[EDR Workflows][‼️ v9.4 ‼️] Enable Endpoint exceptions move feature flag by gergoabraham · Pull Request #260983 · elastic/kibana

gergoabraham · 2026-04-02T16:47:01Z

Caution

Must be retargeted to 9.4 branch as soon as it's cut. Serverless release will follow later.

Summary

This PR enables the Security Solution feature flag endpointExceptionsMovedUnderManagement to:

hide Endpoint exceptions from Detections and Shared exception list pages,
instead, show Endpoint exceptions under Endpoint / Artifacts,
add an opt-in mechanism to allow users to opt-in to per-policy usage for Endpoint exceptions,
and add export/import functionality to all Endpoint artifacts

And in order to do this, it:

adapts some of the tests,
deletes some obsolete ones, including fixtures,
removes Endpoint exception privilege condition for showing Shared exception list page (see this comment)
enables API documentation (see this comment)

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines

Release Notes

Moves Endpoint exceptions from the Shared exception lists and Rules pages to the Endpoint Artifacts page, in order to separate them from Rule exceptions, and emphasize their connection to other Endpoint artifacts.
Adds the possibility for users to opt-in to a per-policy usage for Endpoint exceptions, allowing them to assign Endpoint exceptions to Defend package policies, with the additional result of not evaluating Endpoint exceptions on rule execution anymore.
Adds export/import functionality to all Endpoint artifacts, like Trusted applications, Trusted devices, Event filters, Blocklists, Host isolation exceptions.

(Note: this is the same as in #263687. If one is updated, update the other one as well.)

kibanamachine · 2026-04-02T19:12:36Z

Cloud deployment initiated, see credentials at: https://buildkite.com/elastic/kibana-deploy-cloud-from-pr/builds/904

kibanamachine · 2026-04-02T19:30:28Z

Project deployed, see credentials at: https://buildkite.com/elastic/kibana-deploy-project-from-pr/builds/1138

… page

gergoabraham · 2026-04-09T08:06:47Z

Files by Code Owner

elastic/security-defend-workflows, elastic/security-detection-engine, elastic/security-solution

x-pack/solutions/security/test/security_solution_api_integration/test_suites/edr_workflows/artifacts/trial_license_complete_tier/configs/ess.config.ts
x-pack/solutions/security/test/security_solution_api_integration/test_suites/edr_workflows/artifacts/trial_license_complete_tier/configs/serverless.config.ts
x-pack/solutions/security/test/security_solution_api_integration/test_suites/edr_workflows/artifacts/trial_license_complete_tier/event_filters.ts
x-pack/solutions/security/test/security_solution_api_integration/test_suites/edr_workflows/artifacts/trial_license_complete_tier/host_isolation_exceptions.ts

elastic/security-defend-workflows, elastic/security-solution

x-pack/solutions/security/plugins/security_solution/common/api/endpoint/endpoint_exceptions_per_policy_opt_in/endpoint_exceptions_per_policy_opt_in.schema.yaml
x-pack/solutions/security/plugins/security_solution/public/management/cypress/e2e/artifacts/endpoint_exceptions.no_ff.cy.ts
x-pack/solutions/security/plugins/security_solution/public/management/hooks/artifacts/use_endpoint_per_policy_opt_in.test.ts
x-pack/solutions/security/plugins/security_solution/public/management/links.ts
x-pack/solutions/security/plugins/security_solution/public/management/pages/endpoint_exceptions/view/components/endpoint_exceptions_flyout.tsx

elastic/security-detection-engine, elastic/security-detection-rule-management, elastic/security-engineering-productivity, elastic/security-threat-hunting

x-pack/solutions/security/test/security_solution_cypress/cypress/fixtures/endpoint_exception_list.ndjson
x-pack/solutions/security/test/security_solution_cypress/cypress/objects/rule.ts

elastic/security-detection-engine, elastic/security-engineering-productivity

x-pack/solutions/security/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/exceptions/alerts_table_flow/endpoint_exceptions.cy.ts
x-pack/solutions/security/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/exceptions/alerts_table_flow/rule_exceptions/auto_populate_with_alert_data.cy.ts
x-pack/solutions/security/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/exceptions/rule_details_flow/add_edit_endpoint_exception.cy.ts
x-pack/solutions/security/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/exceptions/shared_exception_lists_management/shared_exception_list_page/filter_table.cy.ts
x-pack/solutions/security/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/exceptions/shared_exception_lists_management/shared_exception_list_page/import_lists.cy.ts
x-pack/solutions/security/test/security_solution_cypress/cypress/e2e/detection_response/detection_engine/exceptions/shared_exception_lists_management/shared_exception_list_page/manage_lists.cy.ts

elastic/security-detection-engine, elastic/security-engineering-productivity, elastic/security-threat-hunting-investigations

x-pack/solutions/security/test/security_solution_cypress/cypress/urls/navigation.ts

elastic/security-detection-rule-management, elastic/security-solution

x-pack/solutions/security/plugins/security_solution/public/rules/links.ts

elastic/security-engineering-productivity

x-pack/solutions/security/test/security_solution_cypress/config.ts
x-pack/solutions/security/test/security_solution_cypress/cypress/screens/exceptions.ts
x-pack/solutions/security/test/security_solution_cypress/cypress/screens/rule_details.ts
x-pack/solutions/security/test/security_solution_cypress/cypress/tasks/exceptions/flyout_options.ts
x-pack/solutions/security/test/security_solution_cypress/cypress/tasks/exceptions_table.ts
x-pack/solutions/security/test/security_solution_cypress/cypress/tasks/rule_details.ts
x-pack/solutions/security/test/security_solution_cypress/es_archives/endpoint/data.json
x-pack/solutions/security/test/security_solution_cypress/es_archives/endpoint/mappings.json
x-pack/solutions/security/test/security_solution_cypress/es_archives/endpoint_2/data.json
x-pack/solutions/security/test/security_solution_cypress/es_archives/endpoint_2/mappings.json

elastic/security-engineering-productivity, elastic/security-threat-hunting-investigations

x-pack/solutions/security/test/security_solution_cypress/cypress/e2e/explore/navigation/navigation.cy.ts

elastic/security-solution

x-pack/solutions/security/plugins/security_solution/common/experimental_features.ts

Owners to ping

elastic/security-defend-workflows
elastic/security-detection-engine
elastic/security-detection-rule-management
elastic/security-engineering-productivity
elastic/security-solution
elastic/security-threat-hunting
elastic/security-threat-hunting-investigations

tomsonpl · 2026-04-09T08:20:57Z

-      x-labels: []
-      #      TODO: When the feature flag `endpointExceptionsMovedUnderManagement` is enabled, remove empty `x-labels` and un-comment the line below.
-      #      x-labels: [ ess, serverless ]
+      x-labels: [ ess, serverless ]


Q: shouldn't these be added while when released in serverless, and not 9.4?

actually, it did not cause any change when adding these labels and running the generate and bundle scripts based on the readme:

kibana/x-pack/solutions/security/plugins/security_solution/common/api/endpoint/README.md

Lines 42 to 53 in dda77f4

### Making changes

1. Update the OpenAPI schema YML file and/or the Kibana schema file (see References below for help with OpenAPI YAML format)

2. Generate/re-generate the Zod schema validation modules:

```shell

yarn --cwd x-pack/solutions/security/plugins/security_solution openapi:generate

```

3. Create a new bundle with the updated APIs:

```shell

yarn --cwd x-pack/solutions/security/plugins/security_solution openapi:bundle:endpoint-management

```

4. Ensure that the newly generated files are commited to source

it seems these docs only make their way into the bundles, if they have neither an x-internal: true attribute, nor /internal/ in their paths:

kibana/src/platform/packages/shared/kbn-openapi-bundler/src/bundler/processor_sets.ts

Lines 31 to 34 in dda77f4

export const DEFAULT_BUNDLING_PROCESSORS: Readonly<DocumentNodeProcessor[]> = [

createSkipNodeWithInternalPropProcessor(X_INTERNAL),

createSkipInternalPathProcessor('/internal'),

createModifyPartialProcessor(),

so I think we're good, and didn't even need to hide this in the first place 👍

MadameSheema · 2026-04-09T08:42:20Z

-      cy.get(EXCEPTION_ITEM_VIEWER_CONTAINER).should('have.length', 1);
-      cy.get(EXCEPTION_CARD_ITEM_NAME).should('have.text', ITEM_NAME_EDIT);
-      cy.get(EXCEPTION_CARD_ITEM_CONDITIONS).contains('span', ADDITIONAL_ENTRY);
+      cy.get('[data-test-subj="endpointExceptionsListPage-card"]').should('have.length', 1);


NIT: Following best-practices, please, extract the locators to screens folder :)

that's a good point, done 🫡
f75f048

agusruidiazgd

LGTM from @elastic/security-threat-hunting-investigations. Code review only

MadameSheema · 2026-04-09T08:45:52Z

  beforeEach(() => {
-    cy.task('esArchiverUnload', { archiveName: 'endpoint_2' });
-    cy.task('esArchiverLoad', { archiveName: 'endpoint_2' });
+    cy.task('esArchiverLoad', { archiveName: 'endpoint' });


Is there any reason why we are not unloading the loaded archive in the after hook?

it is unloaded in the afterEach hook. after I changed the index name and the type from index to data stream, the tests failed with the following message:

CypressError: `cy.task('esArchiverUnload')` failed with the following error: > index_not_found_exception Root causes: index_not_found_exception: no such index [logs-endpoint.alerts-default]

so it seems that while unloading indices is done by best effort, unloading data streams fails when not found. to avoid this, I just added exactly as many unload ops as many load ops we have.

is this expected by the way?

TBH I don't know, this is a thing we can probably ask to appex-qa team.

ashokaditya

Did code review only and looks good to ship. Cypress best practices comments should be addressed.

banderror

LGTM, no rule management functionality affected

MadameSheema

Security Engineering Productivity changes LGTM!

Thanks for tackling the comments :D

dhurley14

DE code changes lgtm

elasticmachine · 2026-04-10T23:21:13Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: a8e64f9
Kibana Serverless Image: docker.elastic.co/kibana-ci/kibana-serverless:pr-260983-a8e64f9279e0

Failed CI Steps

Test Failures

[job] [logs] FTR Configs #107 / discover/cascade layout grouping data fetching does not refetch when returning to a previously expanded group
[job] [logs] FTR Configs #101 / discover/tabs2 tab filters should carry over filters as WHERE clauses when switching to ES|QL

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	11.7MB	11.7MB	+6.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	146.6KB	146.6KB	+42.0B

History

💔 Build #425783 failed 4a1fb6a
💛 Build #425632 was flaky b4f6939
💛 Build #425425 was flaky 00d656e
💚 Build #424698 succeeded 0aa9fa5
💚 Build #424113 succeeded 57636ba

cc @gergoabraham

…ature flag (elastic#260983) > [!CAUTION] > Must be retargeted to 9.4 branch as soon as it's cut. Serverless release will follow later. This PR enables the Security Solution feature flag `endpointExceptionsMovedUnderManagement` to: - hide Endpoint exceptions from Detections and Shared exception list pages, - instead, show Endpoint exceptions under Endpoint / Artifacts, - add an opt-in mechanism to allow users to opt-in to per-policy usage for Endpoint exceptions, - and add export/import functionality to all Endpoint artifacts And in order to do this, it: - adapts some of the tests, - deletes some obsolete ones, including fixtures, - removes Endpoint exception privilege condition for showing Shared exception list page (see [this comment](elastic#239634 (comment))) - enables API documentation (see [this comment](elastic#259598 (comment))) Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - --------- Co-authored-by: Konrad Szwarc <konrad.szwarc@elastic.co>

macroscopeapp bot reviewed Apr 2, 2026

View reviewed changes

Comment thread ...e/exceptions/shared_exception_lists_management/shared_exception_list_page/import_lists.cy.ts

gergoabraham force-pushed the enable-endpoint-exceptions-move-feature-flag branch from 65a7f1f to e8931d6 Compare April 2, 2026 17:08

gergoabraham added ci:build-cloud-image ci:build-serverless-image and removed ci:cloud-deploy Create or update a Cloud deployment ci:project-deploy-security Create a Security Serverless Project labels Apr 7, 2026

gergoabraham force-pushed the enable-endpoint-exceptions-move-feature-flag branch from e8931d6 to 59b5385 Compare April 7, 2026 12:08

elastic deleted a comment from macroscopeapp bot Apr 8, 2026

gergoabraham added 15 commits April 8, 2026 15:27

enable feature flag

db8d0ae

add cypress test coverage

62443e1

fix existing cy test to run with FF enabled

ae2db08

remove obsolete test (see elastic#258556)

a564391

update text in test

55c5ada

fix test typo

3c10211

adapt tests to Endpoint exceptions removed from Shared exception list…

d34b9d5

… page

adapt test to Endpoint exceptions tab removed from Rule details page

cb1ad34

update Endpoint Security rule dummy with correct index

ada873a

use endpoint esArchive with correct index

e6713c8

remove now unused endpoint_2 esArchive

6940631

add Endpoint Exceptions (and other missing) artifacts to navigation test

a76b687

fix jest tests

25502d7

remove obsolete test

b72ed3a

remove obsolete import API test cases

af06ab6

tomsonpl reviewed Apr 9, 2026

View reviewed changes

MadameSheema reviewed Apr 9, 2026

View reviewed changes

agusruidiazgd approved these changes Apr 9, 2026

View reviewed changes

MadameSheema reviewed Apr 9, 2026

View reviewed changes

ashokaditya approved these changes Apr 9, 2026

View reviewed changes

banderror approved these changes Apr 9, 2026

View reviewed changes

joeypoon approved these changes Apr 9, 2026

View reviewed changes

gergoabraham added 2 commits April 9, 2026 13:34

cy: extract selectors to screen folder

f75f048

Merge branch 'main' into enable-endpoint-exceptions-move-feature-flag

0aa9fa5

gergoabraham requested review from MadameSheema and tomsonpl April 9, 2026 11:45

MadameSheema approved these changes Apr 9, 2026

View reviewed changes

PhilippeOberti approved these changes Apr 9, 2026

View reviewed changes

gergoabraham added 2 commits April 10, 2026 10:56

Merge branch 'main' into enable-endpoint-exceptions-move-feature-flag

00d656e

Merge branch 'main' into enable-endpoint-exceptions-move-feature-flag

b4f6939

dhurley14 approved these changes Apr 10, 2026

View reviewed changes

gergoabraham changed the title ~~[EDR Workflows][9.4] Enable Endpoint exceptions move feature flag~~ [EDR Workflows][‼️ v9.4 ‼️] Enable Endpoint exceptions move feature flag Apr 10, 2026

Merge branch 'main' into enable-endpoint-exceptions-move-feature-flag

4a1fb6a

gergoabraham added the ci:skip-cypress-osquery Skips osquery cypress checks label Apr 10, 2026

Merge branch 'main' into enable-endpoint-exceptions-move-feature-flag

0555b29

szwarckonrad changed the base branch from main to 9.4 April 10, 2026 22:12

Merge branch '9.4' into enable-endpoint-exceptions-move-feature-flag

a8e64f9

szwarckonrad enabled auto-merge (squash) April 10, 2026 22:12

szwarckonrad merged commit e7290d4 into elastic:9.4 Apr 10, 2026
14 checks passed

gergoabraham mentioned this pull request Apr 16, 2026

[EDR Workflows][Serverless] Enable Endpoint exceptions move feature flag #263687

Open

3 tasks

gergoabraham added release_note:feature Makes this part of the condensed release notes and removed release_note:skip Skip the PR/issue when compiling release notes labels Apr 16, 2026

	### Making changes

	1. Update the OpenAPI schema YML file and/or the Kibana schema file (see References below for help with OpenAPI YAML format)
	2. Generate/re-generate the Zod schema validation modules:
	```shell
	yarn --cwd x-pack/solutions/security/plugins/security_solution openapi:generate
	```
	3. Create a new bundle with the updated APIs:
	```shell
	yarn --cwd x-pack/solutions/security/plugins/security_solution openapi:bundle:endpoint-management
	```
	4. Ensure that the newly generated files are commited to source

	export const DEFAULT_BUNDLING_PROCESSORS: Readonly<DocumentNodeProcessor[]> = [
	createSkipNodeWithInternalPropProcessor(X_INTERNAL),
	createSkipInternalPathProcessor('/internal'),
	createModifyPartialProcessor(),

Conversation

gergoabraham commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

Release Notes

Uh oh!

Uh oh!

kibanamachine commented Apr 2, 2026

Uh oh!

kibanamachine commented Apr 2, 2026

Uh oh!

gergoabraham commented Apr 9, 2026

Files by Code Owner

elastic/security-defend-workflows, elastic/security-detection-engine, elastic/security-solution

elastic/security-defend-workflows, elastic/security-solution

elastic/security-detection-engine, elastic/security-detection-rule-management, elastic/security-engineering-productivity, elastic/security-threat-hunting

elastic/security-detection-engine, elastic/security-engineering-productivity

elastic/security-detection-engine, elastic/security-engineering-productivity, elastic/security-threat-hunting-investigations

elastic/security-detection-rule-management, elastic/security-solution

elastic/security-engineering-productivity

elastic/security-engineering-productivity, elastic/security-threat-hunting-investigations

elastic/security-solution

Owners to ping

Uh oh!

tomsonpl Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gergoabraham Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

MadameSheema Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

gergoabraham Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

agusruidiazgd left a comment

Choose a reason for hiding this comment

Uh oh!

MadameSheema Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

gergoabraham Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

MadameSheema Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

ashokaditya left a comment

Choose a reason for hiding this comment

Uh oh!

banderror left a comment

Choose a reason for hiding this comment

Uh oh!

MadameSheema left a comment

Choose a reason for hiding this comment

Uh oh!

dhurley14 left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Async chunks

Page load bundle

History

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

gergoabraham commented Apr 2, 2026 •

edited

Loading

tomsonpl Apr 9, 2026 •

edited

Loading

elasticmachine commented Apr 10, 2026 •

edited

Loading