[8.x] [Security Solution][Endpoint] Show tooltip icon on `proces…

…ses` response console command for SentinelOne Windows hosts (elastic#201030) (elastic#202595) # Backport This will backport the following commits from `main` to `8.x`: - [[Security Solution][Endpoint] Show tooltip icon on `processes` response console command for SentinelOne Windows hosts (elastic#201030)](elastic#201030)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Paul Tavares <[email protected]>
machadoum · Dec 2, 2024 · 8e40ae2 · 8e40ae2
1 parent 53e01df
commit 8e40ae2
Show file tree

Hide file tree

Showing 14 changed files with 80 additions and 10 deletions.
diff --git a/...ts/endpoint_responder/command_render_components/integration_tests/execute_action.test.tsx b/...ts/endpoint_responder/command_render_components/integration_tests/execute_action.test.tsx
@@ -73,6 +73,7 @@ describe('When using execute action from response actions console', () => {
                   endpointAgentId: 'a.b.c',
                   endpointCapabilities: [...capabilities],
                   endpointPrivileges,
+                  platform: 'linux',
                 }),
               },
             };

diff --git a/...s/endpoint_responder/command_render_components/integration_tests/get_file_action.test.tsx b/...s/endpoint_responder/command_render_components/integration_tests/get_file_action.test.tsx
@@ -71,6 +71,7 @@ describe('When using get-file action from response actions console', () => {
       endpointAgentId: 'a.b.c',
       endpointCapabilities: [...ENDPOINT_CAPABILITIES],
       endpointPrivileges,
+      platform: 'linux',
     };
 
     render = async (capabilities: EndpointCapabilities[] = [...ENDPOINT_CAPABILITIES]) => {

diff --git a/...point_responder/command_render_components/integration_tests/get_processes_action.test.tsx b/...point_responder/command_render_components/integration_tests/get_processes_action.test.tsx
@@ -59,6 +59,7 @@ describe('When using processes action from response actions console', () => {
         canSuspendProcess: true,
         canGetRunningProcesses: true,
       },
+      platform: 'linux',
     });
   };
 

diff --git a/...ts/endpoint_responder/command_render_components/integration_tests/isolate_action.test.tsx b/...ts/endpoint_responder/command_render_components/integration_tests/isolate_action.test.tsx
@@ -67,6 +67,7 @@ describe('When using isolate action from response actions console', () => {
                     loading: false,
                     canIsolateHost: true,
                   },
+                  platform: 'linux',
                 }),
               },
             };

diff --git a/...dpoint_responder/command_render_components/integration_tests/kill_process_action.test.tsx b/...dpoint_responder/command_render_components/integration_tests/kill_process_action.test.tsx
@@ -63,6 +63,7 @@ describe.skip('When using the kill-process action from response actions console'
         canSuspendProcess: true,
         canGetRunningProcesses: true,
       },
+      platform: 'linux',
     });
   };
 

diff --git a/...ts/endpoint_responder/command_render_components/integration_tests/release_action.test.tsx b/...ts/endpoint_responder/command_render_components/integration_tests/release_action.test.tsx
@@ -46,6 +46,7 @@ const prepareTest = () => {
                   canUnIsolateHost: true,
                   loading: false,
                 },
+                platform: 'linux',
               }),
             },
           };

diff --git a/...nents/endpoint_responder/command_render_components/integration_tests/scan_action.test.tsx b/...nents/endpoint_responder/command_render_components/integration_tests/scan_action.test.tsx
@@ -83,6 +83,7 @@ describe('When using scan action from response actions console', () => {
       endpointAgentId: 'agent-a',
       endpointCapabilities: [...ENDPOINT_CAPABILITIES],
       endpointPrivileges,
+      platform: 'linux',
     };
 
     render = async (capabilities: EndpointCapabilities[] = [...ENDPOINT_CAPABILITIES]) => {

diff --git a/...nts/endpoint_responder/command_render_components/integration_tests/status_action.test.tsx b/...nts/endpoint_responder/command_render_components/integration_tests/status_action.test.tsx
@@ -111,6 +111,7 @@ describe.skip('When using processes action from response actions console', () =>
                     ...getEndpointAuthzInitialState(),
                     loading: false,
                   },
+                  platform: 'linux',
                 }),
               },
             };

diff --git a/...int_responder/command_render_components/integration_tests/suspend_process_action.test.tsx b/...int_responder/command_render_components/integration_tests/suspend_process_action.test.tsx
@@ -73,6 +73,7 @@ describe('When using the suspend-process action from response actions console',
                     canSuspendProcess: true,
                     canGetRunningProcesses: true,
                   },
+                  platform: 'linux',
                 }),
               },
             };

diff --git a/...nts/endpoint_responder/command_render_components/integration_tests/upload_action.test.tsx b/...nts/endpoint_responder/command_render_components/integration_tests/upload_action.test.tsx
@@ -88,6 +88,7 @@ describe.skip('When using `upload` response action', () => {
                   endpointAgentId: 'a.b.c',
                   endpointCapabilities,
                   endpointPrivileges,
+                  platform: 'linux',
                 }),
               },
             };

diff --git a/...lution/public/management/components/endpoint_responder/lib/console_commands_definition.ts b/...lution/public/management/components/endpoint_responder/lib/console_commands_definition.ts
@@ -153,13 +153,16 @@ export interface GetEndpointConsoleCommandsOptions {
   /** Applicable only for Endpoint Agents */
   endpointCapabilities: ImmutableArray<string>;
   endpointPrivileges: EndpointPrivileges;
+  /** Host's platform: windows, linux, macos */
+  platform: string;
 }
 
 export const getEndpointConsoleCommands = ({
   endpointAgentId,
   agentType,
   endpointCapabilities,
   endpointPrivileges,
+  platform,
 }: GetEndpointConsoleCommandsOptions): CommandDefinition[] => {
   const featureFlags = ExperimentalFeaturesService.get();
 
@@ -523,7 +526,7 @@ export const getEndpointConsoleCommands = ({
 
   switch (agentType) {
     case 'sentinel_one':
-      return adjustCommandsForSentinelOne({ commandList: consoleCommands });
+      return adjustCommandsForSentinelOne({ commandList: consoleCommands, platform });
     case 'crowdstrike':
       return adjustCommandsForCrowdstrike({ commandList: consoleCommands });
     default:
@@ -543,8 +546,10 @@ const disableCommand = (command: CommandDefinition, agentType: ResponseActionAge
 /** @private */
 const adjustCommandsForSentinelOne = ({
   commandList,
+  platform,
 }: {
   commandList: CommandDefinition[];
+  platform: string;
 }): CommandDefinition[] => {
   const featureFlags = ExperimentalFeaturesService.get();
   const isKillProcessEnabled = featureFlags.responseActionsSentinelOneKillProcessEnabled;
@@ -580,6 +585,28 @@ const adjustCommandsForSentinelOne = ({
       )
     ) {
       disableCommand(command, 'sentinel_one');
+    } else {
+      // processes is not currently supported for Windows hosts
+      if (command.name === 'processes' && platform.toLowerCase() === 'windows') {
+        const message = i18n.translate(
+          'xpack.securitySolution.consoleCommandsDefinition.sentineloneProcessesWindowRestriction',
+          {
+            defaultMessage:
+              'Processes command is not currently supported for SentinelOne hosts running on Windows',
+          }
+        );
+
+        command.helpDisabled = true;
+        command.about = getCommandAboutInfo({
+          aboutInfo: command.about,
+          isSupported: false,
+          dataTestSubj: 'sentineloneProcessesWindowsWarningTooltip',
+          tooltipContent: message,
+        });
+        command.validate = () => {
+          return message;
+        };
+      }
     }
 
     return command;

diff --git a/...y_solution/public/management/components/endpoint_responder/lib/get_command_about_info.tsx b/...y_solution/public/management/components/endpoint_responder/lib/get_command_about_info.tsx
@@ -6,6 +6,7 @@
  */
 
 import React from 'react';
+import type { EuiToolTipProps } from '@elastic/eui';
 import { EuiIconTip } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 
@@ -17,23 +18,28 @@ const UNSUPPORTED_COMMAND_INFO = i18n.translate(
   }
 );
 
-const DisabledTooltip = React.memo(() => {
-  return <EuiIconTip content={UNSUPPORTED_COMMAND_INFO} type="warning" color="danger" />;
-});
-DisabledTooltip.displayName = 'DisabledTooltip';
-
 export const getCommandAboutInfo = ({
   aboutInfo,
   isSupported,
+  tooltipContent = UNSUPPORTED_COMMAND_INFO,
+  dataTestSubj,
 }: {
-  aboutInfo: string;
+  aboutInfo: React.ReactNode;
   isSupported: boolean;
+  tooltipContent?: EuiToolTipProps['content'];
+  dataTestSubj?: string;
 }) => {
   return isSupported ? (
     aboutInfo
   ) : (
     <>
-      {aboutInfo} <DisabledTooltip />
+      {aboutInfo}{' '}
+      <EuiIconTip
+        anchorProps={{ 'data-test-subj': dataTestSubj }}
+        content={tooltipContent}
+        type="warning"
+        color="danger"
+      />
     </>
   );
 };
diff --git a/.../components/endpoint_responder/lib/integration_tests/console_commands_definition.test.tsx b/.../components/endpoint_responder/lib/integration_tests/console_commands_definition.test.tsx
@@ -52,6 +52,7 @@ describe('When displaying Endpoint Response Actions', () => {
         endpointAgentId: '123',
         endpointCapabilities: endpointMetadata.Endpoint.capabilities ?? [],
         endpointPrivileges: getEndpointPrivilegesInitialStateMock(),
+        platform: 'linux',
       });
     });
 
@@ -89,13 +90,16 @@ describe('When displaying Endpoint Response Actions', () => {
         responseActionsCrowdstrikeManualHostIsolationEnabled: true,
         responseActionsSentinelOneV1Enabled: true,
         responseActionsSentinelOneGetFileEnabled: true,
+        responseActionsSentinelOneKillProcessEnabled: true,
+        responseActionsSentinelOneProcessesEnabled: true,
       });
 
       commands = getEndpointConsoleCommands({
         agentType: 'sentinel_one',
         endpointAgentId: '123',
         endpointCapabilities: endpointMetadata.Endpoint.capabilities ?? [],
         endpointPrivileges: getEndpointPrivilegesInitialStateMock(),
+        platform: 'linux',
       });
     });
 
@@ -110,13 +114,34 @@ describe('When displaying Endpoint Response Actions', () => {
     });
 
     it('should display response action commands in the help panel in expected order', () => {
-      render({ commands });
+      const { queryByTestId } = render({ commands });
       consoleSelectors.openHelpPanel();
       const commandsInPanel = helpPanelSelectors.getHelpCommandNames(
         HELP_GROUPS.responseActions.label
       );
 
-      expect(commandsInPanel).toEqual(['isolate', 'release', 'get-file --path']);
+      expect(commandsInPanel).toEqual([
+        'isolate',
+        'release',
+        'processes',
+        'kill-process --processName',
+        'get-file --path',
+      ]);
+      expect(queryByTestId('sentineloneProcessesWindowsWarningTooltip')).toBeNull();
+    });
+
+    it('should display warning icon on processes command if host is running on windows', () => {
+      commands = getEndpointConsoleCommands({
+        agentType: 'sentinel_one',
+        endpointAgentId: '123',
+        endpointCapabilities: endpointMetadata.Endpoint.capabilities ?? [],
+        endpointPrivileges: getEndpointPrivilegesInitialStateMock(),
+        platform: 'windows',
+      });
+      const { getByTestId } = render({ commands });
+      consoleSelectors.openHelpPanel();
+
+      expect(getByTestId('sentineloneProcessesWindowsWarningTooltip')).not.toBeNull();
     });
   });
 
@@ -130,6 +155,7 @@ describe('When displaying Endpoint Response Actions', () => {
         endpointAgentId: '123',
         endpointCapabilities: endpointMetadata.Endpoint.capabilities ?? [],
         endpointPrivileges: getEndpointPrivilegesInitialStateMock(),
+        platform: 'linux',
       });
     });
 

diff --git a/x-pack/plugins/security_solution/public/management/hooks/use_with_show_responder.tsx b/x-pack/plugins/security_solution/public/management/hooks/use_with_show_responder.tsx
@@ -71,6 +71,7 @@ export const useWithShowResponder = (): ShowResponseActionsConsole => {
             endpointAgentId: agentId,
             endpointCapabilities: capabilities,
             endpointPrivileges,
+            platform,
           }),
           'data-test-subj': `${agentType}ResponseActionsConsole`,
           storagePrefix: 'xpack.securitySolution.Responder',
-Original file line number
+Diff line change
@@ Expand Up @@
             canSuspendProcess: true,
             canGetRunningProcesses: true,
           },
+          platform: 'linux',
         });
       };
@@ Expand Down @@