[EDR Workflow] Default Endpoint exception as Global when creating from Alerts page

x-pack/solutions/security/plugins/security_solution/common/endpoint/service/artifacts/utils.test.ts

@@ -26,6 +26,8 @@ import {
   isFilterProcessDescendantsTag,
   isPolicySelectionTag,
   setArtifactOwnerSpaceId,
+  removeGlobalPolicyTag,
+  addGlobalPolicyTag,
 } from './utils';
 
 describe('Endpoint artifact utilities', () => {
@@ -150,6 +152,34 @@ describe('Endpoint artifact utilities', () => {
     });
   });
 
+  describe('when using `addGlobalPolicyTag()`', () => {
+    it('should add global tag to item without caring about per-policy or other tags', () => {
+      const output = addGlobalPolicyTag(['one', `${BY_POLICY_ARTIFACT_TAG_PREFIX}two`]);
+
+      expect(output).toEqual(['one', `${BY_POLICY_ARTIFACT_TAG_PREFIX}two`, GLOBAL_ARTIFACT_TAG]);
+    });
+
+    it('should not add global tag if it already exists', () => {
+      const output = addGlobalPolicyTag([GLOBAL_ARTIFACT_TAG, 'one', 'two']);
+
+      expect(output).toEqual([GLOBAL_ARTIFACT_TAG, 'one', 'two']);
+    });
+  });
+
+  describe('when using `removeGlobalPolicyTag()`', () => {
+    it('should remove global tag from item', () => {
+      const output = removeGlobalPolicyTag(['one', GLOBAL_ARTIFACT_TAG, 'two']);
+
+      expect(output).toEqual(['one', 'two']);
+    });
+
+    it('should do nothing if global tag is not present', () => {
+      const output = removeGlobalPolicyTag(['one', 'two']);
+
+      expect(output).toEqual(['one', 'two']);
+    });
+  });
+
   describe('when using `isProcessDescendantsEnabled()`', () => {
     it('should return false when `tags` is undefined', () => {
       expect(isProcessDescendantsEnabled({})).toBe(false);

x-pack/solutions/security/plugins/security_solution/common/endpoint/service/artifacts/utils.ts

@@ -124,6 +124,14 @@ export const getEffectedPolicySelectionByTags = (
   };
 };
 
+export const addGlobalPolicyTag = (tags: string[]): string[] => [
+  ...tags,
+  ...(tags.includes(GLOBAL_ARTIFACT_TAG) ? [] : [GLOBAL_ARTIFACT_TAG]),
+];
+
+export const removeGlobalPolicyTag = (tags: string[]): string[] =>
+  tags.filter((tag) => tag !== GLOBAL_ARTIFACT_TAG);
+
 export const isAdvancedModeEnabled = (
   item: Partial<Pick<ExceptionListItemSchema, 'tags'>>
 ): boolean => (item.tags ?? []).includes(ADVANCED_MODE_TAG);

x-pack/solutions/security/plugins/security_solution/public/management/pages/endpoint_exceptions/view/components/endpoint_exceptions_flyout.test.tsx

@@ -8,7 +8,7 @@
 import React from 'react';
 import type { EndpointExceptionsFlyoutProps } from './endpoint_exceptions_flyout';
 import { EndpointExceptionsFlyout } from './endpoint_exceptions_flyout';
-import { act, cleanup, waitFor } from '@testing-library/react';
+import { cleanup, waitFor } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 
 import type { AppContextTestRender } from '../../../../../common/mock/endpoint';
@@ -24,13 +24,19 @@ import type { AlertData } from '../../../../../detection_engine/rule_exceptions/
 import type { Rule } from '../../../../../detection_engine/rule_management/logic';
 import { useSignalIndex } from '../../../../../detections/containers/detection_engine/alerts/use_signal_index';
 import { useAlertsPrivileges } from '../../../../../detections/containers/detection_engine/alerts/use_alerts_privileges';
+import { useGetEndpointExceptionsPerPolicyOptIn } from '../../../../hooks/artifacts/use_endpoint_per_policy_opt_in';
+import { useUserPrivileges } from '../../../../../common/components/user_privileges';
+import { licenseService } from '../../../../../common/hooks/use_license';
 
 jest.mock('../../../../../common/lib/kibana');
 jest.mock('../../../../../common/containers/source');
 jest.mock('../../../../hooks/artifacts/use_create_artifact');
 jest.mock('../../../../../detection_engine/rule_exceptions/logic/use_close_alerts');
 jest.mock('../../../../../detections/containers/detection_engine/alerts/use_signal_index');
 jest.mock('../../../../../detections/containers/detection_engine/alerts/use_alerts_privileges');
+jest.mock('../../../../hooks/artifacts/use_endpoint_per_policy_opt_in');
+jest.mock('../../../../../common/components/user_privileges');
+jest.mock('../../../../../common/hooks/use_license');
 
 describe('Endpoint exceptions flyout', () => {
   jest.setTimeout(10000);
@@ -114,6 +120,16 @@ describe('Endpoint exceptions flyout', () => {
       hasAlertsUpdate: true,
     });
 
+    (useUserPrivileges as jest.Mock).mockReturnValue({
+      endpointPrivileges: { canManageGlobalArtifacts: true },
+    });
+
+    (useGetEndpointExceptionsPerPolicyOptIn as jest.Mock).mockReturnValue({
+      data: { status: true },
+    });
+
+    (licenseService as jest.Mocked<typeof licenseService>).isPlatinumPlus.mockReturnValue(true);
+
     render = (props) => {
       renderResult = mockedContext.render(
         <EndpointExceptionsFlyout
@@ -141,14 +157,18 @@ describe('Endpoint exceptions flyout', () => {
       expect(renderResult.getByTestId('add-endpoint-exception-confirm-button')).toBeInTheDocument();
     });
 
-    it('should render correctly with alert data', () => {
-      act(() => {
-        render({ alertData, isAlertDataLoading: false });
-      });
+    it('should render correctly with alert data', async () => {
+      render({ alertData, isAlertDataLoading: false });
 
-      expect(renderResult.getByTestId('addEndpointExceptionFlyout')).toBeInTheDocument();
-      expect(renderResult.getByTestId('add-endpoint-exception-cancel-button')).toBeInTheDocument();
-      expect(renderResult.getByTestId('add-endpoint-exception-confirm-button')).toBeInTheDocument();
+      await waitFor(() => {
+        expect(renderResult.getByTestId('addEndpointExceptionFlyout')).toBeInTheDocument();
+        expect(
+          renderResult.getByTestId('add-endpoint-exception-cancel-button')
+        ).toBeInTheDocument();
+        expect(
+          renderResult.getByTestId('add-endpoint-exception-confirm-button')
+        ).toBeInTheDocument();
+      });
     });
 
     it('should start with "add endpoint exception" button disabled when loading', () => {
@@ -173,6 +193,50 @@ describe('Endpoint exceptions flyout', () => {
       });
     });
 
+    it('should default to global artifact when user has global artifact management privileges', async () => {
+      (useUserPrivileges as jest.Mock).mockReturnValue({
+        endpointPrivileges: { canManageGlobalArtifacts: true },
+      });
+
+      render({ alertData, isAlertDataLoading: false });
+
+      await waitFor(() => {
+        const globalButton = renderResult.getByTestId(
+          'endpointExceptions-form-effectedPolicies-global'
+        );
+        expect(globalButton).toBeEnabled();
+        expect(globalButton).toHaveAttribute('aria-pressed', 'true');
+
+        const perPolicyButton = renderResult.getByTestId(
+          'endpointExceptions-form-effectedPolicies-perPolicy'
+        );
+        expect(perPolicyButton).toBeEnabled();
+        expect(perPolicyButton).toHaveAttribute('aria-pressed', 'false');
+      });
+    });
+
+    it('should default to per-policy artifact when user does not have global artifact management privileges', async () => {
+      (useUserPrivileges as jest.Mock).mockReturnValue({
+        endpointPrivileges: { canManageGlobalArtifacts: false },
+      });
+
+      render({ alertData, isAlertDataLoading: false });
+
+      await waitFor(() => {
+        const globalButton = renderResult.getByTestId(
+          'endpointExceptions-form-effectedPolicies-global'
+        );
+        expect(globalButton).not.toBeEnabled();
+        expect(globalButton).toHaveAttribute('aria-pressed', 'false');
+
+        const perPolicyButton = renderResult.getByTestId(
+          'endpointExceptions-form-effectedPolicies-perPolicy'
+        );
+        expect(perPolicyButton).toBeEnabled();
+        expect(perPolicyButton).toHaveAttribute('aria-pressed', 'true');
+      });
+    });
+
     it('should close when click on cancel button', async () => {
       render();
       const cancelButton = renderResult.getByTestId('add-endpoint-exception-cancel-button');

x-pack/solutions/security/plugins/security_solution/public/management/pages/endpoint_exceptions/view/components/endpoint_exceptions_flyout.tsx

@@ -22,6 +22,11 @@ import {
 } from '@elastic/eui';
 import { ENDPOINT_ARTIFACT_LISTS } from '@kbn/securitysolution-list-constants';
 import type { CreateExceptionListItemSchema } from '@kbn/securitysolution-io-ts-list-types';
+import {
+  addGlobalPolicyTag,
+  removeGlobalPolicyTag,
+} from '../../../../../../common/endpoint/service/artifacts/utils';
+import { useUserPrivileges } from '../../../../../common/components/user_privileges';
 import { prepareToCloseAlerts } from '../../../../../detection_engine/rule_exceptions/components/add_exception_flyout/helpers';
 import { useCloseAlertsFromExceptions } from '../../../../../detection_engine/rule_exceptions/logic/use_close_alerts';
 import { ExceptionItemsFlyoutAlertsActions } from '../../../../../detection_engine/rule_exceptions/components/flyout_components/alerts_actions';
@@ -83,22 +88,28 @@ export const EndpointExceptionsFlyout: React.FC<EndpointExceptionsFlyoutProps> =
   const [disableBulkClose, setDisableBulkCloseAlerts] = useState(false);
   const [bulkCloseIndex, setBulkCloseIndex] = useState<string[] | undefined>();
   const { hasAlertsUpdate } = useAlertsPrivileges();
+  const { canManageGlobalArtifacts } = useUserPrivileges().endpointPrivileges;
 
   useEffect(() => {
     if (!isAlertDataLoading && alertData) {
+      const defaultException = defaultEndpointExceptionItems(
+        ENDPOINT_ARTIFACT_LISTS.endpointExceptions.id,
+        '',
+        alertData
+      )[0] as CreateExceptionListItemSchema;
+
       const initialException = {
-        ...(defaultEndpointExceptionItems(
-          ENDPOINT_ARTIFACT_LISTS.endpointExceptions.id,
-          '',
-          alertData
-        )[0] as CreateExceptionListItemSchema),
+        ...defaultException,
 
         os_types: retrieveAlertOsTypes(alertData),
+        tags: canManageGlobalArtifacts
+          ? addGlobalPolicyTag(defaultException.tags ?? [])
+          : removeGlobalPolicyTag(defaultException.tags ?? []),
       };
 
       setException(initialException);
     }
-  }, [alertData, isAlertDataLoading]);
+  }, [alertData, canManageGlobalArtifacts, isAlertDataLoading]);
 
   const handleCloseFlyout = useCallback((): void => {
     onCancel(false);