Skip to content

[Security] Fix siemV3 migration for Endpoint Exceptions on Serverless #225331

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gergoabraham merged 3 commits into from
Jun 25, 2025
Merged

[Security] Fix siemV3 migration for Endpoint Exceptions on Serverless #225331

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0d18da3
fix role migration
gergoabraham Jun 25, 2025
5522173
update migration test
gergoabraham Jun 25, 2025
105ffd8
update snapshot test
gergoabraham Jun 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .../security_solution_serverless/server/product_features/security_product_features_config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,10 @@ const securityProductFeaturesConfig: Record<
// Users who have been able to write ANY Artifact before are now granted with this privilege to keep existing behavior.
// This migration is for Endpoint Exceptions artifact in Serverless offering, as it included in Security:ALL privilege.
'global_artifact_management_all',

// As we are switching from `all` to `minimal_all`, Endpoint Exceptions is needed to be added, as it was included in `all`,
// but not in `minimal_all`.
'endpoint_exceptions_all',
],
};
}
Expand Down
17 changes: 15 additions & 2 deletions ...rkflows/role_migrations/trial_license_complete_tier/siem_v3_global_artifact_management.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,16 +133,29 @@ export default function ({ getService }: FtrProviderContext) {

describe(`${deprecatedSiem}:ALL`, () => {
// siem:ALL includes Endpoint Exceptions both on ESS and Serverless
it('should add global_artifact_management:ALL', async () => {
it('@skipInServerless should add global_artifact_management:ALL on ESS', async () => {
await putDeprecatedSiemPrivilegesInRole(['all']);

expect(await getMigratedSiemFeaturesFromRole()).to.eql([
// sub-features toggle enabled to show Global Artifact Management
'minimal_all',
// Endpoint exceptions are tied to siem:ALL, hence the global_artifact_management_all
// Endpoint exceptions are tied to siem:ALL, hence the global_artifact_management_all to keep behaviour
'global_artifact_management_all',
]);
});

it('@skipInEss should add global_artifact_management:ALL and endpoint_exceptions:ALL on serverless', async () => {
await putDeprecatedSiemPrivilegesInRole(['all']);

expect(await getMigratedSiemFeaturesFromRole()).to.eql([
// sub-features toggle enabled to show Global Artifact Management
'minimal_all',
// Endpoint exceptions are tied to siem:ALL, hence the global_artifact_management_all to keep behaviour
'global_artifact_management_all',
// Enpdoint Exceptions were included in siem:ALL, so we need to include them in siem:MINIMAL_ALL
'endpoint_exceptions_all',
]);
});
});

describe(`${deprecatedSiem}:MINIMAL_ALL`, () => {
Expand Down
4 changes: 4 additions & 0 deletions ...k/test_serverless/api_integration/test_suites/security/platform_security/authorization.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1085,6 +1085,8 @@ export default function ({ getService }: FtrProviderContext) {
"ui:siemV3/investigation-guide-interactions",
"ui:siemV3/threat-intelligence",
"ui:siemV3/writeGlobalArtifacts",
"ui:siemV3/showEndpointExceptions",
"ui:siemV3/crudEndpointExceptions",
],
"blocklist_all": Array [
"login:",
Expand Down Expand Up @@ -3737,6 +3739,8 @@ export default function ({ getService }: FtrProviderContext) {
"ui:siemV3/investigation-guide-interactions",
"ui:siemV3/threat-intelligence",
"ui:siemV3/writeGlobalArtifacts",
"ui:siemV3/showEndpointExceptions",
"ui:siemV3/crudEndpointExceptions",
],
"blocklist_all": Array [
"login:",
Expand Down