[EDR Workflows][Serverless] Enable Endpoint exceptions move feature flag by gergoabraham · Pull Request #263687 · elastic/kibana

gergoabraham · 2026-04-16T08:18:12Z

Summary

This PR enables the Security Solution feature flag endpointExceptionsMovedUnderManagement on Serverless.

Note

Dear reviewers, this PR is the cherry-pick of the PR you already reviewed for 9.4 ESS release:

[EDR Workflows][‼️ v9.4 ‼️] Enable Endpoint exceptions move feature flag #260983

Original description

This PR enables the Security Solution feature flag endpointExceptionsMovedUnderManagement to:

hide Endpoint exceptions from Detections and Shared exception list pages,
instead, show Endpoint exceptions under Endpoint / Artifacts,
add an opt-in mechanism to allow users to opt-in to per-policy usage for Endpoint exceptions,
and add export/import functionality to all Endpoint artifacts

And in order to do this, it:

adapts some of the tests,
deletes some obsolete ones, including fixtures,
removes Endpoint exception privilege condition for showing Shared exception list page (see this
comment)
enables API documentation (see this comment)

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines

Release Notes

Moves Endpoint exceptions from the Shared exception lists and Rules pages to the Endpoint Artifacts page, in order to separate them from Rule exceptions, and emphasize their connection to other Endpoint artifacts.
Adds the possibility for users to opt-in to a per-policy usage for Endpoint exceptions, allowing them to assign Endpoint exceptions to Defend package policies, with the additional result of not evaluating Endpoint exceptions on rule execution anymore.
Adds export/import functionality to all Endpoint artifacts, like Trusted applications, Trusted devices, Event filters, Blocklists, Host isolation exceptions.

(Note: this is the same as in #260983. If one is updated, update the other one as well.)

…ature flag (elastic#260983) > [!CAUTION] > Must be retargeted to 9.4 branch as soon as it's cut. Serverless release will follow later. This PR enables the Security Solution feature flag `endpointExceptionsMovedUnderManagement` to: - hide Endpoint exceptions from Detections and Shared exception list pages, - instead, show Endpoint exceptions under Endpoint / Artifacts, - add an opt-in mechanism to allow users to opt-in to per-policy usage for Endpoint exceptions, - and add export/import functionality to all Endpoint artifacts And in order to do this, it: - adapts some of the tests, - deletes some obsolete ones, including fixtures, - removes Endpoint exception privilege condition for showing Shared exception list page (see [this comment](elastic#239634 (comment))) - enables API documentation (see [this comment](elastic#259598 (comment))) Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - --------- Co-authored-by: Konrad Szwarc <konrad.szwarc@elastic.co>

elasticmachine · 2026-04-16T10:20:06Z

⏳ Build in-progress, with failures

Buildkite Build
Commit: 056fd5a

Failed CI Steps

Test Failures

[job] [logs] Defend Workflows Cypress Tests #19 / Automated Response Actions should have been called against a created host should have been called against a created host
[job] [logs] Defend Workflows Cypress Tests on Serverless #3 / Automated Response Actions should have been called against a created host should have been called against a created host
[job] [logs] Defend Workflows Cypress Tests #19 / Automated Response Actions should have been called against a created host should have been called against a created host
[job] [logs] Defend Workflows Cypress Tests on Serverless #3 / Automated Response Actions should have been called against a created host should have been called against a created host
[job] [logs] Defend Workflows Cypress Tests #20 / Automated Response Actions should not show the response when no action history privilege should not show the response when no action history privilege
[job] [logs] Defend Workflows Cypress Tests #20 / Automated Response Actions should not show the response when no action history privilege should not show the response when no action history privilege

History

cc @gergoabraham

…eature-flag

elasticmachine · 2026-04-16T14:20:45Z

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

macroscopeapp · 2026-04-16T14:24:22Z

Catch flakiness early (recommended)

Recommended before merge: run the flaky test runner against this PR to catch flakiness early.

Trigger a run with the Flaky Test Runner UI or post this comment on the PR:

/flaky ftrConfig:x-pack/solutions/security/test/security_solution_api_integration/test_suites/edr_workflows/artifacts/trial_license_complete_tier/configs/ess.config.ts:30 ftrConfig:x-pack/solutions/security/test/security_solution_api_integration/test_suites/edr_workflows/artifacts/trial_license_complete_tier/configs/serverless.config.ts:30 ftrConfig:x-pack/solutions/security/test/security_solution_cypress/cli_config.ts:30 ftrConfig:x-pack/solutions/security/test/security_solution_cypress/serverless_config.ts:30

This check is experimental. Share your feedback in the #appex-qa channel.

^{Posted via Macroscope — Flaky Test Runner nudge}

PhilippeOberti

Code review only, LGTM for the @elastic/security-threat-hunting-investigations team

gergoabraham · 2026-04-17T06:58:16Z

/flaky ftrConfig:x-pack/solutions/security/test/security_solution_api_integration/test_suites/edr_workflows/artifacts/trial_license_complete_tier/configs/ess.config.ts:30 ftrConfig:x-pack/solutions/security/test/security_solution_api_integration/test_suites/edr_workflows/artifacts/trial_license_complete_tier/configs/serverless.config.ts:30 ftrConfig:x-pack/solutions/security/test/security_solution_cypress/cli_config.ts:30 ftrConfig:x-pack/solutions/security/test/security_solution_cypress/serverless_config.ts:30

kibanamachine · 2026-04-17T06:58:32Z

Flaky Test Runner

✅ Build triggered - kibana-flaky-test-suite-runner#11690

x-pack/solutions/security/test/security_solution_api_integration/test_suites/edr_workflows/artifacts/trial_license_complete_tier/configs/ess.config.ts x30
x-pack/solutions/security/test/security_solution_api_integration/test_suites/edr_workflows/artifacts/trial_license_complete_tier/configs/serverless.config.ts x30
x-pack/solutions/security/test/security_solution_cypress/cli_config.ts x30
x-pack/solutions/security/test/security_solution_cypress/serverless_config.ts x30

kibanamachine · 2026-04-17T11:37:11Z

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#11690

[✅] x-pack/solutions/security/test/security_solution_api_integration/test_suites/edr_workflows/artifacts/trial_license_complete_tier/configs/ess.config.ts: 30/30 tests passed.
[✅] x-pack/solutions/security/test/security_solution_api_integration/test_suites/edr_workflows/artifacts/trial_license_complete_tier/configs/serverless.config.ts: 30/30 tests passed.
[✅] x-pack/solutions/security/test/security_solution_cypress/cli_config.ts: 30/30 tests passed.
[✅] x-pack/solutions/security/test/security_solution_cypress/serverless_config.ts: 30/30 tests passed.

see run history

dhurley14

DE changes look good

gergoabraham self-assigned this Apr 16, 2026

gergoabraham added backport:skip This PR does not require backporting Team:Defend Workflows “EDR Workflows” sub-team of Security Solution release_note:feature Makes this part of the condensed release notes labels Apr 16, 2026

gergoabraham mentioned this pull request Apr 16, 2026

[EDR Workflows][‼️ v9.4 ‼️] Enable Endpoint exceptions move feature flag #260983

Merged

3 tasks

Merge branch 'main' into serverless-enable-endpoint-exceptions-move-f…

de9863a

…eature-flag

gergoabraham added the ci:skip-cypress-osquery Skips osquery cypress checks label Apr 16, 2026

gergoabraham requested review from MadameSheema, PhilippeOberti, agusruidiazgd, ashokaditya, banderror, dhurley14 and joeypoon April 16, 2026 14:20

gergoabraham marked this pull request as ready for review April 16, 2026 14:20

gergoabraham requested review from a team as code owners April 16, 2026 14:20

PhilippeOberti approved these changes Apr 16, 2026

View reviewed changes

dhurley14 approved these changes Apr 17, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[EDR Workflows][Serverless] Enable Endpoint exceptions move feature flag#263687

[EDR Workflows][Serverless] Enable Endpoint exceptions move feature flag#263687
gergoabraham wants to merge 2 commits intoelastic:mainfrom
gergoabraham:serverless-enable-endpoint-exceptions-move-feature-flag

gergoabraham commented Apr 16, 2026 •

edited

Loading

Uh oh!

elasticmachine commented Apr 16, 2026 •

edited

Loading

Uh oh!

elasticmachine commented Apr 16, 2026

Uh oh!

macroscopeapp bot commented Apr 16, 2026

Uh oh!

PhilippeOberti left a comment

Uh oh!

gergoabraham commented Apr 17, 2026

Uh oh!

kibanamachine commented Apr 17, 2026

Uh oh!

kibanamachine commented Apr 17, 2026

Uh oh!

dhurley14 left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

gergoabraham commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Original description

Checklist

Release Notes

Uh oh!

elasticmachine commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⏳ Build in-progress, with failures

Failed CI Steps

Test Failures

History

Uh oh!

elasticmachine commented Apr 16, 2026

Uh oh!

macroscopeapp bot commented Apr 16, 2026

Catch flakiness early (recommended)

Uh oh!

PhilippeOberti left a comment

Choose a reason for hiding this comment

Uh oh!

gergoabraham commented Apr 17, 2026

Uh oh!

kibanamachine commented Apr 17, 2026

Flaky Test Runner

✅ Build triggered - kibana-flaky-test-suite-runner#11690

Uh oh!

kibanamachine commented Apr 17, 2026

Flaky Test Runner Stats

🎉 All tests passed! - kibana-flaky-test-suite-runner#11690

Uh oh!

dhurley14 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

gergoabraham commented Apr 16, 2026 •

edited

Loading

elasticmachine commented Apr 16, 2026 •

edited

Loading