[Security Solution][Endpoint] Allow wildcard in trusted app paths

x-pack/plugins/lists/common/schemas/common/schemas.test.ts

@@ -53,6 +53,15 @@ describe('Common schemas', () => {
       expect(message.schema).toEqual(payload);
     });
 
+    test('it should validate for "wildcard_caseless"', () => {
+      const payload = 'wildcard_caseless';
+      const decoded = operator.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(payload);
+    });
+
     test('it should contain same amount of keys as enum', () => {
       // Might seem like a weird test, but its meant to
       // ensure that if operator is updated, you

x-pack/plugins/lists/common/schemas/common/schemas.ts

@@ -276,11 +276,12 @@ export type CursorOrUndefined = t.TypeOf<typeof cursorOrUndefined>;
 export const namespace_type = DefaultNamespace;
 
 export const operatorIncluded = t.keyof({ included: null });
-export const operator = t.keyof({ excluded: null, included: null });
+export const operator = t.keyof({ excluded: null, included: null, wildcard_caseless: null });
 export type Operator = t.TypeOf<typeof operator>;
 export enum OperatorEnum {
   INCLUDED = 'included',
   EXCLUDED = 'excluded',
+  WILDCARD_CASELESS = 'wildcard_caseless',
 }
 
 export enum OperatorTypeEnum {

x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.test.ts

@@ -247,6 +247,30 @@ describe('When invoking Trusted Apps Schema', () => {
         expect(() => body.validate(bodyMsg)).not.toThrow();
       });
 
+      it('should validate `entry.operator` does not accept `wildcard_caseless` when field is NOT PATH', () => {
+        const bodyMsg = createNewTrustedApp({
+          entries: [
+            createConditionEntry({
+              field: ConditionEntryField.HASH,
+              operator: 'wildcard_caseless',
+            }),
+          ],
+        });
+        expect(() => body.validate(bodyMsg)).toThrow();
+      });
+
+      it('should validate `entry.operator` accepts `wildcard_caseless` when field is PATH', () => {
+        const bodyMsg = createNewTrustedApp({
+          entries: [
+            createConditionEntry({
+              field: ConditionEntryField.PATH,
+              operator: 'wildcard_caseless',
+            }),
+          ],
+        });
+        expect(() => body.validate(bodyMsg)).not.toThrow();
+      });
+
       it('should validate `entry.value` required', () => {
         const { value, ...entry } = createConditionEntry();
         expect(() => body.validate(createNewTrustedApp({ entries: [entry] }))).toThrow();

x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.ts

@@ -6,7 +6,7 @@
  */
 
 import { schema } from '@kbn/config-schema';
-import { ConditionEntry, ConditionEntryField, OperatingSystem } from '../types';
+import { ConditionEntry, ConditionEntryField, OperatingSystem, OperatorEntryField } from '../types';
 import { getDuplicateFields, isValidHash } from '../service/trusted_apps/validations';
 
 export const DeleteTrustedAppsRequestSchema = {
@@ -30,7 +30,16 @@ export const GetTrustedAppsRequestSchema = {
 };
 
 const ConditionEntryTypeSchema = schema.literal('match');
-const ConditionEntryOperatorSchema = schema.literal('included');
+// when field === PATH -> operator in ('included', 'wildcard_caseless') else operator === 'included'
+const ConditionEntryOperatorSchema = schema.conditional(
+  schema.siblingRef('field'),
+  ConditionEntryField.PATH,
+  schema.oneOf([
+    schema.literal(OperatorEntryField.included),
+    schema.literal(OperatorEntryField.wildcard_caseless),
+  ]),
+  schema.literal(OperatorEntryField.included)
+);
 
 /*
  * A generic Entry schema to be used for a specific entry schema depending on the OS

x-pack/plugins/security_solution/common/endpoint/types/trusted_apps.ts

@@ -69,10 +69,14 @@ export enum ConditionEntryField {
   SIGNER = 'process.Ext.code_signature',
 }
 
+export enum OperatorEntryField {
+  included = 'included',
+  wildcard_caseless = 'wildcard_caseless',
+}
 export interface ConditionEntry<T extends ConditionEntryField = ConditionEntryField> {
   field: T;
   type: 'match';
-  operator: 'included';
+  operator: keyof typeof OperatorEntryField;
   value: string;
 }
 

x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/condition_entry_input/index.test.tsx

@@ -21,7 +21,7 @@ let onRemoveMock: jest.Mock;
 let onChangeMock: jest.Mock;
 let onVisitedMock: jest.Mock;
 
-const entry: Readonly<ConditionEntry> = {
+const baseEntry: Readonly<ConditionEntry> = {
   field: ConditionEntryField.HASH,
   type: 'match',
   operator: 'included',
@@ -38,7 +38,8 @@ describe('Condition entry input', () => {
   const getElement = (
     subject: string,
     os: OperatingSystem = OperatingSystem.WINDOWS,
-    isRemoveDisabled: boolean = false
+    isRemoveDisabled: boolean = false,
+    entry: ConditionEntry = baseEntry
   ) => (
     <ConditionEntryInput
       os={os}
@@ -64,10 +65,10 @@ describe('Condition entry input', () => {
       expect(onChangeMock).toHaveBeenCalledTimes(1);
       expect(onChangeMock).toHaveBeenCalledWith(
         {
-          ...entry,
+          ...baseEntry,
           field: { target: { value: field } },
         },
-        entry
+        baseEntry
       );
     }
   );
@@ -77,7 +78,7 @@ describe('Condition entry input', () => {
     expect(onRemoveMock).toHaveBeenCalledTimes(0);
     element.find('[data-test-subj="testOnRemove-remove"]').first().simulate('click');
     expect(onRemoveMock).toHaveBeenCalledTimes(1);
-    expect(onRemoveMock).toHaveBeenCalledWith(entry);
+    expect(onRemoveMock).toHaveBeenCalledWith(baseEntry);
   });
 
   it('should not be able to call on remove for field input because disabled', () => {
@@ -92,7 +93,7 @@ describe('Condition entry input', () => {
     expect(onVisitedMock).toHaveBeenCalledTimes(0);
     element.find('[data-test-subj="testOnVisited-value"]').first().simulate('blur');
     expect(onVisitedMock).toHaveBeenCalledTimes(1);
-    expect(onVisitedMock).toHaveBeenCalledWith(entry);
+    expect(onVisitedMock).toHaveBeenCalledWith(baseEntry);
   });
 
   it('should change value for field input', () => {
@@ -105,10 +106,10 @@ describe('Condition entry input', () => {
     expect(onChangeMock).toHaveBeenCalledTimes(1);
     expect(onChangeMock).toHaveBeenCalledWith(
       {
-        ...entry,
+        ...baseEntry,
         value: 'new value',
       },
-      entry
+      baseEntry
     );
   });
 
@@ -138,4 +139,24 @@ describe('Condition entry input', () => {
       .props() as EuiSuperSelectProps<string>;
     expect(superSelectProps.options.length).toBe(2);
   });
+
+  it('should have operator value selected when field is HASH', () => {
+    const element = shallow(getElement('testOperatorOptions'));
+    const inputField = element.find('[data-test-subj="testOperatorOptions-operator"]');
+    expect(inputField.contains('is'));
+  });
+
+  it('should show operator dorpdown with two values when field is PATH', () => {
+    const element = shallow(
+      getElement('testOperatorOptions', undefined, undefined, {
+        ...baseEntry,
+        field: ConditionEntryField.PATH,
+      })
+    );
+    const superSelectProps = element
+      .find('[data-test-subj="testOperatorOptions-operator"]')
+      .first()
+      .props() as EuiSuperSelectProps<string>;
+    expect(superSelectProps.options.length).toBe(2);
+  });
 });

x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/condition_entry_input/index.tsx

@@ -6,6 +6,7 @@
  */
 
 import React, { ChangeEventHandler, memo, useCallback, useMemo } from 'react';
+import styled from 'styled-components';
 import { i18n } from '@kbn/i18n';
 import {
   EuiButtonIcon,
@@ -21,14 +22,15 @@ import {
 import {
   ConditionEntry,
   ConditionEntryField,
+  OperatorEntryField,
   OperatingSystem,
 } from '../../../../../../../common/endpoint/types';
 
 import {
   CONDITION_FIELD_DESCRIPTION,
   CONDITION_FIELD_TITLE,
   ENTRY_PROPERTY_TITLES,
-  OPERATOR_TITLE,
+  OPERATOR_TITLES,
 } from '../../translations';
 
 const ConditionEntryCell = memo<{
@@ -65,6 +67,14 @@ export interface ConditionEntryInputProps {
   'data-test-subj'?: string;
 }
 
+// adding a style prop on EuiFlexGroup works only partially
+// and for some odd reason garbles up gridTemplateAreas entry
+const StyledEuiFlexGroup = styled(EuiFlexGroup)`
+  display: grid;
+  grid-template-columns: 25% 25% 45% 5%;
+  grid-template-areas: 'field operator value remove';
+`;
+
 export const ConditionEntryInput = memo<ConditionEntryInputProps>(
   ({
     os,
@@ -113,6 +123,16 @@ export const ConditionEntryInput = memo<ConditionEntryInputProps>(
       ];
     }, [os]);
 
+    // use a memoized callback to
+    // limit list iteration for re-renders
+    const operatorOptions = useMemo<Array<EuiSuperSelectOption<string>>>(() => {
+      return (Object.keys(OperatorEntryField) as [ConditionEntry['operator']]).map((value) => ({
+        dropdownDisplay: OPERATOR_TITLES[value],
+        inputDisplay: OPERATOR_TITLES[value],
+        value,
+      }));
+    }, []);
+
     const handleValueUpdate = useCallback<ChangeEventHandler<HTMLInputElement>>(
       (ev) => onChange({ ...entry, value: ev.target.value }, entry),
       [entry, onChange]
@@ -123,6 +143,11 @@ export const ConditionEntryInput = memo<ConditionEntryInputProps>(
       [entry, onChange]
     );
 
+    const handleOperatorUpdate = useCallback(
+      (newOperator) => onChange({ ...entry, operator: newOperator }, entry),
+      [entry, onChange]
+    );
+
     const handleRemoveClick = useCallback(() => onRemove(entry), [entry, onRemove]);
 
     const handleValueOnBlur = useCallback(() => {
@@ -132,14 +157,14 @@ export const ConditionEntryInput = memo<ConditionEntryInputProps>(
     }, [entry, onVisited]);
 
     return (
-      <EuiFlexGroup
+      <StyledEuiFlexGroup
         gutterSize="s"
         alignItems="center"
         direction="row"
         data-test-subj={dataTestSubj}
         responsive={false}
       >
-        <EuiFlexItem grow={2}>
+        <EuiFlexItem style={{ gridArea: 'field' }}>
           <ConditionEntryCell showLabel={showLabels} label={ENTRY_PROPERTY_TITLES.field}>
             <EuiSuperSelect
               options={fieldOptions}
@@ -149,12 +174,26 @@ export const ConditionEntryInput = memo<ConditionEntryInputProps>(
             />
           </ConditionEntryCell>
         </EuiFlexItem>
-        <EuiFlexItem>
+        <EuiFlexItem style={{ gridArea: 'operator' }}>
           <ConditionEntryCell showLabel={showLabels} label={ENTRY_PROPERTY_TITLES.operator}>
-            <EuiFieldText name="operator" value={OPERATOR_TITLE.included} readOnly />
+            {entry.field === ConditionEntryField.PATH ? (
+              <EuiSuperSelect
+                options={operatorOptions}
+                onChange={handleOperatorUpdate}
+                valueOfSelected={entry.operator}
+                data-test-subj={getTestId('operator')}
+              />
+            ) : (
+              <EuiFieldText
+                name="operator"
+                value={OPERATOR_TITLES.included}
+                data-test-subj={getTestId('operator')}
+                readOnly
+              />
+            )}
           </ConditionEntryCell>
         </EuiFlexItem>
-        <EuiFlexItem grow={3}>
+        <EuiFlexItem style={{ gridArea: 'value' }}>
           <ConditionEntryCell showLabel={showLabels} label={ENTRY_PROPERTY_TITLES.value}>
             <EuiFieldText
               name="value"
@@ -167,7 +206,7 @@ export const ConditionEntryInput = memo<ConditionEntryInputProps>(
             />
           </ConditionEntryCell>
         </EuiFlexItem>
-        <EuiFlexItem grow={false}>
+        <EuiFlexItem style={{ gridArea: 'remove' }}>
           {/* Unicode `nbsp` is used below so that Remove button is property displayed */}
           <ConditionEntryCell showLabel={showLabels} label={'\u00A0'}>
             <EuiButtonIcon
@@ -183,7 +222,7 @@ export const ConditionEntryInput = memo<ConditionEntryInputProps>(
             />
           </ConditionEntryCell>
         </EuiFlexItem>
-      </EuiFlexGroup>
+      </StyledEuiFlexGroup>
     );
   }
 );

x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/trusted_app_card/index.tsx

@@ -31,7 +31,7 @@ import {
   ENTRY_PROPERTY_TITLES,
   CARD_DELETE_BUTTON_LABEL,
   CONDITION_FIELD_TITLE,
-  OPERATOR_TITLE,
+  OPERATOR_TITLES,
   CARD_EDIT_BUTTON_LABEL,
 } from '../../translations';
 
@@ -56,7 +56,7 @@ const getEntriesColumnDefinitions = (): Array<EuiTableFieldDataColumnType<Entry>
     truncateText: true,
     width: '20%',
     render(field: Entry['operator'], entry: Entry) {
-      return OPERATOR_TITLE[field];
+      return OPERATOR_TITLES[field];
     },
   },
   {

x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/translations.ts

@@ -52,10 +52,13 @@ export const CONDITION_FIELD_DESCRIPTION: { [K in ConditionEntryField]: string }
   ),
 };
 
-export const OPERATOR_TITLE: { [K in ConditionEntry['operator']]: string } = {
-  included: i18n.translate('xpack.securitySolution.trustedapps.card.operator.includes', {
+export const OPERATOR_TITLES: { [K in ConditionEntry['operator']]: string } = {
+  included: i18n.translate('xpack.securitySolution.trustedapps.card.operator.is', {
     defaultMessage: 'is',
   }),
+  wildcard_caseless: i18n.translate('xpack.securitySolution.trustedapps.card.operator.matches', {
+    defaultMessage: 'matches',
+  }),
 };
 
 export const PROPERTY_TITLES: Readonly<