Skip to content

[Security Solution][Endpoint] Reuse disableProtections function for cloud policies #144460

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gergoabraham merged 6 commits into from
Nov 7, 2022
Merged

[Security Solution][Endpoint] Reuse disableProtections function for cloud policies #144460

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
97fded0
use `disableProtections()` for cloud polices
gergoabraham Nov 2, 2022
28b2483
extend `dusableProtections()` with the option to disable support for …
gergoabraham Nov 2, 2022
b74fc04
disable support on all protections for cloud policies
gergoabraham Nov 2, 2022
064c507
Revert "disable support on all protections for cloud policies"
gergoabraham Nov 3, 2022
6bae387
Revert "extend `dusableProtections()` with the option to disable supp…
gergoabraham Nov 3, 2022
6c97570
Merge branch 'main' into reuse-disable-protections-function-for-cloud…
kibanamachine Nov 7, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 4 additions & 32 deletions x-pack/plugins/security_solution/server/fleet_integration/handlers/create_default_policy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ import {
policyFactoryWithoutPaidFeatures as policyConfigFactoryWithoutPaidFeatures,
} from '../../../common/endpoint/models/policy_config';
import type { LicenseService } from '../../../common/license/license';
import { ProtectionModes } from '../../../common/endpoint/types';
import type { PolicyConfig } from '../../../common/endpoint/types';
import type { AnyPolicyCreateConfig, PolicyCreateEndpointConfig } from '../types';
import {
Expand Down Expand Up @@ -110,43 +109,16 @@ const getEndpointPolicyWithIntegrationConfig = (
*/
const getCloudPolicyConfig = (policy: PolicyConfig): PolicyConfig => {
// Disabling all protections, since it's not yet supported on Cloud integrations
const protections = {
memory_protection: {
supported: false,
mode: ProtectionModes.off,
},
malware: {
...policy.linux.malware,
mode: ProtectionModes.off,
},
behavior_protection: {
...policy.linux.behavior_protection,
mode: ProtectionModes.off,
},
};
const policyWithDisabledProtections = disableProtections(policy);

return {
...policy,
...policyWithDisabledProtections,
linux: {
...policy.linux,
...protections,
...policyWithDisabledProtections.linux,
events: {
...policy.linux.events,
...policyWithDisabledProtections.linux.events,
session_data: true,
},
},
windows: {
...policy.windows,
...protections,
// Disabling ransomware protection, since it's not supported on Cloud integrations
ransomware: {
supported: false,
mode: ProtectionModes.off,
},
},
mac: {
...policy.mac,
...protections,
},
};
};