[Security Solution][EDR] Fix import of endpoint exceptions by paul-tavares · Pull Request #233142 · elastic/kibana

paul-tavares · 2025-08-27T15:28:08Z

Summary

Fix import of Endpoint Exceptions to ensure they are made visible and accessible via API
- A bug was introduced with v9.1.0, as part of support for Spaces, that made imported endpoint exceptions unaccessible after import. Items were imported into the index, but they did not include a tag indicating that the exception is Global. This was a new requirement with v9.1.0

Checklist

Unit or functional tests were updated or added to match the most common scenarios

paul-tavares · 2025-08-27T15:28:38Z

/ci

elasticmachine · 2025-08-27T15:49:07Z

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

szwarckonrad · 2025-08-28T09:21:27Z

...ation/test_suites/edr_workflows/artifacts/trial_license_complete_tier/endpoint_exceptions.ts

+export default function ({ getService }: FtrProviderContext) {
+  const endpointArtifactTestResources = getService('endpointArtifactTestResources');
+  const utils = getService('securitySolutionUtils');


From what I recall, these callbacks have relatively low test coverage. Could we at least add a few error-handling tests?

What do you mean by Error handling?

Also - FYI: there are tests for endpoint exceptions that will be transitioned to be owned by our team as you all work on migrating the endpoint exceptions to our area of the UI. I don't know what the coverage is like there.

OH. Wait. I think you mean error conditions that tests the code that was already there in the import extension point.

I'll add some test :)

FYI: I added tests to ensure we get an error for every other artifact

Sorry for the unclear comment earlier, and thanks for addressing it anyway 🙂

gergoabraham · 2025-08-28T14:26:56Z

...ation/test_suites/edr_workflows/artifacts/trial_license_complete_tier/endpoint_exceptions.ts

+          .send()
+          .expect(200);
+
+        expect(body.data.length).to.eql(3);


could you please refactor or just comment this test so it's a bit easier to understand? also, could you help me understand? : )

so 3 list items are imported, 1 with policy:all tag, 2 without it. how does this GET _find api call test this?

So the bug was: imported items were not returned on the GET request. They were imported, but never returned.

This test imports 3 items: some have the Global tag; others don't.... but after the import, all 3 items should be returned - which means that the fix that was applied is working

I will add a comment to this assertion to indicate this. Was there anything else that I can help clarify for you/

thanks for the explanation, all clear. i think this is a good regression test to ensure we don't have the original bug, but it is too indirect for testing that the global artifact tag is really added.

could we also check if the tags are really present either here or in unit test level?

Sure. I will add a check here to ensure the tag was added

…int-exceptions' into task/olm-230679-fix-import-endpoint-exceptions

…-import-endpoint-exceptions

gergoabraham · 2025-09-01T11:34:05Z

...ation/test_suites/edr_workflows/artifacts/trial_license_complete_tier/endpoint_exceptions.ts

+          .send()
+          .expect(200);
+
+        expect(body.data.length).to.eql(3);


thanks for the explanation, all clear. i think this is a good regression test to ensure we don't have the original bug, but it is too indirect for testing that the global artifact tag is really added.

could we also check if the tags are really present either here or in unit test level?

…-import-endpoint-exceptions

kibanamachine · 2025-09-02T21:02:41Z

Starting backport for target branches: 9.1

https://github.com/elastic/kibana/actions/runs/17415879529

elasticmachine · 2025-09-02T21:03:05Z

💚 Build Succeeded

Buildkite Build
Commit: 898f4dd

Metrics [docs]

Saved Objects .kibana field count

Every field in each saved object type adds overhead to Elasticsearch. Kibana needs to keep the total field count below Elasticsearch's default limit of 1000 fields. Only specify field mappings for the fields you wish to search on or query. See https://www.elastic.co/guide/en/kibana/master/saved-objects-service.html#_mappings

id	before	after	diff
`_data_stream_timestamp`	1	-	-1
`_doc_count`	1	-	-1
`_ignored_source`	1	-	-1
`_index_mode`	1	-	-1
`_inference_fields`	1	-	-1
`_tier`	1	-	-1
`apm-custom-dashboards`	5	-	-5
`apm-server-schema`	2	-	-2
`apm-service-group`	5	-	-5
`application_usage_daily`	2	-	-2
`config`	2	-	-2
`config-global`	2	-	-2
`coreMigrationVersion`	1	-	-1
`created_at`	1	-	-1
`created_by`	1	-	-1
`entity-definition`	9	-	-9
`entity-discovery-api-key`	2	-	-2
`event_loop_delays_daily`	2	-	-2
`favorites`	4	-	-4
`file`	11	-	-11
`file-upload-usage-collection-telemetry`	3	-	-3
`fileShare`	5	-	-5
`infra-custom-dashboards`	4	-	-4
`infrastructure-monitoring-log-view`	2	-	-2
`intercept_trigger_record`	5	-	-5
`legacy-url-alias`	7	-	-7
`managed`	1	-	-1
`ml-job`	6	-	-6
`ml-module`	13	-	-13
`ml-trained-model`	7	-	-7
`monitoring-telemetry`	2	-	-2
`namespace`	1	-	-1
`namespaces`	1	-	-1
`observability-onboarding-state`	2	-	-2
`originId`	1	-	-1
`product-doc-install-status`	7	-	-7
`references`	4	-	-4
`sample-data-telemetry`	3	-	-3
`security-ai-prompt`	8	-	-8
`slo`	11	-	-11
`space`	5	-	-5
`synthetics-monitor`	34	-	-34
`synthetics-monitor-multi-space`	34	-	-34
`tag`	4	-	-4
`type`	1	-	-1
`typeMigrationVersion`	1	-	-1
`ui-metric`	2	-	-2
`updated_at`	1	-	-1
`updated_by`	1	-	-1
`upgrade-assistant-ml-upgrade-operation`	3	-	-3
`upgrade-assistant-reindex-operation`	3	-	-3
`uptime-synthetics-api-key`	2	-	-2
`url`	5	-	-5
`usage-counters`	2	-	-2
total			-246

History

💔 Build #334922 failed 5a5f77a
💚 Build #333690 succeeded 11fa941
💚 Build #333322 succeeded 2a5ed92
💔 Build #333208 failed b2f9ec1

cc @paul-tavares

kibanamachine · 2025-09-02T21:09:27Z

💔 All backports failed

Status	Branch	Result
❌	9.1	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 233142

Questions ?

Please refer to the Backport tool documentation

…33142) ## Summary - Fix import of Endpoint Exceptions to ensure they are made visible and accessible via API - A bug was introduced with `v9.1.0`, as part of support for Spaces, that made imported endpoint exceptions unaccessible after import. Items were imported into the index, but they did not include a `tag` indicating that the exception is Global. This was a new requirement with `v9.1.0`

paul-tavares · 2025-09-03T15:50:31Z

💚 All backports created successfully

Status	Branch	Result
✅	9.1

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…33142) ## Summary - Fix import of Endpoint Exceptions to ensure they are made visible and accessible via API - A bug was introduced with `v9.1.0`, as part of support for Spaces, that made imported endpoint exceptions unaccessible after import. Items were imported into the index, but they did not include a `tag` indicating that the exception is Global. This was a new requirement with `v9.1.0` (cherry picked from commit 5be7a8f) # Conflicts: # x-pack/solutions/security/plugins/security_solution/server/lists_integration/endpoint/handlers/exceptions_pre_import_handler.ts # x-pack/solutions/security/test/security_solution_endpoint/services/endpoint_artifacts.ts

…3142) (#233890) # Backport This will backport the following commits from `main` to `9.1`: - [[Security Solution][EDR] Fix import of endpoint exceptions (#233142)](#233142)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)

…33142) ## Summary - Fix import of Endpoint Exceptions to ensure they are made visible and accessible via API - A bug was introduced with `v9.1.0`, as part of support for Spaces, that made imported endpoint exceptions unaccessible after import. Items were imported into the index, but they did not include a `tag` indicating that the exception is Global. This was a new requirement with `v9.1.0`

paul-tavares added 2 commits August 27, 2025 08:42

Add logic to handle import of Endpoint Exceptions

30ff590

FTR tests for endpoint exceptions

b2f9ec1

paul-tavares self-assigned this Aug 27, 2025

paul-tavares added release_note:fix Team:Defend Workflows “EDR Workflows” sub-team of Security Solution backport:version Backport to applied version labels v9.1.0 v9.2.0 labels Aug 27, 2025

paul-tavares marked this pull request as ready for review August 27, 2025 15:49

paul-tavares requested a review from a team as a code owner August 27, 2025 15:49

paul-tavares requested review from ashokaditya and tomsonpl August 27, 2025 15:49

paul-tavares mentioned this pull request Aug 27, 2025

[Defend Workflows] Endpoint exception list has inconsistent behavior after being imported #230679

Closed

paul-tavares requested review from gergoabraham and szwarckonrad and removed request for ashokaditya and tomsonpl August 27, 2025 15:49

Merge branch 'main' into task/olm-230679-fix-import-endpoint-exceptions

2a5ed92

szwarckonrad approved these changes Aug 28, 2025

View reviewed changes

gergoabraham reviewed Aug 28, 2025

View reviewed changes

paul-tavares added 3 commits August 28, 2025 10:42

Added tests to validate non-endpoint exceptions error conditions

dcc244a

Merge remote-tracking branch 'origin/task/olm-230679-fix-import-endpo…

6e5b4f7

…int-exceptions' into task/olm-230679-fix-import-endpoint-exceptions

Merge remote-tracking branch 'upstream/main' into task/olm-230679-fix…

11fa941

…-import-endpoint-exceptions

paul-tavares requested a review from gergoabraham August 28, 2025 14:44

gergoabraham approved these changes Sep 1, 2025

View reviewed changes

paul-tavares and others added 3 commits September 2, 2025 08:41

Add additional checks to FTR test

c4003ad

Merge remote-tracking branch 'upstream/main' into task/olm-230679-fix…

5a5f77a

…-import-endpoint-exceptions

Merge branch 'main' into task/olm-230679-fix-import-endpoint-exceptions

898f4dd

paul-tavares enabled auto-merge (squash) September 2, 2025 19:10

paul-tavares merged commit 5be7a8f into elastic:main Sep 2, 2025
12 checks passed

paul-tavares deleted the task/olm-230679-fix-import-endpoint-exceptions branch September 2, 2025 21:08

paul-tavares mentioned this pull request Sep 3, 2025

[9.1] [Security Solution][EDR] Fix import of endpoint exceptions (#233142) #233890

Merged

kibanamachine mentioned this pull request Sep 3, 2025

[Security Solution] Implement Prebuilt Rules Customization test plan #232776

Merged

kibanamachine added the v9.1.4 label Sep 4, 2025

Conversation

paul-tavares commented Aug 27, 2025 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

Uh oh!

paul-tavares commented Aug 27, 2025

Uh oh!

elasticmachine commented Aug 27, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kibanamachine commented Sep 2, 2025

Uh oh!

elasticmachine commented Sep 2, 2025

💚 Build Succeeded

Metrics [docs]

Saved Objects .kibana field count

History

Uh oh!

kibanamachine commented Sep 2, 2025

💔 All backports failed

Manual backport

Questions ?

Uh oh!

paul-tavares commented Sep 3, 2025

💚 All backports created successfully

Questions ?

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

paul-tavares commented Aug 27, 2025 •

edited by kibanamachine

Loading