Summary

Endpoint Exception ALL privilege got lost, because the original migration (PR: #219566) did this:

• for siem:ALL or siemV2:ALL:
  • it adds the new global_artifact_management_all, because siemVX all meant that user can write Endpoint Exceptions
  • and: it changed siemVX:ALL to siemVX:MINIMAL_ALL, in order to enabled the sub-features toggle, so it is visible to the user that they are granted a new sub-privilege

and the issue: Endpoint Exceptions are not included in siemVX:MINIMAL_ALL, and thanks to this the user lost their access to Endpoint Exceptions.

this PR solves this issue.

visualization

with this change, the siem/siemV2:ALL -> siemV3 migration graph now looks like this:

flowchart LR
    classDef serverless stroke:blue,stroke-dasharray: 5 5

    subgraph siemV2[siem/siemV2]
        all1[all]
    end

    subgraph siemV3
        subgraph minall2[minimal_all]
            g1[global_artifact_management_all]

            eea["`endpoint_exceptions_all
                (only serverless)`"]:::serverless
        end
    end

    all1 -->|keep access to the included Endpoint Exceptions ALL| g1
    all1 -->|enable sub-feature toggle| minall2

    all1 -->|keep access to EE ALL, as it WAS included in ALL. only serverless| eea
    linkStyle 2 stroke:#00f,color:blue

see the previous ones here: #219566

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

• Unit or functional tests were updated or added to match the most common scenarios