[Fleet][Agent Policy][Agent Tamper Protection] UI / API guard agent tamper protection only available if security defend integration present by parkiino · Pull Request #162196 · elastic/kibana

parkiino · 2023-07-18T22:51:08Z

Summary

UI

When there is no elastic defend integration present, the agent tamper protection (is_protected) switch and instruction link are disabled and there is an info tooltip explaining why the switch is disabled

API

Requires the elastic defend integration to be present, in order to set is_protected to true. Will allow the user to create the agent policy and not throw an error, but will keep is_protected as false and log a warning in the kibana server. In the next release, the response will be modified to send back a 201 with the relevant messaging.
Sets is_protected to false when a user deletes the elastic defend package policy

Screenshots

No Elastic Defend integration installed

…t present

…g-with-defend-only

dasansol92

Looking good! Thanks for work on this! Left few suggestions and questions. Let me know your thoughts.

dasansol92 · 2023-07-28T11:11:29Z

x-pack/plugins/fleet/common/services/agent_policies_helpers.ts

+export function isAgentPolicy(
+  policy: Partial<NewAgentPolicy | AgentPolicy>
+): policy is AgentPolicy {
+  return (policy as AgentPolicy).is_protected !== undefined;


Can we use other more specific prop in Agent policy to check if it is an agent policy or not?

do you think revision in AgentPolicy works better maybe?

dasansol92 · 2023-07-28T11:12:06Z

x-pack/plugins/fleet/common/services/generate_new_agent_policy.test.ts

      namespace: 'default',
      monitoring_enabled: ['logs', 'metrics'],
      inactivity_timeout: 1209600,
-      is_protected: false,


why are we removing this?

We want to take this out since NewPackagePolicy doesn't have package_policies, and therefore the defend integration, during creation, and to prevent users from modifying this field. Even if a user were to add the defend integration to a new agent policy, as opposed to an existing one, the new agent policy is created first before adding the defend package policy, and then at this point, the is_protected field would be available but defaulted to false.

dasansol92 · 2023-07-28T11:12:21Z

x-pack/plugins/fleet/common/services/generate_new_agent_policy.ts

    namespace: 'default',
    monitoring_enabled: Object.values(dataTypes),
    inactivity_timeout: TWO_WEEKS_SECONDS,
-    is_protected: false,


same question here

same as above - removing is_protected from the NewAgentPolicy type

dasansol92 · 2023-07-28T11:13:02Z

x-pack/plugins/fleet/common/types/models/agent_policy.ts

  fleet_server_host_id?: string | null;
  schema_version?: string;
  agent_features?: Array<{ name: string; enabled: boolean }>;
-  is_protected?: boolean;


This was optional, why are we removing this?

same as above

dasansol92 · 2023-07-28T11:13:59Z

...lications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/index.test.tsx

      });
      expect(mockUpdateAgentPolicy).toHaveBeenCalledWith({ is_protected: true });
    });
+    describe('when the defend integration is not installed', () => {


Do we have test cases for when it has Defend Integration? If not, can we add those?

yes, the other tests above have the defend integration inside the package policy

dasansol92 · 2023-07-28T11:15:34Z

...c/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/index.tsx

+                  id="xpack.fleet.agentPolicyForm.tamperingSwitchLabel"
+                  defaultMessage="Prevent agent tampering"
+                />{' '}
+                {!policyHasEndpointSecurity(agentPolicy) && (


Can we store and memoize the !policyHasEndpointSecurity(agentPolicy) in a const and use it below?

Same thing for the isAgentPolicy...

dasansol92 · 2023-07-28T11:16:22Z

...c/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/index.tsx

+                      color="subdued"
+                      content={i18n.translate(
+                        'xpack.fleet.agentPolicyForm.tamperingSwitchLabel.disabledWarning',
+                        { defaultMessage: 'this is why its disabled' }


I guess we are waiting for a proper message here, right?

@roxana-gheorghe Do we know what we want to have for the disabled messaging when the defend integration is not present?

dasansol92 · 2023-07-28T11:19:00Z

x-pack/plugins/fleet/server/services/agent_policy.ts

      savedObjectType: AGENT_POLICY_SAVED_OBJECT_TYPE,
    });

-    this.checkTamperProtectionLicense(agentPolicy);


Why we remove this here?

since we are no longer sending in agent tamper protection on agent policy create, there is no need for a license check since agent tamper protection is the only licensed-gated feature

dasansol92 · 2023-07-28T11:20:04Z

x-pack/plugins/fleet/server/services/package_policy.ts

+      const agentPoliciesWithEndpointPackagePolicies = [
+        ...new Set(
+          result
+            .filter((r) => r.success && r.policy_id && r.package?.name === 'endpoint')


Could we use a single reduce here instead?

dasansol92 · 2023-07-28T11:22:35Z

x-pack/plugins/fleet/server/services/package_policy.ts

        ...new Set(result.filter((r) => r.success && r.policy_id).map((r) => r.policy_id!)),
      ];

+      const agentPoliciesWithEndpointPackagePolicies = [


This could be a Set, so no array transformation is needed. Then below you can use the .has method from Set instead of array inculdes

…g-with-defend-only

elasticmachine · 2023-08-08T17:53:44Z

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

juliaElastic

Fleet changes LGTM

…g-with-defend-only

…gent policy

…g-with-defend-only

dasansol92 · 2023-08-11T14:11:40Z

x-pack/plugins/fleet/common/services/generate_new_agent_policy.test.ts

      description: 'test description',
      namespace: 'test-namespace',
      monitoring_enabled: ['logs'],
-      is_protected: true,


should we add this again?

we could add with false

I suppose we could, but I wonder if it makes sense to have a test that changes this since we don't want to generate a new policy with is_protected being true since elastic defend is not present in a New Agent Policy. But I guess if we are just testing functionality, I could? Or maybe I should enforce the code so that the user can't modify is_protected as an override prop? What do you think @dasansol92

We could test both scenarios, when user sets it to false (it is ok) and when user sets it to true (and we turn it back to false). Also when the prop is not set, and we set it to false.

@parkiino you were right, since this is only testing the generateNewAgentPolicyWithDefaults and not the API functionality, it's ok to keep it as it is (is_protected set to false by default when it is not assigned). @juliaElastic let me know if you think different.

dasansol92 · 2023-08-11T14:15:01Z

...c/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/index.tsx

+                <FormattedMessage
+                  id="xpack.fleet.agentPolicyForm.tamperingSwitchLabel"
+                  defaultMessage="Prevent agent tampering"
+                />{' '}


Is this empty space needed?

Yes, otherwise the tooltip icon would be right up against the text

dasansol92 · 2023-08-11T14:15:48Z

...c/applications/fleet/sections/agent_policy/components/agent_policy_advanced_fields/index.tsx

+                      color="subdued"
+                      content={i18n.translate(
+                        'xpack.fleet.agentPolicyForm.tamperingSwitchLabel.disabledWarning',
+                        { defaultMessage: 'this is why its disabled' }


Taking this back @roxana-gheorghe, do we have a proper text for this one?

juliaElastic

LGTM

dasansol92

Pending to update tooltip text. Other than that, it looks good! Thanks for working on this 🔥

…g-with-defend-only

kibana-ci · 2023-08-14T05:45:33Z

💚 Build Succeeded

Buildkite Build
Commit: f9e7abe

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`fleet`	1022.3KB	1022.7KB	+446.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`fleet`	138.7KB	138.8KB	+74.0B

History

💛 Build #149794 was flaky 165c68c
💚 Build #149455 succeeded 4fb9e69
💔 Build #149406 failed 30c1bb9
💔 Build #149399 failed c28a708
💔 Build #149053 failed a6f4af3
💔 Build #148327 failed 3f0b851

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

…amper protection only available if security defend integration present (elastic#162196) ## Summary UI - [x] When there is no elastic defend integration present, the agent tamper protection (`is_protected`) switch and instruction link are disabled and there is an info tooltip explaining why the switch is disabled API - [x] Requires the elastic defend integration to be present, in order to set `is_protected` to true. Will allow the user to create the agent policy and not throw an error, but will keep `is_protected` as false and log a warning in the kibana server. In the next release, the response will be modified to send back a 201 with the relevant messaging. - [x] Sets `is_protected` to false when a user deletes the elastic defend package policy ## Screenshots ### No Elastic Defend integration installed <img width="970" alt="image" src="https://github.com/elastic/kibana/assets/56409205/910be766-1a1e-4580-9ace-306089b4626d">

parkiino added 13 commits July 12, 2023 17:26

disable switch and show conditional icon tip if defend integration no…

022584f

…t present

Merge remote-tracking branch 'upstream/main' into task/agent-tamperin…

ca2fc46

…g-with-defend-only

unit tests for ui

e197b47

Merge remote-tracking branch 'upstream/main' into task/agent-tamperin…

ee9da8b

…g-with-defend-only

Merge remote-tracking branch 'upstream/main' into task/agent-tamperin…

2723282

…g-with-defend-only

change tamper protection to false when endpoint package is deleted

b3c30d0

Merge remote-tracking branch 'upstream/main' into task/agent-tamperin…

23beb0c

…g-with-defend-only

fix type errors

c4e900e

Merge remote-tracking branch 'upstream/main' into task/agent-tamperin…

64ab92d

…g-with-defend-only

wip remove is protected from agent policy create

06450af

fix type, fix test

bafa87e

update index

72b1cff

fixing tests

55b797f

dasansol92 reviewed Jul 28, 2023

View reviewed changes

parkiino added 15 commits July 28, 2023 15:25

Merge remote-tracking branch 'upstream/main' into task/agent-tamperin…

e6bd9ff

…g-with-defend-only

merge origin'

1eed50b

Merge remote-tracking branch 'upstream/main' into task/agent-tamperin…

066cf6a

…g-with-defend-only

remove is_protected from create agent policy tests

2c602b5

Merge remote-tracking branch 'upstream/main' into task/agent-tamperin…

2be3016

…g-with-defend-only

fix jest tests

e928028

Merge remote-tracking branch 'upstream/main' into task/agent-tamperin…

dc92fba

…g-with-defend-only

Merge remote-tracking branch 'upstream/main' into task/agent-tamperin…

9b01bd6

…g-with-defend-only

fix logic and memoize

a201f24

fix agent tamper ui

4cb96e1

Merge remote-tracking branch 'upstream/main' into task/agent-tamperin…

f5b03dd

…g-with-defend-only

Merge remote-tracking branch 'upstream/main' into task/agent-tamperin…

0e6ab67

…g-with-defend-only

Merge remote-tracking branch 'upstream/main' into task/agent-tamperin…

f22f105

…g-with-defend-only

fix tests please?

e8b51a6

import

b600011

parkiino marked this pull request as ready for review August 3, 2023 16:43

parkiino requested a review from juliaElastic August 8, 2023 17:54

juliaElastic approved these changes Aug 9, 2023

View reviewed changes

dasansol92 requested review from a team, dasansol92 and patrykkopycinski and removed request for a team August 9, 2023 09:14

parkiino added 3 commits August 9, 2023 16:53

Merge remote-tracking branch 'upstream/main' into task/agent-tamperin…

acc3a36

…g-with-defend-only

fix package.json and one api integration test

4d9ee38

add back is_protected in newagentpolicy and SO, set to false in new a…

a6f4af3

…gent policy

parkiino requested a review from a team as a code owner August 10, 2023 05:48

parkiino added 5 commits August 10, 2023 15:49

reenable more is protected stuff

c3ac2ca

Merge remote-tracking branch 'upstream/main' into task/agent-tamperin…

c28a708

…g-with-defend-only

add kibana warning message

30c1bb9

adjust tests

cb807eb

Merge remote-tracking branch 'upstream/main' into task/agent-tamperin…

4fb9e69

…g-with-defend-only

dasansol92 reviewed Aug 11, 2023

View reviewed changes

dasansol92 requested a review from juliaElastic August 11, 2023 14:24

juliaElastic approved these changes Aug 11, 2023

View reviewed changes

dasansol92 approved these changes Aug 11, 2023

View reviewed changes

update text to something more appropriate

165c68c

joeypoon approved these changes Aug 12, 2023

View reviewed changes

parkiino added 2 commits August 14, 2023 00:39

add a logger for when agent policy tamper protection is set to false

ecb40eb

Merge remote-tracking branch 'upstream/main' into task/agent-tamperin…

f9e7abe

…g-with-defend-only

parkiino enabled auto-merge (squash) August 14, 2023 04:40

parkiino merged commit 5dd5ec2 into elastic:main Aug 14, 2023

parkiino deleted the task/agent-tampering-with-defend-only branch October 16, 2023 19:48

Conversation

parkiino commented Jul 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Screenshots

No Elastic Defend integration installed

Uh oh!

dasansol92 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Aug 8, 2023

Uh oh!

juliaElastic left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

juliaElastic left a comment

Choose a reason for hiding this comment

Uh oh!

dasansol92 left a comment

Choose a reason for hiding this comment

Uh oh!

kibana-ci commented Aug 14, 2023

💚 Build Succeeded

Metrics [docs]

Async chunks

Page load bundle

History

Uh oh!

parkiino commented Jul 18, 2023 •

edited

Loading