[SIEM][Detection Engine][Lists] Adds specific endpoint_list REST API and API for abilities to auto-create the endpoint_list if it gets deleted by FrankHassanabad · Pull Request #71792 · elastic/kibana

FrankHassanabad · 2020-07-14T23:36:09Z

Summary

Adds specific endpoint list REST API and API for abilities to auto-create the endpoint_list if it gets deleted or to auto-provision it when a rule is first created.

When auto-creating the endpoint_list it does so using these values for the saved object:

id: 'endpoint_list'
_tags: [],
comments: undefined,
description: 'Elastic Endpoint Exception List',
list_id: 'endpoint_list',
list_type: 'list',
name: 'Elastic Endpoint Exception List',
tags: [],
type: 'endpoint',

The new API endpoints are as follows below. These endpoints are like the normal exception list item endpoints except you should not pass down any list_id or namespace_type since these are focused specific endpoints against the space agnostic endpoint_list

# This creates the endpoint_list if it does not exist. If it does exist this will return an empty body of {}
POST /api/endpoint_list

# This will create an endpoint_list item. However, if the endpoint_list does not exist then this will auto-create it first.
POST /api/endpoint_list/items

# This will read an endpoint_list item. This will _not_ auto-create the list if it does not exist.
GET /api/endpoint_list/items

# This will update an endpoint_list item. However, if the endpoint_list does not exist then this will auto-create it first.
PUT /api/endpoint_list/items

# This will delete an endpoint_list item. This will _not_ auto-create the list if it does not exist.
DELETE /api/endpoint_list/items

# This will find an endpoint_list item. However, if the endpoint_list does not exist then this will auto-create it first.
GET /api/endpoint_list/items/_find

New API within the exception_list_client plugin are:

// # This creates the endpoint_list if it does not exist. If it does exist this will return an empty body of {}
createEndpointList()
createEndpointListItem()
updateEndpointListItem()
getEndpointListItem()
deleteEndpointListItem()

Scripts for testing are:

delete_endpoint_list_item.sh 
delete_endpoint_list_item_by_id.sh
find_endpoint_list_items.sh
get_endpoint_list_item.sh
get_endpoint_list_item_by_id.sh
post_endpoint_list.sh
post_endpoint_list_item.sh
update_endpoint_item.sh

Checklist

Delete any items that are not applicable to this PR.

Unit or functional tests were updated or added to match the most common scenarios

…ate the endpoint_list if it gets deleted

x-pack/plugins/lists/common/constants.ts

x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.ts

x-pack/plugins/lists/server/services/exception_lists/create_endpoint_list.ts

spong · 2020-07-15T00:29:15Z

...ns/security_solution/server/lib/detection_engine/routes/rules/add_prepackaged_rules_route.ts

+
+        // This will create the endpoint list if it does not exist yet
+        await context.lists?.getExceptionListClient().createEndpointList();
+


Thaaaank you! 🙏

elasticmachine · 2020-07-15T00:56:48Z

Pinging @elastic/siem (Team:SIEM)

rylnd

Tested the "create endpoint list during rule creation" flow, along with the "associate endpoint list to rule" flow, and both look great! 👍 👍 👍

Up to you if you wanna merge this now and add tests afterwards. Either way I'm gonna have to circle back on #71794, mainly to use the ENDPOINT_LIST_ID constant.

spong · 2020-07-15T03:12:06Z

@elasticmachine merge upstream

peluja1012 · 2020-07-15T05:11:52Z

@elasticmachine merge upstream

kibanamachine · 2020-07-15T06:53:03Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: 0287e8a

Build metrics

@kbn/optimizer bundle module count

id	value	diff	baseline
lists	93	+5	88

miscellaneous assets size

id	value	diff	baseline
lists	55.1KB	+744.0B	54.4KB
upgradeAssistant	22.6KB	-9.0B	22.6KB
total	-	+735.0B	-

page load bundle size

id	value	diff	baseline
lists	273.2KB	+10.6KB	262.5KB

History

💔 Build #61780 failed 6966e92
💔 Build #61765 failed fb40648
💔 Build #61751 failed cbb2abe
💔 Build #61732 failed 653f20b

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* master: (82 commits) Fixed the spacing of child accordion items for policy response dialog. (elastic#71677) [SECURITY] Timeline bug 7.9 (elastic#71748) use fixed isChromeVisible method (elastic#71813) [SIEM][Detection Engine][Lists] Adds specific endpoint_list REST API and API for abilities to auto-create the endpoint_list if it gets deleted (elastic#71792) [test] Skips flaky Saved Objects Management test [APM] Remove watcher integration (elastic#71655) [APM] Increase `xpack.apm.ui.transactionGroupBucketSize` (elastic#71661) [test] Skips Ingest Manager test preventing ES promotion [test] Skips flaky detection engine tests Revert "re-fix navigate path for master add SAML login to login_page (elastic#71337)" [tests] Temporarily skipped Fleet tests [test] Skipped monitoring test [Security Solution][Detections] Associate Endpoint Exceptions List to Rule during rule creation/update (elastic#71794) Add endpoint exception creation API validation (elastic#71791) Skip jest tests that timeout waiting for react (elastic#71801) [Security Solution][Exceptions] - Adds filtering to endpoint index patterns by exceptional fields (elastic#71757) [Reporting] Re-delete a file (elastic#71730) [Security Solution] [Detections] Fixes bug for determining when we hit max signals after filtering with lists (elastic#71768) [Ingest Manager] Better display of Fleet requirements (elastic#71686) [tests] Temporarily skipped to promote snapshot ...

…T API and API for abilities to auto-create the endpoint_list if it gets deleted (#71792) (#71818) Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: Frank Hassanabad <frank.hassanabad@elastic.co>

elasticmachine · 2021-09-23T14:30:44Z

Pinging @elastic/security-solution (Team: SecuritySolution)

Adds specific endpoint_list REST API and API for abilities to autocre…

653f20b

…ate the endpoint_list if it gets deleted

FrankHassanabad requested review from a team as code owners July 14, 2020 23:36

FrankHassanabad self-assigned this Jul 14, 2020

FrankHassanabad added v8.0.0 v7.9.0 release_note:enhancement labels Jul 14, 2020

Added the check against prepackaged list

55236a0

rylnd mentioned this pull request Jul 15, 2020

[Security Solution][Detections] Associate Endpoint Exceptions List to Rule during rule creation/update #71794

Merged

2 tasks

FrankHassanabad commented Jul 15, 2020

View reviewed changes

x-pack/plugins/lists/common/constants.ts Outdated Show resolved Hide resolved

FrankHassanabad commented Jul 15, 2020

View reviewed changes

x-pack/plugins/lists/common/schemas/request/update_endpoint_list_item_schema.ts Outdated Show resolved Hide resolved

FrankHassanabad commented Jul 15, 2020

View reviewed changes

x-pack/plugins/lists/server/services/exception_lists/create_endpoint_list.ts Outdated Show resolved Hide resolved

spong reviewed Jul 15, 2020

View reviewed changes

FrankHassanabad added 4 commits July 14, 2020 18:38

Updated to use LIST names

30c8690

Removed the namespace where it does not belong

46ea8a3

Merge branch 'master' into add-endpoint-list-creation

0ff5925

Updates per code review an extra space that was added

cbb2abe

FrankHassanabad added the Team:SIEM label Jul 15, 2020

rylnd approved these changes Jul 15, 2020

View reviewed changes

Merge branch 'master' into add-endpoint-list-creation

fb40648

Merge branch 'master' into add-endpoint-list-creation

6966e92

peluja1012 mentioned this pull request Jul 15, 2020

[Security Solution][Exception Modal] Create endpoint exception list if it doesn't already exist #71807

Merged

7 tasks

Merge branch 'master' into add-endpoint-list-creation

0287e8a

peluja1012 merged commit 21156d6 into elastic:master Jul 15, 2020

peluja1012 mentioned this pull request Jul 15, 2020

[7.x] [SIEM][Detection Engine][Lists] Adds specific endpoint_list REST API and API for abilities to auto-create the endpoint_list if it gets deleted (#71792) #71818

Merged

FrankHassanabad deleted the add-endpoint-list-creation branch July 15, 2020 12:44

MindyRS added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Sep 23, 2021

rylnd mentioned this pull request Jun 6, 2025

[Internal]: Documentation of /api/endpoint_list APIs is qualitatively incorrect elastic/docs-content#1636

Closed

gergoabraham mentioned this pull request Jan 14, 2026

[EDR Workflows] Fix endpoint list API returning 403 instead of 404 for read-only users #248816

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SIEM][Detection Engine][Lists] Adds specific endpoint_list REST API and API for abilities to auto-create the endpoint_list if it gets deleted#71792

[SIEM][Detection Engine][Lists] Adds specific endpoint_list REST API and API for abilities to auto-create the endpoint_list if it gets deleted#71792
peluja1012 merged 9 commits intoelastic:masterfrom
FrankHassanabad:add-endpoint-list-creation

FrankHassanabad commented Jul 14, 2020 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

spong Jul 15, 2020

Uh oh!

elasticmachine commented Jul 15, 2020

Uh oh!

rylnd left a comment

Uh oh!

spong commented Jul 15, 2020

Uh oh!

peluja1012 commented Jul 15, 2020

Uh oh!

kibanamachine commented Jul 15, 2020

Uh oh!

elasticmachine commented Sep 23, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants


		// This will create the endpoint list if it does not exist yet
		await context.lists?.getExceptionListClient().createEndpointList();

Conversation

FrankHassanabad commented Jul 14, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

Uh oh!

Uh oh!

Uh oh!

Uh oh!

spong Jul 15, 2020

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Jul 15, 2020

Uh oh!

rylnd left a comment

Choose a reason for hiding this comment

Uh oh!

spong commented Jul 15, 2020

Uh oh!

peluja1012 commented Jul 15, 2020

Uh oh!

kibanamachine commented Jul 15, 2020

💚 Build Succeeded

Build metrics

@kbn/optimizer bundle module count

miscellaneous assets size

page load bundle size

History

Uh oh!

elasticmachine commented Sep 23, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

FrankHassanabad commented Jul 14, 2020 •

edited

Loading