Skip to content

[SECURITY_SOLUTION][ENDPOINT] Trusted Apps Create API#76178

Merged
paul-tavares merged 9 commits intoelastic:masterfrom
paul-tavares:task/EMT-686-trusted-app-create-api
Sep 1, 2020
Merged

[SECURITY_SOLUTION][ENDPOINT] Trusted Apps Create API#76178
paul-tavares merged 9 commits intoelastic:masterfrom
paul-tavares:task/EMT-686-trusted-app-create-api

Conversation

@paul-tavares
Copy link
Copy Markdown
Contributor

@paul-tavares paul-tavares commented Aug 27, 2020

Summary

Adds HTTP POST support to the Trusted Apps API for creating a new Trusted App entry.

Request:

_core.http.post(
  '/api/endpoint/trusted_apps',
  {
    body: JSON.stringify({
      name: 'new trusted app for windows',
      os: 'windows',
      entries: [
        { field: 'path', operator: 'included', type: 'match', value: 'one/two' }
      ],
    }),
  }
)

Response:

HTTP 200 with body set to:

{
    "data": {
        "entries": [
            {
                "field": "path",
                "operator": "included",
                "type": "match",
                "value": "one/two"
            }
        ],
        "description": "",
        "created_at": "2020-08-27T19:22:57.526Z",
        "created_by": "kibana",
        "name": "new exception",
        "os": "windows",
        "id": "b6a7a870-e89a-11ea-98dd-29138fd9cf52"
    }
}

Checklist

Delete any items that are not applicable to this PR.

@paul-tavares paul-tavares added v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Team:Endpoint Management Feature:Endpoint Elastic Endpoint feature v7.10.0 labels Aug 27, 2020
@paul-tavares paul-tavares self-assigned this Aug 27, 2020
@paul-tavares paul-tavares marked this pull request as ready for review August 31, 2020 16:54
@paul-tavares paul-tavares requested review from a team as code owners August 31, 2020 16:54
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Aug 31, 2020

Pinging @elastic/endpoint-app-team (Feature:Endpoint)

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Aug 31, 2020

Pinging @elastic/endpoint-management (Team:Endpoint Management)

kevinlog
kevinlog reviewed Aug 31, 2020
View reviewed changes
x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/handlers.ts Outdated

try {
// Ensure list is created if it does not exist
await exceptionsListService?.createTrustedAppsList();
Copy link
Copy Markdown
Contributor

@kevinlog kevinlog Aug 31, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this will check if the list is created first?

Copy link
Copy Markdown
Contributor Author

@paul-tavares paul-tavares Aug 31, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes - the createTrustedAppsLists() method will not create it if it already exists - a warning is logged to the kibana log. Ref:

kibana/x-pack/plugins/lists/server/services/exception_lists/create_endpoint_trusted_apps_list.ts

Lines 70 to 72 in d462274

} catch (err) {
if (savedObjectsClient.errors.isConflictError(err)) {
return null;

(FYI: I just noticed the ? in the above code - will remove it (no longer needed)

kevinlog
kevinlog reviewed Aug 31, 2020
View reviewed changes
x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/index.ts
router.post(
{
path: TRUSTED_APPS_CREATE_API,
validate: PostTrustedAppCreateRequestSchema,
Copy link
Copy Markdown
Contributor

@kevinlog kevinlog Aug 31, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if the schema doesn't validate here, we get a 400 error? Do we get a meaningful message from the error? From your tests, it looks like an error will be thrown as expected - expect(() => body.validate(bodyMsg)).toThrow() - just wondering what the error actually looks like

Copy link
Copy Markdown
Contributor Author

@paul-tavares paul-tavares Aug 31, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

they are "typical" errors thrown by the schema lib. Here are a few examples:

// entries was an empty array
{
  'statusCode': 400,
  'error': 'Bad Request',
  'message': '[request body.entries]: array size is [0], but cannot be smaller than [1]',
}
// enty had os set to `winz`
{
  'statusCode': 400,
  'error': 'Bad Request',
  'message': '[request body.os]: types that failed validation:\n- [request body.os.0]: expected value to equal [linux]\n- [request body.os.1]: expected value to equal [macos]\n- [request body.os.2]: expected value to equal [windows]',
}

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Aug 31, 2020

💚 Build Succeeded

Build metrics

✅ unchanged

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

@paul-tavares paul-tavares merged commit 1c234bf into elastic:master Sep 1, 2020
@paul-tavares paul-tavares mentioned this pull request Sep 1, 2020
Merged
paul-tavares added a commit to paul-tavares/kibana that referenced this pull request Sep 1, 2020
@paul-tavares
[SECURITY_SOLUTION][ENDPOINT] Trusted Apps Create API (elastic#76178)
a880576 
* Create Trusted App API
@paul-tavares paul-tavares deleted the task/EMT-686-trusted-app-create-api branch September 1, 2020 19:34
gmmorris added a commit to gmmorris/kibana that referenced this pull request Sep 2, 2020
@gmmorris
Merge branch 'master' into actions/webhook-remove-header
c9deb85 
* master: (223 commits)
  skip flaky suite (elastic#75724)
  [Reporting] Add functional test for Reports in non-default spaces (elastic#76053)
  [Enterprise Search] Fix various icons in dark mode (elastic#76430)
  skip flaky suite (elastic#76245)
  Add `auto` interval to histogram AggConfig (elastic#76001)
  [Resolver] generator uses setup_node_env (elastic#76422)
  [Ingest Manager] Support both zip & tar archives from Registry (elastic#76197)
  [Ingest Manager] Improve agent vs kibana version checks (elastic#76238)
  Manually building `KueryNode` for Fleet's routes (elastic#75693)
  remove dupe tinymath section (elastic#76093)
  Create APM issue template (elastic#76362)
  Delete unused file. (elastic#76386)
  [SECURITY_SOLUTION][ENDPOINT] Trusted Apps Create API (elastic#76178)
  [Detections Engine] Add Alert actions to the Timeline (elastic#73228)
  [Dashboard First] Library Notification (elastic#76122)
  [Maps] Add mvt support for ES doc sources  (elastic#75698)
  Add setHeaderActionMenu API to AppMountParameters (elastic#75422)
  [ML] Remove "Are you sure" from data frame analytics jobs (elastic#76214)
  [yarn] remove typings-tester, use @ts-expect-error (elastic#76341)
  [Reporting/CSV] Do not fail the job if scroll ID can not be cleared (elastic#76014)
  ...
paul-tavares added a commit that referenced this pull request Sep 2, 2020
@paul-tavares
[SECURITY_SOLUTION][ENDPOINT] Trusted Apps Create API (#76178) (#76428)
692ec65 
* Create Trusted App API
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@parkiino parkiino parkiino approved these changes

+1 more reviewer

@kevinlog kevinlog kevinlog approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@paul-tavares paul-tavares

Labels

Feature:Endpoint Elastic Endpoint feature release_note:skip Skip the PR/issue when compiling release notes v7.10.0 v8.0.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@paul-tavares @elasticmachine @kibanamachine @kevinlog @parkiino