[EDR Workflows][Device Control] Trusted Devices artifacts by szwarckonrad · Pull Request #231167 · elastic/kibana

szwarckonrad · 2025-08-08T14:37:09Z

Prerequisite #230174
Followup #231888

This PR introduces trusted devices as a new artifact type in the Security Solution, enabling device-based allow-listing for endpoint security policies.

Flow:

User enables Device Control in policy settings 🖼️

User adds Trusted Device that will add a whitelist condition to otherwise block policy 🖼️

Artifact is being generated and can be viewed in Agent policy 🖼️

Artifact can be decoded from index storage 🖼️

Artifact can be decoded from fleet server API 🖼️

New Functionality:

Trusted devices schema and types - Complete validation schemas for device identification fields (USERNAME, HOST, DEVICE_ID, MANUFACTURER, PRODUCT_ID)
Artifact integration - Trusted devices now build and distribute alongside other artifact types (trusted apps, blocklists, etc.)
Feature flag gating - Controlled rollout via trustedDevices experimental feature
OS support - Windows and macOS (Linux support planned for future)

Key Components:

API schemas - GET, POST, PUT request validation with proper field restrictions
Manifest manager integration - buildTrustedDevicesArtifacts() method following established patterns
Artifact constants - Support for endpoint-trusteddevicelist-{os}-v1 naming convention
Effect scopes - Global and policy-specific device trust configurations
Unit test coverage - extended existing test coverage as well as introduced new test files where needed

…/kibana into device-control-rbac

…enterprise tier

… cases

…on attributes

Prerequisite #229921 Followup #231167 This PR introduces the Trusted Devices functionality. With these changes, users can: 1. Create Trusted Devices using filters and matching patterns 2. Update existing Trusted Devices 3. Delete Trusted Devices 4. Assign a Trusted Device either globally or to specific policies All functionality is gated behind a feature flag. **Note:** The next PR will introduce artifact creation for Trusted Devices. These artifacts will be consumed by the Endpoint. <img width="1590" height="902" alt="Screenshot 2025-08-08 at 16 19 25" src="https://github.com/user-attachments/assets/e2c0c3e7-e324-49b3-a79a-0e89c232727a" /> <img width="1589" height="932" alt="Screenshot 2025-08-08 at 16 21 28" src="https://github.com/user-attachments/assets/7d508aca-f8dc-40fb-8f45-cac548869960" /> <details><summary>More screenshots</summary> <img width="1591" height="930" alt="Screenshot 2025-08-08 at 16 24 48" src="https://github.com/user-attachments/assets/07bfab25-68ed-4de3-8b8e-7d657d4b5fe3" /> <img width="1563" height="862" alt="Screenshot 2025-08-08 at 16 25 08" src="https://github.com/user-attachments/assets/a4170927-dcb4-4d9a-9327-e26098851532" /> <img width="1589" height="933" alt="Screenshot 2025-08-08 at 16 25 27" src="https://github.com/user-attachments/assets/b43862f3-23f2-48cc-80e8-a8a6f219cf48" /> <img width="731" height="813" alt="Screenshot 2025-08-08 at 16 26 12" src="https://github.com/user-attachments/assets/65334d91-c4e2-4868-924d-e202793dd38d" /> <img width="1309" height="750" alt="Screenshot 2025-08-08 at 16 26 44" src="https://github.com/user-attachments/assets/43e7ae73-f3cb-49ce-a499-7a7587c249c2" /> </details> --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…onrad/kibana into device-control-artifacts

elasticmachine · 2025-08-20T07:48:07Z

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

gergoabraham

looking good, and working well! 🚀

gergoabraham · 2025-08-21T13:33:15Z

x-pack/solutions/security/plugins/security_solution/common/endpoint/types/trusted_devices.ts

+  data: TrustedDevice[];
+}
+
+export type PutTrustedDevicesRequestParams = TypeOf<


q: what's the point of these types? i don't see them being used anywhere. will it be used? the trusted apps counterpart PutTrustedAppsRequestParams is also unused.

q: just out of curiosity, do you know maybe why don't we have these types for event filters, host isolation exceptions, or blocklists?

This is me copying too much from Trusted Applications patterns, will clean up :)

Just FYI: TrustedApps should (for the most part) not be copied as it was built with a very different approach than the rest of the artifacts we have. We have since then attempted to drive away from its design patterns and embraced instead the ExceptionsListItem types and Lists plugin API types. Sorry I missed providing this comment in the past - perhaps it is too late to adjust the implementation (if needed).

paul-tavares

Code looks good

paul-tavares · 2025-08-21T16:00:42Z

x-pack/solutions/security/plugins/security_solution/common/endpoint/types/trusted_devices.ts

+  data: TrustedDevice[];
+}
+
+export type PutTrustedDevicesRequestParams = TypeOf<


Just FYI: TrustedApps should (for the most part) not be copied as it was built with a very different approach than the rest of the artifacts we have. We have since then attempted to drive away from its design patterns and embraced instead the ExceptionsListItem types and Lists plugin API types. Sorry I missed providing this comment in the past - perhaps it is too late to adjust the implementation (if needed).

elasticmachine · 2025-08-21T18:11:29Z

💚 Build Succeeded

Buildkite Build
Commit: 268f15a

Metrics [docs]

✅ unchanged

History

💔 Build #331498 failed 3472731
💛 Build #331355 was flaky 52365d1
💚 Build #331153 succeeded 541ef01
💚 Build #331050 succeeded 682e875
💚 Build #330316 succeeded 115aace

cc @szwarckonrad

Prerequisite #231167 Followup #232269 This PR implements server-side validation for trusted devices in the Kibana by extending the existing list plugin extension points system. The implementation follows established patterns from trusted apps but supports trusted device-specific requirements, including allowing both Windows and Mac OS types (unlike other artifact types that only support single OS per entry) and validating the 5 supported device fields (`username`, `host`, `device ID`, `manufacturer`, `product ID`). The changes include a new `TrustedDeviceValidator` class, integration across all 9 exception list handlers, and comprehensive API integration tests to ensure proper validation and authorization. Key changes: - New `TrustedDeviceValidator` class extending BaseValidator with full space awareness - Updated all 9 list plugin extension point handlers to include trusted device validation - Added comprehensive integration tests covering unique trusted device validation requirements - Maintains consistency with existing artifact validation patterns while supporting device-specific schema --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

Prerequisite elastic#229921 Followup elastic#231167 This PR introduces the Trusted Devices functionality. With these changes, users can: 1. Create Trusted Devices using filters and matching patterns 2. Update existing Trusted Devices 3. Delete Trusted Devices 4. Assign a Trusted Device either globally or to specific policies All functionality is gated behind a feature flag. **Note:** The next PR will introduce artifact creation for Trusted Devices. These artifacts will be consumed by the Endpoint. <img width="1590" height="902" alt="Screenshot 2025-08-08 at 16 19 25" src="https://github.com/user-attachments/assets/e2c0c3e7-e324-49b3-a79a-0e89c232727a" /> <img width="1589" height="932" alt="Screenshot 2025-08-08 at 16 21 28" src="https://github.com/user-attachments/assets/7d508aca-f8dc-40fb-8f45-cac548869960" /> <details><summary>More screenshots</summary> <img width="1591" height="930" alt="Screenshot 2025-08-08 at 16 24 48" src="https://github.com/user-attachments/assets/07bfab25-68ed-4de3-8b8e-7d657d4b5fe3" /> <img width="1563" height="862" alt="Screenshot 2025-08-08 at 16 25 08" src="https://github.com/user-attachments/assets/a4170927-dcb4-4d9a-9327-e26098851532" /> <img width="1589" height="933" alt="Screenshot 2025-08-08 at 16 25 27" src="https://github.com/user-attachments/assets/b43862f3-23f2-48cc-80e8-a8a6f219cf48" /> <img width="731" height="813" alt="Screenshot 2025-08-08 at 16 26 12" src="https://github.com/user-attachments/assets/65334d91-c4e2-4868-924d-e202793dd38d" /> <img width="1309" height="750" alt="Screenshot 2025-08-08 at 16 26 44" src="https://github.com/user-attachments/assets/43e7ae73-f3cb-49ce-a499-7a7587c249c2" /> </details> --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…1167) Prerequisite elastic#230174 Followup elastic#231888 This PR introduces trusted devices as a new artifact type in the Security Solution, enabling device-based allow-listing for endpoint security policies. ### Flow: <details><summary>User enables Device Control in policy settings 🖼️ </summary> <img width="985" height="356" alt="Screenshot 2025-08-11 at 12 53 59" src="https://github.com/user-attachments/assets/6da861ca-4b78-4704-ab12-9bd7cc602d05" /> </details> <details><summary>User adds Trusted Device that will add a whitelist condition to otherwise block policy 🖼️ </summary> <img width="1028" height="530" alt="Screenshot 2025-08-11 at 12 54 10" src="https://github.com/user-attachments/assets/bb801d77-398f-43ff-963a-d91e1c2372f9" /> </details> <details><summary>Artifact is being generated and can be viewed in Agent policy 🖼️ </summary> <img width="620" height="724" alt="Screenshot 2025-08-11 at 12 59 40" src="https://github.com/user-attachments/assets/ac36b3ed-ac1e-4931-8441-d85945629417" /> </details> <details><summary>Artifact can be decoded from index storage 🖼️ </summary> <img width="658" height="684" alt="Screenshot 2025-08-11 at 12 57 38" src="https://github.com/user-attachments/assets/5b6337dc-59e1-4598-8b37-196ece4af5c3" /> </details> <details><summary>Artifact can be decoded from fleet server API 🖼️ </summary> <img width="1253" height="368" alt="Screenshot 2025-08-12 at 12 02 21" src="https://github.com/user-attachments/assets/80229167-25f3-4413-be4e-a127d99faa99" /> </details> ### New Functionality: - **Trusted devices schema and types** - Complete validation schemas for device identification fields (USERNAME, HOST, DEVICE_ID, MANUFACTURER, PRODUCT_ID) - **Artifact integration** - Trusted devices now build and distribute alongside other artifact types (trusted apps, blocklists, etc.) - **Feature flag gating** - Controlled rollout via `trustedDevices` experimental feature - **OS support** - Windows and macOS (Linux support planned for future) ### Key Components: - **API schemas** - GET, POST, PUT request validation with proper field restrictions - **Manifest manager integration** - `buildTrustedDevicesArtifacts()` method following established patterns - **Artifact constants** - Support for `endpoint-trusteddevicelist-{os}-v1` naming convention - **Effect scopes** - Global and policy-specific device trust configurations - **Unit test coverage** - extended existing test coverage as well as introduced new test files where needed --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

szwarckonrad and others added 30 commits July 22, 2025 13:02

feat: add trusted devices feature flag and role

4d405a0

feat: add dedicated product feature key for Trusted Devices management

254e119

Merge branch 'main' into device-control-rbac

f1206c1

Merge branch 'main' into device-control-rbac

b4a07ca

Merge branch 'device-control-rbac' of https://github.com/szwarckonrad…

b187040

…/kibana into device-control-rbac

Merge branch 'main' into device-control-rbac

168132c

feat: add USB device protection card with enterprise license check

298cffc

refactor: rename and update Device Control card component

b231c5f

Merge branch 'main' into device-control-rbac

fabb491

Merge branch 'main' into device-control-rbac

0662df5

Merge branch 'main' into device-control-rbac

7c670d2

Merge branch 'refs/heads/main' into device-control-rbac

8a42e2c

feat: add device control settings to endpoint security policy

a7a112f

feat: add device control settings to endpoint policy configuration

9420353

chore: remove legacy locked card upgrade message from translations

a4a8dea

Merge branch 'main' into device-control-rbac

8885331

feat: add device control license validation to endpoint policy config

35cf852

Merge branch 'main' into device-control-rbac

d6decda

Merge branch 'main' into device-control-rbac

6708c91

feat: add device control popup settings and update license checks to …

d0118aa

…enterprise tier

Merge branch 'main' into device-control-rbac

9ac0f77

feat: add trusted devices management functionality

7d0f505

Merge branch 'main' into device-control-manage

b94b6ca

Merge branch 'main' into device-control-rbac

9b21efe

feat: add execute only access level to device control and update test…

9988f8a

… cases

Merge branch 'main' into device-control-rbac

5ba098d

Merge branch 'main' into device-control-manage

c69573d

feat: add endpoint_trusted_devices to detection alert schema and comm…

e84649a

…on attributes

[CI] Auto-commit changed files from 'yarn openapi:bundle'

c542419

[CI] Auto-commit changed files from 'make api-docs'

546814d

szwarckonrad added 6 commits August 18, 2025 22:35

Merge branch 'main' into device-control-combined

0d2dc30

Merge branch 'main' into device-control-combined

b758c66

Merge branch 'device-control-combined' into device-control-artifacts

5138a55

Add OS_OPTIONS_PLACEHOLDER translation for operating system selection

1c36e39

Merge branch 'main' into device-control-combined

df24319

Merge branch 'device-control-combined' into device-control-artifacts

8803f79

szwarckonrad added 4 commits August 20, 2025 09:30

Merge branch 'main' into device-control-artifacts

f140dff

Merge branch 'main' into device-control-artifacts

b0f045b

Merge branch 'device-control-artifacts' of https://github.com/szwarck…

1fb57bd

…onrad/kibana into device-control-artifacts

clean up comments

682e875

szwarckonrad requested review from gergoabraham and paul-tavares August 20, 2025 07:47

szwarckonrad marked this pull request as ready for review August 20, 2025 07:48

szwarckonrad requested a review from a team as a code owner August 20, 2025 07:48

szwarckonrad added 2 commits August 20, 2025 14:13

Merge branch 'main' into device-control-artifacts

541ef01

Merge branch 'main' into device-control-artifacts

52365d1

gergoabraham approved these changes Aug 21, 2025

View reviewed changes

szwarckonrad added 2 commits August 21, 2025 16:38

Remove unused interfaces and enums from trusted_devices.ts

3477046

Merge branch 'main' into device-control-artifacts

3472731

paul-tavares approved these changes Aug 21, 2025

View reviewed changes

szwarckonrad added 2 commits August 21, 2025 18:30

Merge branch 'main' into device-control-artifacts

b0ced2d

Change export of trusted_devices to type export in index.ts

268f15a

szwarckonrad enabled auto-merge (squash) August 21, 2025 16:35

szwarckonrad merged commit a61db88 into elastic:main Aug 21, 2025
11 of 12 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[EDR Workflows][Device Control] Trusted Devices artifacts#231167

[EDR Workflows][Device Control] Trusted Devices artifacts#231167
szwarckonrad merged 127 commits intoelastic:mainfrom
szwarckonrad:device-control-artifacts

szwarckonrad commented Aug 8, 2025 •

edited

Loading

Uh oh!

elasticmachine commented Aug 20, 2025

Uh oh!

gergoabraham left a comment

Uh oh!

gergoabraham Aug 21, 2025

Uh oh!

szwarckonrad Aug 21, 2025

Uh oh!

paul-tavares Aug 21, 2025

Uh oh!

paul-tavares left a comment

Uh oh!

paul-tavares Aug 21, 2025

Uh oh!

Uh oh!

elasticmachine commented Aug 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

szwarckonrad commented Aug 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Flow:

New Functionality:

Key Components:

Uh oh!

elasticmachine commented Aug 20, 2025

Uh oh!

gergoabraham left a comment

Choose a reason for hiding this comment

Uh oh!

gergoabraham Aug 21, 2025

Choose a reason for hiding this comment

Uh oh!

szwarckonrad Aug 21, 2025

Choose a reason for hiding this comment

Uh oh!

paul-tavares Aug 21, 2025

Choose a reason for hiding this comment

Uh oh!

paul-tavares left a comment

Choose a reason for hiding this comment

Uh oh!

paul-tavares Aug 21, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elasticmachine commented Aug 21, 2025

💚 Build Succeeded

Metrics [docs]

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

szwarckonrad commented Aug 8, 2025 •

edited

Loading