[EDR Workflows] Set Agent Tamper Protection to false on policy unassignment#193017
Conversation
|
Pinging @elastic/fleet (Team:Fleet) |
|
Pinging @elastic/security-defend-workflows (Team:Defend Workflows) |
| const [endpointPackagePolicyUpdatesIds, endpointOldPackagePoliciesIds] = [ | ||
| packagePolicyUpdates, | ||
| oldPackagePolicies, | ||
| ].map((packagePolicies) => |
There was a problem hiding this comment.
Sets instead of arrays could be built here, so the checks in lines 1231 and 1232 will have constant time complexity
There was a problem hiding this comment.
const [endpointPackagePolicyUpdatesIds, endpointOldPackagePoliciesIds] = [
packagePolicyUpdates,
oldPackagePolicies,
].map((packagePolicies) =>
new Set(
packagePolicies
.filter((p) => p.package?.name === 'endpoint')
.map((p) => p.policy_ids)
.flat()
)
);
Like this, right?
There was a problem hiding this comment.
May I also add that instead of iterating twice using filter and map you could use reduce to iterate only once. 😅
gergoabraham
left a comment
There was a problem hiding this comment.
works well when unassigning a Defend integration!
what do you think about initializing the is_protected field when a Defend integration is assigned to an agent policy? it should be false, but we could make sure
|
Hm, so you propose to add another check that will make sure (both on create and update) that if id is to be found in the "new" array and not in the "old" one, we should explicitly set |
@szwarckonrad, i don't actually know any scenario where it could be a problem, i'm just thinking on some weird possible SDHs where users added Defend integration and all of a sudden cannot uninstall agents, because some months prior to that somehow the so yeah, probably we don't need this, so if it would be a big change, we can definitely let it go, but if it's only a small one, i'd say let's go for it what are your thoughts? |
gergoabraham
left a comment
There was a problem hiding this comment.
awesome, thanks for the changes! 🚀
💛 Build succeeded, but was flaky
Failed CI StepsMetrics [docs]
History
To update your PR or re-run it, just comment with: |
…gnment (elastic#193017) This PR fixes an issue where Agent Tamper Protection remained enabled even after a Defend policy was unassigned from the agent policy. There is no issue with removing the integration; it still causes agent tamper protections to be disabled. https://github.com/user-attachments/assets/ee105e60-3db2-4249-a33b-44a2f2f7aac9 (cherry picked from commit 39fe0ae)
💚 All backports created successfully
Note: Successful backport PRs will be merged automatically after passing CI. Questions ?Please refer to the Backport tool documentation |
…unassignment (#193017) (#193713) # Backport This will backport the following commits from `main` to `8.x`: - [[EDR Workflows] Set Agent Tamper Protection to false on policy unassignment (#193017)](#193017) <!--- Backport version: 9.4.3 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Konrad Szwarc","email":"konrad.szwarc@elastic.co"},"sourceCommit":{"committedDate":"2024-09-23T12:02:16Z","message":"[EDR Workflows] Set Agent Tamper Protection to false on policy unassignment (#193017)\n\nThis PR fixes an issue where Agent Tamper Protection remained enabled\r\neven after a Defend policy was unassigned from the agent policy.\r\n\r\nThere is no issue with removing the integration; it still causes agent\r\ntamper protections to be disabled.\r\n\r\n\r\nhttps://github.com/user-attachments/assets/ee105e60-3db2-4249-a33b-44a2f2f7aac9","sha":"39fe0aee76d0383258be8f68bed2865575ec20d2","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Fleet","v9.0.0","Team:Defend Workflows","v8.16.0","backport:version"],"title":"[EDR Workflows] Set Agent Tamper Protection to false on policy unassignment","number":193017,"url":"https://github.com/elastic/kibana/pull/193017","mergeCommit":{"message":"[EDR Workflows] Set Agent Tamper Protection to false on policy unassignment (#193017)\n\nThis PR fixes an issue where Agent Tamper Protection remained enabled\r\neven after a Defend policy was unassigned from the agent policy.\r\n\r\nThere is no issue with removing the integration; it still causes agent\r\ntamper protections to be disabled.\r\n\r\n\r\nhttps://github.com/user-attachments/assets/ee105e60-3db2-4249-a33b-44a2f2f7aac9","sha":"39fe0aee76d0383258be8f68bed2865575ec20d2"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/193017","number":193017,"mergeCommit":{"message":"[EDR Workflows] Set Agent Tamper Protection to false on policy unassignment (#193017)\n\nThis PR fixes an issue where Agent Tamper Protection remained enabled\r\neven after a Defend policy was unassigned from the agent policy.\r\n\r\nThere is no issue with removing the integration; it still causes agent\r\ntamper protections to be disabled.\r\n\r\n\r\nhttps://github.com/user-attachments/assets/ee105e60-3db2-4249-a33b-44a2f2f7aac9","sha":"39fe0aee76d0383258be8f68bed2865575ec20d2"}},{"branch":"8.x","label":"v8.16.0","branchLabelMappingKey":"^v8.16.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Konrad Szwarc <konrad.szwarc@elastic.co>
* main: (176 commits) [ML][Rules] Fixes deletion in Check interval input for anomaly detection rule (elastic#193420) Bump maximum supported package spec version to 3.2 (elastic#193574) [ES|QL] new pattern for `SORT` autocomplete (elastic#193595) [Inventory][ECO] Entities page search bar (elastic#193546) [Synthetics] Remove extra overview route (elastic#192449) [Obs Alerts table] Fix error on clicking alert reason message (elastic#193693) [Migrations] Remove tests that are not applicable in 9.x (elastic#193699) [EDR Workflows] Set Agent Tamper Protection to false on policy unassignment (elastic#193017) [Inventory][ECO] Enable elastic entity model from inventory (elastic#193557) [EDR Workflows] The host isolation exception tab is hidden on the basic license if no artifacts (elastic#192562) [Entity Analytics] Ensuring definition transforms are managed (elastic#193408) [Automatic Import] Do not remove message field for unstructured logs (elastic#193678) [Fleet] Add missing permissions for connector package (elastic#193573) [Fleet] using @kbn/config-schema part 2 (outputs and other apis) (elastic#193326) [Migrations] Provide testing archives + tooling for migrations integration tests (elastic#193328) [ES|QL] Renames the textbased editor to esql editor (elastic#193521) [ES|QL] Update function metadata (elastic#193662) [Security Solution][Entity Analytics] Scoping the entity store to spaces (elastic#193303) [Docs] Update Sharing docs (elastic#190318) [ML] AIOps: Move Log Rate Analysis results callout to help popover. (elastic#192243) ... # Conflicts: # x-pack/plugins/search_inference_endpoints/public/components/all_inference_endpoints/render_table_columns/render_endpoint/endpoint_info.test.tsx # x-pack/plugins/search_inference_endpoints/public/components/all_inference_endpoints/render_table_columns/render_endpoint/endpoint_info.tsx
This PR fixes an issue where Agent Tamper Protection remained enabled even after a Defend policy was unassigned from the agent policy.
There is no issue with removing the integration; it still causes agent tamper protections to be disabled.
Screen.Recording.2024-09-16.at.15.51.26.mov