Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution][Endpoint] Add validation to ensure a SentinelOne agent ID exists when enabling the Respond Take Action option #182158

Merged
merged 3 commits into from
May 1, 2024
Merged

[Security Solution][Endpoint] Add validation to ensure a SentinelOne agent ID exists when enabling the Respond Take Action option #182158

merged 3 commits into from
May 1, 2024

Conversation

paul-tavares
Copy link
Contributor

@paul-tavares paul-tavares commented Apr 30, 2024 •
edited by kibanamachine

Summary

  • For alerts created against SentinelOne data: Fixes the display of "Respond" in the alert details panel "Take Action" menu so that it is disabled if the event data does not have the property that identifies the SentinelOne agent
    • A tooltip is displayed indicating why Responder is not available when it is disabled for this condition (see screen capture below)
image

Checklist

@paul-tavares paul-tavares added release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.14.0 v8.15.0 labels Apr 30, 2024
@paul-tavares paul-tavares self-assigned this Apr 30, 2024
@paul-tavares paul-tavares marked this pull request as ready for review April 30, 2024 16:15
@paul-tavares paul-tavares requested a review from a team as a code owner April 30, 2024 16:15
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

@paul-tavares paul-tavares requested review from a team, pzl, tomsonpl and ashokaditya and removed request for a team and pzl April 30, 2024 16:15
ashokaditya
ashokaditya approved these changes May 1, 2024
View reviewed changes
Copy link
Member

@ashokaditya ashokaditya left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for making a fix. I wasn't aware one could create a custom query and be able to query sentinel one alerts.

...curity_solution/public/detections/components/endpoint_responder/use_responder_action_data.ts Show resolved Hide resolved
@paul-tavares paul-tavares enabled auto-merge (squash) May 1, 2024 12:46
@paul-tavares paul-tavares merged commit 06f3c30 into elastic:main May 1, 2024
35 checks passed
@kibana-ci
Copy link
Collaborator

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 13.7MB 13.7MB +798.0B

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @paul-tavares

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request May 1, 2024
@paul-tavares
[Security Solution][Endpoint] Add validation to ensure a SentinelOne …
72656c9 
…agent ID exists when enabling the `Respond` Take Action option (elastic#182158)

## Summary

- For alerts created against SentinelOne data: Fixes the display of
"Respond" in the alert details panel "Take Action" menu so that it is
disabled if the event data does not have the property that identifies
the SentinelOne agent
- A tooltip is displayed indicating why Responder is not available when
it is disabled for this condition (see screen capture below)

(cherry picked from commit 06f3c30)
@kibanamachine kibanamachine mentioned this pull request May 1, 2024
Merged
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
✅ 8.14

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

@paul-tavares paul-tavares deleted the task/olm-9303-fix-responder-showing-for-events-with-no-obserser_serial_number branch May 1, 2024 14:07
@kibanamachine kibanamachine mentioned this pull request May 2, 2024
Merged
kibanamachine added a commit that referenced this pull request May 2, 2024
@kibanamachine @paul-tavares
[8.14] [Security Solution][Endpoint] Add validation to ensure a Senti…
29c68b4 
…nelOne agent ID exists when enabling the `Respond` Take Action option (#182158) (#182247)

# Backport

This will backport the following commits from `main` to `8.14`:
- [[Security Solution][Endpoint] Add validation to ensure a SentinelOne
agent ID exists when enabling the `Respond` Take Action option
(#182158)](#182158)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Paul
Tavares","email":"56442535+paul-tavares@users.noreply.github.com"},"sourceCommit":{"committedDate":"2024-05-01T13:55:54Z","message":"[Security
Solution][Endpoint] Add validation to ensure a SentinelOne agent ID
exists when enabling the `Respond` Take Action option (#182158)\n\n##
Summary\r\n\r\n- For alerts created against SentinelOne data: Fixes the
display of\r\n\"Respond\" in the alert details panel \"Take Action\"
menu so that it is\r\ndisabled if the event data does not have the
property that identifies\r\nthe SentinelOne agent\r\n- A tooltip is
displayed indicating why Responder is not available when\r\nit is
disabled for this condition (see screen capture
below)","sha":"06f3c30c9d1f58d9647ff73e1b2ff6ce582ba198","branchLabelMapping":{"^v8.15.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Defend
Workflows","v8.14.0","v8.15.0"],"title":"[Security Solution][Endpoint]
Add validation to ensure a SentinelOne agent ID exists when enabling the
`Respond` Take Action
option","number":182158,"url":"#182158
Solution][Endpoint] Add validation to ensure a SentinelOne agent ID
exists when enabling the `Respond` Take Action option (#182158)\n\n##
Summary\r\n\r\n- For alerts created against SentinelOne data: Fixes the
display of\r\n\"Respond\" in the alert details panel \"Take Action\"
menu so that it is\r\ndisabled if the event data does not have the
property that identifies\r\nthe SentinelOne agent\r\n- A tooltip is
displayed indicating why Responder is not available when\r\nit is
disabled for this condition (see screen capture
below)","sha":"06f3c30c9d1f58d9647ff73e1b2ff6ce582ba198"}},"sourceBranch":"main","suggestedTargetBranches":["8.14"],"targetPullRequestStates":[{"branch":"8.14","label":"v8.14.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.15.0","branchLabelMappingKey":"^v8.15.0$","isSourceBranch":true,"state":"MERGED","url":"#182158
Solution][Endpoint] Add validation to ensure a SentinelOne agent ID
exists when enabling the `Respond` Take Action option (#182158)\n\n##
Summary\r\n\r\n- For alerts created against SentinelOne data: Fixes the
display of\r\n\"Respond\" in the alert details panel \"Take Action\"
menu so that it is\r\ndisabled if the event data does not have the
property that identifies\r\nthe SentinelOne agent\r\n- A tooltip is
displayed indicating why Responder is not available when\r\nit is
disabled for this condition (see screen capture
below)","sha":"06f3c30c9d1f58d9647ff73e1b2ff6ce582ba198"}}]}]
BACKPORT-->

Co-authored-by: Paul Tavares <56442535+paul-tavares@users.noreply.github.com>
yuliacech pushed a commit to yuliacech/kibana that referenced this pull request May 3, 2024
@paul-tavares @yuliacech
[Security Solution][Endpoint] Add validation to ensure a SentinelOne …
a2009ab 
…agent ID exists when enabling the `Respond` Take Action option (elastic#182158)

## Summary

- For alerts created against SentinelOne data: Fixes the display of
"Respond" in the alert details panel "Take Action" menu so that it is
disabled if the event data does not have the property that identifies
the SentinelOne agent
- A tooltip is displayed indicating why Responder is not available when
it is disabled for this condition (see screen capture below)
@dasansol92 dasansol92 mentioned this pull request May 3, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ashokaditya ashokaditya ashokaditya approved these changes

@parkiino parkiino parkiino approved these changes

@tomsonpl tomsonpl Awaiting requested review from tomsonpl tomsonpl was automatically assigned from elastic/security-defend-workflows

Assignees

@paul-tavares paul-tavares

Labels
release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.14.0 v8.15.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@paul-tavares @elasticmachine @kibana-ci @kibanamachine @ashokaditya @parkiino