github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 01:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

[EDR Workflows] Enable UI for Automated Actions in more rule types (#193390)

Browse source
This commit is contained in:
Tomasz Ciecierski 2024-09-26 15:56:42 +02:00 • committed by GitHub
parent d6c8840a56
commit 357a82c8a7
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 6 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

9
x-pack/plugins/security_solution/common/detection_engine/utils.ts
View file

@ -94,13 +94,8 @@ export const isSuppressionRuleInGA = (ruleType: Type): boolean => {
return isSuppressibleAlertRule(ruleType) && SUPPRESSIBLE_ALERT_RULES_GA.includes(ruleType);
};
export const shouldShowResponseActions = (
ruleType: Type | undefined,
automatedResponseActionsForMoreRulesEnabled: boolean
) => {
export const shouldShowResponseActions = (ruleType: Type | undefined) => {
return (
isQueryRule(ruleType) ||
(automatedResponseActionsForMoreRulesEnabled &&
(isEsqlRule(ruleType) || isEqlRule(ruleType) || isNewTermsRule(ruleType)))
isQueryRule(ruleType) || isEsqlRule(ruleType) || isEqlRule(ruleType) || isNewTermsRule(ruleType)
);
};

5
x-pack/plugins/security_solution/common/experimental_features.ts
View file

@ -52,11 +52,6 @@ export const allowedExperimentalValues = Object.freeze({
*/
automatedProcessActionsEnabled: true,
/**
* Temporary feature flag to enable the Response Actions in Rules UI - intermediate release
*/
automatedResponseActionsForMoreRulesEnabled: false,
/**
* Enables the ability to send Response actions to SentinelOne and persist the results
* in ES. Adds API changes to support `agentType` and supports `isolate` and `release`

9
x-pack/plugins/security_solution/public/detection_engine/rule_creation/components/step_rule_actions/index.tsx
View file

@ -16,7 +16,6 @@ import type {
} from '@kbn/triggers-actions-ui-plugin/public';
import { UseArray } from '@kbn/es-ui-shared-plugin/static/forms/hook_form_lib';
import type { Type } from '@kbn/securitysolution-io-ts-alerting-types';
import { useIsExperimentalFeatureEnabled } from '../../../../common/hooks/use_experimental_features';
import { shouldShowResponseActions } from '../../../../../common/detection_engine/utils';
import type { RuleObjectId } from '../../../../../common/api/detection_engine/model/rule_schema';
import { ResponseActionsForm } from '../../../rule_response_actions/response_actions_form';
@ -85,9 +84,7 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
const {
services: { application },
} = useKibana();
const automatedResponseActionsForMoreRulesEnabled = useIsExperimentalFeatureEnabled(
'automatedResponseActionsForMoreRulesEnabled'
);
const displayActionsOptions = useMemo(
() => (
<>
@ -105,7 +102,7 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
[actionMessageParams, summaryActionMessageParams]
);
const displayResponseActionsOptions = useMemo(() => {
if (shouldShowResponseActions(ruleType, automatedResponseActionsForMoreRulesEnabled)) {
if (shouldShowResponseActions(ruleType)) {
return (
<UseArray path="responseActions" initialNumberOfItems={0}>
{ResponseActionsForm}
@ -113,7 +110,7 @@ const StepRuleActionsComponent: FC<StepRuleActionsProps> = ({
);
}
return null;
}, [ruleType, automatedResponseActionsForMoreRulesEnabled]);
}, [ruleType]);
// only display the actions dropdown if the user has "read" privileges for actions
const displayActionsDropDown = useMemo(() => {
return application.capabilities.actions.show ? (

1
x-pack/plugins/security_solution/public/management/cypress/e2e/automated_response_actions/form.cy.ts
View file

@ -30,7 +30,6 @@ describe(
kbnServerArgs: [
`--xpack.securitySolution.enableExperimental=${JSON.stringify([
'automatedProcessActionsEnabled',
'automatedResponseActionsForMoreRulesEnabled',
])}`,
],
},

9
x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/utils/validate.ts
View file

@ -70,14 +70,7 @@ export const validateResponseActionsPermissions = async (
ruleUpdate: RuleCreateProps | RuleUpdateProps,
existingRule?: RuleAlertType | null
): Promise<void> => {
const { experimentalFeatures } = await securitySolution.getConfig();
if (
!shouldShowResponseActions(
ruleUpdate.type,
experimentalFeatures.automatedResponseActionsForMoreRulesEnabled
)
) {
if (!shouldShowResponseActions(ruleUpdate.type)) {
return;
}