[EDR Workflows][Device Control] Username option available only for Windows

[szwarckonrad]

Updated trusted devices form to only allow the username field when Windows OS is selected exclusively. The field is now hidden for Mac only or Windows+Mac combinations, with automatic field reset when OS changes.

Changes

• Frontend: Dynamic field filtering in trusted devices form with automatic reset logic
• Backend: Server-side validation to enforce username + Windows-only restriction
• Shared utilities: Added isTrustedDeviceFieldAvailableForOs() function and OS field availability constants
• Tests: Updated form unit tests and added comprehensive API integration tests
• Test data: Fixed generators to avoid invalid username + non-Windows combinations

Screen.Recording.2025-09-01.at.11.14.19.mov

[szwarckonrad]

Not used, added for clarity.

[gergoabraham]

i'd suggest to use it. it can be easily used in the function below in the same style as the ALL_OS array. therefore we would have a single source of truth, because now you need to modify the array in two places

[elasticmachine]

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

[gergoabraham]

i'd suggest to use it. it can be easily used in the function below in the same style as the ALL_OS array. therefore we would have a single source of truth, because now you need to modify the array in two places

[gergoabraham]

nit: i feel these comments are a bit redundant: if we use WINDOWS_ONLY above, and then ALL_OS here is already used, the comments are not only just taking up place without adding any additional value to an easily understandable function, but are also adding maintenance cost as they need to be updated all the time manually (copilotly?) when code changes happen.

[gergoabraham]

nit: again, i'd vote against this kind of comment verbosity in general - it gets easily outdated, adds maintenance cost, makes us avoid reading code because it's easier to read comments, but comments may lie.

i'm perfectly fine for adding comments when they it's sensible, because from code it is very hard to find out the whys, but otherwise, i'm all for clean code practices like using clean variable names, like you did here: shouldResetValue speaks on its own.

this is not a finding, these are just my thoughts, and please let me know yours.

[denar50]

Code owners review only. LGTM!

[Copilot]

Pull Request Overview

This PR implements OS-specific field availability for trusted devices, restricting the USERNAME field to Windows-only OS selection while allowing other fields for all OS combinations. The changes ensure proper validation both on the frontend (form) and backend (server validation) with comprehensive test coverage.

• Dynamic field filtering in the trusted devices form based on OS selection
• Server-side validation to enforce USERNAME field restriction to Windows-only OS
• Comprehensive test coverage for both form behavior and API validation scenarios

Reviewed Changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
trusted_devices.ts	Added API integration tests validating USERNAME field OS restrictions
trusted_device_validator.ts	Added server-side validation for OS-specific field availability
form.tsx	Implemented dynamic field filtering and automatic field reset logic
form.test.tsx	Updated unit tests to cover OS-based field availability scenarios
artifacts.ts	Fixed selector specificity for OS option selection
artifacts_page.ts	Updated test data to use HOST field instead of USERNAME for compatibility
trusted_devices.cy.ts	Updated Cypress tests to reflect USERNAME field Windows-only restriction
exceptions_list_item_generator.ts	Changed default field from USERNAME to HOST for broader OS compatibility
index.ts	Added utility function and constants for OS-specific field availability
index.test.ts	Added comprehensive unit tests for the new field availability utility

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: dc3da58

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
@kbn/securitysolution-utils	63	67	+4

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
lists	126.0KB	126.2KB	+234.0B
securitySolution	10.3MB	10.3MB	+1.2KB
total			+1.4KB

Saved Objects .kibana field count

Every field in each saved object type adds overhead to Elasticsearch. Kibana needs to keep the total field count below Elasticsearch's default limit of 1000 fields. Only specify field mappings for the fields you wish to search on or query. See https://www.elastic.co/guide/en/kibana/master/saved-objects-service.html#_mappings

id	before	after	diff
_data_stream_timestamp	1	-	-1
_doc_count	1	-	-1
_ignored_source	1	-	-1
_index_mode	1	-	-1
_inference_fields	1	-	-1
_tier	1	-	-1
apm-custom-dashboards	5	-	-5
apm-server-schema	2	-	-2
apm-service-group	5	-	-5
application_usage_daily	2	-	-2
config	2	-	-2
config-global	2	-	-2
coreMigrationVersion	1	-	-1
created_at	1	-	-1
created_by	1	-	-1
entity-definition	9	-	-9
entity-discovery-api-key	2	-	-2
event_loop_delays_daily	2	-	-2
favorites	4	-	-4
file	11	-	-11
file-upload-usage-collection-telemetry	3	-	-3
fileShare	5	-	-5
infra-custom-dashboards	4	-	-4
infrastructure-monitoring-log-view	2	-	-2
intercept_trigger_record	5	-	-5
legacy-url-alias	7	-	-7
managed	1	-	-1
ml-job	6	-	-6
ml-module	13	-	-13
ml-trained-model	7	-	-7
monitoring-telemetry	2	-	-2
namespace	1	-	-1
namespaces	1	-	-1
observability-onboarding-state	2	-	-2
originId	1	-	-1
product-doc-install-status	7	-	-7
references	4	-	-4
sample-data-telemetry	3	-	-3
security-ai-prompt	8	-	-8
slo	11	-	-11
space	5	-	-5
synthetics-monitor	34	-	-34
synthetics-monitor-multi-space	34	-	-34
tag	4	-	-4
type	1	-	-1
typeMigrationVersion	1	-	-1
ui-metric	2	-	-2
updated_at	1	-	-1
updated_by	1	-	-1
upgrade-assistant-ml-upgrade-operation	3	-	-3
upgrade-assistant-reindex-operation	3	-	-3
uptime-synthetics-api-key	2	-	-2
url	5	-	-5
usage-counters	2	-	-2
total			-246

Unknown metric groups

API count

id	before	after	diff
@kbn/securitysolution-utils	72	76	+4

History

• 💔 Build #336366 failed d2ff359
• 💔 Build #336275 failed e036a5e
• 💔 Build #336220 failed ce65089
• 💚 Build #335631 succeeded 0a34a99
• 💚 Build #334520 succeeded a8d9f3e

cc @szwarckonrad