[EDR Workflows][Device Control] Trusted Devices CRUD

[szwarckonrad]

Prerequisite #229921
Followup #231167

This PR introduces the Trusted Devices functionality. With these changes, users can:

1. Create Trusted Devices using filters and matching patterns
2. Update existing Trusted Devices
3. Delete Trusted Devices
4. Assign a Trusted Device either globally or to specific policies

All functionality is gated behind a feature flag.

Note: The next PR will introduce artifact creation for Trusted Devices. These artifacts will be consumed by the Endpoint.

More screenshots

[denar50]

Code review only. LGTM!

[gergoabraham]

looks good! added some comments below, and here are some findings and questions:

space awareness

trusted devices doesn't seem to be space aware. if you create a per policy trusted device in one space, it is still visible in another space, while it shouldn't be.

Screen.Recording.2025-08-14.at.11.21.14.mov

more than one condition?

this is rather a product question: do we want to add multiple conditions instead of just having one? similarly to trusted apps, where (in basic mode) only a small number of fields are available, but you can still add multiple conditions

cannot focus on value field

if you open a dropdown, and then click on the value field, it won't receive focus.

this works well when coming from the OS dropdown, but does not when coming from the field or operator dropdown - probably there's a re-render behind the validation of those ones.

Screen.Recording.2025-08-14.at.11.09.30.mov

[szwarckonrad]

 @gergoabraham
CC @paul-tavares

Thanks for the CR, @gergoabraham.

1. Space awareness will be handled in the next PR, which will focus on the validators (extension points for the list plugin). That one will be another fairly large PR, and I’d rather not add a few hundred more lines here. ;) (https://github.com/elastic/security-team/issues/13302)
2. It was a product decision to stick with a single condition form for now.
3. As we discussed offline - I tracked the cause down to a SuperSelect issue. It aggressively sets focus on itself onBlur. We decided to leave it as is, since it’s an edge case with minimal impact on user experience. Alternative components have their own quirks as well. :/

[gergoabraham]

@gergoabraham
CC @paul-tavares

Thanks for the CR, @gergoabraham.

Space awareness will be handled in the next PR, which will focus on the validators (extension points for the list plugin). That one will be another fairly large PR, and I’d rather not add a few hundred more lines here. ;) (https://github.com/elastic/security-team/issues/13302)
It was a product decision to stick with a single condition form for now.
As we discussed offline - I tracked the cause down to a SuperSelect issue. It aggressively sets focus on itself onBlur. We decided to leave it as is, since it’s an edge case with minimal impact on user experience. Alternative components have their own quirks as well. :/

thanks for the changes and the explanations above. let's go! 🚀

[paul-tavares]

Did not run it locally, but code looks good. Only saw one thing that needs to be addressed

[paul-tavares]

This needs to be placed behind a conditional statement that checks license level. See how other artifacts implemented for reference - there is a hook you can use: useCanAssignArtifactPerPolicy()

Also make sure you add tests for it (for when license is below platinum with create and edit flows)

[szwarckonrad]

You're right, I misunderstood the purpose of these checks. Thanks for pointing it out!
f226a89

[paul-tavares]

This needs to be i18n

[szwarckonrad]

Added!

[paul-tavares]

Is this expensive? should it be momoized via memo()?

[szwarckonrad]

It's only 3 options, I believe we are good :)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: df24319

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
securitySolution	7882	7884	+2

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
@kbn/securitysolution-utils	62	63	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	10.4MB	10.4MB	+14.4KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
securitySolution	95.5KB	95.5KB	-1.0B

Unknown metric groups

API count

id	before	after	diff
@kbn/securitysolution-utils	71	72	+1

History

• 💚 Build #330686 succeeded b758c66
• 💚 Build #330600 succeeded 0d2dc30
• 💔 Build #330571 failed 5fb8ded
• 💚 Build #329638 succeeded 08f8bfc
• 💛 Build #329012 was flaky 45fe76d
• 💛 Build #328669 was flaky 41ab373

cc @szwarckonrad