github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 01:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

[Security Solution] blocklist list fixup (#126629)

Browse source
This commit is contained in:
Joey F. Poon 2022-03-02 09:03:58 -06:00 • committed by GitHub
parent 0fb3c9deaa
commit e89e5dbf86
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
6 changed files with 13 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

2
x-pack/plugins/security_solution/common/endpoint/data_generators/exceptions_list_item_generator.ts
View file

@ -256,7 +256,7 @@ export class ExceptionsListItemGenerator extends BaseDataGenerator<ExceptionList
return this.generate({
name: `Blocklist ${this.randomString(5)}`,
list_id: ENDPOINT_BLOCKLISTS_LIST_ID,
item_id: `generator_endpoint_blocklist_${this.randomUUID()}`,
item_id: `generator_endpoint_blocklist_${this.seededUUIDv4()}`,
os_types: ['windows'],
entries: [
this.randomChoice([

2
x-pack/plugins/security_solution/common/endpoint/service/artifacts/constants.ts
View file

@ -9,6 +9,7 @@ import {
ENDPOINT_TRUSTED_APPS_LIST_ID,
ENDPOINT_EVENT_FILTERS_LIST_ID,
ENDPOINT_HOST_ISOLATION_EXCEPTIONS_LIST_ID,
ENDPOINT_BLOCKLISTS_LIST_ID,
} from '@kbn/securitysolution-list-constants';
export const BY_POLICY_ARTIFACT_TAG_PREFIX = 'policy:';
@ -19,6 +20,7 @@ export const ALL_ENDPOINT_ARTIFACT_LIST_IDS: readonly string[] = [
ENDPOINT_TRUSTED_APPS_LIST_ID,
ENDPOINT_EVENT_FILTERS_LIST_ID,
ENDPOINT_HOST_ISOLATION_EXCEPTIONS_LIST_ID,
ENDPOINT_BLOCKLISTS_LIST_ID,
];
export const DEFAULT_EXCEPTION_LIST_ITEM_SEARCHABLE_FIELDS: Readonly<string[]> = [

2
x-pack/plugins/security_solution/public/management/pages/blocklist/services/index.ts
View file

@ -5,4 +5,4 @@
* 2.0.
*/
export * from './blocklists_api_client';
export { BlocklistsApiClient } from './blocklists_api_client';

2
x-pack/plugins/security_solution/public/management/pages/blocklist/view/blocklist.tsx
View file

@ -39,7 +39,7 @@ const BLOCKLIST_PAGE_LABELS: ArtifactListPageProps['labels'] = {
defaultMessage: 'Blocklist',
}),
pageAboutInfo: i18n.translate('xpack.securitySolution.blocklist.pageAboutInfo', {
defaultMessage: 'Add a blocklist to block applications or files from running.',
defaultMessage: 'Add a blocklist to block applications or files from running on the endpoint.',
}),
pageAddButtonTitle: i18n.translate('xpack.securitySolution.blocklist.pageAddButtonTitle', {
defaultMessage: 'Add blocklist entry',

8
x-pack/plugins/security_solution/server/fleet_integration/fleet_integration.test.ts
View file

@ -41,8 +41,8 @@ import { Manifest } from '../endpoint/lib/artifacts';
import { NewPackagePolicy } from '../../../fleet/common/types/models';
import { ManifestSchema } from '../../common/endpoint/schema/manifest';
import { DeletePackagePoliciesResponse } from '../../../fleet/common';
import { ARTIFACT_LISTS_IDS_TO_REMOVE } from './handlers/remove_policy_from_artifacts';
import { createMockPolicyData } from '../endpoint/services/feature_usage';
import { ALL_ENDPOINT_ARTIFACT_LIST_IDS } from '../../common/endpoint/service/artifacts/constants';
describe('ingest_integration tests ', () => {
let endpointAppContextMock: EndpointAppContextServiceStartContract;
@ -334,11 +334,11 @@ describe('ingest_integration tests ', () => {
await invokeDeleteCallback();
expect(exceptionListClient.findExceptionListsItem).toHaveBeenCalledWith({
listId: ARTIFACT_LISTS_IDS_TO_REMOVE,
filter: ARTIFACT_LISTS_IDS_TO_REMOVE.map(
listId: ALL_ENDPOINT_ARTIFACT_LIST_IDS,
filter: ALL_ENDPOINT_ARTIFACT_LIST_IDS.map(
() => `exception-list-agnostic.attributes.tags:"policy:${policyId}"`
),
namespaceType: ARTIFACT_LISTS_IDS_TO_REMOVE.map(() => 'agnostic'),
namespaceType: ALL_ENDPOINT_ARTIFACT_LIST_IDS.map(() => 'agnostic'),
page: 1,
perPage: 50,
sortField: undefined,

18
x-pack/plugins/security_solution/server/fleet_integration/handlers/remove_policy_from_artifacts.ts
View file

@ -7,19 +7,9 @@
import pMap from 'p-map';
import {
ENDPOINT_TRUSTED_APPS_LIST_ID,
ENDPOINT_EVENT_FILTERS_LIST_ID,
ENDPOINT_HOST_ISOLATION_EXCEPTIONS_LIST_ID,
} from '@kbn/securitysolution-list-constants';
import { ExceptionListClient } from '../../../../lists/server';
import { PostPackagePolicyDeleteCallback } from '../../../../fleet/server';
export const ARTIFACT_LISTS_IDS_TO_REMOVE = [
ENDPOINT_TRUSTED_APPS_LIST_ID,
ENDPOINT_EVENT_FILTERS_LIST_ID,
ENDPOINT_HOST_ISOLATION_EXCEPTIONS_LIST_ID,
];
import { ALL_ENDPOINT_ARTIFACT_LIST_IDS } from '../../../common/endpoint/service/artifacts/constants';
/**
* Removes policy from artifacts
@ -32,11 +22,11 @@ export const removePolicyFromArtifacts = async (
const findArtifactsByPolicy = (currentPage: number) => {
return exceptionsClient.findExceptionListsItem({
listId: ARTIFACT_LISTS_IDS_TO_REMOVE,
filter: ARTIFACT_LISTS_IDS_TO_REMOVE.map(
listId: ALL_ENDPOINT_ARTIFACT_LIST_IDS as string[],
filter: ALL_ENDPOINT_ARTIFACT_LIST_IDS.map(
() => `exception-list-agnostic.attributes.tags:"policy:${policy.id}"`
),
namespaceType: ARTIFACT_LISTS_IDS_TO_REMOVE.map(() => 'agnostic'),
namespaceType: ALL_ENDPOINT_ARTIFACT_LIST_IDS.map(() => 'agnostic'),
page: currentPage,
perPage: 50,
sortField: undefined,