[EDR Workflows][Device Control] Trusted Devices validators by szwarckonrad · Pull Request #231888 · elastic/kibana

szwarckonrad · 2025-08-14T19:19:25Z

Prerequisite #231167
Followup #232269

This PR implements server-side validation for trusted devices in the Kibana by extending the existing list plugin extension points system. The implementation follows established patterns from trusted apps but supports trusted device-specific requirements, including allowing both Windows and Mac OS types (unlike other artifact types that only support single OS per entry) and validating the 5 supported device fields (username, host, device ID, manufacturer, product ID). The changes include a new TrustedDeviceValidator class, integration across all 9 exception list handlers, and comprehensive API integration tests to ensure proper validation and authorization.

Key changes:

New TrustedDeviceValidator class extending BaseValidator with full space awareness
Updated all 9 list plugin extension point handlers to include trusted device validation
Added comprehensive integration tests covering unique trusted device validation requirements
Maintains consistency with existing artifact validation patterns while supporting device-specific schema

…/kibana into device-control-rbac

…enterprise tier

… cases

…on attributes

Prerequisite #230174 Followup #231888 This PR introduces trusted devices as a new artifact type in the Security Solution, enabling device-based allow-listing for endpoint security policies. ### Flow: <details><summary>User enables Device Control in policy settings 🖼️ </summary> <img width="985" height="356" alt="Screenshot 2025-08-11 at 12 53 59" src="https://github.com/user-attachments/assets/6da861ca-4b78-4704-ab12-9bd7cc602d05" /> </details> <details><summary>User adds Trusted Device that will add a whitelist condition to otherwise block policy 🖼️ </summary> <img width="1028" height="530" alt="Screenshot 2025-08-11 at 12 54 10" src="https://github.com/user-attachments/assets/bb801d77-398f-43ff-963a-d91e1c2372f9" /> </details> <details><summary>Artifact is being generated and can be viewed in Agent policy 🖼️ </summary> <img width="620" height="724" alt="Screenshot 2025-08-11 at 12 59 40" src="https://github.com/user-attachments/assets/ac36b3ed-ac1e-4931-8441-d85945629417" /> </details> <details><summary>Artifact can be decoded from index storage 🖼️ </summary> <img width="658" height="684" alt="Screenshot 2025-08-11 at 12 57 38" src="https://github.com/user-attachments/assets/5b6337dc-59e1-4598-8b37-196ece4af5c3" /> </details> <details><summary>Artifact can be decoded from fleet server API 🖼️ </summary> <img width="1253" height="368" alt="Screenshot 2025-08-12 at 12 02 21" src="https://github.com/user-attachments/assets/80229167-25f3-4413-be4e-a127d99faa99" /> </details> ### New Functionality: - **Trusted devices schema and types** - Complete validation schemas for device identification fields (USERNAME, HOST, DEVICE_ID, MANUFACTURER, PRODUCT_ID) - **Artifact integration** - Trusted devices now build and distribute alongside other artifact types (trusted apps, blocklists, etc.) - **Feature flag gating** - Controlled rollout via `trustedDevices` experimental feature - **OS support** - Windows and macOS (Linux support planned for future) ### Key Components: - **API schemas** - GET, POST, PUT request validation with proper field restrictions - **Manifest manager integration** - `buildTrustedDevicesArtifacts()` method following established patterns - **Artifact constants** - Support for `endpoint-trusteddevicelist-{os}-v1` naming convention - **Effect scopes** - Global and policy-specific device trust configurations - **Unit test coverage** - extended existing test coverage as well as introduced new test files where needed --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

# Conflicts: # x-pack/solutions/security/plugins/security_solution/common/endpoint/types/index.ts # x-pack/solutions/security/plugins/security_solution/common/endpoint/types/trusted_devices.ts

elasticmachine · 2025-08-22T07:51:21Z

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

csr

AppEx QA changes (roles.yaml file) LGTM

denar50

Code review only for files owned by @elastic/security-detection-engine. LGTM!

gergoabraham · 2025-08-22T14:37:57Z

src/platform/packages/shared/kbn-es/src/serverless_resources/project_roles/security/roles.yml

        - feature_siemV3.endpoint_list_all
        - feature_siemV3.global_artifact_management_all
        - feature_siemV3.trusted_applications_all
+        - feature_siemV3.trusted_devices_all


is this intentional here? if yes, do we want to add the new privilege only to endpoint_policy_manager?

gergoabraham · 2025-08-22T14:45:28Z

...s/security_solution/server/lists_integration/endpoint/validators/trusted_device_validator.ts

+    return super.validateHasPrivilege('canReadTrustedDevices');
+  }
+
+  private async validateTrustedDevicesFeatureEnabled(): Promise<void> {


nice, very thorough! 👏

gergoabraham · 2025-08-22T14:49:59Z

...urity_solution/server/lists_integration/endpoint/validators/trusted_device_validator.test.ts

+        await expect(
+          trustedDeviceValidator.validatePreCreateItem(
+            item as unknown as CreateExceptionListItemOptions
+          )
+        ).rejects.toThrow(EndpointArtifactExceptionValidationError);
+        await expect(
+          trustedDeviceValidator.validatePreCreateItem(
+            item as unknown as CreateExceptionListItemOptions
+          )
+        ).rejects.toThrow('Trusted devices feature is not enabled');


the two calls can be merged into one:

await expect( trustedDeviceValidator.validatePreCreateItem( item as unknown as CreateExceptionListItemOptions ) ).rejects.toThrow( new EndpointArtifactExceptionValidationError('Trusted devices feature is not enabled') );

but... i guess this is not a test with a long life expectancy... so this is a nit :)

paul-tavares

Left a few comment, but am approving as they seem minor (but perhaps required)

paul-tavares · 2025-08-25T13:58:41Z

...s/security_solution/server/lists_integration/endpoint/validators/trusted_device_validator.ts

+            validate: (osTypes: string[]) => {
+              const validOsTypes = [OperatingSystem.WINDOWS, OperatingSystem.MAC];
+              const invalidOs = osTypes.find((os) => !validOsTypes.includes(os as OperatingSystem));
+              return invalidOs
+                ? `Unsupported OS type: ${invalidOs}. Only Windows and Mac are supported for trusted devices.`
+                : undefined;
+            },


I don't think this is needed. The osTypes is already validating that only Windows and Mac can be used, so I don't think this code is ever hit if you try to use anything else.

Also - I tested this via API and it currently allows for duplicate values to be set - example: os_types: ["windows", "windows"]. Perhaps add a validation for that instead.

Fixed - removed redundant OS validation and added duplicate prevention to reject entries like ["windows", "windows"]

paul-tavares · 2025-08-25T13:59:29Z

...s/security_solution/server/lists_integration/endpoint/validators/trusted_device_validator.ts

+   * Override base validation to allow both Windows and Mac OS types for trusted devices
+   */
+  protected async validateBasicData(item: ExceptionItemLikeOptions) {
+    const TrustedDeviceBasicDataSchema = schema.object(


Maybe extract the Schema into a module const just like the other schemas?

Extracted schema to TrustedDeviceBasicDataSchema.

paul-tavares · 2025-08-25T14:04:07Z

...tegration/test_suites/edr_workflows/artifacts/trial_license_complete_tier/trusted_devices.ts

+    const anEndpointArtifactError = (res: { body: { message: string } }) => {
+      expect(res.body.message).to.match(/EndpointArtifactError/);
+    };
+    const aValidationError = (res: { body: { message: string } }) => {
+      // Match either EndpointArtifactError or OpenAPI validation errors
+      expect(res.body.message).to.match(/(EndpointArtifactError|\[request body\])/);
+    };
+    const anErrorMessageWith = (
+      value: string | RegExp
+    ): ((res: { body: { message: string } }) => void) => {
+      return (res) => {
+        if (value instanceof RegExp) {
+          expect(res.body.message).to.match(value);
+        } else {
+          expect(res.body.message).to.be(value);
+        }
+      };
+    };


++1 on the function names here. Makes it very clear on intent when reading the assertions code below 👍

paul-tavares · 2025-08-25T14:56:08Z

...s/security_solution/server/lists_integration/endpoint/validators/trusted_device_validator.ts

+        name: schema.string({ minLength: 1, maxLength: 256 }),
+        description: schema.maybe(
+          schema.string({ minLength: 0, maxLength: 256, defaultValue: '' })
+        ),


Most of these properties are already validated at the Lists plugin level (here), so you might not need them unless you are trying to apply stricter validations.

Example: description is marked as optional here, but required at the lists plugin, so its not actually optional.

Updated to use BasicEndpointExceptionDataSchema.extends() pattern, removing redundant validation while keeping trusted device-specific constraints

elasticmachine · 2025-08-26T11:09:44Z

💚 Build Succeeded

Buildkite Build
Commit: 17ac822

Metrics [docs]

✅ unchanged

History

💛 Build #331698 was flaky 5ce5dbd
💚 Build #330431 succeeded 425f9b2
💔 Build #330359 failed c4dcdd0
💔 Build #330333 failed 2d17172
💔 Build #330319 failed 6b576f4

cc @szwarckonrad

…1167) Prerequisite elastic#230174 Followup elastic#231888 This PR introduces trusted devices as a new artifact type in the Security Solution, enabling device-based allow-listing for endpoint security policies. ### Flow: <details><summary>User enables Device Control in policy settings 🖼️ </summary> <img width="985" height="356" alt="Screenshot 2025-08-11 at 12 53 59" src="https://github.com/user-attachments/assets/6da861ca-4b78-4704-ab12-9bd7cc602d05" /> </details> <details><summary>User adds Trusted Device that will add a whitelist condition to otherwise block policy 🖼️ </summary> <img width="1028" height="530" alt="Screenshot 2025-08-11 at 12 54 10" src="https://github.com/user-attachments/assets/bb801d77-398f-43ff-963a-d91e1c2372f9" /> </details> <details><summary>Artifact is being generated and can be viewed in Agent policy 🖼️ </summary> <img width="620" height="724" alt="Screenshot 2025-08-11 at 12 59 40" src="https://github.com/user-attachments/assets/ac36b3ed-ac1e-4931-8441-d85945629417" /> </details> <details><summary>Artifact can be decoded from index storage 🖼️ </summary> <img width="658" height="684" alt="Screenshot 2025-08-11 at 12 57 38" src="https://github.com/user-attachments/assets/5b6337dc-59e1-4598-8b37-196ece4af5c3" /> </details> <details><summary>Artifact can be decoded from fleet server API 🖼️ </summary> <img width="1253" height="368" alt="Screenshot 2025-08-12 at 12 02 21" src="https://github.com/user-attachments/assets/80229167-25f3-4413-be4e-a127d99faa99" /> </details> ### New Functionality: - **Trusted devices schema and types** - Complete validation schemas for device identification fields (USERNAME, HOST, DEVICE_ID, MANUFACTURER, PRODUCT_ID) - **Artifact integration** - Trusted devices now build and distribute alongside other artifact types (trusted apps, blocklists, etc.) - **Feature flag gating** - Controlled rollout via `trustedDevices` experimental feature - **OS support** - Windows and macOS (Linux support planned for future) ### Key Components: - **API schemas** - GET, POST, PUT request validation with proper field restrictions - **Manifest manager integration** - `buildTrustedDevicesArtifacts()` method following established patterns - **Artifact constants** - Support for `endpoint-trusteddevicelist-{os}-v1` naming convention - **Effect scopes** - Global and policy-specific device trust configurations - **Unit test coverage** - extended existing test coverage as well as introduced new test files where needed --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…2269) Prerequisite #231888 Followup #232374 This PR brings comprehensive Cypress test coverage to Trusted Devices, mirroring the established Trusted Apps testing patterns. We implemented full CRUD operations testing, RBAC permissions validation, and serverless PLI/tier access controls. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

…stic#232269) Prerequisite elastic#231888 Followup elastic#232374 This PR brings comprehensive Cypress test coverage to Trusted Devices, mirroring the established Trusted Apps testing patterns. We implemented full CRUD operations testing, RBAC permissions validation, and serverless PLI/tier access controls. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

szwarckonrad and others added 30 commits July 22, 2025 13:02

feat: add trusted devices feature flag and role

4d405a0

feat: add dedicated product feature key for Trusted Devices management

254e119

Merge branch 'main' into device-control-rbac

f1206c1

Merge branch 'main' into device-control-rbac

b4a07ca

Merge branch 'device-control-rbac' of https://github.com/szwarckonrad…

b187040

…/kibana into device-control-rbac

Merge branch 'main' into device-control-rbac

168132c

feat: add USB device protection card with enterprise license check

298cffc

refactor: rename and update Device Control card component

b231c5f

Merge branch 'main' into device-control-rbac

fabb491

Merge branch 'main' into device-control-rbac

0662df5

Merge branch 'main' into device-control-rbac

7c670d2

Merge branch 'refs/heads/main' into device-control-rbac

8a42e2c

feat: add device control settings to endpoint security policy

a7a112f

feat: add device control settings to endpoint policy configuration

9420353

chore: remove legacy locked card upgrade message from translations

a4a8dea

Merge branch 'main' into device-control-rbac

8885331

feat: add device control license validation to endpoint policy config

35cf852

Merge branch 'main' into device-control-rbac

d6decda

Merge branch 'main' into device-control-rbac

6708c91

feat: add device control popup settings and update license checks to …

d0118aa

…enterprise tier

Merge branch 'main' into device-control-rbac

9ac0f77

feat: add trusted devices management functionality

7d0f505

Merge branch 'main' into device-control-manage

b94b6ca

Merge branch 'main' into device-control-rbac

9b21efe

feat: add execute only access level to device control and update test…

9988f8a

… cases

Merge branch 'main' into device-control-rbac

5ba098d

Merge branch 'main' into device-control-manage

c69573d

feat: add endpoint_trusted_devices to detection alert schema and comm…

e84649a

…on attributes

[CI] Auto-commit changed files from 'yarn openapi:bundle'

c542419

[CI] Auto-commit changed files from 'make api-docs'

546814d

szwarckonrad added 3 commits August 20, 2025 14:13

Merge branch 'device-control-artifacts' into device-control-validators

80821a4

Merge branch 'main' into device-control-artifacts

52365d1

Merge branch 'device-control-artifacts' into device-control-validators

74c3cb1

Merge branch 'main' into device-control-validators

9348340

# Conflicts: # x-pack/solutions/security/plugins/security_solution/common/endpoint/types/index.ts # x-pack/solutions/security/plugins/security_solution/common/endpoint/types/trusted_devices.ts

szwarckonrad requested review from gergoabraham and paul-tavares August 22, 2025 07:51

szwarckonrad marked this pull request as ready for review August 22, 2025 07:51

szwarckonrad requested review from a team as code owners August 22, 2025 07:51

szwarckonrad requested a review from denar50 August 22, 2025 07:51

remove outdated comments

5ce5dbd

csr approved these changes Aug 22, 2025

View reviewed changes

mdbirnstiehl approved these changes Aug 22, 2025

View reviewed changes

denar50 approved these changes Aug 22, 2025

View reviewed changes

gergoabraham approved these changes Aug 22, 2025

View reviewed changes

Merge branch 'main' into device-control-validators

d71ecae

paul-tavares approved these changes Aug 25, 2025

View reviewed changes

szwarckonrad added 2 commits August 26, 2025 09:29

Merge branch 'main' into device-control-validators

e8ec84d

refactor validation schemas

17ac822

szwarckonrad enabled auto-merge (squash) August 26, 2025 10:19

szwarckonrad merged commit 136fb6d into elastic:main Aug 26, 2025
12 checks passed

Conversation

szwarckonrad commented Aug 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elasticmachine commented Aug 22, 2025

Uh oh!

csr left a comment

Choose a reason for hiding this comment

Uh oh!

denar50 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

paul-tavares left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elasticmachine commented Aug 26, 2025

💚 Build Succeeded

Metrics [docs]

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

szwarckonrad commented Aug 14, 2025 •

edited

Loading