[Security Solution] Exceptions TTL Follow-up #151952

dplumlee · 2023-02-22T23:30:58Z

Summary

Addresses a number of bugs that were found in the original Exceptions TTL PR:

[Security Solution] Expiration date cannot be removed from the exception #151102
[Security Solution] Expiration date on exceptions are not duplicated when duplicating a rule #151100

Also strips out the UI elements for endpoint exception TTL - to be reimplemented in a later PR

PUT update route

Adds another update method to the exceptions list client as our existing method uses a PATCH style update wherein any undefined values don't get unset, they just remain unchanged. For the expire_time field, we couldn't use this style, and so this PR switches the update exception list item route to utilize the new method which should act identical in all cases from the users perspective except fixing the existing bug listed above where expire_time fields are unable to be unset.

Checklist

Delete any items that are not applicable to this PR.

Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios

For maintainers

This was checked for breaking API changes and was labeled appropriately

x-pack/plugins/lists/server/services/exception_lists/put_update_exception_list_item.ts

dplumlee · 2023-02-27T03:47:58Z

@elasticmachine merge upstream

kibana-ci · 2023-02-28T22:15:59Z

💚 Build Succeeded

Buildkite Build
Commit: f79a48e

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`lists`	93	94	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`lists`	152.8KB	152.8KB	-30.0B
`securitySolution`	15.7MB	15.7MB	+1.2KB
total			+1.1KB

Unknown metric groups

API count

id	before	after	diff
`lists`	208	210	+2

ESLint disabled line counts

id	before	after	diff
`securitySolution`	428	430	+2

Total ESLint disabled count

id	before	after	diff
`securitySolution`	506	508	+2

History

💛 Build #110525 was flaky da1023ec3c5dc96a21dbc693e6a044dbff0a4a15
💔 Build #110524 failed e843f54
💚 Build #110444 succeeded 024fff3
💚 Build #109873 succeeded 71f2f78
💔 Build #109872 failed 5863b4c

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @dplumlee

banderror

The removed TODO comment LGTM 👍 🙂

dhurley14

I think this looks great! thanks for the bug fixes!

yctercero

Code LGTM. Pulled down and tested:

creating non endpoint exception item with ttl
waiting to see it expire and it switch over to only showing under expired filter in rule details exceptions tab
edited ttl
removed ttl from item
created endpoint exception and made sure it wasn't showing there
created trusted apps and made sure it wasn't showing there
made sure I could not create an endpoint exception item with TTL via API
made sure I could not modify created_by during update

It would be great to add cypress tests for this flow.

yctercero · 2023-03-02T23:14:55Z

x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts

@@ -579,6 +578,11 @@ export class ExceptionListClient {

  /**
   * Update an existing exception list item
+   *
+   * NOTE: This method will PATCH the targeted exception list item, not fully overwrite it.


Should we update the exception docs? This may already be in the works, but this is what we have right now I think - https://www.elastic.co/guide/en/security/current/exceptions-api-update-item.html

Hmm probably worth updating them since the behavior will be different, I'll reach out to docs team

dplumlee · 2023-03-03T23:56:18Z

@yctercero Agreed, have cypress tests coming for this and a few other workflows in this PR

kibanamachine · 2023-03-04T00:01:39Z

💚 All backports created successfully

Status	Branch	Result
✅	8.7

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

(cherry picked from commit 203fa3a)

kibanamachine · 2023-03-04T00:02:08Z

💚 All backports created successfully

Status	Branch	Result
✅	8.7

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

# Backport This will backport the following commits from `main` to `8.7`: - [[Security Solution] Exceptions TTL Follow-up (#151952)](#151952)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  --------- Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com> Co-authored-by: Davis Plumlee <davis.plumlee@elastic.co>

Addresses #152653 Fixes a merge conflict that somehow made its way into main between these two PRs ([1](#152301), [2](#151952))

Addresses elastic#152653 Fixes a merge conflict that somehow made its way into main between these two PRs ([1](elastic#152301), [2](elastic#151952))

removes endpoint stuff and adds put route

5863b4c

dplumlee added bug Fixes for quality problems that affect the customer experience release_note:skip Skip the PR/issue when compiling release notes Team:Detection Alerts Security Detection Alerts Area Team v8.7.0 labels Feb 22, 2023

dplumlee self-assigned this Feb 22, 2023

dplumlee added the v8.8.0 label Feb 22, 2023

removes console log

71f2f78

dplumlee marked this pull request as ready for review February 23, 2023 19:52

dplumlee requested a review from a team as a code owner February 23, 2023 19:52

dplumlee requested a review from marshallmain February 23, 2023 19:56

marshallmain reviewed Feb 24, 2023

View reviewed changes

x-pack/plugins/lists/server/services/exception_lists/put_update_exception_list_item.ts Outdated Show resolved Hide resolved

dplumlee added 3 commits February 24, 2023 15:25

updates names

9f3ce75

fixes typo

024fff3

Merge remote-tracking branch 'upstream/main' into expire-time-follow-up

e843f54

dplumlee added 2 commits February 28, 2023 14:43

gets rid of endpoint options

006b19c

Merge remote-tracking branch 'upstream/main' into expire-time-follow-up

128ee1c

dplumlee force-pushed the expire-time-follow-up branch from da1023e to 128ee1c Compare February 28, 2023 19:44

removes endpoint details ttl modal

f79a48e

dplumlee requested a review from a team as a code owner February 28, 2023 20:07

dplumlee requested a review from banderror February 28, 2023 20:07

banderror approved these changes Mar 1, 2023

View reviewed changes

dhurley14 self-requested a review March 1, 2023 17:25

peluja1012 mentioned this pull request Mar 1, 2023

[Security Solution]User is not able to remove added expired date from exception. #152447

Closed

dhurley14 approved these changes Mar 3, 2023

View reviewed changes

yctercero approved these changes Mar 3, 2023

View reviewed changes

dplumlee merged commit 203fa3a into elastic:main Mar 3, 2023

dplumlee added the backport:prev-minor Backport to (9.0) the previous minor version (i.e. one version back from main) label Mar 3, 2023

kibanamachine mentioned this pull request Mar 4, 2023

[8.7] [Security Solution] Exceptions TTL Follow-up (#151952) #152645

Merged

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Mar 4, 2023

[Security Solution] Exceptions TTL Follow-up (elastic#151952)

98d9d15

(cherry picked from commit 203fa3a)

dplumlee deleted the expire-time-follow-up branch March 4, 2023 00:04

dplumlee mentioned this pull request Mar 5, 2023

[Security Solution] Fixes breaking type in main #152654

Merged

4 tasks

dplumlee added a commit that referenced this pull request Mar 5, 2023

[Security Solution] Fixes breaking type in main (#152654)

05f306c

Addresses #152653 Fixes a merge conflict that somehow made its way into main between these two PRs ([1](#152301), [2](#151952))

bmorelli25 pushed a commit to bmorelli25/kibana that referenced this pull request Mar 10, 2023

[Security Solution] Exceptions TTL Follow-up (elastic#151952)

1761a40

nastasha-solomon mentioned this pull request Mar 21, 2023

Rule exceptions can expire elastic/security-docs#2891

Closed

15 tasks

nastasha-solomon mentioned this pull request Mar 22, 2023

8.7.0 Release notes elastic/security-docs#2884

Closed

15 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution] Exceptions TTL Follow-up #151952

[Security Solution] Exceptions TTL Follow-up #151952

dplumlee commented Feb 22, 2023 •

edited by kibanamachine

Loading

dplumlee commented Feb 27, 2023

kibana-ci commented Feb 28, 2023

API count

ESLint disabled line counts

Total ESLint disabled count

banderror left a comment

dhurley14 left a comment

yctercero left a comment •

edited

Loading

yctercero Mar 2, 2023

dplumlee Mar 3, 2023

dplumlee commented Mar 3, 2023

kibanamachine commented Mar 4, 2023

kibanamachine commented Mar 4, 2023

[Security Solution] Exceptions TTL Follow-up #151952

[Security Solution] Exceptions TTL Follow-up #151952

Conversation

dplumlee commented Feb 22, 2023 • edited by kibanamachine Loading

Summary

PUT update route

Checklist

For maintainers

dplumlee commented Feb 27, 2023

kibana-ci commented Feb 28, 2023

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Async chunks

API count

ESLint disabled line counts

Total ESLint disabled count

History

banderror left a comment

Choose a reason for hiding this comment

dhurley14 left a comment

Choose a reason for hiding this comment

yctercero left a comment • edited Loading

Choose a reason for hiding this comment

yctercero Mar 2, 2023

Choose a reason for hiding this comment

dplumlee Mar 3, 2023

Choose a reason for hiding this comment

dplumlee commented Mar 3, 2023

kibanamachine commented Mar 4, 2023

💚 All backports created successfully

Questions ?

kibanamachine commented Mar 4, 2023

💚 All backports created successfully

Questions ?

dplumlee commented Feb 22, 2023 •

edited by kibanamachine

Loading

yctercero left a comment •

edited

Loading