Removes event filters feature flag and exposes this feature by default (

#100389) (#100550) * Removes event filters feature flag and expose this feature by default * Fixes manifest unit test * Fixes functional test adding event filter list case Co-authored-by: Kibana Machine <[email protected]> Co-authored-by: David Sánchez <[email protected]>
elastic · May 25, 2021 · 7db9be1 · 7db9be1
1 parent f841748
commit 7db9be1
Show file tree

Hide file tree

Showing 14 changed files with 204 additions and 48 deletions.
diff --git a/x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts b/x-pack/plugins/lists/server/services/exception_lists/exception_list_client.mock.ts
@@ -32,9 +32,11 @@ export class ExceptionListClientMock extends ExceptionListClient {
   public createEndpointList = jest.fn().mockResolvedValue(getExceptionListSchemaMock());
 }
 
-export const getExceptionListClientMock = (): ExceptionListClient => {
+export const getExceptionListClientMock = (
+  savedObject?: ReturnType<typeof savedObjectsClientMock.create>
+): ExceptionListClient => {
   const mock = new ExceptionListClientMock({
-    savedObjectsClient: savedObjectsClientMock.create(),
+    savedObjectsClient: savedObject ? savedObject : savedObjectsClientMock.create(),
     user: 'elastic',
   });
   return mock;

diff --git a/x-pack/plugins/security_solution/common/experimental_features.ts b/x-pack/plugins/security_solution/common/experimental_features.ts
@@ -14,7 +14,6 @@ export type ExperimentalFeatures = typeof allowedExperimentalValues;
 const allowedExperimentalValues = Object.freeze({
   trustedAppsByPolicyEnabled: false,
   metricsEntitiesEnabled: false,
-  eventFilteringEnabled: false,
   hostIsolationEnabled: false,
 });
 

diff --git a/x-pack/plugins/security_solution/public/common/mock/global_state.ts b/x-pack/plugins/security_solution/public/common/mock/global_state.ts
@@ -40,7 +40,6 @@ export const mockGlobalState: State = {
       { id: 'error-id-2', title: 'title-2', message: ['error-message-2'] },
     ],
     enableExperimental: {
-      eventFilteringEnabled: false,
       trustedAppsByPolicyEnabled: false,
       metricsEntitiesEnabled: false,
       hostIsolationEnabled: false,

diff --git a/x-pack/plugins/security_solution/public/management/components/administration_list_page.tsx b/x-pack/plugins/security_solution/public/management/components/administration_list_page.tsx
@@ -25,7 +25,6 @@ import {
   getEventFiltersListPath,
   getTrustedAppsListPath,
 } from '../common/routing';
-import { useIsExperimentalFeatureEnabled } from '../../common/hooks/use_experimental_features';
 
 /** Ensure that all flyouts z-index in Administation area show the flyout header */
 const EuiPanelStyled = styled(EuiPanel)`
@@ -44,7 +43,6 @@ interface AdministrationListPageProps {
 
 export const AdministrationListPage: FC<AdministrationListPageProps & CommonProps> = memo(
   ({ beta, title, subtitle, actions, children, headerBackComponent, ...otherProps }) => {
-    const isEventFilteringEnabled = useIsExperimentalFeatureEnabled('eventFilteringEnabled');
     const badgeOptions = !beta ? undefined : { beta: true, text: BETA_BADGE_LABEL };
 
     return (
@@ -77,18 +75,14 @@ export const AdministrationListPage: FC<AdministrationListPageProps & CommonProp
               pageId: SecurityPageName.administration,
               disabled: false,
             },
-            ...(isEventFilteringEnabled
-              ? {
-                  [AdministrationSubTab.eventFilters]: {
-                    name: EVENT_FILTERS_TAB,
-                    id: AdministrationSubTab.eventFilters,
-                    href: getEventFiltersListPath(),
-                    urlKey: 'administration',
-                    pageId: SecurityPageName.administration,
-                    disabled: false,
-                  },
-                }
-              : {}),
+            [AdministrationSubTab.eventFilters]: {
+              name: EVENT_FILTERS_TAB,
+              id: AdministrationSubTab.eventFilters,
+              href: getEventFiltersListPath(),
+              urlKey: 'administration',
+              pageId: SecurityPageName.administration,
+              disabled: false,
+            },
           }}
         />
 

diff --git a/.../public/management/pages/event_filters/view/components/event_filter_delete_modal.test.tsx b/.../public/management/pages/event_filters/view/components/event_filter_delete_modal.test.tsx
@@ -64,7 +64,6 @@ describe('When event filters delete modal is shown', () => {
     };
 
     waitForAction = mockedContext.middlewareSpy.waitForAction;
-    mockedContext.setExperimentalFlag({ eventFilteringEnabled: true });
   });
 
   it('should display name of event filter in body message', async () => {

diff --git a/...rity_solution/public/management/pages/event_filters/view/event_filters_list_page.test.tsx b/...rity_solution/public/management/pages/event_filters/view/event_filters_list_page.test.tsx
@@ -41,7 +41,6 @@ describe('When on the Event Filters List Page', () => {
     waitForAction = mockedContext.middlewareSpy.waitForAction;
 
     act(() => {
-      mockedContext.setExperimentalFlag({ eventFilteringEnabled: true });
       history.push('/event_filters');
     });
   });

diff --git a/x-pack/plugins/security_solution/public/management/pages/index.tsx b/x-pack/plugins/security_solution/public/management/pages/index.tsx
@@ -25,7 +25,6 @@ import { SecurityPageName } from '../../../common/constants';
 import { SpyRoute } from '../../common/utils/route/spy_routes';
 import { useIngestEnabledCheck } from '../../common/hooks/endpoint/ingest_enabled';
 import { EventFiltersContainer } from './event_filters';
-import { useIsExperimentalFeatureEnabled } from '../../common/hooks/use_experimental_features';
 
 const NoPermissions = memo(() => {
   return (
@@ -58,7 +57,6 @@ NoPermissions.displayName = 'NoPermissions';
 
 export const ManagementContainer = memo(() => {
   const history = useHistory();
-  const isEventFilteringEnabled = useIsExperimentalFeatureEnabled('eventFilteringEnabled');
   const { allEnabled: isIngestEnabled } = useIngestEnabledCheck();
 
   if (!isIngestEnabled) {
@@ -70,10 +68,7 @@ export const ManagementContainer = memo(() => {
       <Route path={MANAGEMENT_ROUTING_ENDPOINTS_PATH} component={EndpointsContainer} />
       <Route path={MANAGEMENT_ROUTING_POLICIES_PATH} component={PolicyContainer} />
       <Route path={MANAGEMENT_ROUTING_TRUSTED_APPS_PATH} component={TrustedAppsContainer} />
-
-      {isEventFilteringEnabled && (
-        <Route path={MANAGEMENT_ROUTING_EVENT_FILTERS_PATH} component={EventFiltersContainer} />
-      )}
+      <Route path={MANAGEMENT_ROUTING_EVENT_FILTERS_PATH} component={EventFiltersContainer} />
 
       <Route
         path={MANAGEMENT_ROUTING_ROOT_PATH}

diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/actions/index.tsx
@@ -21,7 +21,6 @@ import { EventsTdContent } from '../../styles';
 import * as i18n from '../translations';
 import { DEFAULT_ICON_BUTTON_WIDTH } from '../../helpers';
 import { useShallowEqualSelector } from '../../../../../common/hooks/use_selector';
-import { useIsExperimentalFeatureEnabled } from '../../../../../common/hooks/use_experimental_features';
 import { AddToCaseAction } from '../../../../../cases/components/timeline_actions/add_to_case_action';
 import { TimelineId, TimelineTabs } from '../../../../../../common/types/timeline';
 import { timelineSelectors } from '../../../../store/timeline';
@@ -89,8 +88,6 @@ const ActionsComponent: React.FC<ActionProps> = ({
   const emptyNotes: string[] = [];
   const getTimeline = useMemo(() => timelineSelectors.getTimelineByIdSelector(), []);
 
-  const isEventFilteringEnabled = useIsExperimentalFeatureEnabled('eventFilteringEnabled');
-
   const handleSelectEvent = useCallback(
     (event: React.ChangeEvent<HTMLInputElement>) =>
       onRowSelected({
@@ -116,8 +113,8 @@ const ActionsComponent: React.FC<ActionProps> = ({
   const eventType = getEventType(ecsData);
 
   const isEventContextMenuEnabled = useMemo(
-    () => isEventFilteringEnabled && !!ecsData.event?.kind && ecsData.event?.kind[0] === 'event',
-    [ecsData.event?.kind, isEventFilteringEnabled]
+    () => !!ecsData.event?.kind && ecsData.event?.kind[0] === 'event',
+    [ecsData.event?.kind]
   );
 
   return (

diff --git a/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/mocks.ts b/x-pack/plugins/security_solution/server/endpoint/lib/artifacts/mocks.ts
@@ -92,6 +92,36 @@ export const createPackagePolicyWithInitialManifestMock = (): PackagePolicy => {
       artifact_manifest: {
         value: {
           artifacts: {
+            'endpoint-eventfilterlist-linux-v1': {
+              compression_algorithm: 'zlib',
+              decoded_sha256: 'd801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658',
+              decoded_size: 14,
+              encoded_sha256: 'f8e6afa1d5662f5b37f83337af774b5785b5b7f1daee08b7b00c2d6813874cda',
+              encoded_size: 22,
+              encryption_algorithm: 'none',
+              relative_url:
+                '/api/fleet/artifacts/endpoint-eventfilterlist-linux-v1/d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658',
+            },
+            'endpoint-eventfilterlist-macos-v1': {
+              compression_algorithm: 'zlib',
+              decoded_sha256: 'd801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658',
+              decoded_size: 14,
+              encoded_sha256: 'f8e6afa1d5662f5b37f83337af774b5785b5b7f1daee08b7b00c2d6813874cda',
+              encoded_size: 22,
+              encryption_algorithm: 'none',
+              relative_url:
+                '/api/fleet/artifacts/endpoint-eventfilterlist-macos-v1/d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658',
+            },
+            'endpoint-eventfilterlist-windows-v1': {
+              compression_algorithm: 'zlib',
+              decoded_sha256: 'd801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658',
+              decoded_size: 14,
+              encoded_sha256: 'f8e6afa1d5662f5b37f83337af774b5785b5b7f1daee08b7b00c2d6813874cda',
+              encoded_size: 22,
+              encryption_algorithm: 'none',
+              relative_url:
+                '/api/fleet/artifacts/endpoint-eventfilterlist-windows-v1/d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658',
+            },
             'endpoint-exceptionlist-macos-v1': {
               compression_algorithm: 'zlib',
               encryption_algorithm: 'none',

diff --git a/...ity_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.mock.ts b/...ity_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.mock.ts
@@ -69,13 +69,16 @@ export interface ManifestManagerMockOptions {
 
 export const buildManifestManagerMockOptions = (
   opts: Partial<ManifestManagerMockOptions>
-): ManifestManagerMockOptions => ({
-  cache: new LRU<string, Buffer>({ max: 10, maxAge: 1000 * 60 * 60 }),
-  exceptionListClient: listMock.getExceptionListClient(),
-  packagePolicyService: createPackagePolicyServiceMock(),
-  savedObjectsClient: savedObjectsClientMock.create(),
-  ...opts,
-});
+): ManifestManagerMockOptions => {
+  const savedObjectMock = savedObjectsClientMock.create();
+  return {
+    cache: new LRU<string, Buffer>({ max: 10, maxAge: 1000 * 60 * 60 }),
+    exceptionListClient: listMock.getExceptionListClient(savedObjectMock),
+    packagePolicyService: createPackagePolicyServiceMock(),
+    savedObjectsClient: savedObjectMock,
+    ...opts,
+  };
+};
 
 export const buildManifestManagerContextMock = (
   opts: Partial<ManifestManagerMockOptions>

diff --git a/...ity_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts b/...ity_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.test.ts
@@ -65,6 +65,9 @@ describe('ManifestManager', () => {
   const ARTIFACT_NAME_TRUSTED_APPS_MACOS = 'endpoint-trustlist-macos-v1';
   const ARTIFACT_NAME_TRUSTED_APPS_WINDOWS = 'endpoint-trustlist-windows-v1';
   const ARTIFACT_NAME_TRUSTED_APPS_LINUX = 'endpoint-trustlist-linux-v1';
+  const ARTIFACT_NAME_EVENT_FILTERS_MACOS = 'endpoint-eventfilterlist-macos-v1';
+  const ARTIFACT_NAME_EVENT_FILTERS_WINDOWS = 'endpoint-eventfilterlist-windows-v1';
+  const ARTIFACT_NAME_EVENT_FILTERS_LINUX = 'endpoint-eventfilterlist-linux-v1';
 
   let ARTIFACTS: InternalArtifactCompleteSchema[] = [];
   let ARTIFACTS_BY_ID: { [K: string]: InternalArtifactCompleteSchema } = {};
@@ -219,6 +222,9 @@ describe('ManifestManager', () => {
       ARTIFACT_NAME_TRUSTED_APPS_MACOS,
       ARTIFACT_NAME_TRUSTED_APPS_WINDOWS,
       ARTIFACT_NAME_TRUSTED_APPS_LINUX,
+      ARTIFACT_NAME_EVENT_FILTERS_MACOS,
+      ARTIFACT_NAME_EVENT_FILTERS_WINDOWS,
+      ARTIFACT_NAME_EVENT_FILTERS_LINUX,
     ];
 
     const getArtifactIds = (artifacts: InternalArtifactSchema[]) => [
@@ -249,6 +255,11 @@ describe('ManifestManager', () => {
       context.exceptionListClient.findExceptionListItem = mockFindExceptionListItemResponses({});
       context.packagePolicyService.listIds = mockPolicyListIdsResponse([TEST_POLICY_ID_1]);
 
+      context.savedObjectsClient.create = jest
+        .fn()
+        .mockImplementation((type: string, object: InternalManifestSchema) => ({
+          attributes: object,
+        }));
       const manifest = await manifestManager.buildNewManifest();
 
       expect(manifest?.getSchemaVersion()).toStrictEqual('v1');
@@ -257,7 +268,7 @@ describe('ManifestManager', () => {
 
       const artifacts = manifest.getAllArtifacts();
 
-      expect(artifacts.length).toBe(6);
+      expect(artifacts.length).toBe(9);
       expect(getArtifactIds(artifacts)).toStrictEqual(SUPPORTED_ARTIFACT_NAMES);
       expect(artifacts.every(isCompressed)).toBe(true);
 
@@ -280,6 +291,11 @@ describe('ManifestManager', () => {
         [ENDPOINT_LIST_ID]: { macos: [exceptionListItem] },
         [ENDPOINT_TRUSTED_APPS_LIST_ID]: { linux: [trustedAppListItem] },
       });
+      context.savedObjectsClient.create = jest
+        .fn()
+        .mockImplementation((type: string, object: InternalManifestSchema) => ({
+          attributes: object,
+        }));
       context.packagePolicyService.listIds = mockPolicyListIdsResponse([TEST_POLICY_ID_1]);
 
       const manifest = await manifestManager.buildNewManifest();
@@ -290,7 +306,7 @@ describe('ManifestManager', () => {
 
       const artifacts = manifest.getAllArtifacts();
 
-      expect(artifacts.length).toBe(6);
+      expect(artifacts.length).toBe(9);
       expect(getArtifactIds(artifacts)).toStrictEqual(SUPPORTED_ARTIFACT_NAMES);
       expect(artifacts.every(isCompressed)).toBe(true);
 
@@ -304,6 +320,9 @@ describe('ManifestManager', () => {
       expect(await uncompressArtifact(artifacts[5])).toStrictEqual({
         entries: translateToEndpointExceptions([trustedAppListItem], 'v1'),
       });
+      expect(await uncompressArtifact(artifacts[6])).toStrictEqual({ entries: [] });
+      expect(await uncompressArtifact(artifacts[7])).toStrictEqual({ entries: [] });
+      expect(await uncompressArtifact(artifacts[8])).toStrictEqual({ entries: [] });
 
       for (const artifact of artifacts) {
         expect(manifest.isDefaultArtifact(artifact)).toBe(true);
@@ -323,7 +342,11 @@ describe('ManifestManager', () => {
         [ENDPOINT_LIST_ID]: { macos: [exceptionListItem] },
       });
       context.packagePolicyService.listIds = mockPolicyListIdsResponse([TEST_POLICY_ID_1]);
-
+      context.savedObjectsClient.create = jest
+        .fn()
+        .mockImplementation((type: string, object: InternalManifestSchema) => ({
+          attributes: object,
+        }));
       const oldManifest = await manifestManager.buildNewManifest();
 
       context.exceptionListClient.findExceptionListItem = mockFindExceptionListItemResponses({
@@ -339,7 +362,7 @@ describe('ManifestManager', () => {
 
       const artifacts = manifest.getAllArtifacts();
 
-      expect(artifacts.length).toBe(6);
+      expect(artifacts.length).toBe(9);
       expect(getArtifactIds(artifacts)).toStrictEqual(SUPPORTED_ARTIFACT_NAMES);
       expect(artifacts.every(isCompressed)).toBe(true);
 
@@ -351,6 +374,9 @@ describe('ManifestManager', () => {
       expect(await uncompressArtifact(artifacts[5])).toStrictEqual({
         entries: translateToEndpointExceptions([trustedAppListItem], 'v1'),
       });
+      expect(await uncompressArtifact(artifacts[6])).toStrictEqual({ entries: [] });
+      expect(await uncompressArtifact(artifacts[7])).toStrictEqual({ entries: [] });
+      expect(await uncompressArtifact(artifacts[8])).toStrictEqual({ entries: [] });
 
       for (const artifact of artifacts) {
         expect(manifest.isDefaultArtifact(artifact)).toBe(true);
@@ -384,6 +410,12 @@ describe('ManifestManager', () => {
         TEST_POLICY_ID_2,
       ]);
 
+      context.savedObjectsClient.create = jest
+        .fn()
+        .mockImplementation((type: string, object: InternalManifestSchema) => ({
+          attributes: object,
+        }));
+
       const manifest = await manifestManager.buildNewManifest();
 
       expect(manifest?.getSchemaVersion()).toStrictEqual('v1');
@@ -392,7 +424,7 @@ describe('ManifestManager', () => {
 
       const artifacts = manifest.getAllArtifacts();
 
-      expect(artifacts.length).toBe(7);
+      expect(artifacts.length).toBe(10);
       expect(getArtifactIds(artifacts)).toStrictEqual(SUPPORTED_ARTIFACT_NAMES);
       expect(artifacts.every(isCompressed)).toBe(true);
 
@@ -412,6 +444,9 @@ describe('ManifestManager', () => {
           'v1'
         ),
       });
+      expect(await uncompressArtifact(artifacts[7])).toStrictEqual({ entries: [] });
+      expect(await uncompressArtifact(artifacts[8])).toStrictEqual({ entries: [] });
+      expect(await uncompressArtifact(artifacts[9])).toStrictEqual({ entries: [] });
 
       for (const artifact of artifacts.slice(0, 5)) {
         expect(manifest.isDefaultArtifact(artifact)).toBe(true);

diff --git a/...security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts b/...security_solution/server/endpoint/services/artifacts/manifest_manager/manifest_manager.ts
@@ -361,10 +361,7 @@ export class ManifestManager {
     const results = await Promise.all([
       this.buildExceptionListArtifacts(),
       this.buildTrustedAppsArtifacts(),
-      // If Endpoint Event Filtering feature is ON, then add in the exceptions for them
-      ...(this.experimentalFeatures.eventFilteringEnabled
-        ? [this.buildEventFiltersArtifacts()]
-        : []),
+      this.buildEventFiltersArtifacts(),
     ]);
 
     const manifest = new Manifest({

diff --git a/...ty_solution/server/search_strategy/security_solution/factory/hosts/details/index.test.tsx b/...ty_solution/server/search_strategy/security_solution/factory/hosts/details/index.test.tsx
@@ -32,7 +32,6 @@ const mockDeps = {
     experimentalFeatures: {
       trustedAppsByPolicyEnabled: false,
       metricsEntitiesEnabled: false,
-      eventFilteringEnabled: false,
       hostIsolationEnabled: false,
     },
     service: {} as EndpointAppContextService,
-Original file line number
+Diff line change
@@ Expand Up / @@ -64,7 +64,6 @@ describe('When event filters delete modal is shown', () => { @@
         };
         waitForAction = mockedContext.middlewareSpy.waitForAction;
-        mockedContext.setExperimentalFlag({ eventFilteringEnabled: true });
       });
       it('should display name of event filter in body message', async () => {
@@ Expand Down @@