Adds RBAC API checks for event filters

elastic · Oct 25, 2022 · 230aa51 · 230aa51
1 parent 1b5ea75
commit 230aa51
Showing 1 changed file with 16 additions and 8 deletions.
diff --git a/.../security_solution/server/lists_integration/endpoint/validators/event_filter_validator.ts b/.../security_solution/server/lists_integration/endpoint/validators/event_filter_validator.ts
@@ -48,8 +48,16 @@ export class EventFilterValidator extends BaseValidator {
     return item.listId === ENDPOINT_EVENT_FILTERS_LIST_ID;
   }
 
+  protected async validateHasWritePrivilege(): Promise<void> {
+    return super.validateHasPrivilege('canWriteEventFilters');
+  }
+
+  protected async validateHasReadPrivilege(): Promise<void> {
+    return super.validateHasPrivilege('canReadEventFilters');
+  }
+
   async validatePreCreateItem(item: CreateExceptionListItemOptions) {
-    await this.validateCanManageEndpointArtifacts();
+    await this.validateHasWritePrivilege();
     await this.validateEventFilterData(item);
 
     // user can always create a global entry so additional checks not needed
@@ -67,7 +75,7 @@ export class EventFilterValidator extends BaseValidator {
   ): Promise<UpdateExceptionListItemOptions> {
     const updatedItem = _updatedItem as ExceptionItemLikeOptions;
 
-    await this.validateCanManageEndpointArtifacts();
+    await this.validateHasWritePrivilege();
     await this.validateEventFilterData(updatedItem);
 
     try {
@@ -96,27 +104,27 @@ export class EventFilterValidator extends BaseValidator {
   }
 
   async validatePreGetOneItem(): Promise<void> {
-    await this.validateCanManageEndpointArtifacts();
+    await this.validateHasReadPrivilege();
   }
 
   async validatePreSummary(): Promise<void> {
-    await this.validateCanManageEndpointArtifacts();
+    await this.validateHasReadPrivilege();
   }
 
   async validatePreDeleteItem(): Promise<void> {
-    await this.validateCanManageEndpointArtifacts();
+    await this.validateHasWritePrivilege();
   }
 
   async validatePreExport(): Promise<void> {
-    await this.validateCanManageEndpointArtifacts();
+    await this.validateHasWritePrivilege();
   }
 
   async validatePreSingleListFind(): Promise<void> {
-    await this.validateCanManageEndpointArtifacts();
+    await this.validateHasReadPrivilege();
   }
 
   async validatePreMultiListFind(): Promise<void> {
-    await this.validateCanManageEndpointArtifacts();
+    await this.validateHasReadPrivilege();
   }
 
   async validatePreImport(): Promise<void> {