Skip to content

[EDR Workflows] Fix endpoint exception RBAC UI issues#235119

Merged
tomsonpl merged 21 commits intoelastic:mainfrom
gergoabraham:fix-endpoint-exception-rbac-ui-issues
Sep 26, 2025
Merged

[EDR Workflows] Fix endpoint exception RBAC UI issues#235119
tomsonpl merged 21 commits intoelastic:mainfrom
gergoabraham:fix-endpoint-exception-rbac-ui-issues

Conversation

@gergoabraham
Copy link
Copy Markdown
Contributor

@gergoabraham gergoabraham commented Sep 15, 2025 •
edited
Loading

should be merged on the same week as:

Summary

image

As Endpoint Exception sub-feature privilege, which has been only available on Serverless, is now being added to ESS as well, it is time fix some discrepancies on UI around user access for rule exceptions and endpoint exceptions.

Fortunately, these issues seem to be UI only, on API side the correct privileges are used.

🟢 Shared exception lists page

Lists and exceptions now can be edited only if the user has the correct privilege:

  • endpoint exceptions ALL for endpoint exceptions
  • security ALL for any other rule exceptions

Some scenarios:

  • Security:ALL & Endpoint Exceptions:READ

    video
    Screen.Recording.2025-09-15.at.18.58.48.mov

  • Security:READ & Endpoint Exceptions:ALL

    video
    Screen.Recording.2025-09-15.at.19.00.28.mov

Import and create buttons

They used to be shown even with READ privileges.

privilege screenshot comment
siem:READ, ee:READ/NONE image nothing with write access here
siem:ALL, ee:READ/NONE image allow to import/create rule exceptions (API error on importing endpoint exception list)
siem:READ, ee:ALL image allow to import endpoint exception list (API error on rule exceptions)
siem:ALL, ee:ALL image allow all

🟢 List detail page

Same changes. Also, 'Link Rules' button is now hidden for Rule exceptions with Security:READ privilege.

Some scenarios:

  • Security:ALL & Endpoint Exceptions:READ

    video
    Screen.Recording.2025-09-15.at.19.04.38.mov

  • Security:READ & Endpoint Exceptions:ALL

    video
    Screen.Recording.2025-09-15.at.19.05.12.mov

    Also, Link rules button is now disabled for Rule exceptions with Security:READ
    image

🟢 Rule page - Rule exceptions and Endpoint exceptions tabs

  • Security:ALL & Endpoint Exceptions:READ

    video
    Screen.Recording.2025-09-16.at.15.29.36.mov

  • Security:READ & Endpoint Exceptions:ALL

    video
    Screen.Recording.2025-09-16.at.15.28.13.mov

🟢 Alerts page - alert context menu

siem:READ, ee:READ/NONE siem:ALL, ee:READ/NONE siem:READ, ee:ALL siem:ALL, ee:ALL
image image image image

🟢 Alert flyout - take action menu

siem:READ, ee:READ/NONE siem:ALL, ee:READ/NONE siem:READ, ee:ALL siem:ALL, ee:ALL
image image image image

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

@gergoabraham gergoabraham self-assigned this Sep 15, 2025
@gergoabraham gergoabraham added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:Defend Workflows “EDR Workflows” sub-team of Security Solution labels Sep 15, 2025
@gergoabraham gergoabraham mentioned this pull request Sep 16, 2025
Closed
@gergoabraham gergoabraham force-pushed the fix-endpoint-exception-rbac-ui-issues branch from d4ceb9d to b33334e Compare September 17, 2025 07:39
@gergoabraham gergoabraham mentioned this pull request Sep 17, 2025
Merged
4 tasks
@gergoabraham gergoabraham linked an issue Sep 17, 2025 that may be closed by this pull request
[Bug] [Defend Workflows] [Endpoint Exceptions RBAC SeimV4] User with full privileges cannot update existing endpoint exceptions and missing endpoint exception option in alerts #235159
Closed
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Sep 17, 2025

Cloud deployment initiated, see credentials at: https://buildkite.com/elastic/kibana-deploy-cloud-from-pr/builds/423

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Sep 17, 2025

Project deployed, see credentials at: https://buildkite.com/elastic/kibana-deploy-project-from-pr/builds/599

This was linked to issues Sep 17, 2025
[Bug] [Defend Workflows] Add Rule Exception option is enabled with Read-only Security Privileges #235341
Closed
[Bug] [Defend Workflows] Create Shared Exception List enabled with Endpoint Exceptions: None privilege #235345
Closed
@gergoabraham gergoabraham force-pushed the fix-endpoint-exception-rbac-ui-issues branch from f7a0e8b to f5c6e85 Compare September 17, 2025 12:30
@gergoabraham gergoabraham force-pushed the fix-endpoint-exception-rbac-ui-issues branch from f5c6e85 to 00c94ec Compare September 17, 2025 12:31
@sukhwindersingh-qasource
Copy link
Copy Markdown

sukhwindersingh-qasource commented Sep 17, 2025

Hi @gergoabraham ,

We have validated this ticket on latest 9.2.0-serverless-PR builds and below are the observations

Login Credentials

Below are the Testing Details :

Build Details:

VERSION: 9.2.0
BUILD: 90659
COMMIT: b33334e00d92d6b3d4470eb78980fd50e40d7518

Detailed Observations with Screen-captures for 9.2.0-Serverless:

  • Security READ + Endpoint Exceptions ALL + Global Artifact Management ALL ✔
abc.mp4
  • Security ALL + Endpoint Exceptions ALL + Global Artifact Management NONE : ✔
    • Should not allow modifying Endpoint Exceptions, while should allow modifying other exceptions (i.e. rule exceptions)
Detection.rules.SIEM.-.Kibana.-.Google.Chrome.2025-09-17.17-45-08.mp4
  • Security ALL + Endpoint Exceptions READ + Global Artifact Management ALL : ✔
    • Should provide only READ access to Endpoint Exceptions
    • Should provide WRITE access to rule exceptions
Get.started.-.Kibana.-.Google.Chrome.2025-09-17.17-54-58.mp4
  • 'Link Rules' button is now disabled for Rule exceptions with Security:READ ✔
Shared.exception.lists.-.Kibana.-.Google.Chrome.2025-09-17.17-50-37.mp4
  • ** Endpoint Exception is only enable in the Alerts tab when the user have the privileges Security : All/read , Globa artifact : all , Endpoint exception : all** ✔
Alerts.-.Kibana.-.Google.Chrome.2025-09-17.18-00-53.mp4

Hence we are marking it as QA Validated

Thanks !!

@sukhwindersingh-qasource sukhwindersingh-qasource added the QA:Validated Issue has been validated by QA label Sep 17, 2025
maximpn
maximpn reviewed Sep 18, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@maximpn maximpn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@gergoabraham Thanks for fixing RBAC UI inconsistencies 🙏

And thanks a lot for the detailed PR description with before/after videos 👍 I significantly helps to grasp the difference.

The diff is minimal and overall I don't have critical comments. However, disabled actions like buttons may be puzzling for users. The best practice is to provide explanation tooltips or hide actions from the screens.

Comment thread ...packages/kbn-securitysolution-exception-list-components/src/list_header/menu_items/index.tsx Outdated
Comment thread ...curity/plugins/security_solution/public/exceptions/components/list_exception_items/index.tsx Outdated
Comment thread .../solutions/security/plugins/security_solution/public/exceptions/pages/shared_lists/index.tsx Outdated
Comment thread .../solutions/security/plugins/security_solution/public/exceptions/pages/shared_lists/index.tsx Outdated
Comment thread ...ecurity/plugins/security_solution/public/exceptions/pages/shared_lists/shared_lists.test.tsx Outdated
Comment thread x-pack/solutions/security/plugins/security_solution/public/rules/links.ts
PhilippeOberti
PhilippeOberti approved these changes Sep 18, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@PhilippeOberti PhilippeOberti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code review only, it would be nice to add some unit tests for the useAlertExceptionActions hook.

@gergoabraham
Copy link
Copy Markdown
Contributor Author

gergoabraham commented Sep 19, 2025

Code review only, it would be nice to add some unit tests for the useAlertExceptionActions hook.

thanks for the review @PhilippeOberti, added unit test:
f283d87

maximpn
maximpn approved these changes Sep 19, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@maximpn maximpn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@gergoabraham Thanks for addressing my comments 👍

denar50
denar50 approved these changes Sep 22, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@denar50 denar50 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Code review only.

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Sep 26, 2025 •
edited
Loading

💔 Build Failed

Failed CI Steps

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 10.8MB 10.8MB -19.0B

History

cc @gergoabraham

@tomsonpl tomsonpl merged commit 7464924 into elastic:main Sep 26, 2025
12 checks passed
niros1 pushed a commit that referenced this pull request Sep 30, 2025
@gergoabraham @niros1
[EDR Workflows] Fix endpoint exception RBAC UI issues (#235119)
9644e97
@gergoabraham gergoabraham deleted the fix-endpoint-exception-rbac-ui-issues branch October 16, 2025 14:00
rylnd pushed a commit to rylnd/kibana that referenced this pull request Oct 17, 2025
@gergoabraham
[EDR Workflows] Fix endpoint exception RBAC UI issues (elastic#235119)
8e2a1fe
@gergoabraham gergoabraham mentioned this pull request Nov 21, 2025
Merged
@gergoabraham
Copy link
Copy Markdown
Contributor Author

gergoabraham commented Nov 21, 2025

💚 All backports created successfully

Status Branch Result
✅ 9.1

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

gergoabraham added a commit to gergoabraham/kibana that referenced this pull request Nov 21, 2025
@gergoabraham
[EDR Workflows] Fix endpoint exception RBAC UI issues (elastic#235119)
6ae4598 
(cherry picked from commit 7464924)

# Conflicts:
#	x-pack/solutions/security/plugins/security_solution/public/detections/components/alerts_table/timeline_actions/use_add_exception_actions.tsx
gergoabraham added a commit that referenced this pull request Nov 21, 2025
@gergoabraham
[9.1] [EDR Workflows] Fix endpoint exception RBAC UI issues (#235119) (…
6dccb56 
…#243768)

# Backport

This will backport the following commits from `main` to `9.1`:
- [[EDR Workflows] Fix endpoint exception RBAC UI issues
(#235119)](#235119)

<!--- Backport version: 10.2.0 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Gergő
Ábrahám","email":"gergo.abraham@elastic.co"},"sourceCommit":{"committedDate":"2025-09-26T07:41:45Z","message":"[EDR
Workflows] Fix endpoint exception RBAC UI issues
(#235119)","sha":"74649249be16d255d67248c7559f7fbb67e28263","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","backport:skip","Team:Defend
Workflows","QA:Validated","ci:cloud-deploy","ci:project-deploy-security","v9.2.0"],"title":"[EDR
Workflows] Fix endpoint exception RBAC UI
issues","number":235119,"url":"https://github.com/elastic/kibana/pull/235119","mergeCommit":{"message":"[EDR
Workflows] Fix endpoint exception RBAC UI issues
(#235119)","sha":"74649249be16d255d67248c7559f7fbb67e28263"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/235119","number":235119,"mergeCommit":{"message":"[EDR
Workflows] Fix endpoint exception RBAC UI issues
(#235119)","sha":"74649249be16d255d67248c7559f7fbb67e28263"}}]}]
BACKPORT-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@maximpn maximpn maximpn approved these changes

@denar50 denar50 denar50 approved these changes

@PhilippeOberti PhilippeOberti PhilippeOberti approved these changes

Assignees

@gergoabraham gergoabraham

Labels

backport:skip This PR does not require backporting ci:cloud-deploy Create or update a Cloud deployment ci:project-deploy-security Create a Security Serverless Project QA:Validated Issue has been validated by QA release_note:skip Skip the PR/issue when compiling release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v9.1.8 v9.2.0

Projects

None yet

Milestone

No milestone