[EDR Workflows] The host isolation exception tab is hidden on the basic license if no artifacts by szwarckonrad · Pull Request #192562 · elastic/kibana

szwarckonrad · 2024-09-11T10:30:35Z

This PR updates how the Host Isolation Exceptions tab is displayed based on the user’s permissions and license. The tab is always visible to platinum+ users. For lower-tier licenses, a check is performed: if a user has previously defined host isolation exceptions, they will see the tab and be able to view or remove existing exceptions. If they haven’t, the tab will be hidden, and the functionality will be inaccessible.

Previously, even if a user didn’t have access to host isolation exceptions, they could still see and enter the Host Isolation Exceptions tab.

To test locally:
ESS:

Start ES + Kibana the regular way, with the default trial license.
Add HIE
Downgrade license (https://github.com/elastic/pzl-es-tools)
Verify that the license had been downgraded

Serverless:

Start Serverless ES yarn es serverless --clean --teardown --kill -E xpack.security.authc.api_key.enabled=true -E http.host=0.0.0.0 --projectType security
Start Serverless Kibana yarn serverless-security
Add HIE
Modify config/serverless.security.yml to security and endpoint essential
Wait for Kibana to reload

ESS:

Screen.Recording.2024-09-11.at.15.27.26.mov

Serverless:

Screen.Recording.2024-09-11.at.15.47.46.mov

elasticmachine · 2024-09-11T15:18:10Z

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

gergoabraham

nice work, @szwarckonrad, thanks for all the cleanup as well! 👏 tested with both ESS and serverless, works well

i have only some nitpicks - see below -, other than that, i have a question regarding the feature (cc @dasansol92 @caitlinbetz)

with Basic licence, if there's a HIE after downgrade

we show the HIE page amongst the management page, that's clear bc there the user sees all HIE entries
but, we also show the HIE tab on the Policy Details page regardless if anything is displayed there. so the question, do we want to show the HIE tab for every integration, including the ones that does not have a HIE assigned (and there's no global HIE)?

with this modification, on Basic license the user sees this if there are some HIE left but none of those are global or assigned to the opened integration:

x-pack/plugins/security_solution/public/management/pages/policy/view/tabs/policy_tabs.tsx

...security_solution/public/management/hooks/artifacts/use_host_isolation_exceptions_access.tsx

gergoabraham

last nitpicks are below, but it's looking real good, thanks for the changes! 🚀

(also quickly re-tested only with ESS, still works well 👍 )

gergoabraham · 2024-09-17T08:51:19Z

...ity_solution/public/management/hooks/artifacts/use_host_isolation_exceptions_access.test.tsx

    await waitFor(() => {
      expect(checkArtifactHasData).not.toHaveBeenCalled();
-      expect(result.current).toBe(true);
+      expect(result.current.hasAccessToHostIsolationExceptions).toBe(true);


i think a test case for isHostIsolationExceptionsAccessLoading: true would be useful, both here and in policy_details.test.tsx

ashokaditya

Great work fixing this. 🚀 Tested it out and works as expected. I left some suggestions for you to consider.

ashokaditya · 2024-09-13T13:36:14Z

...lugins/security_solution/public/management/pages/blocklist/services/blocklists_api_client.ts

  UpdateExceptionListItemSchema,
 } from '@kbn/securitysolution-io-ts-list-types';
-import { ENDPOINT_BLOCKLISTS_LIST_ID } from '@kbn/securitysolution-list-constants';
+import { ENDPOINT_ARTIFACT_LISTS } from '@kbn/securitysolution-list-constants';


Thanks for cleaning up the deprecations 🥇

ashokaditya · 2024-09-18T14:06:05Z

x-pack/plugins/security_solution/public/management/pages/policy/view/tabs/policy_tabs.tsx

+    const redirectHostIsolationException =
+      isInHostIsolationExceptionsTab &&
+      (!canReadHostIsolationExceptions ||
+        (!isHostIsolationExceptionsAccessLoading && !hasAccessToHostIsolationExceptions));


!isHostIsolationExceptionsAccessLoading check is redundant here.

ashokaditya · 2024-09-18T14:06:27Z

x-pack/plugins/security_solution/public/management/pages/policy/view/tabs/policy_tabs.tsx

+      return;
+    }
+
+    const redirectHostIsolationException =


Suggested change

const redirectHostIsolationException =

const shouldNotSeeHostIsolationExceptions =

ashokaditya · 2024-09-18T14:11:22Z

...ity_solution/public/management/hooks/artifacts/use_host_isolation_exceptions_access.test.tsx

    await waitFor(() => {
      expect(checkArtifactHasData).not.toHaveBeenCalled();
-      expect(result.current).toBe(true);
+      expect(result.current.hasAccessToHostIsolationExceptions).toBe(true);


x-pack/plugins/security_solution/public/management/pages/policy/view/policy_details.test.tsx

…y/view/policy_details.test.tsx Co-authored-by: Ash <1849116+ashokaditya@users.noreply.github.com>

kibana-ci · 2024-09-23T09:57:54Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: dc425f7

Failed CI Steps

FTR Configs #42

Test Failures

[job] [logs] FTR Configs #42 / Journey[many_fields_discover] Expand the first document

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	5814	5815	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	20.4MB	20.4MB	+1.9KB

Unknown metric groups

References to deprecated APIs

id	before	after	diff
`securitySolution`	470	458	-12

History

💛 Build #235981 was flaky f6104eb
💔 Build #235916 failed 5dc3427
💚 Build #235453 succeeded 776a7f2
💛 Build #234493 was flaky 7dcf947
💔 Build #234306 failed 0d736cd
💛 Build #233476 was flaky 03e6fab

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @szwarckonrad

…ic license if no artifacts (elastic#192562) This PR updates how the Host Isolation Exceptions tab is displayed based on the user’s permissions and license. The tab is always visible to platinum+ users. For lower-tier licenses, a check is performed: if a user has previously defined host isolation exceptions, they will see the tab and be able to view or remove existing exceptions. If they haven’t, the tab will be hidden, and the functionality will be inaccessible. Previously, even if a user didn’t have access to host isolation exceptions, they could still see and enter the Host Isolation Exceptions tab. To test locally: ESS: 1. Start ES + Kibana the regular way, with the default `trial` license. 2. Add HIE 3. Downgrade license (https://github.com/elastic/pzl-es-tools) 4. Verify that the license had been downgraded Serverless: 1. Start Serverless ES `yarn es serverless --clean --teardown --kill -E xpack.security.authc.api_key.enabled=true -E http.host=0.0.0.0 --projectType security` 2. Start Serverless Kibana `yarn serverless-security` 3. Add HIE 4. Modify `config/serverless.security.yml` to security and endpoint essential 5. Wait for Kibana to reload ESS: https://github.com/user-attachments/assets/75527af7-9d06-4da7-9e86-6ce6b22ac147 Serverless: https://github.com/user-attachments/assets/e89bd642-9e99-4a22-8b42-5997f7333ea6 --------- Co-authored-by: Ash <1849116+ashokaditya@users.noreply.github.com> (cherry picked from commit 636baad)

kibanamachine · 2024-09-23T12:04:55Z

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…he basic license if no artifacts (#192562) (#193711) # Backport This will backport the following commits from `main` to `8.x`: - [[EDR Workflows] The host isolation exception tab is hidden on the basic license if no artifacts (#192562)](#192562)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Konrad Szwarc <konrad.szwarc@elastic.co>

* main: (176 commits) [ML][Rules] Fixes deletion in Check interval input for anomaly detection rule (elastic#193420) Bump maximum supported package spec version to 3.2 (elastic#193574) [ES|QL] new pattern for `SORT` autocomplete (elastic#193595) [Inventory][ECO] Entities page search bar (elastic#193546) [Synthetics] Remove extra overview route (elastic#192449) [Obs Alerts table] Fix error on clicking alert reason message (elastic#193693) [Migrations] Remove tests that are not applicable in 9.x (elastic#193699) [EDR Workflows] Set Agent Tamper Protection to false on policy unassignment (elastic#193017) [Inventory][ECO] Enable elastic entity model from inventory (elastic#193557) [EDR Workflows] The host isolation exception tab is hidden on the basic license if no artifacts (elastic#192562) [Entity Analytics] Ensuring definition transforms are managed (elastic#193408) [Automatic Import] Do not remove message field for unstructured logs (elastic#193678) [Fleet] Add missing permissions for connector package (elastic#193573) [Fleet] using @kbn/config-schema part 2 (outputs and other apis) (elastic#193326) [Migrations] Provide testing archives + tooling for migrations integration tests (elastic#193328) [ES|QL] Renames the textbased editor to esql editor (elastic#193521) [ES|QL] Update function metadata (elastic#193662) [Security Solution][Entity Analytics] Scoping the entity store to spaces (elastic#193303) [Docs] Update Sharing docs (elastic#190318) [ML] AIOps: Move Log Rate Analysis results callout to help popover. (elastic#192243) ... # Conflicts: # x-pack/plugins/search_inference_endpoints/public/components/all_inference_endpoints/render_table_columns/render_endpoint/endpoint_info.test.tsx # x-pack/plugins/search_inference_endpoints/public/components/all_inference_endpoints/render_table_columns/render_endpoint/endpoint_info.tsx

depreciated const removal

de7bc89

szwarckonrad added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.16.0 labels Sep 11, 2024

szwarckonrad self-assigned this Sep 11, 2024

szwarckonrad linked an issue Sep 11, 2024 that may be closed by this pull request

[EDR Workflows] The host isolation exception tab is available inconsistently on the basic license #191945

Closed

1 task

szwarckonrad added 3 commits September 11, 2024 12:56

depreciated const removal

21740a0

do not display the tab under certain conditions

e65294e

Merge branch 'refs/heads/main' into hide-hie-tab-when-no-access

56d0482

szwarckonrad requested review from ashokaditya and gergoabraham September 11, 2024 15:17

Merge branch 'main' into hide-hie-tab-when-no-access

03e6fab

szwarckonrad marked this pull request as ready for review September 11, 2024 15:18

szwarckonrad requested a review from a team as a code owner September 11, 2024 15:18

gergoabraham reviewed Sep 13, 2024

View reviewed changes

szwarckonrad added 4 commits September 16, 2024 10:48

Merge branch 'refs/heads/main' into hide-hie-tab-when-no-access

9b55c4e

cr

0d736cd

Merge branch 'refs/heads/main' into hide-hie-tab-when-no-access

c08dbc9

tests aligned

7dcf947

gergoabraham approved these changes Sep 17, 2024

View reviewed changes

ashokaditya approved these changes Sep 18, 2024

View reviewed changes

szwarckonrad and others added 4 commits September 19, 2024 08:58

Merge branch 'main' into hide-hie-tab-when-no-access

776a7f2

Update x-pack/plugins/security_solution/public/management/pages/polic…

c554f89

…y/view/policy_details.test.tsx Co-authored-by: Ash <1849116+ashokaditya@users.noreply.github.com>

added test coverage for loading state

5dc3427

Merge branch 'main' into hide-hie-tab-when-no-access

f6104eb

szwarckonrad added backport:version Backport to applied version labels v9.0.0 and removed backport:skip This PR does not require backporting labels Sep 20, 2024

Merge branch 'main' into hide-hie-tab-when-no-access

dc425f7

szwarckonrad merged commit 636baad into elastic:main Sep 23, 2024

kibanamachine mentioned this pull request Sep 23, 2024

[8.x] [EDR Workflows] The host isolation exception tab is hidden on the basic license if no artifacts (#192562) #193711

Merged

szwarckonrad mentioned this pull request Mar 23, 2026

[EDR Workflows][Artifacts Regrouping] Re-organize all artifacts to a single page with separate tabs #257001

Merged

5 tasks

	const redirectHostIsolationException =
	const shouldNotSeeHostIsolationExceptions =

Conversation

szwarckonrad commented Sep 11, 2024 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elasticmachine commented Sep 11, 2024

Uh oh!

gergoabraham left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gergoabraham left a comment

Choose a reason for hiding this comment

Uh oh!

gergoabraham Sep 17, 2024

Choose a reason for hiding this comment

Uh oh!

ashokaditya Sep 18, 2024

Choose a reason for hiding this comment

Uh oh!

ashokaditya left a comment

Choose a reason for hiding this comment

Uh oh!

ashokaditya Sep 13, 2024

Choose a reason for hiding this comment

Uh oh!

ashokaditya Sep 18, 2024

Choose a reason for hiding this comment

Uh oh!

ashokaditya Sep 18, 2024

Choose a reason for hiding this comment

Uh oh!

ashokaditya Sep 18, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kibana-ci commented Sep 23, 2024

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Async chunks

References to deprecated APIs

History

Uh oh!

kibanamachine commented Sep 23, 2024

💚 All backports created successfully

Questions ?

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

szwarckonrad commented Sep 11, 2024 •

edited by kibanamachine

Loading