[SecuritySolution][Endpoint] Add `scan` response action API #184437

ashokaditya · 2024-05-29T14:30:26Z

Summary

Adds a scan action response route and related server side logic to handle scan action response.

Note: A lot of the changes in the PR are due to test updates that resulted out of adding scan command to list of API commands.

Testing

Add responseActionScanEnabled feature flag to xpack.securitySolution.enableExperimental
Run ES/Kibana
Run node x-pack/plugins/security_solution/scripts/endpoint/run_endpoint_agent.js to start a VM with Elastic Defend installed.
Visit app/security/administration/endpoints and click on the endpoint on the endpoint list.
Copy the endpoint id (selected_endpopint) from the URL.
Use curl to send out a scan request to the endpoint with elastic user. Use the curl command below:

curl


curl --location 'http://localhost:5601/api/endpoint/action/scan' \
--header 'kbn-xsrf: test-xsrf' \
--header 'Content-Type: application/json' \
--header 'Authorization: Basic ZWxhc3RpYzpjaGFuZ2VtZQ==' \
--data '{
    "endpoint_ids": [
        "copied_endpoint_id"
    ],
    "parameters": {
        "path": "/home/ubuntu"
    }
}'

You should see the action created on the response actions history for the endpoint.
Using any other non existing file path will result in a failed action. UX work to address this will follow.
Disabling/removing responseActionScanEnabled feature flag should give you a not found error when accessing the API.

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios
Flaky Test Runner was used on any tests changed

closes elastic/security-team/issues/8991

ashokaditya · 2024-05-29T16:01:40Z

/ci

ashokaditya · 2024-05-30T09:44:06Z

/ci

ashokaditya · 2024-05-30T11:15:00Z

/ci

elasticmachine · 2024-05-30T13:43:38Z

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

refs changes in https://github.com/elastic/kibana/pull/165473/files#diff-b109782d19f6167e0bad2fefe051cde6ab7338fdfbf9896e31c15a080ef008dfR33

paul-tavares

Looks great - thank you.

I left a few minor comments, but am 👍 it. Note that i did not run it locally - only did code review

paul-tavares · 2024-05-31T14:43:34Z

x-pack/plugins/security_solution/common/endpoint/schema/actions.test.ts

@@ -759,4 +759,6 @@ describe('actions schemas', () => {
      }).toThrow('[file]: expected value of type [Stream] but got [Object]');
    });
  });
+
+  describe('ScanActionRequestSchema', () => {});


still working on these?

Oh yeah. I need to add these 😅

done c44b3e6

paul-tavares · 2024-05-31T14:47:05Z

...olution/public/management/cypress/e2e/serverless/feature_access/complete_with_endpoint.cy.ts

@@ -47,7 +47,10 @@ describe(
        });
      }

-      for (const actionName of RESPONSE_ACTION_API_COMMANDS_NAMES) {
+      // TODO: update tests when `scan` is included in PLIs


Remind me: we have an issue tracking that, correct?

Not a separate ticket but the same API ticket has an item in it.

paul-tavares · 2024-05-31T14:53:02Z

...y_solution/server/endpoint/services/actions/clients/endpoint/endpoint_actions_client.test.ts

@@ -261,6 +261,8 @@ describe('EndpointActionsClient', () => {
    execute: responseActionsClientMock.createExecuteOptions(getCommonResponseActionOptions()),

    upload: responseActionsClientMock.createUploadOptions(getCommonResponseActionOptions()),
+
+    scan: responseActionsClientMock.createUploadOptions(getCommonResponseActionOptions()),


using incorrect mock here. Should create one that is specific for scan (even if the same options as upload are returned). Will prevent issues if we ever enhance one command to add more parameters, but not for the others that maybe reusing the same props

Sheesh! Yeah I'll update this as well. Thanks for catching this.

FYI: I think that for isolate/release I created two separate functions out of responseActionsClientMock, but internally In that mock file) its actually using the same payload for both. This ensure that consumers of the mock still use the appropriate mock creation function and if we need to ever change them to differ from each other, then only the mock provider internal logic needs to be changed.

done 881a8bb

…-fix'

review changes

tomsonpl

Lgtm 👍 added some comments, thanks for considering them :)

tomsonpl · 2024-06-03T12:01:46Z

x-pack/plugins/security_solution/common/api/endpoint/actions/get_file.schema.yaml

@@ -30,7 +30,6 @@ components:
        - type: object
          required:
            - parameters
-            - file


Was this removed on purpose?

yes. The file param is redundant. The schema needs a parameters only.

tomsonpl · 2024-06-03T12:13:46Z

...s/security_solution/public/management/cypress/e2e/serverless/feature_access/essentials.cy.ts

-        (apiName) => apiName !== 'unisolate'
-      )) {
+        (apiName) => apiName !== 'scan'
+      ).filter((apiName) => apiName !== 'unisolate')) {


I don't understand the double .filter() here, what do you think about the following? :

for (const actionName of RESPONSE_ACTION_API_COMMANDS_NAMES.filter( (apiName) => apiName !== 'unisolate' && apiName !== 'scan' )) {

Yeah that works the same way. I added another filter function just so that it is easier to delete later and not confuse with the logic for excluding release action from tests

tomsonpl · 2024-06-03T12:16:15Z

x-pack/plugins/security_solution/server/endpoint/services/actions/action_list.test.ts

@@ -95,6 +95,7 @@ describe('When using `getActionList()', () => {
          agentType: 'endpoint',
          hosts: { 'agent-a': { name: 'Host-agent-a' } },
          command: 'kill-process',
+          alertIds: undefined,


Why do we need these changes?

The test needed to be updated as the API command list is now changed resulting in the endpoint action generator (that uses that) now picks the execute command for the tests instead.

kibana-ci · 2024-06-03T20:22:48Z

💚 Build Succeeded

Buildkite Build
Commit: 63d93c5

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	15.3MB	15.3MB	+1.0KB

Unknown metric groups

ESLint disabled in files

id	before	after	diff
`securitySolution`	81	82	+1

Total ESLint disabled count

id	before	after	diff
`securitySolution`	606	607	+1

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @ashokaditya

…184437) ## Summary Adds a `scan` action response route and related server side logic to handle `scan` action response. Note: A lot of the changes in the PR are due to test updates that resulted out of adding `scan` command to list of API commands. ### Testing 1. Add `responseActionScanEnabled` feature flag to `xpack.securitySolution.enableExperimental` 2. Run ES/Kibana 3. Run `node x-pack/plugins/security_solution/scripts/endpoint/run_endpoint_agent.js` to start a VM with Elastic Defend installed. 4. Visit `app/security/administration/endpoints` and click on the endpoint on the endpoint list. 5. Copy the endpoint id (`selected_endpopint`) from the URL. 6. Use `curl` to send out a `scan` request to the endpoint with `elastic` user. Use the curl command below: <details><summary>curl</summary> <code> curl --location 'http://localhost:5601/api/endpoint/action/scan' \ --header 'kbn-xsrf: test-xsrf' \ --header 'Content-Type: application/json' \ --header 'Authorization: Basic ZWxhc3RpYzpjaGFuZ2VtZQ==' \ --data '{ "endpoint_ids": [ "copied_endpoint_id" ], "parameters": { "path": "/home/ubuntu" } }' </code> </details> 7. You should see the action created on the response actions history for the endpoint. 8. Using any other non existing file path will result in a failed action. UX work to address this will follow. 9. Disabling/removing `responseActionScanEnabled` feature flag should give you a not found error when accessing the API. ### Checklist - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

refs elastic/pull/184437

Add scan action request API

2ccc4e5

closes elastic/security-team/issues/8991

ashokaditya self-assigned this May 29, 2024

ashokaditya added release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution OLM Sprint v8.15.0 labels May 29, 2024

ashokaditya added 2 commits May 30, 2024 10:57

fix types

db07eb3

fix tests

b27d2a8

ashokaditya force-pushed the task/dw-scan-response-action-api branch from 4e78e38 to b27d2a8 Compare May 30, 2024 09:43

ashokaditya added 3 commits May 30, 2024 12:58

route behind feature flag

e5f4b8c

fix type

9e62e59

fix tests

ae882df

ashokaditya force-pushed the task/dw-scan-response-action-api branch from c339810 to ae882df Compare May 30, 2024 11:14

ashokaditya marked this pull request as ready for review May 30, 2024 13:43

ashokaditya requested a review from a team as a code owner May 30, 2024 13:43

ashokaditya requested review from pzl and parkiino May 30, 2024 13:43

ashokaditya requested a review from paul-tavares May 30, 2024 13:44

ashokaditya and others added 5 commits May 30, 2024 16:16

Merge branch 'main' into task/dw-scan-response-action-api

4fdc8a3

remove redundant schema field

42c4454

refs changes in https://github.com/elastic/kibana/pull/165473/files#diff-b109782d19f6167e0bad2fefe051cde6ab7338fdfbf9896e31c15a080ef008dfR33

Merge branch 'main' into task/dw-scan-response-action-api

3b6cf46

Merge branch 'main' into task/dw-scan-response-action-api

3ae76aa

Merge branch 'main' into task/dw-scan-response-action-api

8fa21e2

paul-tavares approved these changes May 31, 2024

View reviewed changes

ashokaditya and others added 2 commits June 3, 2024 09:56

Merge branch 'main' into task/dw-scan-response-action-api

ea349a0

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

8cb121a

…-fix'

ashokaditya added 2 commits June 3, 2024 12:02

fix mock creation

881a8bb

review changes

Update actions.test.ts

c44b3e6

pzl approved these changes Jun 3, 2024

View reviewed changes

tomsonpl approved these changes Jun 3, 2024

View reviewed changes

ashokaditya and others added 2 commits June 3, 2024 15:07

update generator action errors for scan

471539e

Merge branch 'main' into task/dw-scan-response-action-api

e72d14c

ashokaditya enabled auto-merge (squash) June 3, 2024 13:09

ashokaditya added 5 commits June 3, 2024 15:47

Merge branch 'main' into task/dw-scan-response-action-api

022377b

Merge branch 'main' into task/dw-scan-response-action-api

a548ffc

Merge branch 'main' into task/dw-scan-response-action-api

3db5e62

Merge branch 'main' into task/dw-scan-response-action-api

23e73ef

Merge branch 'main' into task/dw-scan-response-action-api

63d93c5

ashokaditya merged commit 1203de2 into elastic:main Jun 3, 2024
36 checks passed

kibanamachine added the backport:skip This commit does not require backporting label Jun 3, 2024

ashokaditya deleted the task/dw-scan-response-action-api branch June 3, 2024 21:02

ashokaditya added a commit to ashokaditya/kibana that referenced this pull request Jun 17, 2024

Typo correction

e42a063

refs elastic/pull/184437

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SecuritySolution][Endpoint] Add `scan` response action API #184437

[SecuritySolution][Endpoint] Add `scan` response action API #184437

ashokaditya commented May 29, 2024 •

edited

Loading

ashokaditya commented May 29, 2024

ashokaditya commented May 30, 2024

ashokaditya commented May 30, 2024

elasticmachine commented May 30, 2024

paul-tavares left a comment

paul-tavares May 31, 2024

ashokaditya May 31, 2024

ashokaditya Jun 3, 2024

paul-tavares May 31, 2024

ashokaditya May 31, 2024

paul-tavares May 31, 2024

ashokaditya May 31, 2024

paul-tavares May 31, 2024

ashokaditya Jun 3, 2024

tomsonpl left a comment

tomsonpl Jun 3, 2024

ashokaditya Jun 3, 2024

tomsonpl Jun 3, 2024

ashokaditya Jun 3, 2024

tomsonpl Jun 3, 2024

ashokaditya Jun 3, 2024

kibana-ci commented Jun 3, 2024

ESLint disabled in files

Total ESLint disabled count

[SecuritySolution][Endpoint] Add scan response action API #184437

[SecuritySolution][Endpoint] Add scan response action API #184437

Conversation

ashokaditya commented May 29, 2024 • edited Loading

Summary

Testing

Checklist

ashokaditya commented May 29, 2024

ashokaditya commented May 30, 2024

ashokaditya commented May 30, 2024

elasticmachine commented May 30, 2024

paul-tavares left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tomsonpl left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kibana-ci commented Jun 3, 2024

💚 Build Succeeded

Metrics [docs]

Async chunks

ESLint disabled in files

Total ESLint disabled count

History

[SecuritySolution][Endpoint] Add `scan` response action API #184437

[SecuritySolution][Endpoint] Add `scan` response action API #184437

ashokaditya commented May 29, 2024 •

edited

Loading