github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 09:48:58 -04:00
Code Issues Projects Releases Packages Wiki Activity

[EDR Workflows] Fix CrowdStrike's runscript availability in Defend (#211889)

Browse source
This commit is contained in:
Tomasz Ciecierski 2025-02-25 17:37:45 +01:00 • committed by GitHub
parent 464a471446
commit 7bd5aa6fba
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 8 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

15
x-pack/solutions/security/plugins/security_solution/public/management/components/endpoint_responder/lib/console_commands_definition.ts
View file

@ -171,7 +171,7 @@ export const getEndpointConsoleCommands = ({
const crowdstrikeRunScriptEnabled = featureFlags.crowdstrikeRunScriptEnabled;
const doesEndpointSupportCommand = (commandName: ConsoleResponseActionCommands) => {
// Agent capabilities is only validated for Endpoint agent types
// Agent capabilities are only validated for Endpoint agent types
if (agentType !== 'endpoint') {
return true;
}
@ -530,7 +530,7 @@ export const getEndpointConsoleCommands = ({
name: 'runscript',
about: getCommandAboutInfo({
aboutInfo: CROWDSTRIKE_CONSOLE_COMMANDS.runscript.about,
isSupported: doesEndpointSupportCommand('runscript'),
isSupported: agentType === 'crowdstrike' && doesEndpointSupportCommand('runscript'),
}),
RenderComponent: RunScriptActionResult,
meta: {
@ -583,11 +583,12 @@ export const getEndpointConsoleCommands = ({
helpGroupLabel: HELP_GROUPS.responseActions.label,
helpGroupPosition: HELP_GROUPS.responseActions.position,
helpCommandPosition: 9,
helpDisabled: !doesEndpointSupportCommand('runscript'),
helpHidden: !getRbacControl({
commandName: 'runscript',
privileges: endpointPrivileges,
}),
helpDisabled: !doesEndpointSupportCommand('runscript') || agentType !== 'crowdstrike',
helpHidden:
!getRbacControl({
commandName: 'runscript',
privileges: endpointPrivileges,
}) || agentType !== 'crowdstrike',
});
}