forked from elastic/kibana
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into de_8_15/esql_alert_suppression
- Loading branch information
Showing
33 changed files
with
3,045 additions
and
365 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
8 changes: 8 additions & 0 deletions
8
x-pack/plugins/fleet/server/saved_objects/model_versions/security_solution/index.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| export { packagePolicyV10OnWriteScanFix } from './v10_on_write_scan_fix'; |
183 changes: 183 additions & 0 deletions
183
...fleet/server/saved_objects/model_versions/security_solution/v10_on_write_scan_fix.test.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,183 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| import type { SavedObject } from '@kbn/core-saved-objects-api-server'; | ||
| import type { ModelVersionTestMigrator } from '@kbn/core-test-helpers-model-versions'; | ||
| import { createModelVersionTestMigrator } from '@kbn/core-test-helpers-model-versions'; | ||
|
|
||
| import { getSavedObjectTypes } from '../..'; | ||
|
|
||
| import type { PackagePolicy } from '../../../../common'; | ||
| import { PACKAGE_POLICY_SAVED_OBJECT_TYPE } from '../../../../common'; | ||
|
|
||
| describe('backfill for modelVersion 10 - fix on_write_scan field', () => { | ||
| let migrator: ModelVersionTestMigrator; | ||
| let policyConfigSO: SavedObject<PackagePolicy>; | ||
|
|
||
| beforeEach(() => { | ||
| migrator = createModelVersionTestMigrator({ | ||
| type: getSavedObjectTypes()[PACKAGE_POLICY_SAVED_OBJECT_TYPE], | ||
| }); | ||
|
|
||
| policyConfigSO = { | ||
| id: 'mock-saved-object-id', | ||
| attributes: { | ||
| name: 'Some Policy Name', | ||
| package: { | ||
| name: 'endpoint', | ||
| title: '', | ||
| version: '', | ||
| }, | ||
| id: 'endpoint', | ||
| policy_id: '', | ||
| enabled: true, | ||
| namespace: '', | ||
| revision: 0, | ||
| updated_at: '', | ||
| updated_by: '', | ||
| created_at: '', | ||
| created_by: '', | ||
| inputs: [ | ||
| { | ||
| type: 'endpoint', | ||
| enabled: true, | ||
| streams: [], | ||
| config: { | ||
| policy: { | ||
| value: { | ||
| windows: { | ||
| malware: { | ||
| mode: 'detect', | ||
| }, | ||
| antivirus_registration: { | ||
| enabled: true, | ||
| }, | ||
| }, | ||
| mac: { | ||
| malware: { | ||
| mode: 'detect', | ||
| }, | ||
| }, | ||
| linux: { | ||
| malware: { | ||
| mode: 'detect', | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| ], | ||
| }, | ||
| type: PACKAGE_POLICY_SAVED_OBJECT_TYPE, | ||
| references: [], | ||
| }; | ||
| }); | ||
|
|
||
| describe('when updating to model version 10', () => { | ||
| it('should change `on_write_scan` from `true` to `false` if Malware is off', () => { | ||
| setMalwareMode(policyConfigSO, 'off'); | ||
| setOnWriteScan(policyConfigSO, true); | ||
|
|
||
| const migratedPolicyConfigSO = migrator.migrate<PackagePolicy, PackagePolicy>({ | ||
| document: policyConfigSO, | ||
| fromVersion: 9, | ||
| toVersion: 10, | ||
| }); | ||
|
|
||
| expectOnWriteScanToBe(false, migratedPolicyConfigSO); | ||
| }); | ||
|
|
||
| it('should not change `on_write_scan` if Malware is detect', () => { | ||
| setMalwareMode(policyConfigSO, 'detect'); | ||
| setOnWriteScan(policyConfigSO, true); | ||
|
|
||
| const migratedPolicyConfigSO = migrator.migrate<PackagePolicy, PackagePolicy>({ | ||
| document: policyConfigSO, | ||
| fromVersion: 9, | ||
| toVersion: 10, | ||
| }); | ||
|
|
||
| expectOnWriteScanToBe(true, migratedPolicyConfigSO); | ||
| }); | ||
|
|
||
| it('should not change `on_write_scan` if Malware is prevent', () => { | ||
| setMalwareMode(policyConfigSO, 'prevent'); | ||
| setOnWriteScan(policyConfigSO, true); | ||
|
|
||
| const migratedPolicyConfigSO = migrator.migrate<PackagePolicy, PackagePolicy>({ | ||
| document: policyConfigSO, | ||
| fromVersion: 9, | ||
| toVersion: 10, | ||
| }); | ||
|
|
||
| expectOnWriteScanToBe(true, migratedPolicyConfigSO); | ||
| }); | ||
| }); | ||
|
|
||
| describe('additional test: when updating from model version 5 to model version 10', () => { | ||
| it('should add `on_write_scan=false` if Malware is off', () => { | ||
| setMalwareMode(policyConfigSO, 'off'); | ||
|
|
||
| const migratedPolicyConfigSO = migrator.migrate<PackagePolicy, PackagePolicy>({ | ||
| document: policyConfigSO, | ||
| fromVersion: 5, | ||
| toVersion: 10, | ||
| }); | ||
|
|
||
| expectOnWriteScanToBe(false, migratedPolicyConfigSO); | ||
| }); | ||
|
|
||
| it('should add `on_write_scan=true` if Malware is detect', () => { | ||
| setMalwareMode(policyConfigSO, 'detect'); | ||
|
|
||
| const migratedPolicyConfigSO = migrator.migrate<PackagePolicy, PackagePolicy>({ | ||
| document: policyConfigSO, | ||
| fromVersion: 5, | ||
| toVersion: 10, | ||
| }); | ||
|
|
||
| expectOnWriteScanToBe(true, migratedPolicyConfigSO); | ||
| }); | ||
|
|
||
| it('should add `on_write_scan=true` if Malware is prevent', () => { | ||
| setMalwareMode(policyConfigSO, 'prevent'); | ||
|
|
||
| const migratedPolicyConfigSO = migrator.migrate<PackagePolicy, PackagePolicy>({ | ||
| document: policyConfigSO, | ||
| fromVersion: 5, | ||
| toVersion: 10, | ||
| }); | ||
|
|
||
| expectOnWriteScanToBe(true, migratedPolicyConfigSO); | ||
| }); | ||
| }); | ||
|
|
||
| const setMalwareMode = (so: SavedObject<PackagePolicy>, level: 'off' | 'detect' | 'prevent') => { | ||
| const config = so.attributes.inputs[0].config?.policy.value; | ||
|
|
||
| config.windows.malware.mode = level; | ||
| config.mac.malware.mode = level; | ||
| config.linux.malware.mode = level; | ||
| }; | ||
|
|
||
| const setOnWriteScan = (so: SavedObject<PackagePolicy>, value: boolean) => { | ||
| const config = so.attributes.inputs[0].config?.policy.value; | ||
|
|
||
| config.windows.malware.on_write_scan = value; | ||
| config.mac.malware.on_write_scan = value; | ||
| config.linux.malware.on_write_scan = value; | ||
| }; | ||
|
|
||
| const expectOnWriteScanToBe = (expectedValue: boolean, so: SavedObject<PackagePolicy>) => { | ||
| const config = so.attributes.inputs[0].config?.policy.value; | ||
|
|
||
| expect(config.windows.malware.on_write_scan).toBe(expectedValue); | ||
| expect(config.mac.malware.on_write_scan).toBe(expectedValue); | ||
| expect(config.linux.malware.on_write_scan).toBe(expectedValue); | ||
| }; | ||
| }); |
42 changes: 42 additions & 0 deletions
42
...gins/fleet/server/saved_objects/model_versions/security_solution/v10_on_write_scan_fix.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| import type { | ||
| SavedObjectModelDataBackfillFn, | ||
| SavedObjectUnsanitizedDoc, | ||
| } from '@kbn/core-saved-objects-server'; | ||
|
|
||
| import type { PackagePolicy } from '../../../../common'; | ||
|
|
||
| export const packagePolicyV10OnWriteScanFix: SavedObjectModelDataBackfillFn< | ||
| PackagePolicy, | ||
| PackagePolicy | ||
| > = (packagePolicyDoc) => { | ||
| if (packagePolicyDoc.attributes.package?.name !== 'endpoint') { | ||
| return { attributes: packagePolicyDoc.attributes }; | ||
| } | ||
|
|
||
| const updatedPackagePolicyDoc: SavedObjectUnsanitizedDoc<PackagePolicy> = packagePolicyDoc; | ||
|
|
||
| const input = updatedPackagePolicyDoc.attributes.inputs[0]; | ||
|
|
||
| if (input && input.config) { | ||
| const policy = input.config.policy.value; | ||
|
|
||
| if (policy.windows.malware.mode === 'off') { | ||
| policy.windows.malware.on_write_scan = false; | ||
| } | ||
| if (policy.mac.malware.mode === 'off') { | ||
| policy.mac.malware.on_write_scan = false; | ||
| } | ||
| if (policy.linux.malware.mode === 'off') { | ||
| policy.linux.malware.on_write_scan = false; | ||
| } | ||
| } | ||
|
|
||
| return { attributes: updatedPackagePolicyDoc.attributes }; | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.