[EDR Workflows] Scripts selector component in Response Console by tomsonpl · Pull Request #204965 · elastic/kibana

tomsonpl · 2024-12-19T15:36:53Z

Description

This PR implements a custom scripts selector component for the Security Solution console, with initial support for CrowdStrike integration. The component allows users to select custom scripts that can be executed as part of response actions.

Changes

1. Custom Scripts API Implementation

Created a public method on response actions client to fetch scripts
Implemented CrowdStrike-specific client that fetches scripts via the CrowdStrike connector
Added server-side route handler for retrieving custom scripts http://localhost:5601//internal/api/endpoint/action/custom_scripts

2. UI Component Development

Developed a reusable CustomScriptSelector component that can be used as a command argument selector
Implemented searchable script selection with EuiSelectable
Added proper focus management and keyboard navigation
Applied consistent styling aligned with the console UI

3. Type Safety & Schema Validation

Added comprehensive TypeScript interfaces for custom scripts
Implemented schema validation for API requests
Ensured proper error handling and type safety throughout the implementation

4. Testing

Added unit tests for the new components and functionality

UI:

Screen.Recording.2025-05-23.at.10.32.02.mov

Testing

Please contact @tomsonpl to get CS credentials

… runscript-cs-fetch-scripts

tomsonpl · 2025-05-19T13:34:47Z

/ci

tomsonpl · 2025-05-19T15:25:42Z

/ci

tomsonpl · 2025-05-19T16:23:32Z

/ci

tomsonpl · 2025-05-20T13:17:14Z

/ci

Copilot

Pull Request Overview

This PR introduces a custom scripts API and integrates a new SelectorComponent into the UI for cloud file selection. Key changes include the addition of server routes and API schemas for custom scripts, updates to the crowdstrike connector to support script retrieval, and comprehensive UI and test updates to integrate the new custom scripts selector.

Reviewed Changes

Copilot reviewed 30 out of 30 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
x-pack/solutions/security/plugins/security_solution/server/endpoint/services/actions/clients/crowdstrike/utils.test.ts	Adjusted test expectations for command output formatting
x-pack/solutions/security/plugins/security_solution/server/endpoint/routes/custom_scripts/*	Added new routes, handlers, and tests for custom scripts API
x-pack/solutions/security/plugins/security_solution/public/management/*	Integrated the CustomScriptSelector into console commands and related hooks/tests
x-pack/platform/plugins/shared/stack_connectors/server/connector_types/crowdstrike/crowdstrike.ts	Updated the crowdstrike connector to retrieve scripts with a renamed endpoint and adjusted payload type
Other related files	Updated types, constants, API schemas, and tests to support the new custom scripts feature

Comments suppressed due to low confidence (1)

x-pack/platform/plugins/shared/stack_connectors/server/connector_types/crowdstrike/crowdstrike.ts:99

The endpoint name has changed from 'getRTRCloudScriptsDetails' to 'getRTRCloudScripts'. Ensure that corresponding client code, documentation, and tests are updated to reflect this naming change consistently.

getRTRCloudScripts: `${this.config.url}/real-time-response/entities/scripts/v1`,

Copilot · 2025-05-20T20:12:29Z

...plugins/security_solution/server/endpoint/services/actions/clients/crowdstrike/utils.test.ts

      commandLine: 'echo Hello World',
    });
-    expect(result).toBe('runscript --CommandLine=```echo Hello World```');
+    expect(result).toBe(`runscript --CommandLine='echo Hello World'`);


Clarify in the test documentation whether the use of single quotes for the CommandLine parameter is the intended format compared to triple backticks for other parameters, to ensure consistency in expected output.

...k/platform/plugins/shared/stack_connectors/server/connector_types/crowdstrike/crowdstrike.ts

ashokaditya

I've a few questions and suggestions but it looks good to go. Tested it out with you and we found some issues that might need a fix.

ashokaditya · 2025-06-02T07:59:21Z

...y_solution/server/endpoint/services/actions/clients/endpoint/endpoint_actions_client.test.ts

@@ -360,7 +360,7 @@ describe('EndpointActionsClient', () => {
  type ResponseActionsMethodsOnly = keyof Omit<
    ResponseActionsClient,
    // TODO: not yet implemented


Is this TODO still relevant?

not relevant, thanks!

ashokaditya · 2025-06-02T12:43:43Z

...k/platform/plugins/shared/stack_connectors/server/connector_types/crowdstrike/crowdstrike.ts

-  // TODO: for now just for testing purposes, will be a part of a following PR
  public async getRTRCloudScripts(
-    payload: CrowdstrikeGetAgentsParams,
+    payload: {},


Consider removing the payload param. I don't see that it is being used anywhwere.

I decided to keep it to have the same structure as other actions, especially that maybe we'll need some payload in the end when filtering data or something. Is it ok?

ashokaditya · 2025-06-02T12:50:43Z

...k/platform/plugins/shared/stack_connectors/server/connector_types/crowdstrike/crowdstrike.ts

        name: SUB_ACTION.GET_RTR_CLOUD_SCRIPTS,
        method: 'getRTRCloudScripts',
-        schema: CrowdstrikeGetScriptsParamsSchema,
+        schema: CrowdstrikeRTRCommandParamsSchema, // Empty schema - this request do not have any parameters


Q: Is there a reason we don't use schema: null when we register this and all above actions if the request schema is empty?

schema:null for RTR is is fine 👍 Thx! The other above still need to be adjusted. I'll try to do it when there's more time to work on CrowdStrike.

ashokaditya · 2025-06-02T13:34:48Z

...tion/public/management/components/console_argument_selectors/custom_script_selector.test.tsx

+  test('sets search value based on valueText prop', async () => {
+    const SelectorComponent = CustomScriptSelector('endpoint');
+    await renderAndWaitForComponent(
+      <SelectorComponent
+        {...defaultProps}
+        value="Script 1"
+        valueText="Script 1"
+        store={{ isPopoverOpen: true }}
+      />
+    );
+
+    const searchbox = screen.getByRole('searchbox', { name: 'Filter options' });
+    expect(searchbox).toHaveValue('Script 1');
+  });
+
+  test('filters options based on valueText prop', async () => {


These two test descriptions should be contextual to the UX. valueText prop seems like a EUI specific test which looking at the test doesn't look like that it is. Consider updating the description.

Hmm, I think it's our custom props - not EUI specific. How would you suggest to change it ?

… runscript-cs-fetch-scripts

elasticmachine · 2025-06-03T07:38:54Z

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	7451	7453	+2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	9.2MB	9.2MB	+3.7KB

Unknown metric groups

References to deprecated APIs

id	before	after	diff
`securitySolution`	336	337	+1

History

💔 Build #304316 failed c480990
💔 Build #304276 failed b45cbb9
💛 Build #303951 was flaky 4110e5b
💚 Build #303388 succeeded 37d45e4
💔 Build #303347 failed 151165a

cc @tomsonpl

kibanamachine · 2025-06-03T08:30:58Z

Starting backport for target branches: 8.19

https://github.com/elastic/kibana/actions/runs/15412432726

…ic#204965) (cherry picked from commit 4390ea8)

kibanamachine · 2025-06-03T08:37:12Z

💚 All backports created successfully

Status	Branch	Result
✅	8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…ic#204965)

…ic#204965) (cherry picked from commit 4390ea8)

kibanamachine · 2025-06-05T08:48:59Z

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 204965 locally
cc: @tomsonpl

kibanamachine · 2025-06-06T08:49:02Z

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 204965 locally
cc: @tomsonpl

kibanamachine · 2025-06-09T09:48:44Z

Friendly reminder: Looks like this PR hasn’t been backported yet.
To create automatically backports add a backport:* label or prevent reminders by adding the backport:skip label.
You can also create backports manually by running node scripts/backport --pr 204965 locally
cc: @tomsonpl

…#204965) (#222754)

…ic#204965)

refs elastic#204965

tomsonpl added 2 commits December 19, 2024 16:33

WIP custom scripts

4d46ad6

fix

f01f3c4

tomsonpl added Team:Defend Workflows “EDR Workflows” sub-team of Security Solution release_note:feature Makes this part of the condensed release notes backport:version Backport to applied version labels v8.18.0 labels Dec 19, 2024

tomsonpl self-assigned this Dec 19, 2024

tomsonpl added 6 commits January 7, 2025 12:02

Merge branch 'main' into runscript-cs-fetch-scripts

070450d

Merge branch 'main' into runscript-cs-fetch-scripts

548873c

Merge branch 'main' into runscript-cs-fetch-scripts

91016ea

Merge remote-tracking branch 'origin/runscript-cs-fetch-scripts' into…

8e9c4f0

… runscript-cs-fetch-scripts

add types, schemas, logic

cfb35cb

fix styles

f685c41

tomsonpl added v9.1.0 and removed v8.18.0 labels May 19, 2025

tomsonpl added 3 commits May 19, 2025 16:11

fix styles

bf735e1

fix type

67d995d

rename scripts to custom_scripts

560c344

tomsonpl added the v8.19.0 label May 19, 2025

add tests

7f5ed49

fix types and convert cs to customscripts schema

425652a

adjust the tests

e43250f

tomsonpl added 2 commits May 20, 2025 18:10

change to selectable, add inputref, initial css

8848a10

fix css

f39c367

tomsonpl requested a review from Copilot May 20, 2025 20:11

Copilot AI reviewed May 20, 2025

View reviewed changes

tomsonpl added 2 commits May 29, 2025 15:48

Merge branch 'main' into runscript-cs-fetch-scripts

37d45e4

Merge branch 'main' into runscript-cs-fetch-scripts

4110e5b

ashokaditya approved these changes Jun 2, 2025

View reviewed changes

tomsonpl added 2 commits June 2, 2025 18:46

fix

528cc50

Merge remote-tracking branch 'origin/runscript-cs-fetch-scripts' into…

b45cbb9

… runscript-cs-fetch-scripts

tomsonpl enabled auto-merge (squash) June 2, 2025 17:32

tomsonpl added 3 commits June 2, 2025 20:13

fix

afa36a2

fix

c480990

Merge branch 'main' into runscript-cs-fetch-scripts

4454753

tomsonpl merged commit 4390ea8 into elastic:main Jun 3, 2025
10 checks passed

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jun 3, 2025

[EDR Workflows] Scripts selector component in Response Console (elast…

0ca9b9b

…ic#204965) (cherry picked from commit 4390ea8)

kibanamachine mentioned this pull request Jun 3, 2025

[8.19] [EDR Workflows] Scripts selector component in Response Console (#204965) #222308

Closed

zacharyparikh pushed a commit to zacharyparikh/kibana that referenced this pull request Jun 4, 2025

[EDR Workflows] Scripts selector component in Response Console (elast…

77c1852

…ic#204965)

tomsonpl added a commit to tomsonpl/kibana that referenced this pull request Jun 5, 2025

[EDR Workflows] Scripts selector component in Response Console (elast…

42bc59c

…ic#204965) (cherry picked from commit 4390ea8)

kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label Jun 5, 2025

tomsonpl mentioned this pull request Jun 9, 2025

[8.19] [EDR Workflows] Scripts selector component in Response Console (#204965) #222754

Merged

tomsonpl added a commit that referenced this pull request Jun 10, 2025

[8.19] [EDR Workflows] Scripts selector component in Response Console (…

6495ebe

…#204965) (#222754)

kibanamachine removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label Jun 10, 2025

tomsonpl mentioned this pull request Jun 10, 2025

[EDR Workflows] Add runscript from Microsoft Defender for Endpoint support to Response Console #222377

Merged

nickpeihl pushed a commit to nickpeihl/kibana that referenced this pull request Jun 12, 2025

[EDR Workflows] Scripts selector component in Response Console (elast…

34de613

…ic#204965)

tomsonpl mentioned this pull request Jul 3, 2025

[EDR Workflows] Initialize SelectorComponent value in Scripts picker #225451

Closed

ashokaditya added a commit to ashokaditya/kibana that referenced this pull request Jul 3, 2025

internal route prefix

09cd78b

refs elastic#204965

ashokaditya mentioned this pull request Jul 3, 2025

[SecuritySolution][Endpoint][ResponseActions] Internal route prefix #226494

Merged

10 tasks

tomsonpl mentioned this pull request Jul 11, 2025

[EDR Workflows] Initialize argument selector value #227463

Merged

Conversation

tomsonpl commented Dec 19, 2024 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

1. Custom Scripts API Implementation

2. UI Component Development

3. Type Safety & Schema Validation

4. Testing

UI:

Testing

Uh oh!

tomsonpl commented May 19, 2025

Uh oh!

tomsonpl commented May 19, 2025

Uh oh!

tomsonpl commented May 19, 2025

Uh oh!

tomsonpl commented May 20, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI May 20, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ashokaditya left a comment

Choose a reason for hiding this comment

Uh oh!

ashokaditya Jun 2, 2025

Choose a reason for hiding this comment

Uh oh!

tomsonpl Jun 2, 2025

Choose a reason for hiding this comment

Uh oh!

ashokaditya Jun 2, 2025

Choose a reason for hiding this comment

Uh oh!

tomsonpl Jun 2, 2025

Choose a reason for hiding this comment

Uh oh!

ashokaditya Jun 2, 2025

Choose a reason for hiding this comment

Uh oh!

tomsonpl Jun 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ashokaditya Jun 2, 2025

Choose a reason for hiding this comment

Uh oh!

tomsonpl Jun 2, 2025

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Jun 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Module Count

Async chunks

References to deprecated APIs

History

Uh oh!

Uh oh!

kibanamachine commented Jun 3, 2025

Uh oh!

kibanamachine commented Jun 3, 2025

💚 All backports created successfully

Questions ?

Uh oh!

kibanamachine commented Jun 5, 2025

Uh oh!

kibanamachine commented Jun 6, 2025

Uh oh!

kibanamachine commented Jun 9, 2025

Uh oh!

tomsonpl commented Dec 19, 2024 •

edited by kibanamachine

Loading

tomsonpl Jun 2, 2025 •

edited

Loading

elasticmachine commented Jun 3, 2025 •

edited

Loading