[Security Solution][Endpoint] Guided onboarding configures events only for endpoint policy

x-pack/plugins/security_solution/common/endpoint/models/policy_config.ts

@@ -200,7 +200,7 @@ export const policyFactoryWithoutPaidFeatures = (
         ...policy.windows.popup,
         malware: {
           message: '',
-          enabled: true,
+          enabled: true, // disabling/configuring malware popup is a paid feature
         },
         ransomware: {
           message: '',
@@ -230,7 +230,7 @@ export const policyFactoryWithoutPaidFeatures = (
         ...policy.mac.popup,
         malware: {
           message: '',
-          enabled: true,
+          enabled: true, // disabling/configuring malware popup is a paid feature
         },
         memory_protection: {
           message: '',
@@ -256,7 +256,7 @@ export const policyFactoryWithoutPaidFeatures = (
         ...policy.linux.popup,
         malware: {
           message: '',
-          enabled: true,
+          enabled: true, // disabling/configuring malware popup is a paid feature
         },
         memory_protection: {
           message: '',
@@ -272,7 +272,7 @@ export const policyFactoryWithoutPaidFeatures = (
 };
 
 /**
- * Strips paid features from an existing or new `PolicyConfig` for gold and below license
+ * Enables support for paid features for an existing or new `PolicyConfig` for platinum and above license
  */
 export const policyFactoryWithSupportedFeatures = (
   policy: PolicyConfig = policyFactory()

x-pack/plugins/security_solution/common/endpoint/models/policy_config_helpers.test.ts

@@ -0,0 +1,175 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { PolicyConfig } from '../types';
+import { ProtectionModes } from '../types';
+import { policyFactory } from './policy_config';
+import { disableProtections } from './policy_config_helpers';
+
+describe('Policy Config helpers', () => {
+  describe('disableProtections', () => {
+    it('disables all the protections in the default policy', () => {
+      expect(disableProtections(policyFactory())).toEqual<PolicyConfig>(eventsOnlyPolicy);
+    });
+
+    it('does not enable supported fields', () => {
+      const defaultPolicy: PolicyConfig = policyFactory();
+
+      const notSupported: PolicyConfig['windows']['memory_protection'] = {
+        mode: ProtectionModes.off,
+        supported: false,
+      };
+
+      const inputPolicyWithoutSupportedProtections: PolicyConfig = {
+        ...defaultPolicy,
+        windows: {
+          ...defaultPolicy.windows,
+          memory_protection: notSupported,
+          behavior_protection: notSupported,
+          ransomware: notSupported,
+        },
+        mac: {
+          ...defaultPolicy.mac,
+          memory_protection: notSupported,
+          behavior_protection: notSupported,
+        },
+        linux: {
+          ...defaultPolicy.linux,
+          memory_protection: notSupported,
+          behavior_protection: notSupported,
+        },
+      };
+
+      const expectedPolicyWithoutSupportedProtections: PolicyConfig = {
+        ...eventsOnlyPolicy,
+        windows: {
+          ...eventsOnlyPolicy.windows,
+          memory_protection: notSupported,
+          behavior_protection: notSupported,
+          ransomware: notSupported,
+        },
+        mac: {
+          ...eventsOnlyPolicy.mac,
+          memory_protection: notSupported,
+          behavior_protection: notSupported,
+        },
+        linux: {
+          ...eventsOnlyPolicy.linux,
+          memory_protection: notSupported,
+          behavior_protection: notSupported,
+        },
+      };
+
+      const policy = disableProtections(inputPolicyWithoutSupportedProtections);
+
+      expect(policy).toEqual<PolicyConfig>(expectedPolicyWithoutSupportedProtections);
+    });
+
+    it('does not enable events', () => {
+      const defaultPolicy: PolicyConfig = policyFactory();
+
+      const windowsEvents: typeof defaultPolicy.windows.events = {
+        dll_and_driver_load: false,
+        dns: false,
+        file: false,
+        network: false,
+        process: false,
+        registry: false,
+        security: false,
+      };
+
+      const macEvents: typeof defaultPolicy.mac.events = {
+        file: false,
+        process: false,
+        network: false,
+      };
+
+      const linuxEvents: typeof defaultPolicy.linux.events = {
+        file: false,
+        process: false,
+        network: false,
+        session_data: false,
+        tty_io: false,
+      };
+
+      const expectedPolicy: PolicyConfig = {
+        ...eventsOnlyPolicy,
+        windows: { ...eventsOnlyPolicy.windows, events: { ...windowsEvents } },
+        mac: { ...eventsOnlyPolicy.mac, events: { ...macEvents } },
+        linux: { ...eventsOnlyPolicy.linux, events: { ...linuxEvents } },
+      };
+
+      const inputPolicy = {
+        ...defaultPolicy,
+        windows: { ...defaultPolicy.windows, events: { ...windowsEvents } },
+        mac: { ...defaultPolicy.mac, events: { ...macEvents } },
+        linux: { ...defaultPolicy.linux, events: { ...linuxEvents } },
+      };
+
+      expect(disableProtections(inputPolicy)).toEqual<PolicyConfig>(expectedPolicy);
+    });
+  });
+});
+
+// This constant makes sure that if the type `PolicyConfig` is ever modified,
+// the logic for disabling protections is also modified due to type check.
+export const eventsOnlyPolicy: PolicyConfig = {
+  windows: {
+    events: {
+      dll_and_driver_load: true,
+      dns: true,
+      file: true,
+      network: true,
+      process: true,
+      registry: true,
+      security: true,
+    },
+    malware: { mode: ProtectionModes.off, blocklist: false },
+    ransomware: { mode: ProtectionModes.off, supported: true },
+    memory_protection: { mode: ProtectionModes.off, supported: true },
+    behavior_protection: { mode: ProtectionModes.off, supported: true },
+    popup: {
+      malware: { message: '', enabled: false },
+      ransomware: { message: '', enabled: false },
+      memory_protection: { message: '', enabled: false },
+      behavior_protection: { message: '', enabled: false },
+    },
+    logging: { file: 'info' },
+    antivirus_registration: { enabled: false },
+    attack_surface_reduction: { credential_hardening: { enabled: false } },
+  },
+  mac: {
+    events: { process: true, file: true, network: true },
+    malware: { mode: ProtectionModes.off, blocklist: false },
+    behavior_protection: { mode: ProtectionModes.off, supported: true },
+    memory_protection: { mode: ProtectionModes.off, supported: true },
+    popup: {
+      malware: { message: '', enabled: false },
+      behavior_protection: { message: '', enabled: false },
+      memory_protection: { message: '', enabled: false },
+    },
+    logging: { file: 'info' },
+  },
+  linux: {
+    events: {
+      process: true,
+      file: true,
+      network: true,
+      session_data: false,
+      tty_io: false,
+    },
+    malware: { mode: ProtectionModes.off, blocklist: false },
+    behavior_protection: { mode: ProtectionModes.off, supported: true },
+    memory_protection: { mode: ProtectionModes.off, supported: true },
+    popup: {
+      malware: { message: '', enabled: false },
+      behavior_protection: { message: '', enabled: false },
+      memory_protection: { message: '', enabled: false },
+    },
+    logging: { file: 'info' },
+  },
+};

x-pack/plugins/security_solution/common/endpoint/models/policy_config_helpers.ts

@@ -0,0 +1,105 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { PolicyConfig } from '../types';
+import { ProtectionModes } from '../types';
+
+/**
+ * Returns a copy of the passed `PolicyConfig` with all protections set to disabled.
+ *
+ * @param policy
+ * @returns
+ */
+export const disableProtections = (policy: PolicyConfig): PolicyConfig => {
+  const result = disableCommonProtections(policy);
+
+  return {
+    ...result,
+    windows: {
+      ...result.windows,
+      ...getDisabledWindowsSpecificProtections(result),
+      popup: {
+        ...result.windows.popup,
+        ...getDisabledWindowsSpecificPopups(result),
+      },
+    },
+  };
+};
+
+const disableCommonProtections = (policy: PolicyConfig) => {
+  let policyOutput = policy;
+
+  for (const key in policyOutput) {
+    if (Object.prototype.hasOwnProperty.call(policyOutput, key)) {
+      const os = key as keyof PolicyConfig;
+
+      policyOutput = {
+        ...policyOutput,
+        [os]: {
+          ...policyOutput[os],
+          ...getDisabledCommonProtectionsForOS(policyOutput, os),
+          popup: {
+            ...policyOutput[os].popup,
+            ...getDisabledCommonPopupsForOS(policyOutput, os),
+          },
+        },
+      };
+    }
+  }
+  return policyOutput;
+};
+
+const getDisabledCommonProtectionsForOS = (policy: PolicyConfig, os: keyof PolicyConfig) => ({
+  behavior_protection: {
+    ...policy[os].behavior_protection,
+    mode: ProtectionModes.off,
+  },
+  memory_protection: {
+    ...policy[os].memory_protection,
+    mode: ProtectionModes.off,
+  },
+  malware: {
+    ...policy[os].malware,
+    blocklist: false,
+    mode: ProtectionModes.off,
+  },
+});
+
+const getDisabledCommonPopupsForOS = (policy: PolicyConfig, os: keyof PolicyConfig) => ({
+  behavior_protection: {
+    ...policy[os].popup.behavior_protection,
+    enabled: false,
+  },
+  malware: {
+    ...policy[os].popup.malware,
+    enabled: false,
+  },
+  memory_protection: {
+    ...policy[os].popup.memory_protection,
+    enabled: false,
+  },
+});
+
+const getDisabledWindowsSpecificProtections = (policy: PolicyConfig) => ({
+  ransomware: {
+    ...policy.windows.ransomware,
+    mode: ProtectionModes.off,
+  },
+  attack_surface_reduction: {
+    ...policy.windows.attack_surface_reduction,
+    credential_hardening: {
+      enabled: false,
+    },
+  },
+});
+
+const getDisabledWindowsSpecificPopups = (policy: PolicyConfig) => ({
+  ransomware: {
+    ...policy.windows.popup.ransomware,
+    enabled: false,
+  },
+});

x-pack/plugins/security_solution/server/fleet_integration/fleet_integration.test.ts

@@ -47,6 +47,7 @@ import type { DeletePackagePoliciesResponse } from '@kbn/fleet-plugin/common';
 import { createMockPolicyData } from '../endpoint/services/feature_usage/mocks';
 import { ALL_ENDPOINT_ARTIFACT_LIST_IDS } from '../../common/endpoint/service/artifacts/constants';
 import { ENDPOINT_EVENT_FILTERS_LIST_ID } from '@kbn/securitysolution-list-constants';
+import { disableProtections } from '../../common/endpoint/models/policy_config_helpers';
 
 jest.mock('uuid', () => ({
   v4: (): string => 'NEW_UUID',
@@ -89,7 +90,7 @@ describe('ingest_integration tests ', () => {
       streams: [],
       config: {
         integration_config: {},
-        policy: { value: policyFactory() },
+        policy: { value: disableProtections(policyFactory()) },
         artifact_manifest: { value: manifest },
       },
     });