Skip to content

[9.2][EDR Workflows][Device Control] Trusted Devices Feature Enabled #237302

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
szwarckonrad merged 2 commits into from
Oct 3, 2025
Merged

[9.2][EDR Workflows][Device Control] Trusted Devices Feature Enabled #237302

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b66a838
device-control feature flag enablement for 9.2
szwarckonrad Oct 2, 2025
a997607
Merge branch '9.2' into device-control-enabled-9.2
szwarckonrad Oct 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions x-pack/platform/test/api_integration/apis/security/privileges.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,6 +174,8 @@ export default function ({ getService }: FtrProviderContext) {
'global_artifact_management_all',
'trusted_applications_all',
'trusted_applications_read',
'trusted_devices_all',
'trusted_devices_read',
'host_isolation_exceptions_all',
'host_isolation_exceptions_read',
'blocklist_all',
Expand Down Expand Up @@ -204,6 +206,8 @@ export default function ({ getService }: FtrProviderContext) {
'global_artifact_management_all',
'trusted_applications_all',
'trusted_applications_read',
'trusted_devices_all',
'trusted_devices_read',
'host_isolation_exceptions_all',
'host_isolation_exceptions_read',
'blocklist_all',
Expand Down
4 changes: 4 additions & 0 deletions x-pack/platform/test/api_integration_basic/apis/security/privileges.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -300,6 +300,8 @@ export default function ({ getService }: FtrProviderContext) {
'file_operations_all',
'execute_operations_all',
'scan_operations_all',
'trusted_devices_all',
'trusted_devices_read',
'workflow_insights_all',
'workflow_insights_read',
],
Expand Down Expand Up @@ -327,6 +329,8 @@ export default function ({ getService }: FtrProviderContext) {
'read',
'trusted_applications_all',
'trusted_applications_read',
'trusted_devices_all',
'trusted_devices_read',
'file_operations_all',
'execute_operations_all',
'scan_operations_all',
Expand Down
2 changes: 1 addition & 1 deletion x-pack/solutions/security/plugins/security_solution/common/experimental_features.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -298,7 +298,7 @@ export const allowedExperimentalValues = Object.freeze({
* Enables Trusted Devices artifact management for device control protections.
* Allows users to manage trusted USB and external devices
*/
trustedDevices: false,
trustedDevices: true,

/**
* Enables the ability to import and migration dashboards through automatic migration service
Expand Down
7 changes: 0 additions & 7 deletions ...y/plugins/security_solution/public/management/cypress/e2e/artifacts/trusted_devices.cy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,13 +33,6 @@ describe(
'Trusted Devices',
{
tags: ['@ess', '@serverless', '@skipInServerlessMKI'],
env: {
ftrConfig: {
kbnServerArgs: [
`--xpack.securitySolution.enableExperimental=${JSON.stringify(['trustedDevices'])}`,
],
},
},
},
() => {
let indexedPolicy: IndexedFleetEndpointPolicyResponse;
Expand Down
7 changes: 0 additions & 7 deletions ...gins/security_solution/public/management/cypress/e2e/artifacts/trusted_devices_rbac.cy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,13 +12,6 @@ describe(
'Trusted devices RBAC',
{
tags: ['@ess', '@serverless', '@skipInServerlessMKI'],
env: {
ftrConfig: {
kbnServerArgs: [
`--xpack.securitySolution.enableExperimental=${JSON.stringify(['trustedDevices'])}`,
],
},
},
},

getArtifactMockedDataTests(getArtifactsListTestDataForArtifact('trustedDevices'), [
Expand Down
5 changes: 1 addition & 4 deletions ...ns/security/plugins/security_solution/public/management/cypress/e2e/rbac/navigation.cy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,10 +164,7 @@ describe(
cy.get('[data-test-subj~="sideNavPanel-id-securityGroup:assets"]');

for (const page of allPages) {
if (page.selector !== Selectors.TRUSTED_DEVICES) {
// Skip Trusted Devices for now — soc_manager does not yet have the required privilege in controller (MKI would fail otherwise).
cy.get(page.selector);
}
cy.get(page.selector);
}
});
});
Expand Down
5 changes: 0 additions & 5 deletions .../security_solution/public/management/cypress/e2e/serverless/feature_access/complete.cy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,11 +18,6 @@ describe(
env: {
ftrConfig: {
productTypes: [{ product_line: 'security', product_tier: 'complete' }],
// This is not needed for this test, but it's a good example of
// how to enable experimental features in the Cypress tests.
kbnServerArgs: [
`--xpack.securitySolution.enableExperimental=${JSON.stringify(['trustedDevices'])}`,
],
},
},
},
Expand Down
3 changes: 0 additions & 3 deletions ...tion/public/management/cypress/e2e/serverless/feature_access/complete_with_endpoint.cy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,6 @@ describe(
{ product_line: 'security', product_tier: 'complete' },
{ product_line: 'endpoint', product_tier: 'complete' },
],
kbnServerArgs: [
`--xpack.securitySolution.enableExperimental=${JSON.stringify(['trustedDevices'])}`,
],
},
},
},
Expand Down
3 changes: 0 additions & 3 deletions ...ecurity_solution/public/management/cypress/e2e/serverless/feature_access/essentials.cy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,6 @@ describe(
env: {
ftrConfig: {
productTypes: [{ product_line: 'security', product_tier: 'essentials' }],
kbnServerArgs: [
`--xpack.securitySolution.enableExperimental=${JSON.stringify(['trustedDevices'])}`,
],
},
},
},
Expand Down
3 changes: 0 additions & 3 deletions ...on/public/management/cypress/e2e/serverless/feature_access/essentials_with_endpoint.cy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,6 @@ describe(
{ product_line: 'security', product_tier: 'essentials' },
{ product_line: 'endpoint', product_tier: 'essentials' },
],
kbnServerArgs: [
`--xpack.securitySolution.enableExperimental=${JSON.stringify(['trustedDevices'])}`,
],
},
},
},
Expand Down
3 changes: 0 additions & 3 deletions ...olution/public/management/cypress/e2e/serverless/roles/complete_with_endpoint_roles.cy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,9 +40,6 @@ describe(
{ product_line: 'security', product_tier: 'complete' },
{ product_line: 'endpoint', product_tier: 'complete' },
],
kbnServerArgs: [
`--xpack.securitySolution.enableExperimental=${JSON.stringify(['trustedDevices'])}`,
],
},
},
},
Expand Down
127 changes: 21 additions & 106 deletions ...ity_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -393,6 +393,8 @@ describe('ManifestManager', () => {
ARTIFACT_NAME_BLOCKLISTS_MACOS,
ARTIFACT_NAME_BLOCKLISTS_WINDOWS,
ARTIFACT_NAME_BLOCKLISTS_LINUX,
ARTIFACT_NAME_TRUSTED_DEVICES_MACOS,
ARTIFACT_NAME_TRUSTED_DEVICES_WINDOWS,
];

const getArtifactIds = (artifacts: InternalArtifactSchema[]) => [
Expand Down Expand Up @@ -425,7 +427,7 @@ describe('ManifestManager', () => {

const artifacts = manifest.getAllArtifacts();

expect(artifacts.length).toBe(15);
expect(artifacts.length).toBe(17);
expect(getArtifactIds(artifacts)).toStrictEqual(SUPPORTED_ARTIFACT_NAMES);

for (const artifact of artifacts) {
Expand Down Expand Up @@ -480,7 +482,7 @@ describe('ManifestManager', () => {

const artifacts = manifest.getAllArtifacts();

expect(artifacts.length).toBe(15);
expect(artifacts.length).toBe(17);
expect(getArtifactIds(artifacts)).toStrictEqual(SUPPORTED_ARTIFACT_NAMES);

expect(getArtifactObject(artifacts[0])).toStrictEqual({
Expand Down Expand Up @@ -569,7 +571,7 @@ describe('ManifestManager', () => {

const artifacts = manifest.getAllArtifacts();

expect(artifacts.length).toBe(15);
expect(artifacts.length).toBe(17);
expect(getArtifactIds(artifacts)).toStrictEqual(SUPPORTED_ARTIFACT_NAMES);

expect(artifacts[0]).toStrictEqual(oldManifest.getAllArtifacts()[0]);
Expand Down Expand Up @@ -672,7 +674,7 @@ describe('ManifestManager', () => {

const artifacts = manifest.getAllArtifacts();

expect(artifacts.length).toBe(16);
expect(artifacts.length).toBe(18);
expect(getArtifactIds(artifacts)).toStrictEqual(SUPPORTED_ARTIFACT_NAMES);

expect(getArtifactObject(artifacts[0])).toStrictEqual({
Expand Down Expand Up @@ -784,7 +786,7 @@ describe('ManifestManager', () => {

const artifacts = manifest.getAllArtifacts();

expect(artifacts.length).toBe(16);
expect(artifacts.length).toBe(18);
expect(getArtifactIds(artifacts)).toStrictEqual(SUPPORTED_ARTIFACT_NAMES);

expect(getArtifactObject(artifacts[0])).toStrictEqual({
Expand Down Expand Up @@ -839,6 +841,8 @@ describe('ManifestManager', () => {
ARTIFACT_NAME_BLOCKLISTS_MACOS,
ARTIFACT_NAME_BLOCKLISTS_WINDOWS,
ARTIFACT_NAME_BLOCKLISTS_LINUX,
ARTIFACT_NAME_TRUSTED_DEVICES_MACOS,
ARTIFACT_NAME_TRUSTED_DEVICES_WINDOWS,
];

const getArtifactIds = (artifacts: InternalArtifactSchema[]) => [
Expand Down Expand Up @@ -890,7 +894,7 @@ describe('ManifestManager', () => {

const artifacts = manifest.getAllArtifacts();

expect(artifacts.length).toBe(15);
expect(artifacts.length).toBe(17);
expect(getArtifactIds(artifacts)).toStrictEqual(SUPPORTED_ARTIFACT_NAMES);

expect(getArtifactObject(artifacts[0])).toStrictEqual({
Expand Down Expand Up @@ -971,7 +975,7 @@ describe('ManifestManager', () => {

const artifacts = manifest.getAllArtifacts();

expect(artifacts.length).toBe(15);
expect(artifacts.length).toBe(17);
expect(getArtifactIds(artifacts)).toStrictEqual(SUPPORTED_ARTIFACT_NAMES);

expect(getArtifactObject(artifacts[0])).toStrictEqual({
Expand Down Expand Up @@ -1055,7 +1059,7 @@ describe('ManifestManager', () => {

const artifacts = manifest.getAllArtifacts();

expect(artifacts.length).toBe(15);
expect(artifacts.length).toBe(17);
expect(getArtifactIds(artifacts)).toStrictEqual(SUPPORTED_ARTIFACT_NAMES);

expect(getArtifactObject(artifacts[0])).toStrictEqual({ entries: [] });
Expand Down Expand Up @@ -1083,28 +1087,8 @@ describe('ManifestManager', () => {
});
});

describe('buildNewManifest with trustedDevices experimental feature', () => {
describe('buildNewManifest with trustedDevices', () => {
const SUPPORTED_ARTIFACT_NAMES_WITH_TRUSTED_DEVICES = [
ARTIFACT_NAME_EXCEPTIONS_MACOS,
ARTIFACT_NAME_EXCEPTIONS_WINDOWS,
ARTIFACT_NAME_EXCEPTIONS_LINUX,
ARTIFACT_NAME_TRUSTED_APPS_MACOS,
ARTIFACT_NAME_TRUSTED_APPS_WINDOWS,
ARTIFACT_NAME_TRUSTED_APPS_LINUX,
ARTIFACT_NAME_TRUSTED_DEVICES_MACOS,
ARTIFACT_NAME_TRUSTED_DEVICES_WINDOWS,
ARTIFACT_NAME_EVENT_FILTERS_MACOS,
ARTIFACT_NAME_EVENT_FILTERS_WINDOWS,
ARTIFACT_NAME_EVENT_FILTERS_LINUX,
ARTIFACT_NAME_HOST_ISOLATION_EXCEPTIONS_MACOS,
ARTIFACT_NAME_HOST_ISOLATION_EXCEPTIONS_WINDOWS,
ARTIFACT_NAME_HOST_ISOLATION_EXCEPTIONS_LINUX,
ARTIFACT_NAME_BLOCKLISTS_MACOS,
ARTIFACT_NAME_BLOCKLISTS_WINDOWS,
ARTIFACT_NAME_BLOCKLISTS_LINUX,
];

const SUPPORTED_ARTIFACT_NAMES_WITHOUT_TRUSTED_DEVICES = [
ARTIFACT_NAME_EXCEPTIONS_MACOS,
ARTIFACT_NAME_EXCEPTIONS_WINDOWS,
ARTIFACT_NAME_EXCEPTIONS_LINUX,
Expand All @@ -1120,25 +1104,16 @@ describe('ManifestManager', () => {
ARTIFACT_NAME_BLOCKLISTS_MACOS,
ARTIFACT_NAME_BLOCKLISTS_WINDOWS,
ARTIFACT_NAME_BLOCKLISTS_LINUX,
ARTIFACT_NAME_TRUSTED_DEVICES_MACOS,
ARTIFACT_NAME_TRUSTED_DEVICES_WINDOWS,
];

const getArtifactIds = (artifacts: InternalArtifactSchema[]) => [
...new Set(artifacts.map((artifact) => artifact.identifier)).values(),
];

test('builds manifest with trusted devices when feature flag enabled', async () => {
const context = buildManifestManagerContextMock({
experimentalFeatures: ['trustedDevices'],
});
// Set up licensing to allow trusted devices (both PLI and enterprise)
context.productFeaturesService.isEnabled = jest.fn().mockImplementation((key) => {
return (
key === ProductFeatureKey.endpointTrustedDevices ||
key === ProductFeatureKey.endpointArtifactManagement
);
});
context.licenseService = createLicenseServiceMock();
context.licenseService.isEnterprise = jest.fn().mockReturnValue(true);
test('builds manifest with trusted devices', async () => {
const context = buildManifestManagerContextMock({});
const manifestManager = new ManifestManager(context);

context.exceptionListClient.findExceptionListItem = mockFindExceptionListItemResponses({});
Expand Down Expand Up @@ -1182,66 +1157,13 @@ describe('ManifestManager', () => {
}
});

test('builds manifest without trusted devices when feature flag disabled', async () => {
const context = buildManifestManagerContextMock({
experimentalFeatures: [], // No trustedDevices feature
});
const manifestManager = new ManifestManager(context);

context.exceptionListClient.findExceptionListItem = mockFindExceptionListItemResponses({});
context.packagePolicyService.fetchAllItemIds = getMockPolicyFetchAllItemIds([
TEST_POLICY_ID_1,
]);

const manifest = await manifestManager.buildNewManifest();

expect(manifest?.getSchemaVersion()).toStrictEqual('v1');
expect(manifest?.getSemanticVersion()).toStrictEqual('1.0.0');
expect(manifest?.getSavedObjectVersion()).toBeUndefined();

const artifacts = manifest.getAllArtifacts();

expect(artifacts.length).toBe(15); // Standard artifacts only
expect(getArtifactIds(artifacts)).toStrictEqual(
SUPPORTED_ARTIFACT_NAMES_WITHOUT_TRUSTED_DEVICES
);

// Verify trusted devices artifacts are NOT present
const trustedDevicesMacosArtifact = artifacts.find(
(a) => a.identifier === ARTIFACT_NAME_TRUSTED_DEVICES_MACOS
);
const trustedDevicesWindowsArtifact = artifacts.find(
(a) => a.identifier === ARTIFACT_NAME_TRUSTED_DEVICES_WINDOWS
);

expect(trustedDevicesMacosArtifact).toBeUndefined();
expect(trustedDevicesWindowsArtifact).toBeUndefined();

for (const artifact of artifacts) {
expect(manifest.isDefaultArtifact(artifact)).toBe(true);
expect(manifest.getArtifactTargetPolicies(artifact)).toStrictEqual(
new Set([TEST_POLICY_ID_1])
);
}
});

test('builds manifest with trusted devices entries when feature flag enabled and trusted devices data present', async () => {
test('builds manifest with trusted devices entries when trusted devices data present', async () => {
const trustedDeviceListItem = getExceptionListItemSchemaMock({
os_types: ['windows'],
tags: ['policy:all'],
});

const context = buildManifestManagerContextMock({
experimentalFeatures: ['trustedDevices'],
});
context.productFeaturesService.isEnabled = jest.fn().mockImplementation((key) => {
return (
key === ProductFeatureKey.endpointTrustedDevices ||
key === ProductFeatureKey.endpointArtifactManagement
);
});
context.licenseService = createLicenseServiceMock();
context.licenseService.isEnterprise = jest.fn().mockReturnValue(true);
const context = buildManifestManagerContextMock({});
const manifestManager = new ManifestManager(context);

context.exceptionListClient.findExceptionListItem = mockFindExceptionListItemResponses({
Expand Down Expand Up @@ -1314,7 +1236,7 @@ describe('ManifestManager', () => {

const artifacts = manifest.getAllArtifacts();

expect(artifacts.length).toBe(15);
expect(artifacts.length).toBe(17);

expect(getArtifactObject(artifacts[0])).toStrictEqual({
entries: translateToEndpointExceptions([expectedExceptionListItem], 'v1', defaultFeatures),
Expand Down Expand Up @@ -1354,7 +1276,7 @@ describe('ManifestManager', () => {

const artifacts = manifest.getAllArtifacts();

expect(artifacts.length).toBe(15);
expect(artifacts.length).toBe(17);

expect(getArtifactObject(artifacts[0])).toStrictEqual({
entries: translateToEndpointExceptions([expectedExceptionListItem], 'v1', defaultFeatures),
Expand Down Expand Up @@ -2468,13 +2390,6 @@ describe('ManifestManager', () => {
manifestManager = new ManifestManager(context);
});

test('should return false for trusted devices artifacts when feature flag is disabled', () => {
const shouldRetrieve = (
manifestManager as unknown as ManifestManagerWithPrivateMethods
).shouldRetrieveExceptions(ENDPOINT_ARTIFACT_LISTS.trustedDevices.id);
expect(shouldRetrieve).toBe(false);
});

test('should return true for other artifact types regardless of feature flag', () => {
const shouldRetrieveExceptions = (
manifestManager as unknown as ManifestManagerWithPrivateMethods
Expand Down
Loading