[EDR Workflows] Option to sync antivirus registration with malware settings #180484

gergoabraham · 2024-04-10T15:06:03Z

Summary

Adds option to Defend integration's Antivirus Registration card to sync registration with Malware settings.

Details:

it adds a new field to PolicyConfig: antivirus_registration.mode, which can be enabled, disabled or sync_with_malware_prevent

this field is not used by Endpoint: instead the existing antivirus_registration.enabled field is derived from this field, so it's compatible with older Endpoints, too
the calculation of antivirus_registration.enabled happens both on client side and on server side (in Fleet's packagePolicyUpdate ingest callback)
default value for new policy is the same: disabled, as in previous version
adds migration

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios

elasticmachine · 2024-04-10T15:06:06Z

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

elasticmachine · 2024-04-10T15:06:11Z

Pinging @elastic/fleet (Team:Fleet)

… src/core/server/integration_tests/ci_checks'

kpollich

Fleet changes 🚀

gergoabraham · 2024-04-11T06:50:37Z

@elasticmachine merge upstream

…tings

… src/core/server/integration_tests/ci_checks'

szwarckonrad

Tested flow locally, everything propagates up to agent policy as expected.
I guess Endpoint doesn't mind this extra field in the config? :)
Great job 🚀 !

szwarckonrad · 2024-04-11T11:30:47Z

x-pack/plugins/security_solution/common/endpoint/types/index.ts

@@ -1000,6 +1000,7 @@ export interface PolicyConfig {
      };
    };
    antivirus_registration: {
+      mode?: AntivirusRegistrationModes;


Is mode truly optional?

it is optional only for one release cycle, afterwards it will be required - this is for supporting serverless rollout, see this comment: #179176 (comment)

szwarckonrad · 2024-04-11T11:38:33Z

x-pack/plugins/security_solution/common/endpoint/utils/update_antivirus_registration_enabled.ts

+import type { PolicyConfig } from '../types';
+import { ProtectionModes, AntivirusRegistrationModes } from '../types';
+
+export const updateAntivirusRegistrationEnabledInPlace = (policy: PolicyConfig): PolicyConfig => {


Maybe drop InPlace from the name? Spent way too much time trying to figure out what does it mean :D

done, also added JSOC 3d1bdba

szwarckonrad · 2024-04-11T12:01:21Z

...ment/pages/policy/view/policy_settings_form/components/cards/antivirus_registration_card.tsx

+  ),
+  [AntivirusRegistrationModes.sync]: i18n.translate(
+    'xpack.securitySolution.endpoint.policy.details.antivirusRegistration.syncWithMalwarePrevent',
+    { defaultMessage: 'Sync with Malware Prevent' }


Suggested change

{ defaultMessage: 'Sync with Malware Prevent' }

{ defaultMessage: 'Sync with Malware Protection level' }

Either way, I believe we could use a popover of sorts to explain what will happen on Prevent and Detect

done, also added hint 3f23c6d

szwarckonrad · 2024-04-11T12:16:32Z

x-pack/plugins/security_solution/common/endpoint/utils/update_antivirus_registration_enabled.ts

+  if (antivirusRegistrationMode) {
+    // calculate only if `mode` exists
+    policy.windows.antivirus_registration.enabled =
+      modeToEnabled[antivirusRegistrationMode] ?? false;


can modeToEnabled[antivirusRegistrationMode] be undefined?

yes, if there is an invalid value in antivirusRegistrationMode. so it should not happen, but if it happens because of reasons, the safest is to keep antivirus registration disabled

gergoabraham · 2024-04-11T14:30:20Z

@caitlinbetz @joepeeples @ferullo

what do you think about the tooltip text?
Using this setting will automatically enable antivirus registration if Malware protection is set to prevent. In any other case antivirus registration will be disabled. (update: changed cases to case)

also, I've displayed the current outcome of antivirus registration, so the user can see immediately what setting the antivirus registration to sync with malware results in. should we go with this?

paul-tavares

Looks good. Left one question, but nothing that should hold this back. Thanks for all of the test coverage 🤩

paul-tavares · 2024-04-11T15:29:34Z

...pages/policy/view/policy_settings_form/components/cards/antivirus_registration_card.test.tsx

-      'aria-checked',
-      'false'
-    );
+    expect(renderResult.getByTestId(antivirusTestSubj.radioButtons)).toBeTruthy();


Why the change in this test case? it now just seem to be checking that its in the DOM and not really checking what state it is in (checked or unchecked)

good point - I forgot to check it :)
fixed here 2b457bf

joepeeples

Thanks for including me in the review, @gergoabraham! Left a couple suggested edits, just let me know if you need anything else.

...ment/pages/policy/view/policy_settings_form/components/cards/antivirus_registration_card.tsx

Co-authored-by: Joe Peeples <[email protected]>

dasansol92 · 2024-04-15T08:19:57Z

@elasticmachine merge upstream

…tings

dasansol92 · 2024-04-15T10:45:21Z

@elasticmachine merge upstream

…tings

kibana-ci · 2024-04-15T12:00:08Z

💚 Build Succeeded

Buildkite Build
Commit: 4dc8cc7

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	5387	5388	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	17.2MB	17.2MB	+4.2KB

History

💔 Build #203529 failed e20b23f
💚 Build #203011 succeeded 2b457bf
💚 Build #202927 succeeded dcc1069
💔 Build #202911 failed b70d197
💛 Build #202818 was flaky 973d546

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @gergoabraham

…n.mode` from optional to required (#181986) ## Summary `antivirus_registration.mode` field was added to Endpoint integration policy config in this PR: #180484 It was optional to support roll-out, now it's changed to required as it has been released since. Co-authored-by: Kibana Machine <[email protected]>

gergoabraham added 9 commits April 10, 2024 15:43

add antivirus registration mode to PolicyConfig

3a4369d

update policy config defaults and helpers

d7e69a2

type fix - although unused code?

047b2be

add calculator for determining antivirus registration state

b114798

calculate antivirus_registration.enabled in policy update API handler

31a63fd

display antivirus registration sync with malware on UI

4ba2129

calculate antivirus_registration.enabled on client side, as well

6eec041

set new field optional to support serverless rollout

8006fd6

add migration for antivirus_registration.mode field

fd3f708

gergoabraham added release_note:skip Skip the PR/issue when compiling release notes backport:skip This commit does not require backporting Team:Defend Workflows “EDR Workflows” sub-team of Security Solution labels Apr 10, 2024

gergoabraham self-assigned this Apr 10, 2024

gergoabraham requested review from a team as code owners April 10, 2024 15:06

gergoabraham requested review from dasansol92 and ferullo April 10, 2024 15:06

botelastic bot added the Team:Fleet Team label for Observability Data Collection Fleet team label Apr 10, 2024

[CI] Auto-commit changed files from 'node scripts/jest_integration -u…

70fe012

… src/core/server/integration_tests/ci_checks'

gergoabraham requested a review from a team as a code owner April 10, 2024 15:37

kpollich approved these changes Apr 10, 2024

View reviewed changes

kibanamachine and others added 3 commits April 11, 2024 02:50

Merge branch 'main' into sync-antivirus-registration-with-malware-set…

ac285dc

…tings

Merge branch 'main' into sync-antivirus-registration-with-malware-set…

672e934

…tings

[CI] Auto-commit changed files from 'node scripts/jest_integration -u…

973d546

… src/core/server/integration_tests/ci_checks'

szwarckonrad approved these changes Apr 11, 2024

View reviewed changes

pgayvallet approved these changes Apr 11, 2024

View reviewed changes

gergoabraham added 3 commits April 11, 2024 16:21

rename function and add jsdoc

3d1bdba

update text and add tooltip for Sync option

3f23c6d

show current sync outcome to user

b70d197

gergoabraham added 3 commits April 11, 2024 16:36

fix translation ids

d1dec83

improve text

7658ba7

fix sync outcome text color for disabled controls

dcc1069

gergoabraham requested review from caitlinbetz, joepeeples and paul-tavares April 11, 2024 15:26

paul-tavares approved these changes Apr 11, 2024

View reviewed changes

improve antivirus registration card unit test

2b457bf

SiddharthMantri approved these changes Apr 12, 2024

View reviewed changes

joepeeples reviewed Apr 12, 2024

View reviewed changes

Apply suggestions from code review

642823e

Co-authored-by: Joe Peeples <[email protected]>

dasansol92 requested a review from joepeeples April 15, 2024 08:19

Merge branch 'main' into sync-antivirus-registration-with-malware-set…

e20b23f

…tings

Merge branch 'main' into sync-antivirus-registration-with-malware-set…

4dc8cc7

…tings

caitlinbetz approved these changes Apr 15, 2024

View reviewed changes

joepeeples approved these changes Apr 15, 2024

View reviewed changes

dasansol92 merged commit 12ec883 into elastic:main Apr 15, 2024
37 checks passed

kibanamachine added the v8.14.0 label Apr 15, 2024

gergoabraham deleted the sync-antivirus-registration-with-malware-settings branch April 17, 2024 08:09

gergoabraham mentioned this pull request Apr 29, 2024

[EDR Workflows][chore] Change previously added antivirus_registration.mode from optional to required #181986

Merged

caitlinbetz mentioned this pull request Jun 4, 2024

8.14.0 Release notes elastic/security-docs#5155

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[EDR Workflows] Option to sync antivirus registration with malware settings #180484

[EDR Workflows] Option to sync antivirus registration with malware settings #180484

gergoabraham commented Apr 10, 2024 •

edited

Loading

elasticmachine commented Apr 10, 2024

elasticmachine commented Apr 10, 2024

kpollich left a comment

gergoabraham commented Apr 11, 2024

szwarckonrad left a comment

szwarckonrad Apr 11, 2024

gergoabraham Apr 11, 2024

szwarckonrad Apr 11, 2024

gergoabraham Apr 11, 2024

szwarckonrad Apr 11, 2024

gergoabraham Apr 11, 2024

szwarckonrad Apr 11, 2024

gergoabraham Apr 11, 2024

gergoabraham commented Apr 11, 2024 •

edited

Loading

paul-tavares left a comment

paul-tavares Apr 11, 2024

gergoabraham Apr 11, 2024

joepeeples left a comment

dasansol92 commented Apr 15, 2024

dasansol92 commented Apr 15, 2024

kibana-ci commented Apr 15, 2024

	{ defaultMessage: 'Sync with Malware Prevent' }
	{ defaultMessage: 'Sync with Malware Protection level' }

[EDR Workflows] Option to sync antivirus registration with malware settings #180484

[EDR Workflows] Option to sync antivirus registration with malware settings #180484

Conversation

gergoabraham commented Apr 10, 2024 • edited Loading

Summary

Details:

Checklist

elasticmachine commented Apr 10, 2024

elasticmachine commented Apr 10, 2024

kpollich left a comment

Choose a reason for hiding this comment

gergoabraham commented Apr 11, 2024

szwarckonrad left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gergoabraham commented Apr 11, 2024 • edited Loading

paul-tavares left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

joepeeples left a comment

Choose a reason for hiding this comment

dasansol92 commented Apr 15, 2024

dasansol92 commented Apr 15, 2024

kibana-ci commented Apr 15, 2024

💚 Build Succeeded

Metrics [docs]

Module Count

Async chunks

History

gergoabraham commented Apr 10, 2024 •

edited

Loading

gergoabraham commented Apr 11, 2024 •

edited

Loading