Skip to content

Commit 0d8b59e

Browse files
tomsonplniros1
tomsonpl
authored and
niros1
committed
[EDR Workflows] Add Cancel response action to MDE (#230399)
1 parent 4e397ad commit 0d8b59e

File tree

76 files changed

+5828
-528
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

76 files changed

+5828
-528
lines changed

‎oas_docs/output/kibana.serverless.yaml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10991,6 +10991,39 @@ paths:
1099110991
x-metaTags:
1099210992
- content: Kibana, Elastic Cloud Serverless
1099310993
name: product_name
10994+
/api/endpoint/action/cancel:
10995+
post:
10996+
description: Cancel a running or pending response action (Applies only to some agent types).
10997+
operationId: CancelAction
10998+
requestBody:
10999+
content:
11000+
application/json:
11001+
examples:
11002+
MicrosoftDefenderEndpoint:
11003+
summary: Cancel a response action on a Microsoft Defender for Endpoint host
11004+
value:
11005+
agent_type: microsoft_defender_endpoint
11006+
comment: Cancelling action due to change in requirements
11007+
endpoint_ids:
11008+
- ed518850-681a-4d60-bb98-e22640cae2a8
11009+
parameters:
11010+
id: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
11011+
schema:
11012+
$ref: '#/components/schemas/Security_Endpoint_Management_API_CancelRouteRequestBody'
11013+
required: true
11014+
responses:
11015+
'200':
11016+
content:
11017+
application/json:
11018+
schema:
11019+
$ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
11020+
description: Successfully cancelled the response action
11021+
summary: Cancel a response action
11022+
tags:
11023+
- Security Endpoint Management API
11024+
x-metaTags:
11025+
- content: Kibana, Elastic Cloud Serverless
11026+
name: product_name
1099411027
/api/endpoint/action/execute:
1099511028
post:
1099611029
description: Run a shell command on an endpoint.
@@ -70035,6 +70068,54 @@ components:
7003570068
- microsoft_defender_endpoint
7003670069
example: endpoint
7003770070
type: string
70071+
Security_Endpoint_Management_API_CancelRouteRequestBody:
70072+
allOf:
70073+
- type: object
70074+
properties:
70075+
agent_type:
70076+
$ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
70077+
alert_ids:
70078+
description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts.
70079+
example:
70080+
- alert-id-1
70081+
- alert-id-2
70082+
items:
70083+
minLength: 1
70084+
type: string
70085+
minItems: 1
70086+
type: array
70087+
case_ids:
70088+
description: The IDs of cases where the action taken will be logged.
70089+
example:
70090+
- case-id-1
70091+
- case-id-2
70092+
items:
70093+
minLength: 1
70094+
type: string
70095+
minItems: 1
70096+
type: array
70097+
comment:
70098+
$ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
70099+
endpoint_ids:
70100+
$ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
70101+
parameters:
70102+
$ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
70103+
required:
70104+
- endpoint_ids
70105+
- type: object
70106+
properties:
70107+
parameters:
70108+
type: object
70109+
properties:
70110+
id:
70111+
description: ID of the response action to cancel
70112+
example: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
70113+
minLength: 1
70114+
type: string
70115+
required:
70116+
- id
70117+
required:
70118+
- parameters
7003870119
Security_Endpoint_Management_API_CloudFileScriptParameters:
7003970120
type: object
7004070121
properties:

‎oas_docs/output/kibana.yaml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13976,6 +13976,46 @@ paths:
1397613976
x-metaTags:
1397713977
- content: Kibana
1397813978
name: product_name
13979+
/api/endpoint/action/cancel:
13980+
post:
13981+
description: |-
13982+
**Spaces method and path for this operation:**
13983+
13984+
<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/cancel</span></div>
13985+
13986+
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
13987+
13988+
Cancel a running or pending response action (Applies only to some agent types).
13989+
operationId: CancelAction
13990+
requestBody:
13991+
content:
13992+
application/json:
13993+
examples:
13994+
MicrosoftDefenderEndpoint:
13995+
summary: Cancel a response action on a Microsoft Defender for Endpoint host
13996+
value:
13997+
agent_type: microsoft_defender_endpoint
13998+
comment: Cancelling action due to change in requirements
13999+
endpoint_ids:
14000+
- ed518850-681a-4d60-bb98-e22640cae2a8
14001+
parameters:
14002+
id: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
14003+
schema:
14004+
$ref: '#/components/schemas/Security_Endpoint_Management_API_CancelRouteRequestBody'
14005+
required: true
14006+
responses:
14007+
'200':
14008+
content:
14009+
application/json:
14010+
schema:
14011+
$ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
14012+
description: Successfully cancelled the response action
14013+
summary: Cancel a response action
14014+
tags:
14015+
- Security Endpoint Management API
14016+
x-metaTags:
14017+
- content: Kibana
14018+
name: product_name
1397914019
/api/endpoint/action/execute:
1398014020
post:
1398114021
description: |-
@@ -83090,6 +83130,54 @@ components:
8309083130
- microsoft_defender_endpoint
8309183131
example: endpoint
8309283132
type: string
83133+
Security_Endpoint_Management_API_CancelRouteRequestBody:
83134+
allOf:
83135+
- type: object
83136+
properties:
83137+
agent_type:
83138+
$ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
83139+
alert_ids:
83140+
description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts.
83141+
example:
83142+
- alert-id-1
83143+
- alert-id-2
83144+
items:
83145+
minLength: 1
83146+
type: string
83147+
minItems: 1
83148+
type: array
83149+
case_ids:
83150+
description: The IDs of cases where the action taken will be logged.
83151+
example:
83152+
- case-id-1
83153+
- case-id-2
83154+
items:
83155+
minLength: 1
83156+
type: string
83157+
minItems: 1
83158+
type: array
83159+
comment:
83160+
$ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
83161+
endpoint_ids:
83162+
$ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
83163+
parameters:
83164+
$ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
83165+
required:
83166+
- endpoint_ids
83167+
- type: object
83168+
properties:
83169+
parameters:
83170+
type: object
83171+
properties:
83172+
id:
83173+
description: ID of the response action to cancel
83174+
example: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
83175+
minLength: 1
83176+
type: string
83177+
required:
83178+
- id
83179+
required:
83180+
- parameters
8309383181
Security_Endpoint_Management_API_CloudFileScriptParameters:
8309483182
type: object
8309583183
properties:

‎x-pack/solutions/security/plugins/security_solution/common/api/endpoint/actions/response_actions/cancel/cancel.gen.ts‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License
4+
* 2.0; you may not use this file except in compliance with the Elastic License
5+
* 2.0.
6+
*/
7+
8+
/*
9+
* NOTICE: Do not edit this file manually.
10+
* This file is automatically generated by the OpenAPI Generator, @kbn/openapi-generator.
11+
*
12+
* info:
13+
* title: Cancel Action Schema
14+
* version: 2023-10-31
15+
*/
16+
17+
import { z } from '@kbn/zod';
18+
19+
import {
20+
ResponseActionCreateSuccessResponse,
21+
BaseActionSchema,
22+
} from '../../../model/schema/common.gen';
23+
24+
export type CancelRouteRequestBody = z.infer<typeof CancelRouteRequestBody>;
25+
export const CancelRouteRequestBody = BaseActionSchema.merge(
26+
z.object({
27+
parameters: z.object({
28+
/**
29+
* ID of the response action to cancel
30+
*/
31+
id: z.string().min(1),
32+
}),
33+
})
34+
);
35+
36+
export type CancelActionRequestBody = z.infer<typeof CancelActionRequestBody>;
37+
export const CancelActionRequestBody = CancelRouteRequestBody;
38+
export type CancelActionRequestBodyInput = z.input<typeof CancelActionRequestBody>;
39+
40+
export type CancelActionResponse = z.infer<typeof CancelActionResponse>;
41+
export const CancelActionResponse = ResponseActionCreateSuccessResponse;

‎x-pack/solutions/security/plugins/security_solution/common/api/endpoint/actions/response_actions/cancel/cancel.schema.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
openapi: 3.0.0
2+
info:
3+
title: Cancel Action Schema
4+
version: '2023-10-31'
5+
description: Schema for canceling response actions
6+
paths:
7+
/api/endpoint/action/cancel:
8+
post:
9+
summary: Cancel a response action
10+
operationId: CancelAction
11+
description: Cancel a running or pending response action (Applies only to some agent types).
12+
x-codegen-enabled: true
13+
x-labels: [ess, serverless]
14+
requestBody:
15+
required: true
16+
content:
17+
application/json:
18+
schema:
19+
$ref: '#/components/schemas/CancelRouteRequestBody'
20+
examples:
21+
MicrosoftDefenderEndpoint:
22+
summary: Cancel a response action on a Microsoft Defender for Endpoint host
23+
value:
24+
endpoint_ids:
25+
- 'ed518850-681a-4d60-bb98-e22640cae2a8'
26+
agent_type: 'microsoft_defender_endpoint'
27+
parameters:
28+
id: '7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d'
29+
comment: 'Cancelling action due to change in requirements'
30+
responses:
31+
'200':
32+
description: Successfully cancelled the response action
33+
content:
34+
application/json:
35+
schema:
36+
$ref: '../../../model/schema/common.schema.yaml#/components/schemas/ResponseActionCreateSuccessResponse'
37+
components:
38+
schemas:
39+
CancelRouteRequestBody:
40+
allOf:
41+
- $ref: '../../../model/schema/common.schema.yaml#/components/schemas/BaseActionSchema'
42+
- type: object
43+
required:
44+
- parameters
45+
properties:
46+
parameters:
47+
required:
48+
- id
49+
type: object
50+
properties:
51+
id:
52+
type: string
53+
minLength: 1
54+
description: ID of the response action to cancel
55+
example: '7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d'

‎x-pack/solutions/security/plugins/security_solution/common/api/endpoint/actions/response_actions/cancel/cancel.ts‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License
4+
* 2.0; you may not use this file except in compliance with the Elastic License
5+
* 2.0.
6+
*/
7+
8+
import type { TypeOf } from '@kbn/config-schema';
9+
import { schema } from '@kbn/config-schema';
10+
import { BaseActionRequestSchema } from '../../common/base';
11+
12+
const CancelActionRequestBodySchema = schema.object({
13+
...BaseActionRequestSchema,
14+
parameters: schema.object({
15+
id: schema.string({
16+
minLength: 1,
17+
validate: (value) => {
18+
if (!value.trim().length) {
19+
return 'id cannot be an empty string';
20+
}
21+
},
22+
}),
23+
}),
24+
});
25+
26+
export const CancelActionRequestSchema = {
27+
body: CancelActionRequestBodySchema,
28+
};
29+
30+
export type CancelActionRequestBody = TypeOf<typeof CancelActionRequestSchema.body>;

‎x-pack/solutions/security/plugins/security_solution/common/api/endpoint/actions/response_actions/cancel/index.ts‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
/*
2+
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
3+
* or more contributor license agreements. Licensed under the Elastic License
4+
* 2.0; you may not use this file except in compliance with the Elastic License
5+
* 2.0.
6+
*/
7+
8+
export * from './cancel';

‎x-pack/solutions/security/plugins/security_solution/common/api/endpoint/index.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ export * from './actions/response_actions/execute';
2525
export * from './actions/response_actions/upload';
2626
export * from './actions/response_actions/scan';
2727
export * from './actions/response_actions/run_script';
28+
export * from './actions/response_actions/cancel';
2829

2930
export * from './metadata';
3031

‎x-pack/solutions/security/plugins/security_solution/common/api/quickstart_client.gen.ts‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,10 @@ import type {
126126
EndpointGetActionsListRequestQueryInput,
127127
EndpointGetActionsListResponse,
128128
} from './endpoint/actions/list/list.gen';
129+
import type {
130+
CancelActionRequestBodyInput,
131+
CancelActionResponse,
132+
} from './endpoint/actions/response_actions/cancel/cancel.gen';
129133
import type {
130134
EndpointExecuteActionRequestBodyInput,
131135
EndpointExecuteActionResponse,
@@ -574,6 +578,22 @@ If asset criticality records already exist for the specified entities, those rec
574578
})
575579
.catch(catchAxiosErrorFormatAndThrow);
576580
}
581+
/**
582+
* Cancel a running or pending response action (Applies only to some agent types).
583+
*/
584+
async cancelAction(props: CancelActionProps) {
585+
this.log.info(`${new Date().toISOString()} Calling API CancelAction`);
586+
return this.kbnClient
587+
.request<CancelActionResponse>({
588+
path: '/api/endpoint/action/cancel',
589+
headers: {
590+
[ELASTIC_HTTP_VERSION_HEADER]: '2023-10-31',
591+
},
592+
method: 'POST',
593+
body: props.body,
594+
})
595+
.catch(catchAxiosErrorFormatAndThrow);
596+
}
577597
/**
578598
* Create a clean draft Timeline or Timeline template for the current user.
579599
> info
@@ -3113,6 +3133,9 @@ export interface AlertsMigrationCleanupProps {
31133133
export interface BulkUpsertAssetCriticalityRecordsProps {
31143134
body: BulkUpsertAssetCriticalityRecordsRequestBodyInput;
31153135
}
3136+
export interface CancelActionProps {
3137+
body: CancelActionRequestBodyInput;
3138+
}
31163139
export interface CleanDraftTimelinesProps {
31173140
body: CleanDraftTimelinesRequestBodyInput;
31183141
}

‎x-pack/solutions/security/plugins/security_solution/common/endpoint/constants.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,7 @@ export const EXECUTE_ROUTE = `${BASE_ENDPOINT_ACTION_ROUTE}/execute`;
9898
export const UPLOAD_ROUTE = `${BASE_ENDPOINT_ACTION_ROUTE}/upload`;
9999
export const SCAN_ROUTE = `${BASE_ENDPOINT_ACTION_ROUTE}/scan`;
100100
export const RUN_SCRIPT_ROUTE = `${BASE_ENDPOINT_ACTION_ROUTE}/run_script`;
101+
export const CANCEL_ROUTE = `${BASE_ENDPOINT_ACTION_ROUTE}/cancel`;
101102
export const CUSTOM_SCRIPTS_ROUTE = `${BASE_INTERNAL_ENDPOINT_ACTION_ROUTE}/custom_scripts`;
102103

103104
/** Endpoint Actions Routes */

0 commit comments

Comments
 (0)