[Defend Workflows] Fix endpoint list API to mirror exception list API #246019

szwarckonrad · 2025-12-11T14:56:36Z

This PR fixes the deprecated api/endpoint_list APIs to properly enforce RBAC, space awareness, and security tag assignment through the extension point system.

Changes:

Modified 5 ExceptionListClient methods to invoke extension points: createEndpointListItem, updateEndpointListItem, deleteEndpointListItem, getEndpointListItem, findEndpointListItem
Added entry validation and disallowed field checks to create route
Fixed return type in read route to match API schema
Added comprehensive unit tests for all 5 methods
Added API integration tests covering all RBAC scenarios

All changes mirror the existing exception list API behavior.

Closes https://github.com/elastic/security-team/issues/14818

…ension points

…fore hook.

elasticmachine · 2025-12-17T09:55:41Z

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

paul-tavares

Reviewed code only and looks good

nkhristinin

Code review only, changes looks fine, only have 1 question about return type

nkhristinin · 2025-12-18T08:01:35Z

x-pack/solutions/security/plugins/lists/server/routes/read_endpoint_list_item_route.ts

-              return response.ok({ body: ReadEndpointListItemResponse.parse(exceptionListItem) });
+              // API schema expects an array of items
+              return response.ok({
+                body: ReadEndpointListItemResponse.parse([exceptionListItem]),


Do we change response type here to array?

Is this route consumed by anybody and would it be a breaking change?

Great catch, the schema was incorrectly defined as an array when it should return a single item (matching the exception list API pattern), so I've updated the OpenAPI schema and regenerated the types instead of wrapping the response in an array.

… of array

gergoabraham

looks great, and works mostly great! 🚀

one use case is missing, which shouldn't be a problem for 9.1/9.2/9.3 without the endpointExceptionsMovedUnderManagement feature flag enabled, so it can be done in a follow-up PR as well.

the use case is _find with space awareness: a per-policy (or non-global) artifact should be only seen in a space where it was either created, or where a package policy to which it's assigned exists. the easiest use case: an unassigned per-policy artifact should be visible only in the space it was created.

and this space aware filtering is provided by the exception_lists API, it's working out of the box for all artifacts, even for endpoint exceptions: you won't see endpoint exceptions on the UI from other spaces. but, endpoint_list API for some reason does not apply the space filtering.

i understood earlier that it should be provided by the validators (here by setFindRequestFilterScopeToActiveSpace), so i don't see why it's not applied based on your changes.

if you chose the follow-up PR, please make sure to don't close the issue for now, as this use case is tracked there 🙌

here are the tests i performed

// -- when endpointExceptionsMovedUnderManagement feature flag is enabled ---
// test 1: fetching should not show item from space B (only when FF enabled) ❌
// for this, you need per-policy endpoint exceptions created in another space, therefore they shouldn't be visible in the current space
// result: exception_list API filters based on space, endpoint_list API does not
GET kbn://api/exception_lists/items/_find?list_id=endpoint_list&namespace_type=agnostic
GET kbn://api/endpoint_list/items/_find

// test 1.5: deleting in another space only with global_artifact_management_all, but in current space without it (only when FF enabled) ✅
DELETE kbn://api/endpoint_list/items?id=24187dc1-c65e-42a6-94a4-d58640161ce5
DELETE kbn://api/exception_lists/items?id=77e62c4a-3e23-40bd-9223-c3a6fd82ec5d&list_id=endpoint_list&namespace_type=agnostic

// -- when feature flag is disabled ---
// test 2: should add space owner + policy:all tags on create ✅
// test 3: should create only with both global_artifact_management AND endpoint_exceptions_all ✅
POST kbn://api/exception_lists/items
{
  "comments": [],
  "description": "Exception list item",
  "entries": [
    {
      "field": "client.port",
      "operator": "included",
      "type": "match",
      "value": "2"
    }
  ],
  "list_id": "endpoint_list",
  "name": "through exceptions API",
  "namespace_type": "agnostic",
  "tags": [],
  "type": "simple",
  "os_types": [
    "linux"
  ]
}
POST kbn://api/endpoint_list/items
{
  "comments": [],
  "description": "Exception list item",
  "entries": [
    {
      "field": "client.port",
      "operator": "included",
      "type": "match",
      "value": "3"
    }
  ],
  "name": "through endpoint_list_API",
  "namespace_type": "agnostic",
  "tags": [


  ],
  "type": "simple",
  "os_types": [
    "linux"
  ]
}



// test 4: should DELETE only with both global_artifact_management AND endpoint_exceptions_all ✅
DELETE kbn://api/endpoint_list/items?id=9f5d8514-13e1-4262-9dc7-0b52b161f418
DELETE kbn://api/exception_lists/items?id=9f5d8514-13e1-4262-9dc7-0b52b161f418

// test 5: should update only with both global_artifact_management AND endpoint_exceptions_all ✅
PUT kbn://api/exception_lists/items
{
  "id": "24187dc1-c65e-42a6-94a4-d58640161ce5",
  "item_id": "cb8d988c-ec08-41d3-afc3-15f695aa3d0b",
  "type": "simple",
  "name": "from UI space default",
  "description": "Exception list item",
  "entries": [
    {
      "field": "client.port",
      "operator": "included",
      "type": "match",
      "value": "66"
    }
  ],
  "namespace_type": "agnostic",
  "os_types": [
    "linux"
  ],
  "tags": [
    "ownerSpaceId:default"
  ],
  "comments": []
}
PUT kbn://api/endpoint_list/items
{
  "id": "24187dc1-c65e-42a6-94a4-d58640161ce5",
  "item_id": "cb8d988c-ec08-41d3-afc3-15f695aa3d0b",
  "type": "simple",
  "name": "from UI space default",
  "description": "Exception list item",
  "entries": [
    {
      "field": "client.port",
      "operator": "included",
      "type": "match",
      "value": "666"
    }
  ],
  "namespace_type": "agnostic",
  "os_types": [
    "linux"
  ],
  "tags": [
  ],
  "comments": []
}

// test 6: should add tags on update ✅
PUT kbn://api/exception_lists/items
{
  "id": "44ade8b0-af69-46a0-84a1-2b11102645cf",
  "item_id": "3fce5cc9-c8e3-40dc-a7d3-5a3104173de4",
  "type": "simple",
  "name": "from UI space default",
  "description": "Exception list item",
  "entries": [
    {
      "field": "client.port",
      "operator": "included",
      "type": "match",
      "value": "66"
    }
  ],
  "namespace_type": "agnostic",
  "os_types": [
    "linux"
  ],
  "tags": [],
  "comments": []
}
PUT kbn://api/endpoint_list/items
{
  "id": "44ade8b0-af69-46a0-84a1-2b11102645cf",
  "item_id": "3fce5cc9-c8e3-40dc-a7d3-5a3104173de4",
  "type": "simple",
  "name": "from UI space default",
  "description": "Exception list item",
  "entries": [
    {
      "field": "client.port",
      "operator": "included",
      "type": "match",
      "value": "666"
    }
  ],
  "namespace_type": "agnostic",
  "os_types": [
    "linux"
  ],
  "tags": [],
  "comments": []
}

...on/test_suites/edr_workflows/artifacts/trial_license_complete_tier/endpoint_list_api_rbac.ts

…elastic#246019) This PR fixes the deprecated `api/endpoint_list` APIs to properly enforce RBAC, space awareness, and security tag assignment through the extension point system. Changes: - Modified 5 ExceptionListClient methods to invoke extension points: `createEndpointListItem`, `updateEndpointListItem`, `deleteEndpointListItem`, `getEndpointListItem`, `findEndpointListItem` - Added entry validation and disallowed field checks to create route - Fixed return type in read route to match API schema - Added comprehensive unit tests for all 5 methods - Added API integration tests covering all RBAC scenarios All changes mirror the existing exception list API behavior. Closes elastic/security-team#14818 --------- Co-authored-by: kibanamachine <[email protected]> (cherry picked from commit 70c5025)

szwarckonrad · 2025-12-19T10:34:19Z

💚 All backports created successfully

Status	Branch	Result
✅	9.3
✅	9.2
✅	9.1

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…elastic#246019) This PR fixes the deprecated `api/endpoint_list` APIs to properly enforce RBAC, space awareness, and security tag assignment through the extension point system. Changes: - Modified 5 ExceptionListClient methods to invoke extension points: `createEndpointListItem`, `updateEndpointListItem`, `deleteEndpointListItem`, `getEndpointListItem`, `findEndpointListItem` - Added entry validation and disallowed field checks to create route - Fixed return type in read route to match API schema - Added comprehensive unit tests for all 5 methods - Added API integration tests covering all RBAC scenarios All changes mirror the existing exception list API behavior. Closes elastic/security-team#14818 --------- Co-authored-by: kibanamachine <[email protected]> (cherry picked from commit 70c5025) # Conflicts: # x-pack/solutions/security/test/security_solution_api_integration/test_suites/edr_workflows/artifacts/trial_license_complete_tier/endpoint_exceptions.ff_enabled.ts

szwarckonrad · 2025-12-19T10:36:11Z

💚 All backports created successfully

Status	Branch	Result
✅	9.2

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…st API (#246019) (#247041) # Backport This will backport the following commits from `main` to `9.3`: - [[Defend Workflows] Fix endpoint list API to mirror exception list API (#246019)](#246019)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: kibanamachine <[email protected]>

kibanamachine · 2025-12-22T10:48:47Z