Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

When upgrading existing Policies in 7.9, Trusted Applications artifacts are not added #88408

Open
kevinlog opened this issue Jan 14, 2021 · 1 comment
Assignees
Labels
bug Fixes for quality problems that affect the customer experience impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team:Defend Workflows “EDR Workflows” sub-team of Security Solution

Comments

@kevinlog
Copy link
Contributor

Kibana version:
7.10+

Elasticsearch version:
7.10+

Describe the bug:
When a user creates Endpoint Policies in 7.9 and upgrade, the Trusted Apps artifacts are not added to existing Policies. This causes newer Endpoints to send an Error in the Policy Response for User Artifacts.

If you view the Policies migrated from 7.9, you will see that the Trusted App policies do not contain the trustlist artifacts.

Note that newly created artifacts in 7.10+ will correctly add the trustlist artifacts.

Steps to reproduce:

  1. Deploy 7.9 Kibana, create an Endpoint Policy
  2. Upgrade to 7.10+, check existing Policy and see that trusted apps artifact isn't added
  3. Try adding the Policy to a 7.10+ Endpoint and see a Policy response failure

Expected behavior:
Upgraded policies from 7.9 should get the Trusted Apps artifact added during migration

Screenshots (if relevant):

Any additional context:
A workaround for users would be to recreate Policies from 7.9, but this is a pain.

@kevinlog kevinlog added bug Fixes for quality problems that affect the customer experience impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v7.11.1 labels Jan 14, 2021
@paul-tavares
Copy link
Contributor

I will take a look at this. The work around here might be to just add a trusted app entry - since that will trigger artifacts to be generated and manifest in the policies to be updated.

@kevinlog kevinlog added impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. and removed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. v7.11.1 labels Apr 29, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team:Defend Workflows “EDR Workflows” sub-team of Security Solution
Projects
None yet
Development

No branches or pull requests

3 participants