From 9f114e881ecde742b9b837de5823424222a665ef Mon Sep 17 00:00:00 2001 From: "Joey F. Poon" Date: Thu, 11 Sep 2025 15:12:27 +0900 Subject: [PATCH 1/5] [Security Solution] remove automatic troubleshooting tech preview - removes techical preview label from automatic troubleshooting UI - remove defendInsights feature flag --- .../impl/capabilities/index.ts | 1 - .../server/routes/defend_insights/helpers.ts | 18 --------------- .../server/services/app_context.test.ts | 7 ------ .../common/experimental_features.ts | 5 ---- .../components/insights/workflow_insights.tsx | 23 +------------------ .../routes/workflow_insights/index.ts | 6 ++--- .../services/workflow_insights/index.test.ts | 5 ---- .../services/workflow_insights/index.ts | 13 +---------- .../security_solution/server/plugin.ts | 1 - 9 files changed, 4 insertions(+), 75 deletions(-) diff --git a/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/capabilities/index.ts b/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/capabilities/index.ts index d84d6c797c209..35fcf4b5fdcf4 100644 --- a/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/capabilities/index.ts +++ b/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/capabilities/index.ts @@ -20,6 +20,5 @@ export type AssistantFeatureKey = keyof AssistantFeatures; */ export const defaultAssistantFeatures = Object.freeze({ assistantModelEvaluation: false, - defendInsights: true, defendInsightsPolicyResponseFailure: false, }); diff --git a/x-pack/solutions/security/plugins/elastic_assistant/server/routes/defend_insights/helpers.ts b/x-pack/solutions/security/plugins/elastic_assistant/server/routes/defend_insights/helpers.ts index 66f48b6d973a7..5cb7406b4b89b 100644 --- a/x-pack/solutions/security/plugins/elastic_assistant/server/routes/defend_insights/helpers.ts +++ b/x-pack/solutions/security/plugins/elastic_assistant/server/routes/defend_insights/helpers.ts @@ -68,24 +68,6 @@ function addGenerationInterval( return newGenerationIntervals; } -export function isDefendInsightsEnabled({ - request, - logger, - assistantContext, -}: { - request: KibanaRequest; - logger: Logger; - assistantContext: ElasticAssistantApiRequestHandlerContext; -}): boolean { - const pluginName = getPluginNameFromRequest({ - request, - logger, - defaultPluginName: DEFAULT_PLUGIN_NAME, - }); - - return assistantContext.getRegisteredFeatures(pluginName).defendInsights; -} - export function isDefendInsightsPolicyResponseFailureEnabled({ request, logger, diff --git a/x-pack/solutions/security/plugins/elastic_assistant/server/services/app_context.test.ts b/x-pack/solutions/security/plugins/elastic_assistant/server/services/app_context.test.ts index b2b0749e754a2..0195a8d36d3df 100644 --- a/x-pack/solutions/security/plugins/elastic_assistant/server/services/app_context.test.ts +++ b/x-pack/solutions/security/plugins/elastic_assistant/server/services/app_context.test.ts @@ -64,7 +64,6 @@ describe('AppContextService', () => { appContextService.start(mockAppContext); appContextService.registerFeatures('super', { assistantModelEvaluation: true, - defendInsights: true, }); appContextService.stop(); @@ -126,7 +125,6 @@ describe('AppContextService', () => { const features: AssistantFeatures = { ...defaultAssistantFeatures, assistantModelEvaluation: true, - defendInsights: true, }; appContextService.start(mockAppContext); @@ -142,13 +140,11 @@ describe('AppContextService', () => { const featuresOne: AssistantFeatures = { ...defaultAssistantFeatures, assistantModelEvaluation: true, - defendInsights: true, }; const pluginTwo = 'plugin2'; const featuresTwo: AssistantFeatures = { ...defaultAssistantFeatures, assistantModelEvaluation: false, - defendInsights: false, }; appContextService.start(mockAppContext); @@ -164,12 +160,10 @@ describe('AppContextService', () => { const featuresOne: AssistantFeatures = { ...defaultAssistantFeatures, assistantModelEvaluation: true, - defendInsights: true, }; const featuresTwo: AssistantFeatures = { ...defaultAssistantFeatures, assistantModelEvaluation: false, - defendInsights: false, }; appContextService.start(mockAppContext); @@ -191,7 +185,6 @@ describe('AppContextService', () => { const pluginName = 'pluginName'; const featuresSubset: Partial = { assistantModelEvaluation: true, - defendInsights: true, }; appContextService.start(mockAppContext); diff --git a/x-pack/solutions/security/plugins/security_solution/common/experimental_features.ts b/x-pack/solutions/security/plugins/security_solution/common/experimental_features.ts index 9806db10570d7..165b5ac23988f 100644 --- a/x-pack/solutions/security/plugins/security_solution/common/experimental_features.ts +++ b/x-pack/solutions/security/plugins/security_solution/common/experimental_features.ts @@ -257,11 +257,6 @@ export const allowedExperimentalValues = Object.freeze({ */ siemMigrationsDisabled: false, - /** - * Enables the Defend Insights feature - */ - defendInsights: true, - /** * Enables the Defend Insights Policy Response Failure feature */ diff --git a/x-pack/solutions/security/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/insights/workflow_insights.tsx b/x-pack/solutions/security/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/insights/workflow_insights.tsx index 40b893eca8eb5..bf049b8504481 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/insights/workflow_insights.tsx +++ b/x-pack/solutions/security/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/components/insights/workflow_insights.tsx @@ -5,23 +5,12 @@ * 2.0. */ -import { - EuiAccordion, - EuiSpacer, - EuiText, - EuiBetaBadge, - EuiFlexItem, - EuiFlexGroup, -} from '@elastic/eui'; +import { EuiAccordion, EuiSpacer, EuiText, EuiFlexItem, EuiFlexGroup } from '@elastic/eui'; import React, { useState, useEffect, useCallback, useMemo } from 'react'; import moment from 'moment'; import type { DefendInsightType } from '@kbn/elastic-assistant-common'; import { ActionType } from '../../../../../../../../common/endpoint/types/workflow_insights'; -import { - TECHNICAL_PREVIEW_TOOLTIP, - TECHNICAL_PREVIEW, -} from '../../../../../../../common/translations'; import { useIsExperimentalFeatureEnabled } from '../../../../../../../common/hooks/use_experimental_features'; import { useFetchInsights } from '../../../hooks/insights/use_fetch_insights'; import { useTriggerScan } from '../../../hooks/insights/use_trigger_scan'; @@ -177,16 +166,6 @@ export const WorkflowInsights = React.memo(({ endpointId }: WorkflowInsightsProp

{WORKFLOW_INSIGHTS.title}

- - - } initialIsOpen diff --git a/x-pack/solutions/security/plugins/security_solution/server/endpoint/routes/workflow_insights/index.ts b/x-pack/solutions/security/plugins/security_solution/server/endpoint/routes/workflow_insights/index.ts index 3fc3a0a70d1b9..80476e6a497f8 100644 --- a/x-pack/solutions/security/plugins/security_solution/server/endpoint/routes/workflow_insights/index.ts +++ b/x-pack/solutions/security/plugins/security_solution/server/endpoint/routes/workflow_insights/index.ts @@ -16,8 +16,6 @@ export const registerWorkflowInsightsRoutes = ( config: ConfigType, endpointContext: EndpointAppContext ) => { - if (config.experimentalFeatures.defendInsights) { - registerGetInsightsRoute(router, endpointContext); - registerUpdateInsightsRoute(router, endpointContext); - } + registerGetInsightsRoute(router, endpointContext); + registerUpdateInsightsRoute(router, endpointContext); }; diff --git a/x-pack/solutions/security/plugins/security_solution/server/endpoint/services/workflow_insights/index.test.ts b/x-pack/solutions/security/plugins/security_solution/server/endpoint/services/workflow_insights/index.test.ts index 33f8fbb1deabe..9cf5bf52202d4 100644 --- a/x-pack/solutions/security/plugins/security_solution/server/endpoint/services/workflow_insights/index.test.ts +++ b/x-pack/solutions/security/plugins/security_solution/server/endpoint/services/workflow_insights/index.test.ts @@ -149,7 +149,6 @@ describe('SecurityWorkflowInsightsService', () => { securityWorkflowInsightsService.setup({ kibanaVersion: kibanaPackageJson.version, logger, - isFeatureEnabled: true, endpointContext: mockEndpointAppContextService, }); @@ -166,7 +165,6 @@ describe('SecurityWorkflowInsightsService', () => { securityWorkflowInsightsService.setup({ kibanaVersion: kibanaPackageJson.version, logger, - isFeatureEnabled: true, endpointContext: mockEndpointAppContextService, }); @@ -191,7 +189,6 @@ describe('SecurityWorkflowInsightsService', () => { securityWorkflowInsightsService.setup({ kibanaVersion: kibanaPackageJson.version, logger, - isFeatureEnabled: true, endpointContext: mockEndpointAppContextService, }); expect(createDatastreamMock).toHaveBeenCalledTimes(1); @@ -218,7 +215,6 @@ describe('SecurityWorkflowInsightsService', () => { securityWorkflowInsightsService.setup({ kibanaVersion: kibanaPackageJson.version, logger, - isFeatureEnabled: true, endpointContext: mockEndpointAppContextService, }); @@ -518,7 +514,6 @@ describe('SecurityWorkflowInsightsService', () => { securityWorkflowInsightsService.setup({ kibanaVersion: kibanaPackageJson.version, logger, - isFeatureEnabled: true, endpointContext: mockEndpointAppContextService, }); diff --git a/x-pack/solutions/security/plugins/security_solution/server/endpoint/services/workflow_insights/index.ts b/x-pack/solutions/security/plugins/security_solution/server/endpoint/services/workflow_insights/index.ts index 0c82e38e0b352..3137a366b3b43 100644 --- a/x-pack/solutions/security/plugins/security_solution/server/endpoint/services/workflow_insights/index.ts +++ b/x-pack/solutions/security/plugins/security_solution/server/endpoint/services/workflow_insights/index.ts @@ -44,7 +44,6 @@ const DEFAULT_PAGE_SIZE = 10; interface SetupInterface { kibanaVersion: string; logger: Logger; - isFeatureEnabled: boolean; endpointContext: EndpointAppContextService; } @@ -64,7 +63,6 @@ class SecurityWorkflowInsightsService { private _isInitialized: Promise<[void, void]> = firstValueFrom( combineLatest<[void, void]>([this.setup$, this.start$]) ); - private isFeatureEnabled = false; /** * Lifecycle @@ -74,12 +72,7 @@ class SecurityWorkflowInsightsService { return this._isInitialized; } - public setup({ kibanaVersion, logger, isFeatureEnabled, endpointContext }: SetupInterface) { - this.isFeatureEnabled = isFeatureEnabled; - if (!isFeatureEnabled) { - return; - } - + public setup({ kibanaVersion, logger, endpointContext }: SetupInterface) { this._logger = logger; this._endpointContext = endpointContext; @@ -94,10 +87,6 @@ class SecurityWorkflowInsightsService { } public async start({ esClient, registerDefendInsightsCallback }: StartInterface) { - if (!this.isFeatureEnabled) { - return; - } - this._esClient = esClient; await firstValueFrom(this.setup$); diff --git a/x-pack/solutions/security/plugins/security_solution/server/plugin.ts b/x-pack/solutions/security/plugins/security_solution/server/plugin.ts index bde72ac22d433..c00be0b1713fd 100644 --- a/x-pack/solutions/security/plugins/security_solution/server/plugin.ts +++ b/x-pack/solutions/security/plugins/security_solution/server/plugin.ts @@ -582,7 +582,6 @@ export class Plugin implements ISecuritySolutionPlugin { securityWorkflowInsightsService.setup({ kibanaVersion: pluginContext.env.packageInfo.version, logger: this.logger, - isFeatureEnabled: config.experimentalFeatures.defendInsights, endpointContext: this.endpointContext.service, }); From 19209b93f4fae20b627268720b052c371959938b Mon Sep 17 00:00:00 2001 From: "Joey F. Poon" Date: Fri, 12 Sep 2025 21:45:57 +0900 Subject: [PATCH 2/5] fix get capabilities route --- .../impl/schemas/capabilities/get_capabilities_route.gen.ts | 2 +- .../schemas/capabilities/get_capabilities_route.schema.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.gen.ts b/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.gen.ts index 8777e8d728279..1d06731fd953d 100644 --- a/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.gen.ts +++ b/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.gen.ts @@ -19,5 +19,5 @@ import { z } from '@kbn/zod'; export type GetCapabilitiesResponse = z.infer; export const GetCapabilitiesResponse = z.object({ assistantModelEvaluation: z.boolean(), - defendInsights: z.boolean(), + defendInsightsPolicyResponseFailure: z.boolean(), }); diff --git a/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.schema.yaml b/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.schema.yaml index e9b6ca9697256..d506ed956ceeb 100644 --- a/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.schema.yaml +++ b/x-pack/platform/packages/shared/kbn-elastic-assistant-common/impl/schemas/capabilities/get_capabilities_route.schema.yaml @@ -22,11 +22,11 @@ paths: properties: assistantModelEvaluation: type: boolean - defendInsights: + defendInsightsPolicyResponseFailure: type: boolean required: - assistantModelEvaluation - - defendInsights + - defendInsightsPolicyResponseFailure '400': description: Generic Error content: From ade282f7ec1513d36ae867dc5b1f7bd7185cdac4 Mon Sep 17 00:00:00 2001 From: "Joey F. Poon" Date: Fri, 12 Sep 2025 23:11:00 +0900 Subject: [PATCH 3/5] remove FE FF check --- .../view/details/endpoint_details_content.tsx | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/x-pack/solutions/security/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/endpoint_details_content.tsx b/x-pack/solutions/security/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/endpoint_details_content.tsx index 842a83f3eadbf..466212f9ce598 100644 --- a/x-pack/solutions/security/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/endpoint_details_content.tsx +++ b/x-pack/solutions/security/plugins/security_solution/public/management/pages/endpoint_hosts/view/details/endpoint_details_content.tsx @@ -15,7 +15,6 @@ import { } from '@elastic/eui'; import React, { memo, useMemo } from 'react'; import { FormattedMessage } from '@kbn/i18n-react'; -import { useIsExperimentalFeatureEnabled } from '../../../../../common/hooks/use_experimental_features'; import { WorkflowInsights } from './components/insights/workflow_insights'; import { isPolicyOutOfDate } from '../../utils'; import { AgentStatus } from '../../../../../common/components/endpoint/agents/agent_status'; @@ -45,14 +44,7 @@ interface EndpointDetailsContentProps { export const EndpointDetailsContent = memo( ({ hostInfo, policyInfo }) => { // Access control - const isWorkflowInsightsFeatureFlagEnabled = useIsExperimentalFeatureEnabled('defendInsights'); const { canReadWorkflowInsights } = useUserPrivileges().endpointPrivileges; - const canAccessWorkflowInsights = useMemo(() => { - if (!isWorkflowInsightsFeatureFlagEnabled) { - return false; - } - return canReadWorkflowInsights; - }, [canReadWorkflowInsights, isWorkflowInsightsFeatureFlagEnabled]); const queryParams = useEndpointSelector(uiQueryParams); const policyStatus = useMemo( @@ -195,7 +187,7 @@ export const EndpointDetailsContent = memo( }, [hostInfo, policyInfo, missingPolicies, policyStatus, policyStatusClickHandler]); return (
- {canAccessWorkflowInsights && } + {canReadWorkflowInsights && } Date: Tue, 16 Sep 2025 18:03:51 +0900 Subject: [PATCH 4/5] fix tests --- .../features/src/security/v2_features/kibana_sub_features.ts | 3 --- .../src/context/assistant_context/assistant_provider.test.tsx | 2 +- 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/x-pack/solutions/security/packages/features/src/security/v2_features/kibana_sub_features.ts b/x-pack/solutions/security/packages/features/src/security/v2_features/kibana_sub_features.ts index 9642ea7d9dfe4..a1429816440a1 100644 --- a/x-pack/solutions/security/packages/features/src/security/v2_features/kibana_sub_features.ts +++ b/x-pack/solutions/security/packages/features/src/security/v2_features/kibana_sub_features.ts @@ -131,9 +131,6 @@ export const getSecurityV2SubFeaturesMap = ({ if (!experimentalFeatures.endpointManagementSpaceAwarenessEnabled) { securitySubFeaturesMap.delete(SecuritySubFeatureId.globalArtifactManagement); } - if (!experimentalFeatures.defendInsights) { - securitySubFeaturesMap.delete(SecuritySubFeatureId.workflowInsights); - } return Object.freeze(securitySubFeaturesMap); }; diff --git a/x-pack/solutions/security/plugins/elastic_assistant/public/src/context/assistant_context/assistant_provider.test.tsx b/x-pack/solutions/security/plugins/elastic_assistant/public/src/context/assistant_context/assistant_provider.test.tsx index 81701a798c7e0..9806cbef10ad9 100644 --- a/x-pack/solutions/security/plugins/elastic_assistant/public/src/context/assistant_context/assistant_provider.test.tsx +++ b/x-pack/solutions/security/plugins/elastic_assistant/public/src/context/assistant_context/assistant_provider.test.tsx @@ -70,7 +70,7 @@ describe('AssistantProvider', () => { }), assistantFeatures: expect.objectContaining({ assistantModelEvaluation: expect.any(Boolean), - defendInsights: expect.any(Boolean), + defendInsightsPolicyResponseFailure: expect.any(Boolean), }), assistantStreamingEnabled: expect.any(Boolean), assistantTelemetry: expect.any(Object), From d68962017d944581275bdd0573869412426c75ff Mon Sep 17 00:00:00 2001 From: "Joey F. Poon" Date: Tue, 16 Sep 2025 18:38:29 +0900 Subject: [PATCH 5/5] remove ff check in v3 --- .../features/src/security/v3_features/kibana_sub_features.ts | 3 --- 1 file changed, 3 deletions(-) diff --git a/x-pack/solutions/security/packages/features/src/security/v3_features/kibana_sub_features.ts b/x-pack/solutions/security/packages/features/src/security/v3_features/kibana_sub_features.ts index 6174a5c9ab25b..d8533d425b4e9 100644 --- a/x-pack/solutions/security/packages/features/src/security/v3_features/kibana_sub_features.ts +++ b/x-pack/solutions/security/packages/features/src/security/v3_features/kibana_sub_features.ts @@ -78,9 +78,6 @@ export const getSecurityV3SubFeaturesMap = ({ ); // Remove disabled experimental features - if (!experimentalFeatures.defendInsights) { - securitySubFeaturesMap.delete(SecuritySubFeatureId.workflowInsights); - } if (!experimentalFeatures.trustedDevices) { securitySubFeaturesMap.delete(SecuritySubFeatureId.trustedDevices); }