-------------------------------------------------------------------\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"type\": \"simple\",\r\n \"entries\": [\r\n {\r\n \"field\": \"file.path\",\r\n \"operator\": \"included\",\r\n \"type\": \"exact_caseless_any\",\r\n \"value\": [\r\n \"/opt/exe.exe\"\r\n ]\r\n }\r\n ]\r\n }\r\n```\r\n\r\nWindows:\r\n```\r\n-------------------------------------------------------------------\r\nPolicy: Protect\r\nManifest: 1.0.6 | v1\r\nArtifact: endpoint-blocklist-windows-v1\r\n Relative URL: /api/fleet/artifacts/endpoint-blocklist-windows-v1/2a6fcc67c696ad4e29d91f8b685bff46977198cd34b9a61e8003d55b78dff6ac\r\n Encoded SHA256: c6e045fce97651336eeb400f0123541475b940e3aa38ce721f299585683da288\r\n Decoded SHA256: 2a6fcc67c696ad4e29d91f8b685bff46977198cd34b9a61e8003d55b78dff6ac\r\n-------------------------------------------------------------------\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"type\": \"simple\",\r\n \"entries\": [\r\n {\r\n \"field\": \"file.path\",\r\n \"operator\": \"included\",\r\n \"type\": \"exact_caseless_any\",\r\n \"value\": [\r\n \"C:\\\\path\\\\path.exe\"\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n}\r\n```\r\n\r\n### Checklist\r\n\r\nDelete any items that are not applicable to this PR.\r\n\r\n- [x] Any text added follows [EUI's writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\r\nsentence case text and includes [i18n\r\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine <[email protected]>","sha":"88bd71c0773d158ed1e6312075633ed85abc575e"}},{"branch":"8.11","label":"v8.11.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.9","label":"v8.9.2","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Kevin Logan <[email protected]>
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Aug 21, 2023
…e case insensitive (elastic#164200) ## Summary This fixes a bug where Windows and Mac Blocklist file path entries should be passed as case insensitive. This is because Mac and Windows are caseless for most use cases. Bug ticket: elastic#158581 Here is how it will be displayed in the UI: <img width="1728" alt="image" src="https://github.com/elastic/kibana/assets/56395104/a3006397-f49e-4de0-818d-94e2de20dba3"> Here are the breakdown of the artifacts after the fix: Linux: ``` ------------------------------------------------------------------- Policy: Protect Manifest: 1.0.6 | v1 Artifact: endpoint-blocklist-linux-v1 Relative URL: /api/fleet/artifacts/endpoint-blocklist-linux-v1/f33e6890aeced00861c26a08121dd42d2d29ba08abfeb3c065d0447e32e18640 Encoded SHA256: a907835be40af89b8b7aa23a6efc66c01ceaa5a19622edd378139319f3ca5fa0 Decoded SHA256: f33e6890aeced00861c26a08121dd42d2d29ba08abfeb3c065d0447e32e18640 ------------------------------------------------------------------- { "entries": [ { "type": "simple", "entries": [ { "field": "file.path", "operator": "included", "type": "exact_cased_any", "value": [ "/opt/bin/bin.exe" ] } ] } ] } ``` Mac: ``` ------------------------------------------------------------------- Policy: Protect Manifest: 1.0.6 | v1 Artifact: endpoint-blocklist-macos-v1 Relative URL: /api/fleet/artifacts/endpoint-blocklist-macos-v1/b28e7978da4314ebc2c94770e0638fc4b2270f9dc17a11d6d32b8634b1fbec0f Encoded SHA256: 4f3e80d688f5cae4bf6a88b0704e37909f9fa4f47fe8325b7b154cddd46a2db9 Decoded SHA256: b28e7978da4314ebc2c94770e0638fc4b2270f9dc17a11d6d32b8634b1fbec0f ------------------------------------------------------------------- { "entries": [ { "type": "simple", "entries": [ { "field": "file.path", "operator": "included", "type": "exact_caseless_any", "value": [ "/opt/exe.exe" ] } ] } ``` Windows: ``` ------------------------------------------------------------------- Policy: Protect Manifest: 1.0.6 | v1 Artifact: endpoint-blocklist-windows-v1 Relative URL: /api/fleet/artifacts/endpoint-blocklist-windows-v1/2a6fcc67c696ad4e29d91f8b685bff46977198cd34b9a61e8003d55b78dff6ac Encoded SHA256: c6e045fce97651336eeb400f0123541475b940e3aa38ce721f299585683da288 Decoded SHA256: 2a6fcc67c696ad4e29d91f8b685bff46977198cd34b9a61e8003d55b78dff6ac ------------------------------------------------------------------- { "entries": [ { "type": "simple", "entries": [ { "field": "file.path", "operator": "included", "type": "exact_caseless_any", "value": [ "C:\\path\\path.exe" ] } ] } ] } ``` ### Checklist Delete any items that are not applicable to this PR. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios --------- Co-authored-by: kibanamachine <[email protected]> (cherry picked from commit 88bd71c)
💚 All backports created successfully
Note: Successful backport PRs will be merged automatically after passing CI. Questions ?Please refer to the Backport tool documentation |
kibanamachine
added a commit
that referenced
this pull request
Aug 22, 2023
…ould be case insensitive (#164200) (#164319) # Backport This will backport the following commits from `main` to `8.9`: - [[Security Solution] File paths for Blocklist Windows and Mac should be case insensitive (#164200)](#164200) <!--- Backport version: 8.9.7 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Kevin Logan","email":"[email protected]"},"sourceCommit":{"committedDate":"2023-08-21T14:00:53Z","message":"[Security Solution] File paths for Blocklist Windows and Mac should be case insensitive (#164200)\n\n## Summary\r\n\r\nThis fixes a bug where Windows and Mac Blocklist file path entries\r\nshould be passed as case insensitive. This is because Mac and Windows\r\nare caseless for most use cases.\r\n\r\nBug ticket: https://github.com/elastic/kibana/issues/158581\r\n\r\nHere is how it will be displayed in the UI:\r\n<img width=\"1728\" alt=\"image\"\r\nsrc=\"https://github.com/elastic/kibana/assets/56395104/a3006397-f49e-4de0-818d-94e2de20dba3\">\r\n\r\nHere are the breakdown of the artifacts after the fix:\r\n\r\nLinux:\r\n```\r\n-------------------------------------------------------------------\r\nPolicy: Protect\r\nManifest: 1.0.6 | v1\r\nArtifact: endpoint-blocklist-linux-v1\r\n Relative URL: /api/fleet/artifacts/endpoint-blocklist-linux-v1/f33e6890aeced00861c26a08121dd42d2d29ba08abfeb3c065d0447e32e18640\r\n Encoded SHA256: a907835be40af89b8b7aa23a6efc66c01ceaa5a19622edd378139319f3ca5fa0\r\n Decoded SHA256: f33e6890aeced00861c26a08121dd42d2d29ba08abfeb3c065d0447e32e18640\r\n-------------------------------------------------------------------\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"type\": \"simple\",\r\n \"entries\": [\r\n {\r\n \"field\": \"file.path\",\r\n \"operator\": \"included\",\r\n \"type\": \"exact_cased_any\",\r\n \"value\": [\r\n \"/opt/bin/bin.exe\"\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n}\r\n```\r\n\r\nMac:\r\n```\r\n-------------------------------------------------------------------\r\nPolicy: Protect\r\nManifest: 1.0.6 | v1\r\nArtifact: endpoint-blocklist-macos-v1\r\n Relative URL: /api/fleet/artifacts/endpoint-blocklist-macos-v1/b28e7978da4314ebc2c94770e0638fc4b2270f9dc17a11d6d32b8634b1fbec0f\r\n Encoded SHA256: 4f3e80d688f5cae4bf6a88b0704e37909f9fa4f47fe8325b7b154cddd46a2db9\r\n Decoded SHA256: b28e7978da4314ebc2c94770e0638fc4b2270f9dc17a11d6d32b8634b1fbec0f\r\n-------------------------------------------------------------------\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"type\": \"simple\",\r\n \"entries\": [\r\n {\r\n \"field\": \"file.path\",\r\n \"operator\": \"included\",\r\n \"type\": \"exact_caseless_any\",\r\n \"value\": [\r\n \"/opt/exe.exe\"\r\n ]\r\n }\r\n ]\r\n }\r\n```\r\n\r\nWindows:\r\n```\r\n-------------------------------------------------------------------\r\nPolicy: Protect\r\nManifest: 1.0.6 | v1\r\nArtifact: endpoint-blocklist-windows-v1\r\n Relative URL: /api/fleet/artifacts/endpoint-blocklist-windows-v1/2a6fcc67c696ad4e29d91f8b685bff46977198cd34b9a61e8003d55b78dff6ac\r\n Encoded SHA256: c6e045fce97651336eeb400f0123541475b940e3aa38ce721f299585683da288\r\n Decoded SHA256: 2a6fcc67c696ad4e29d91f8b685bff46977198cd34b9a61e8003d55b78dff6ac\r\n-------------------------------------------------------------------\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"type\": \"simple\",\r\n \"entries\": [\r\n {\r\n \"field\": \"file.path\",\r\n \"operator\": \"included\",\r\n \"type\": \"exact_caseless_any\",\r\n \"value\": [\r\n \"C:\\\\path\\\\path.exe\"\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n}\r\n```\r\n\r\n### Checklist\r\n\r\nDelete any items that are not applicable to this PR.\r\n\r\n- [x] Any text added follows [EUI's writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\r\nsentence case text and includes [i18n\r\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine <[email protected]>","sha":"88bd71c0773d158ed1e6312075633ed85abc575e","branchLabelMapping":{"^v8.10.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","Team:Defend Workflows","v8.10.0","v8.11.0","v8.9.2"],"number":164200,"url":"https://github.com/elastic/kibana/pull/164200","mergeCommit":{"message":"[Security Solution] File paths for Blocklist Windows and Mac should be case insensitive (#164200)\n\n## Summary\r\n\r\nThis fixes a bug where Windows and Mac Blocklist file path entries\r\nshould be passed as case insensitive. This is because Mac and Windows\r\nare caseless for most use cases.\r\n\r\nBug ticket: https://github.com/elastic/kibana/issues/158581\r\n\r\nHere is how it will be displayed in the UI:\r\n<img width=\"1728\" alt=\"image\"\r\nsrc=\"https://github.com/elastic/kibana/assets/56395104/a3006397-f49e-4de0-818d-94e2de20dba3\">\r\n\r\nHere are the breakdown of the artifacts after the fix:\r\n\r\nLinux:\r\n```\r\n-------------------------------------------------------------------\r\nPolicy: Protect\r\nManifest: 1.0.6 | v1\r\nArtifact: endpoint-blocklist-linux-v1\r\n Relative URL: /api/fleet/artifacts/endpoint-blocklist-linux-v1/f33e6890aeced00861c26a08121dd42d2d29ba08abfeb3c065d0447e32e18640\r\n Encoded SHA256: a907835be40af89b8b7aa23a6efc66c01ceaa5a19622edd378139319f3ca5fa0\r\n Decoded SHA256: f33e6890aeced00861c26a08121dd42d2d29ba08abfeb3c065d0447e32e18640\r\n-------------------------------------------------------------------\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"type\": \"simple\",\r\n \"entries\": [\r\n {\r\n \"field\": \"file.path\",\r\n \"operator\": \"included\",\r\n \"type\": \"exact_cased_any\",\r\n \"value\": [\r\n \"/opt/bin/bin.exe\"\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n}\r\n```\r\n\r\nMac:\r\n```\r\n-------------------------------------------------------------------\r\nPolicy: Protect\r\nManifest: 1.0.6 | v1\r\nArtifact: endpoint-blocklist-macos-v1\r\n Relative URL: /api/fleet/artifacts/endpoint-blocklist-macos-v1/b28e7978da4314ebc2c94770e0638fc4b2270f9dc17a11d6d32b8634b1fbec0f\r\n Encoded SHA256: 4f3e80d688f5cae4bf6a88b0704e37909f9fa4f47fe8325b7b154cddd46a2db9\r\n Decoded SHA256: b28e7978da4314ebc2c94770e0638fc4b2270f9dc17a11d6d32b8634b1fbec0f\r\n-------------------------------------------------------------------\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"type\": \"simple\",\r\n \"entries\": [\r\n {\r\n \"field\": \"file.path\",\r\n \"operator\": \"included\",\r\n \"type\": \"exact_caseless_any\",\r\n \"value\": [\r\n \"/opt/exe.exe\"\r\n ]\r\n }\r\n ]\r\n }\r\n```\r\n\r\nWindows:\r\n```\r\n-------------------------------------------------------------------\r\nPolicy: Protect\r\nManifest: 1.0.6 | v1\r\nArtifact: endpoint-blocklist-windows-v1\r\n Relative URL: /api/fleet/artifacts/endpoint-blocklist-windows-v1/2a6fcc67c696ad4e29d91f8b685bff46977198cd34b9a61e8003d55b78dff6ac\r\n Encoded SHA256: c6e045fce97651336eeb400f0123541475b940e3aa38ce721f299585683da288\r\n Decoded SHA256: 2a6fcc67c696ad4e29d91f8b685bff46977198cd34b9a61e8003d55b78dff6ac\r\n-------------------------------------------------------------------\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"type\": \"simple\",\r\n \"entries\": [\r\n {\r\n \"field\": \"file.path\",\r\n \"operator\": \"included\",\r\n \"type\": \"exact_caseless_any\",\r\n \"value\": [\r\n \"C:\\\\path\\\\path.exe\"\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n}\r\n```\r\n\r\n### Checklist\r\n\r\nDelete any items that are not applicable to this PR.\r\n\r\n- [x] Any text added follows [EUI's writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\r\nsentence case text and includes [i18n\r\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine <[email protected]>","sha":"88bd71c0773d158ed1e6312075633ed85abc575e"}},"sourceBranch":"main","suggestedTargetBranches":["8.11","8.9"],"targetPullRequestStates":[{"branch":"main","label":"v8.10.0","labelRegex":"^v8.10.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/164200","number":164200,"mergeCommit":{"message":"[Security Solution] File paths for Blocklist Windows and Mac should be case insensitive (#164200)\n\n## Summary\r\n\r\nThis fixes a bug where Windows and Mac Blocklist file path entries\r\nshould be passed as case insensitive. This is because Mac and Windows\r\nare caseless for most use cases.\r\n\r\nBug ticket: https://github.com/elastic/kibana/issues/158581\r\n\r\nHere is how it will be displayed in the UI:\r\n<img width=\"1728\" alt=\"image\"\r\nsrc=\"https://github.com/elastic/kibana/assets/56395104/a3006397-f49e-4de0-818d-94e2de20dba3\">\r\n\r\nHere are the breakdown of the artifacts after the fix:\r\n\r\nLinux:\r\n```\r\n-------------------------------------------------------------------\r\nPolicy: Protect\r\nManifest: 1.0.6 | v1\r\nArtifact: endpoint-blocklist-linux-v1\r\n Relative URL: /api/fleet/artifacts/endpoint-blocklist-linux-v1/f33e6890aeced00861c26a08121dd42d2d29ba08abfeb3c065d0447e32e18640\r\n Encoded SHA256: a907835be40af89b8b7aa23a6efc66c01ceaa5a19622edd378139319f3ca5fa0\r\n Decoded SHA256: f33e6890aeced00861c26a08121dd42d2d29ba08abfeb3c065d0447e32e18640\r\n-------------------------------------------------------------------\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"type\": \"simple\",\r\n \"entries\": [\r\n {\r\n \"field\": \"file.path\",\r\n \"operator\": \"included\",\r\n \"type\": \"exact_cased_any\",\r\n \"value\": [\r\n \"/opt/bin/bin.exe\"\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n}\r\n```\r\n\r\nMac:\r\n```\r\n-------------------------------------------------------------------\r\nPolicy: Protect\r\nManifest: 1.0.6 | v1\r\nArtifact: endpoint-blocklist-macos-v1\r\n Relative URL: /api/fleet/artifacts/endpoint-blocklist-macos-v1/b28e7978da4314ebc2c94770e0638fc4b2270f9dc17a11d6d32b8634b1fbec0f\r\n Encoded SHA256: 4f3e80d688f5cae4bf6a88b0704e37909f9fa4f47fe8325b7b154cddd46a2db9\r\n Decoded SHA256: b28e7978da4314ebc2c94770e0638fc4b2270f9dc17a11d6d32b8634b1fbec0f\r\n-------------------------------------------------------------------\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"type\": \"simple\",\r\n \"entries\": [\r\n {\r\n \"field\": \"file.path\",\r\n \"operator\": \"included\",\r\n \"type\": \"exact_caseless_any\",\r\n \"value\": [\r\n \"/opt/exe.exe\"\r\n ]\r\n }\r\n ]\r\n }\r\n```\r\n\r\nWindows:\r\n```\r\n-------------------------------------------------------------------\r\nPolicy: Protect\r\nManifest: 1.0.6 | v1\r\nArtifact: endpoint-blocklist-windows-v1\r\n Relative URL: /api/fleet/artifacts/endpoint-blocklist-windows-v1/2a6fcc67c696ad4e29d91f8b685bff46977198cd34b9a61e8003d55b78dff6ac\r\n Encoded SHA256: c6e045fce97651336eeb400f0123541475b940e3aa38ce721f299585683da288\r\n Decoded SHA256: 2a6fcc67c696ad4e29d91f8b685bff46977198cd34b9a61e8003d55b78dff6ac\r\n-------------------------------------------------------------------\r\n\r\n{\r\n \"entries\": [\r\n {\r\n \"type\": \"simple\",\r\n \"entries\": [\r\n {\r\n \"field\": \"file.path\",\r\n \"operator\": \"included\",\r\n \"type\": \"exact_caseless_any\",\r\n \"value\": [\r\n \"C:\\\\path\\\\path.exe\"\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n}\r\n```\r\n\r\n### Checklist\r\n\r\nDelete any items that are not applicable to this PR.\r\n\r\n- [x] Any text added follows [EUI's writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\r\nsentence case text and includes [i18n\r\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\r\n- [x] [Unit or functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere updated or added to match the most common scenarios\r\n\r\n---------\r\n\r\nCo-authored-by: kibanamachine <[email protected]>","sha":"88bd71c0773d158ed1e6312075633ed85abc575e"}},{"branch":"8.11","label":"v8.11.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.9","label":"v8.9.2","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> --------- Co-authored-by: Kevin Logan <[email protected]> Co-authored-by: Kevin Logan <[email protected]>
This was referenced Oct 1, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This fixes a bug where Windows and Mac Blocklist file path entries should be passed as case insensitive. This is because Mac and Windows are caseless for most use cases.
Bug ticket: #158581
Here is how it will be displayed in the UI:
Here are the breakdown of the artifacts after the fix:
Linux:
Mac:
Windows:
Checklist
Delete any items that are not applicable to this PR.