[Security Solution][Endpoint][Admin] Malware user notification checkbox

x-pack/plugins/security_solution/common/endpoint/models/policy_config.ts

@@ -24,6 +24,12 @@ export const factory = (): PolicyConfig => {
       malware: {
         mode: ProtectionModes.prevent,
       },
+      popup: {
+        malware: {
+          message: '',
+          enabled: true,
+        },
+      },
       logging: {
         file: 'info',
       },
@@ -37,6 +43,12 @@ export const factory = (): PolicyConfig => {
       malware: {
         mode: ProtectionModes.prevent,
       },
+      popup: {
+        malware: {
+          message: '',
+          enabled: true,
+        },
+      },
       logging: {
         file: 'info',
       },

x-pack/plugins/security_solution/common/endpoint/types/index.ts

@@ -858,6 +858,12 @@ export interface PolicyConfig {
     logging: {
       file: string;
     };
+    popup: {
+      malware: {
+        message: string;
+        enabled: boolean;
+      };
+    };
   };
   mac: {
     events: {
@@ -866,6 +872,12 @@ export interface PolicyConfig {
       network: boolean;
     };
     malware: MalwareFields;
+    popup: {
+      malware: {
+        message: string;
+        enabled: boolean;
+      };
+    };
     logging: {
       file: string;
     };
@@ -889,11 +901,11 @@ export interface UIPolicyConfig {
   /**
    * Windows-specific policy configuration that is supported via the UI
    */
-  windows: Pick<PolicyConfig['windows'], 'events' | 'malware'>;
+  windows: Pick<PolicyConfig['windows'], 'events' | 'malware' | 'popup'>;
   /**
    * Mac-specific policy configuration that is supported via the UI
    */
-  mac: Pick<PolicyConfig['mac'], 'malware' | 'events'>;
+  mac: Pick<PolicyConfig['mac'], 'malware' | 'events' | 'popup'>;
   /**
    * Linux-specific policy configuration that is supported via the UI
    */

x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/index.test.ts

@@ -238,11 +238,23 @@ describe('policy details: ', () => {
                       security: true,
                     },
                     malware: { mode: 'prevent' },
+                    popup: {
+                      malware: {
+                        enabled: true,
+                        message: '',
+                      },
+                    },
                     logging: { file: 'info' },
                   },
                   mac: {
                     events: { process: true, file: true, network: true },
                     malware: { mode: 'prevent' },
+                    popup: {
+                      malware: {
+                        enabled: true,
+                        message: '',
+                      },
+                    },
                     logging: { file: 'info' },
                   },
                   linux: {

x-pack/plugins/security_solution/public/management/pages/policy/store/policy_details/selectors.ts

@@ -105,10 +105,12 @@ export const policyConfig: (s: PolicyDetailsState) => UIPolicyConfig = createSel
       windows: {
         events: windows.events,
         malware: windows.malware,
+        popup: windows.popup,
       },
       mac: {
         events: mac.events,
         malware: mac.malware,
+        popup: mac.popup,
       },
       linux: {
         events: linux.events,

x-pack/plugins/security_solution/public/management/pages/policy/view/policy_forms/protections/malware.tsx

@@ -14,6 +14,7 @@ import {
   EuiSpacer,
   htmlIdGenerator,
   EuiCallOut,
+  EuiCheckbox,
 } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
@@ -50,6 +51,11 @@ const ProtectionRadio = React.memo(({ id, label }: { id: ProtectionModes; label:
       const newPayload = clone(policyDetailsConfig);
       for (const os of OSes) {
         newPayload[os][protection].mode = id;
+        if (id === ProtectionModes.prevent) {
+          newPayload[os].popup[protection].enabled = true;
+        } else {
+          newPayload[os].popup[protection].enabled = false;
+        }
       }
       dispatch({
         type: 'userChangedPolicyConfig',
@@ -85,6 +91,8 @@ export const MalwareProtections = React.memo(() => {
   const dispatch = useDispatch();
   // currently just taking windows.malware, but both windows.malware and mac.malware should be the same value
   const selected = policyDetailsConfig && policyDetailsConfig.windows.malware.mode;
+  const userNotificationSelected =
+    policyDetailsConfig && policyDetailsConfig.windows.popup.malware.enabled;
 
   const radios: Immutable<Array<{
     id: ProtectionModes;
@@ -116,10 +124,12 @@ export const MalwareProtections = React.memo(() => {
         if (event.target.checked === false) {
           for (const os of OSes) {
             newPayload[os][protection].mode = ProtectionModes.off;
+            newPayload[os].popup[protection].enabled = event.target.checked;
           }
         } else {
           for (const os of OSes) {
             newPayload[os][protection].mode = ProtectionModes.prevent;
+            newPayload[os].popup[protection].enabled = event.target.checked;
           }
         }
         dispatch({
@@ -131,6 +141,22 @@ export const MalwareProtections = React.memo(() => {
     [dispatch, policyDetailsConfig]
   );
 
+  const handleUserNotificationCheckbox = useCallback(
+    (event) => {
+      if (policyDetailsConfig) {
+        const newPayload = clone(policyDetailsConfig);
+        for (const os of OSes) {
+          newPayload[os].popup[protection].enabled = event.target.checked;
+        }
+        dispatch({
+          type: 'userChangedPolicyConfig',
+          payload: { policyConfig: newPayload },
+        });
+      }
+    },
+    [policyDetailsConfig, dispatch]
+  );
+
   const radioButtons = useMemo(() => {
     return (
       <>
@@ -154,9 +180,18 @@ export const MalwareProtections = React.memo(() => {
             );
           })}
         </ProtectionRadioGroup>
+        <EuiCheckbox
+          id="xpack.securitySolution.endpoint.policyDetail.malware.userNotification"
+          onChange={handleUserNotificationCheckbox}
+          checked={userNotificationSelected}
+          label={i18n.translate(
+            'xpack.securitySolution.endpoint.policyDetail.malware.userNotification',
+            { defaultMessage: 'User Notification' }
+          )}
+        />
       </>
     );
-  }, [radios]);
+  }, [radios, handleUserNotificationCheckbox, userNotificationSelected]);
 
   const protectionSwitch = useMemo(() => {
     return (

x-pack/plugins/security_solution/server/endpoint/lib/policy/saved_object_mappings.ts

@@ -0,0 +1,69 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SavedObjectsType } from '../../../../../../../src/core/server/types';
+import { PACKAGE_POLICY_SAVED_OBJECT_TYPE } from '../../../../../ingest_manager/common';
+import { migratePackagePolicyToV7110 } from './to_v7_11.0';
+
+export const packagePolicyType: SavedObjectsType = {
+  name: PACKAGE_POLICY_SAVED_OBJECT_TYPE,
+  hidden: false,
+  namespaceType: 'agnostic',
+  management: {
+    importableAndExportable: false,
+  },
+  mappings: {
+    properties: {
+      name: { type: 'keyword' },
+      description: { type: 'text' },
+      namespace: { type: 'keyword' },
+      enabled: { type: 'boolean' },
+      policy_id: { type: 'keyword' },
+      output_id: { type: 'keyword' },
+      package: {
+        properties: {
+          name: { type: 'keyword' },
+          title: { type: 'keyword' },
+          version: { type: 'keyword' },
+        },
+      },
+      inputs: {
+        type: 'nested',
+        enabled: false,
+        properties: {
+          type: { type: 'keyword' },
+          enabled: { type: 'boolean' },
+          vars: { type: 'flattened' },
+          config: { type: 'flattened' },
+          streams: {
+            type: 'nested',
+            properties: {
+              id: { type: 'keyword' },
+              enabled: { type: 'boolean' },
+              data_stream: {
+                properties: {
+                  dataset: { type: 'keyword' },
+                  type: { type: 'keyword' },
+                },
+              },
+              vars: { type: 'flattened' },
+              config: { type: 'flattened' },
+              compiled_stream: { type: 'flattened' },
+            },
+          },
+        },
+      },
+      revision: { type: 'integer' },
+      updated_at: { type: 'date' },
+      updated_by: { type: 'keyword' },
+      created_at: { type: 'date' },
+      created_by: { type: 'keyword' },
+    },
+  },
+  migrations: {
+    '7.11.0': migratePackagePolicyToV7110,
+  },
+};

x-pack/plugins/security_solution/server/endpoint/lib/policy/to_v7_11.0.test.ts

@@ -0,0 +1,94 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SavedObjectMigrationContext, SavedObjectUnsanitizedDoc } from 'kibana/server';
+import { PackagePolicy } from '../../../../../ingest_manager/common';
+import { migratePackagePolicyToV7110 } from './to_v7_11.0';
+
+describe('7.11.0 Endpoint Package Policy migration', () => {
+  const migration = migratePackagePolicyToV7110;
+  it('adds malware notification checkbox and optional message', () => {
+    const doc = {
+      attributes: {
+        name: 'endpoint',
+        id: 'endpoint',
+        policy_id: '',
+        enabled: true,
+        namespace: '',
+        output_id: '',
+        revision: 0,
+        updated_at: '',
+        updated_by: '',
+        created_at: '',
+        created_by: '',
+        inputs: [
+          {
+            type: 'endpoint',
+            enabled: true,
+            streams: [],
+            config: {
+              policy: {
+                value: {
+                  windows: {},
+                  mac: {},
+                },
+              },
+            },
+          },
+        ],
+      },
+      type: ' nested',
+    };
+
+    expect(
+      migration(doc, {} as SavedObjectMigrationContext) as SavedObjectUnsanitizedDoc<PackagePolicy>
+    ).toEqual({
+      attributes: {
+        name: 'endpoint',
+        id: 'endpoint',
+        policy_id: '',
+        enabled: true,
+        namespace: '',
+        output_id: '',
+        revision: 0,
+        updated_at: '',
+        updated_by: '',
+        created_at: '',
+        created_by: '',
+        inputs: [
+          {
+            type: 'endpoint',
+            enabled: true,
+            streams: [],
+            config: {
+              policy: {
+                value: {
+                  windows: {
+                    popup: {
+                      malware: {
+                        message: '',
+                        enabled: false,
+                      },
+                    },
+                  },
+                  mac: {
+                    popup: {
+                      malware: {
+                        message: '',
+                        enabled: false,
+                      },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        ],
+      },
+      type: ' nested',
+    });
+  });
+});

x-pack/plugins/security_solution/server/endpoint/lib/policy/to_v7_11.0.ts

@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SavedObjectMigrationFn, SavedObjectUnsanitizedDoc } from 'kibana/server';
+import { cloneDeep } from 'lodash';
+import { PackagePolicy } from '../../types';
+
+export const migratePackagePolicyToV7110: SavedObjectMigrationFn<PackagePolicy, PackagePolicy> = (
+  packagePolicyDoc
+) => {
+  const updatedPackagePolicyDoc: SavedObjectUnsanitizedDoc<PackagePolicy> = cloneDeep(
+    packagePolicyDoc
+  );
+  if (packagePolicyDoc.attributes.name === 'endpoint') {
+    const input = updatedPackagePolicyDoc.attributes.inputs[0];
+    const popup = {
+      malware: {
+        message: '',
+        enabled: false,
+      },
+    };
+    if (input && input.config) {
+      input.config.policy.value.windows.popup = popup;
+      input.config.policy.value.mac.popup = popup;
+    }
+  }
+
+  return updatedPackagePolicyDoc;
+};