[EDR Workflows][Endpoint Exception move] Opt-in mechanism for per-policy Endpoint Exceptions by gergoabraham · Pull Request #259598 · elastic/kibana

gergoabraham · 2026-03-25T15:18:13Z

Summary

This PR adds an opt-in mechanism that allows using the so far global-only Endpoint Exceptions on a per-policy basis.

Note

Hidden behind feature flag (as part of the Endpoint exception move effort):

xpack.securitySolution.enableExperimental:
 - endpointExceptionsMovedUnderManagement

Behavior in short

new deployments are automatically opted in. they also won't see the 'Endpoint exceptions moved' and 'Endpoint exceptions not evaluated on rules anymore' callouts (from [EDR Workflows][Endpoint Exception move] Remove endpoint exceptions from detections pages #258556).
upgraded environments will see a new callout on the Endpoint exceptions page that suggests to enable per-policy behavior
- superuser role (ESS) or admin role (serverless) users are able to perform the opt-in
- other users will see a message to contact their administrators
after manually opting in
- Endpoint exceptions can be assigned to package policies, like other endpoint artifacts
- but, they won't be evaluated during rule execution anymore (see Filter endpoint list exceptions in DE logic #233289)
- and they cannot be added to detection rules anymore (see [Security Solution] [Detection Engine] Conditionally hides checkbox to add endpoint exceptions to rule execution #242480)

Data

Opt-in status is stored in the ReferenceDataClient, and it's defaulted during plugin start phase either to:

{ status: false }, in case endpoint exception list exists (i.e. upgrade, it's created every time),
{ status: true, reason: 'newDeployment' }, in case the list does not exist.

API

2 new API endpoints are added:

GET /internal/api/endpoint/endpoint_exceptions_per_policy_opt_in to receive the opt-in status on the UI,
POST /internal/api/endpoint/endpoint_exceptions_per_policy_opt_in to perform the opt-in, that sets the status to { status: true, reason: 'userOptedIn' }

UI

empty page is... empty

callout for non-superusers

callout for superusers / admins

menu action for superusers / admins

in case the callout is dismissed. although, it will come up again as it's only dismissed for the session.

modal

recording

opt-in process and endpoint exceptions pages

Screen.Recording.2026-03-27.at.19.28.53.mov

hiding stuff behind opt-in status

endpoint exception related per-policy activities are available only after opt-in, like
- per-policy assignment in the form,
- assigning exceptions to policies in the Policy details page Endpoint exceptions tab,
- ManifestManager also uses per-policy EE after opt-in only.
'endpoint exceptions moved' informative callouts are shown without opting in (due to the FF enabled), or after manual opt-in (i.e. are hidden on new deployments)
- see the details in the previous PR: [EDR Workflows][Endpoint Exception move] Remove endpoint exceptions from detections pages #258556
'endpoint exceptions are not evaluated on rules' informative callouts are shown only after manually opting in (i.e. it needs opt-in, but isn't shown on new deployments)
- see the details in the previous PR: [EDR Workflows][Endpoint Exception move] Remove endpoint exceptions from detections pages #258556

Testing

To test this,

either add some data (endpoint exceptions), and then turn on the feature flag xpack.securitySolution.enableExperimental.endpointExceptionsMovedUnderManagement, to simulate an 'upgrade' scenario,
or start with the feature flag turned on, to simulate a 'new deployment' scenario.

Reading opt-in status

dev console:

GET .kibana_security_solution/_doc/security:reference-data:ENDPOINT-EXCEPTIONS-PER-POLICY-OPT-IN-STATUS

Deleting opt-in status

you can also delete the opt-in status, so you're back to the 'upgrade' scenario.
for this, you need a system_indices_superuser, here's a quick console command to create one:

POST kbn://internal/security/users/testuser
{
  "password": "changeme",
  "username": "testuser",
  "full_name": "",
  "email": "",
  "roles": [
    "system_indices_superuser", "superuser"
  ]
}

and then delete like this:

DELETE .kibana_security_solution/_doc/security:reference-data:ENDPOINT-EXCEPTIONS-PER-POLICY-OPT-IN-STATUS

todo

docs

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios

gergoabraham · 2026-03-26T09:01:08Z

buildkite test this

… opt-in status

szwarckonrad

Thanks for addressing my comments. Looks good, great work!

paul-tavares · 2026-03-30T20:01:18Z

  const hasSuperuserRole = userRoles.includes('superuser');
+  const hasAdminRole = userRoles.includes('admin');
+
+  const hasSuperuserPrivileges = isServerless ? hasAdminRole : hasSuperuserRole;


OH... I missread. I think this new property should really be the one assigned to canWriteAdminData. I can do that in a separate PR if you don't want ot include it here... but also: maybe you should also be using canWriteAdminData instead of introducing a new authz privilege?

paul-tavares · 2026-03-30T20:06:52Z

  EndpointGetActionsStatusRequestQueryInput,
  EndpointGetActionsStatusResponse,
 } from './endpoint/actions/status/status.gen';
+import type { GetEndpointExceptionsPerPolicyOptInResponse } from './endpoint/endpoint_exceptions_per_policy_opt_in/endpoint_exceptions_per_policy_opt_in.gen';


I guess we're using the ZOD schemas generated from API docs now? I though we were sticking with Kibana Schemas for our APIs

oh, yeah, i did not notice that the generated schemas are not used, although 27 of our API docs enabled x-codegen-enabled, and only 15 disabled it.

do we have a reason not to use these? if yes, i'll switch these to a hand-made schema, otherwise i think it is nice to have a single source of truth... especially if we have to write the API docs anyway

natasha-moore-elastic

Docs link LGTM

…PolicyEndpointExceptions`

denar50

Code only review for files owned by the Detection Engine team. LGTM!

denar50 · 2026-03-31T10:46:14Z

            </EuiToolTip>
            <EuiSpacer size="l" />
-            {!endpointExceptionsMovedUnderManagement ? (
+            {endpointPerPolicyOptIn?.status === true ? (


useGetEndpointExceptionsPerPolicyOptIn has a loading state. Should you take that on into account here?

i think this should be fine: this way we use the GhostFormField (in order to not loose the data from the form) when loading is finished and opt-in is done, so we practically show the checkbox during loading - which shouldn't be disturbing as it is hidden in a closed 'advanced options' section anyway. but, in case fetching the opt-in state fails, we go back to the old behavior, i.e. showing the checkbox, which should be useful for now.

denar50 · 2026-03-31T10:56:29Z

+            title="moved"
+          />
+        );
+      } else if (endpointPerPolicyOptIn?.reason === 'userOptedIn') {


nit: this else can be removed.

elasticmachine · 2026-03-31T11:41:02Z

💚 Build Succeeded

Buildkite Build
Commit: 0c64ee5

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	9253	9257	+4

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`aiAssistantManagementSelection`	96.1KB	96.2KB	+94.0B
`securitySolution`	11.5MB	11.5MB	+8.7KB
total			+8.7KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`core`	520.7KB	520.8KB	+94.0B
`securitySolution`	121.2KB	121.2KB	+37.0B
total			+131.0B

History

cc @gergoabraham

…icy Endpoint Exceptions (elastic#259598) ## Summary This PR adds an opt-in mechanism that allows using the so far global-only Endpoint Exceptions on a per-policy basis. > [!note] > Hidden behind feature flag (as part of the Endpoint exception move effort): > ``` > xpack.securitySolution.enableExperimental: > - endpointExceptionsMovedUnderManagement > ``` ### Behavior in short - new deployments are automatically opted in. they also won't see the 'Endpoint exceptions moved' and 'Endpoint exceptions not evaluated on rules anymore' callouts (from elastic#258556). - upgraded environments will see a new callout on the Endpoint exceptions page that suggests to enable per-policy behavior - superuser role (ESS) or admin role (serverless) users are able to perform the opt-in - other users will see a message to contact their administrators - after manually opting in - Endpoint exceptions can be assigned to package policies, like other endpoint artifacts - but, they won't be evaluated during rule execution anymore (see elastic#233289) - and they cannot be added to detection rules anymore (see elastic#242480) ### Data Opt-in status is stored in the `ReferenceDataClient`, and it's defaulted during plugin start phase either to: - `{ status: false }`, in case endpoint exception list exists (i.e. upgrade, it's created every time), - `{ status: true, reason: 'newDeployment' }`, in case the list does not exist. ### API 2 new API endpoints are added: - `GET /internal/api/endpoint/endpoint_exceptions_per_policy_opt_in` to receive the opt-in status on the UI, - `POST /internal/api/endpoint/endpoint_exceptions_per_policy_opt_in` to perform the opt-in, that sets the status to `{ status: true, reason: 'userOptedIn' }` ### UI #### empty page is... empty <img width="400" height="793" alt="image" src="https://github.com/user-attachments/assets/e7b72ab9-2a42-49ca-b2e9-2447e3ff9dd3" /> #### callout for non-superusers <img width="1280" height="516" alt="image" src="https://github.com/user-attachments/assets/f88a04a6-b8bb-46be-8f5f-ece5f1d89cf2" /> #### callout for superusers / admins <img width="1215" height="554" alt="image" src="https://github.com/user-attachments/assets/e2552d27-ac9d-4dfe-84da-48012fdf57fc" /> #### menu action for superusers / admins in case the callout is dismissed. although, it will come up again as it's only dismissed for the session. <img width="335" height="204" alt="image" src="https://github.com/user-attachments/assets/5d7a23e6-2428-4f8f-b941-0f97e8bd7750" /> #### modal <img width="925" height="564" alt="image" src="https://github.com/user-attachments/assets/0cbc4573-b052-4e1f-82c5-13298532f7fe" /> ### recording #### opt-in process and endpoint exceptions pages https://github.com/user-attachments/assets/de8204bd-72d2-4a99-b51c-b86771c577c3 ### hiding stuff behind opt-in status - endpoint exception related per-policy activities are available only after opt-in, like - per-policy assignment in the form, - assigning exceptions to policies in the Policy details page Endpoint exceptions tab, - `ManifestManager` also uses per-policy EE after opt-in only. - 'endpoint exceptions moved' informative callouts are shown without opting in (due to the FF enabled), or after _manual_ opt-in (i.e. are hidden on new deployments) - see the details in the previous PR: elastic#258556 - 'endpoint exceptions are not evaluated on rules' informative callouts are shown only after _manually_ opting in (i.e. it needs opt-in, but isn't shown on new deployments) - see the details in the previous PR: elastic#258556 ## Testing To test this, - either add some data (endpoint exceptions), and then turn on the feature flag `xpack.securitySolution.enableExperimental.endpointExceptionsMovedUnderManagement`, to simulate an 'upgrade' scenario, - or start with the feature flag turned on, to simulate a 'new deployment' scenario. ### Reading opt-in status dev console: ``` GET .kibana_security_solution/_doc/security:reference-data:ENDPOINT-EXCEPTIONS-PER-POLICY-OPT-IN-STATUS ``` ### Deleting opt-in status you can also delete the opt-in status, so you're back to the 'upgrade' scenario. for this, you need a `system_indices_superuser`, here's a quick console command to create one: ``` POST kbn://internal/security/users/testuser { "password": "changeme", "username": "testuser", "full_name": "", "email": "", "roles": [ "system_indices_superuser", "superuser" ] } ``` and then delete like this: ``` DELETE .kibana_security_solution/_doc/security:reference-data:ENDPOINT-EXCEPTIONS-PER-POLICY-OPT-IN-STATUS ``` ## todo docs ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

…m Alerts page (#262282) ## Summary > [!note] > After `endpointExceptionsMovedUnderManagement` FF is enabled, and after user [has opted in](#259598) to per-policy Endpoint exceptions... ...the Endpoint exception create form shows the Policy selector: <img width="573" height="99" alt="image" src="https://github.com/user-attachments/assets/a69b35b6-f55b-4e15-aa59-64f29eb6a64b" /> This should be defaulted to 'Global' when trying to create an Endpoint exception on the Alerts page: - to harmonize with historic behavior: so far Endpoint exceptions used to be always global, - to harmonize with Endpoint artifact pages: there we also default to global. ## Screen recording ### User with Global artifact management privilege https://github.com/user-attachments/assets/3058f0fd-7bea-4b2d-ab7f-f14912f8bd41 ### User without Global artifact management privilege https://github.com/user-attachments/assets/4f93e393-674b-462f-ba2c-8d4e31121983 > [!note] > actually this cannot be tested in this PR manually, because it is hidden behind another hidden bug: elastic/security-team#16784 > but the unit test shows the behavior ## Todo - [ ] update backport labels in case 9.4 branch is cut ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios

…lag (#260983) > [!CAUTION] > Must be retargeted to 9.4 branch as soon as it's cut. Serverless release will follow later. ## Summary This PR enables the Security Solution feature flag `endpointExceptionsMovedUnderManagement` to: - hide Endpoint exceptions from Detections and Shared exception list pages, - instead, show Endpoint exceptions under Endpoint / Artifacts, - add an opt-in mechanism to allow users to opt-in to per-policy usage for Endpoint exceptions, - and add export/import functionality to all Endpoint artifacts And in order to do this, it: - adapts some of the tests, - deletes some obsolete ones, including fixtures, - removes Endpoint exception privilege condition for showing Shared exception list page (see [this comment](#239634 (comment))) - enables API documentation (see [this comment](#259598 (comment))) ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - --------- Co-authored-by: Konrad Szwarc <konrad.szwarc@elastic.co>

…ature flag (elastic#260983) > [!CAUTION] > Must be retargeted to 9.4 branch as soon as it's cut. Serverless release will follow later. This PR enables the Security Solution feature flag `endpointExceptionsMovedUnderManagement` to: - hide Endpoint exceptions from Detections and Shared exception list pages, - instead, show Endpoint exceptions under Endpoint / Artifacts, - add an opt-in mechanism to allow users to opt-in to per-policy usage for Endpoint exceptions, - and add export/import functionality to all Endpoint artifacts And in order to do this, it: - adapts some of the tests, - deletes some obsolete ones, including fixtures, - removes Endpoint exception privilege condition for showing Shared exception list page (see [this comment](elastic#239634 (comment))) - enables API documentation (see [this comment](elastic#259598 (comment))) Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - --------- Co-authored-by: Konrad Szwarc <konrad.szwarc@elastic.co>

gergoabraham self-assigned this Mar 25, 2026

gergoabraham added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:Defend Workflows “EDR Workflows” sub-team of Security Solution labels Mar 25, 2026

macroscopeapp bot reviewed Mar 25, 2026

View reviewed changes

Comment thread ...lugins/security_solution/public/management/hooks/artifacts/use_endpoint_per_policy_opt_in.ts Outdated

Comment thread ...blic/management/pages/endpoint_exceptions/view/components/per_policy_opt_in_callout.test.tsx Outdated

gergoabraham force-pushed the per-policy-endpoint-exceptions-opt-in branch from 645adb3 to 0f4fc7d Compare March 26, 2026 08:51

gergoabraham added 23 commits March 27, 2026 18:46

[data] add endpoint opt-in status to reference dataset

d91c36f

[api] add POST API to allow opting in

65b207f

[api] add test coverage for POST api

130a7a4

[api] add GET API to allow fetching opt-in status

3cc05d6

[docs] add api documentation

a99ddc0

[api] remove manually created response type

5e2e906

[ui] add callout component

88289fa

[ui] add modal component

41c6e06

[ui] add initial behavior in usePerPolicyOptIn

b5a1c8e

[ui] add new callout prop to artifact list page

bfdc38a

[ui] add unit test coverage

9f4d87f

[ui] RBAC: only admin can opt in

7d97b5a

[ui] show opt-in menu action to user

0664591

[e2e] add cypress happy-path test

9127f15

[e2e] perform opt-in in existing endpoint exceptions cy test

fc92314

[ui] hiding policy selector on endpoint exception form

a897bea

[ui] hiding policy assignment in policy details for endpoint exceptions

eb3ea95

[api] update create/update apis with opt-in status

5f02fd9

[api] update import api with opt-in status

82412cf

[task] update ManifestManager with opt-in status

ca628fb

[ui] hide "Add existing endpont exceptions" to rule checkbox based on…

2165f67

… opt-in status

[DE] do not evaluate endpoint exceptions based on opt-in status

018ee4c

[data] initialize opt-in status based on new deployment vs upgrade

81e24a7

gergoabraham added 6 commits March 30, 2026 17:11

[task] optimize SO service usage

4feb866

[ui] typo change

6c59790

[chore] update imports

adf803f

[ui] do not call opt-in API with FF disabled

53185e4

[ui] add doc link

95f0db6

type fix

b221241

gergoabraham requested a review from a team as a code owner March 30, 2026 15:57

[ui] remove toast from api request hook

0989562

gergoabraham requested review from paul-tavares and szwarckonrad March 30, 2026 16:28

szwarckonrad approved these changes Mar 30, 2026

View reviewed changes

paul-tavares approved these changes Mar 30, 2026

View reviewed changes

natasha-moore-elastic approved these changes Mar 31, 2026

View reviewed changes

gergoabraham added 4 commits March 31, 2026 11:08

Merge branch 'main' into per-policy-endpoint-exceptions-opt-in

49010a4

[test] update endpoint list API tests

dd8cf08

[auth] fix canReadAdminData and canWriteAdminData

37a2094

[auth] simplification: reuse hasAdminWrite, get rid of `canOptInPer…

0c64ee5

…PolicyEndpointExceptions`

denar50 approved these changes Mar 31, 2026

View reviewed changes

gergoabraham merged commit f855cf3 into elastic:main Mar 31, 2026
18 checks passed

gergoabraham deleted the per-policy-endpoint-exceptions-opt-in branch March 31, 2026 14:07

kibanamachine added the v9.4.0 label Mar 31, 2026

This was referenced Apr 9, 2026

[EDR Workflows][‼️ v9.4 ‼️] Enable Endpoint exceptions move feature flag #260983

Merged

[EDR Workflow] Default Endpoint exception as Global when creating from Alerts page #262282

Merged

gergoabraham mentioned this pull request Apr 16, 2026

[EDR Workflows][Serverless] Enable Endpoint exceptions move feature flag #263687

Open

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[EDR Workflows][Endpoint Exception move] Opt-in mechanism for per-policy Endpoint Exceptions#259598

[EDR Workflows][Endpoint Exception move] Opt-in mechanism for per-policy Endpoint Exceptions#259598
gergoabraham merged 48 commits intoelastic:mainfrom
gergoabraham:per-policy-endpoint-exceptions-opt-in

gergoabraham commented Mar 25, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

gergoabraham commented Mar 26, 2026

Uh oh!

szwarckonrad left a comment

Uh oh!

paul-tavares Mar 30, 2026

Uh oh!

paul-tavares Mar 30, 2026

Uh oh!

gergoabraham Mar 31, 2026

Uh oh!

natasha-moore-elastic left a comment

Uh oh!

denar50 left a comment

Uh oh!

denar50 Mar 31, 2026

Uh oh!

gergoabraham Mar 31, 2026

Uh oh!

denar50 Mar 31, 2026

Uh oh!

elasticmachine commented Mar 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Conversation

gergoabraham commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Behavior in short

Data

API

UI

empty page is... empty

callout for non-superusers

callout for superusers / admins

menu action for superusers / admins

modal

recording

opt-in process and endpoint exceptions pages

hiding stuff behind opt-in status

Testing

Reading opt-in status

Deleting opt-in status

todo

Checklist

Uh oh!

Uh oh!

Uh oh!

gergoabraham commented Mar 26, 2026

Uh oh!

szwarckonrad left a comment

Choose a reason for hiding this comment

Uh oh!

paul-tavares Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

paul-tavares Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

gergoabraham Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

natasha-moore-elastic left a comment

Choose a reason for hiding this comment

Uh oh!

denar50 left a comment

Choose a reason for hiding this comment

Uh oh!

denar50 Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

gergoabraham Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

denar50 Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Mar 31, 2026

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

Page load bundle

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

gergoabraham commented Mar 25, 2026 •

edited

Loading