[EDR Workflows] Add Cancel response action to MDE #230399

tomsonpl · 2025-08-04T12:09:34Z

Summary

This PR introduces cancel action capabilities for Microsoft Defender Endpoint response actions in Kibana's Security Solution. Previously, there was no mechanism to cancel long-running or stuck response actions, creating operational challenges for security analysts managing Microsoft Defender Endpoint hosts.

Problem Statement

Security analysts working with Microsoft Defender Endpoint needed the ability to cancel pending or long-running response actions that may be stuck or no longer needed. Without this capability, they had to wait for actions to timeout or complete naturally, potentially impacting incident response times.

Solution

Core Authorization System

Implemented a dynamic, context-aware authorization system for cancel operations that evaluates permissions based on:

Base security solution access
Agent type compatibility (currently Microsoft Defender Endpoint only)
User's permission for the original command being cancelled
Feature flag enablement

Key Files:

common/endpoint/service/authz/cancel_authz_utils.ts - Authorization utility functions
- isCancelFeatureAvailable() - Checks if cancel is available for agent type
- canUserCancelCommand() - Validates command-specific permissions
- checkCancelPermission() - Complete permission check combining all factors

API Layer

Request Schema & Validation:

common/api/endpoint/actions/response_actions/cancel/cancel.ts - Request schema with action_id validation
common/api/endpoint/actions/response_actions/cancel/cancel.schema.yaml - OpenAPI specification

Route Implementation:

server/endpoint/routes/actions/response_actions.ts - Cancel route handler that:
1. Uses standard withEndpointAuthz middleware for base permissions
2. Fetches original action details to determine command type and agent type
3. Applies dynamic permission validation using authorization utilities
4. Delegates to existing response action execution framework

UI Components

Console Integration:

public/management/components/endpoint_responder/command_render_components/cancel_action.tsx
- React component for executing cancel operations from response console
- Uses established console action submitter patterns

Pending Actions Selector:

public/management/components/console_argument_selectors/pending_actions_selector/
- UI component for selecting pending actions to cancel
- Implements permission-based filtering showing only cancelable actions
- Provides clear error messages when actions aren't cancelable

API Communication:

public/management/hooks/response_actions/use_send_cancel_request.ts
- React Query-based hook for cancel API requests
- Follows established mutation patterns

Feature Flag

Added microsoftDefenderEndpointCancelEnabled experimental feature flag to:

Control availability of cancel functionality
Enable gradual rollout and testing
Located in common/experimental_features.ts

Technical Approach

Permission Model

The implementation uses a dynamic, context-aware authorization model rather than static permissions:

// Permission check combines multiple factors:
const canCancel = checkCancelPermission(
  endpointAuthz,           // User's current permissions
  experimentalFeatures,    // Feature flag status
  agentType,              // Agent type support
  command                 // Original command permission
);

Integration Pattern

The solution integrates seamlessly with existing patterns:

Extends BaseActionRequestSchema for consistency
Uses standard withEndpointAuthz middleware
Leverages existing response action execution framework
Follows established UI component patterns

Testing

Comprehensive test coverage added:

common/endpoint/service/authz/cancel_authz_utils.test.ts - Authorization logic tests
server/endpoint/routes/actions/response_actions.test.ts - Route handler tests
public/management/components/endpoint_responder/command_render_components/integration_tests/cancel_action.test.tsx - UI integration tests
public/management/components/console_argument_selectors/pending_actions_selector/pending_actions_selector.test.tsx - Selector component tests

Key Changes

Modified Files:

Authorization: Added canCancelResponseActions: false to EndpointAuthz interface for framework consistency
Constants: Added CANCEL_ROUTE constant to endpoint route definitions
Console Commands: Integrated cancel command into Microsoft Defender Endpoint console
Response Actions List: Added cancel action support to action history display

New Files:

Authorization utilities for cancel permission logic
Cancel action API schemas and route handlers
UI components for cancel functionality
React hooks for API communication
Comprehensive test files

Impact & Limitations

Benefits:

✅ Security analysts can now cancel stuck or unnecessary Microsoft Defender Endpoint actions
✅ Dynamic permission system ensures proper authorization
✅ Intuitive UI for selecting and cancelling pending actions
✅ Proper API documentation and validation
✅ Follows established architectural patterns

Current Limitations:

Cancel operations currently supported only for Microsoft Defender Endpoint agents

Closes: https://github.com/elastic/security-team/issues/13443
Closes: https://github.com/elastic/security-team/issues/13444
Closes: https://github.com/elastic/security-team/issues/13445
Closes: https://github.com/elastic/security-team/issues/13464
Closes: https://github.com/elastic/security-team/issues/13766

tomsonpl · 2025-08-06T11:44:21Z

/ci

# Conflicts: # x-pack/solutions/security/plugins/security_solution/public/management/components/console_argument_selectors/custom_scripts_selector/custom_script_selector.tsx # x-pack/solutions/security/plugins/security_solution/public/management/components/endpoint_responder/lib/console_commands_definition.ts # x-pack/solutions/security/plugins/security_solution/server/endpoint/services/actions/clients/lib/types.ts

tomsonpl · 2025-08-27T09:47:05Z

/ci

…no-cache --fix'

tomsonpl · 2025-08-27T20:09:21Z

/ci

tomsonpl · 2025-08-28T10:13:05Z

/ci

tomsonpl · 2025-08-28T12:23:27Z

/ci

…el-action

tomsonpl · 2025-09-17T10:42:00Z

@paul-tavares Thanks for the feedback! I applied some changes to the picker's option, and fixed the tooltip. a69afe1

However, regarding

❌ When selecting a previously entered (and successful) cancel command from the Console's input history, the script picker shows the UUID of the action, but the picker does not show it as a selectable option (because it was already completed and no longer pending).

I am not sure what else we should do here — to me handling this scenario differently would be an overkill. Users still can try to call this action, but the picker is not supposed to reflect that, it shows only currently pending actions.
What would you expect to happen in this case?

…no-cache --fix'

…el-action # Conflicts: # x-pack/solutions/security/plugins/security_solution/public/management/components/endpoint_responder/command_render_components/integration_tests/cancel_action.test.tsx

ashokaditya

Thanks for the changes in here and patience with continuing with more change requests. I tested it locally and found some issues that I'll list here. I could review backend code so far and would do another round of review for the frontend code shortly.

Cancel action is available even if there was no action taken or pending. I think it should be disabled when there is no action to cancel. See error shown at the start state when no action has ever been taken.

I see considerable lag between action taken and it showing up on the cancel action dropdown list, and sometimes the action completes before the cancel action can be taken. See screenshot.

Is another user supposed to be able to cancel a cancel action taken by another user? I think not. This should be restricted to the user who took the original action. I see potential issues with allowing cross-user cancel action for a cancel action.
Cancelled cancel actions show up as "successful" actions in the action history, instead of failed like we show for cancelled response actions. This should be consistent. So if we are allowing cancelling cancel action then all cancelled actions should show as failed.

Note: My test clips are bigger than 10 mb for attaching here so I'll send them to you offline

ashokaditya · 2025-09-16T07:49:45Z

x-pack/solutions/security/plugins/security_solution/server/endpoint/routes/actions/state.ts

 ) {
  const responseActionAuthzNames = uniq(
-    Object.values(RESPONSE_CONSOLE_ACTION_COMMANDS_TO_REQUIRED_AUTHZ)
+    Object.values(RESPONSE_CONSOLE_ACTION_COMMANDS_TO_REQUIRED_AUTHZ) as Array<keyof EndpointAuthz>


This is a redundant cast. TS correctly infers the type of responseActionAuthzNames.

ashokaditya · 2025-09-16T10:21:16Z

x-pack/solutions/security/plugins/security_solution/server/endpoint/routes/actions/utils.ts

+  const legacyResponseData = responseActionsWithLegacyActionProperty.includes(command)
+    ? {
+        action: actionId ?? data.id ?? '',
+      }
+    : {};


Do we want to continue using the deprecated action?

For now I'd say let's keep it, and if we decide to remove this code - let's do it in a separate PR. Is that ok?

ashokaditya · 2025-09-16T10:32:36Z

...solutions/security/plugins/security_solution/server/endpoint/services/actions/utils/utils.ts

  error?: EcsError;
  /** Host info that might have been stored along with the Action Request (ex. 3rd party EDR actions) */
  hosts: ActionDetails['hosts'];
+  /** Additional metadata that might be stored with the action (ex. 3rd party EDR action IDs) */


I don't see this meta being used anywhere. Do we need this?

ashokaditya · 2025-09-16T15:35:15Z

...k/solutions/security/plugins/security_solution/server/endpoint/routes/with_endpoint_authz.ts

    if (additionalChecks) {
      try {
-        await additionalChecks(context, request);
+        await additionalChecks(context, request, logger);


Yes agree. I think best to not make a change to this file at all, when endpointContext can be used for logger. I think this is an unnecessary change here.

ashokaditya · 2025-09-16T15:36:53Z

x-pack/solutions/security/plugins/security_solution/server/endpoint/routes/actions/utils.ts

+  ): Promise<void> => {
+    const { parameters } = request.body as CancelActionRequestBody;
+    const actionId = parameters.id;
+


You can create the logger here like so, const logger = endpointContext.logFactory.get('cancelActionAdditionalChecks'); here instead of passing a logger in the param of this anonymous async function.

ashokaditya · 2025-09-17T13:01:10Z

...tions/security/plugins/security_solution/common/endpoint/service/authz/cancel_authz_utils.ts

+  }
+
+  // Check if Microsoft Defender Endpoint cancel feature is enabled
+  if (!featureFlags.microsoftDefenderEndpointCancelEnabled) {


Agree➕ . The condition should be combined for feature flag and MDE agent type

ashokaditya · 2025-09-17T13:17:28Z

...ons/security/plugins/security_solution/common/endpoint/service/response_actions/constants.ts

  'suspend-process': 'canSuspendProcess',
  scan: 'canWriteScanOperations',
  runscript: 'canWriteExecuteOperations',
+  cancel: 'canAccessResponseConsole', // Cancel uses base console permission


So does this mean if you can't access response console you can't access the API? For example if a user created a release action but wants to cancel it (on a platinum license). You won't be able to do this via API with the current privilege tied to Enterprise license. Cancel action should work via API for all allowable response actions in a downgrade scenario. For instance for release action that is available to non-enterprise users.

Changing to a new privilege that does not expect enterprise license 👍 that's a very good catch @ashokaditya , thanks!

ashokaditya · 2025-09-17T13:36:39Z

x-pack/solutions/security/plugins/security_solution/common/endpoint/types/actions.ts


+export interface ResponseActionCancelOutputContent {
+  code: string;
+  actionId: string;


Is this the cancelled action's id or the id for the cancel action? Maybe name it so it's clear. Also where is this used? I don't see it being populated in the response of history API or /api/endpoint/action or /api/endpoint/action/cancel

Removed 👍

ashokaditya · 2025-09-17T13:47:25Z

...tion/server/endpoint/services/actions/clients/crowdstrike/crowdstrike_actions_client.test.ts

            size: 1,
-            _source: ['agent', 'device.id', 'event.created'],
-            sort: [{ 'event.created': 'desc' }],
+            _source: ['agent', 'device.id', '@timestamp'],


I don't think this bug fix should go in this PR!

ashokaditya · 2025-09-17T13:48:26Z

..._solution/server/endpoint/services/actions/clients/crowdstrike/crowdstrike_actions_client.ts

+          _source: ['agent', 'device.id', '@timestamp'],
+          sort: [{ '@timestamp': 'desc' }],


Let's not merge this CS bug fix in this PR

It was merged in another PR, so the change is not included here - but thanks for double checking 👍

…no-cache --fix'

…el-action

tomsonpl · 2025-09-18T08:54:13Z

@ashokaditya Thanks! Good comments, I applied most of them in 3a2d495, fixed the bug where the pending list wasn't refetched too 👍 For the UI discussion we had, I'll create follow up issues so we can make a decision and apply after FF 👍 Big thanks!

…no-cache --fix'

elasticmachine · 2025-09-23T09:55:12Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 83bb54b

Failed CI Steps

FTR Configs #72

Test Failures

[job] [logs] FTR Configs #72 / Dataset Quality Dataset quality handles user privileges User can read logs-* User can monitor some data streams "before all" hook for "shows underprivileged warning when size cannot be accessed for some data streams"

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	8026	8034	+8

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	10.5MB	10.6MB	+11.5KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	97.2KB	97.2KB	+42.0B

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
`securitySolution`	678	684	+6

References to deprecated APIs

id	before	after	diff
`securitySolution`	388	389	+1

Total ESLint disabled count

id	before	after	diff
`securitySolution`	782	788	+6

History

💔 Build #342238 failed d8fd9a2
💔 Build #342168 failed 1737e09
💔 Build #340946 failed 7ddf79a
💔 Build #340876 failed 902ffd7
💔 Build #340786 failed 6b23319
💔 Build #340691 failed 9ec9073

cc @tomsonpl

ashokaditya

Thanks for all the hard work on this, subsequent changes and patience with this @tomsonpl. 🙇🏻 I have not been able to test it again after privilege changes that I thought should be considered and that you promptly added. I'll test it after you merge this and make improvements as we begin to test cancel action.

cancel wip

8b9160f

tomsonpl self-assigned this Aug 4, 2025

tomsonpl added 3 commits August 4, 2025 16:34

cancelled is not an error, fix ts

024e578

fix error messgae

d5fb0b2

feature flag

4fd5a03

tomsonpl added 8 commits August 25, 2025 10:09

Merge branch 'main' into mde-cancel-action

5eb0e99

refactor api to use actionId, add picker

a6c07cb

refactor argument selectors

8e1433c

fix types

0692b0e

changes after merge

5c5483b

remove pending actions endpoint and use lists

85058c4

fix types and mark cancel action as success

326d47b

kibanamachine and others added 3 commits August 27, 2025 10:10

[CI] Auto-commit changed files from 'node scripts/eslint_all_files --…

037f35d

…no-cache --fix'

command privilege check

0693cf3

fix i18n

2bdd440

tomsonpl added 6 commits August 28, 2025 10:44

fix tests

c34e71d

Merge branch 'main' into mde-cancel-action

a87f7e0

rename id to action

bd19683

fix permission check

eeda23f

fix tests

ee82367

add more tests

1a81edf

fix schema

1a37767

kibanamachine added 2 commits August 28, 2025 12:42

[CI] Auto-commit changed files from 'yarn openapi:bundle'

135abff

[CI] Auto-commit changed files from 'yarn openapi:generate'

eb30707

tomsonpl added 2 commits September 17, 2025 12:39

change disabled tooltip

a69afe1

Merge remote-tracking branch 'origin/mde-cancel-action' into mde-canc…

b2c515e

…el-action

kibanamachine and others added 5 commits September 17, 2025 11:00

[CI] Auto-commit changed files from 'yarn openapi:generate'

e2849bd

[CI] Auto-commit changed files from 'node scripts/eslint_all_files --…

70798db

…no-cache --fix'

refactor tests

c29f7af

Merge remote-tracking branch 'origin/mde-cancel-action' into mde-canc…

61a47b4

…el-action # Conflicts: # x-pack/solutions/security/plugins/security_solution/public/management/components/endpoint_responder/command_render_components/integration_tests/cancel_action.test.tsx

fix

151b279

ashokaditya reviewed Sep 17, 2025

View reviewed changes

kibanamachine and others added 4 commits September 17, 2025 14:46

[CI] Auto-commit changed files from 'node scripts/eslint_all_files --…

49a508c

…no-cache --fix'

Merge branch 'main' into mde-cancel-action

76fe0ee

refactored canAccessResponseConsole to canAccessCancelAction

3a2d495

Merge remote-tracking branch 'origin/mde-cancel-action' into mde-canc…

9ec9073

…el-action

tomsonpl and others added 5 commits September 18, 2025 13:00

expect ts error

8008ffd

[CI] Auto-commit changed files from 'node scripts/eslint_all_files --…

6b23319

…no-cache --fix'

Merge branch 'main' into mde-cancel-action

902ffd7

Merge branch 'main' into mde-cancel-action

7ddf79a

Merge branch 'main' into mde-cancel-action

b4a4c10

tomsonpl requested a review from ashokaditya September 19, 2025 10:54

tomsonpl added 4 commits September 22, 2025 13:02

Merge branch 'main' into mde-cancel-action

524dcc4

Merge branch 'main' into mde-cancel-action

1737e09

Merge branch 'main' into mde-cancel-action

d8fd9a2

Merge branch 'main' into mde-cancel-action

83bb54b

ashokaditya approved these changes Sep 23, 2025

View reviewed changes

tomsonpl merged commit ec047c7 into elastic:main Sep 23, 2025
12 checks passed

CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Sep 24, 2025

[EDR Workflows] Add Cancel response action to MDE (elastic#230399)

3b08d8b

niros1 pushed a commit that referenced this pull request Sep 30, 2025

[EDR Workflows] Add Cancel response action to MDE (#230399)

0d8b59e

rylnd pushed a commit to rylnd/kibana that referenced this pull request Oct 17, 2025

[EDR Workflows] Add Cancel response action to MDE (elastic#230399)

5d548b0

		_source: ['agent', 'device.id', '@timestamp'],
		sort: [{ '@timestamp': 'desc' }],

[EDR Workflows] Add Cancel response action to MDE #230399

[EDR Workflows] Add Cancel response action to MDE #230399

Uh oh!

Conversation

tomsonpl commented Aug 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem Statement

Solution

Core Authorization System

API Layer

UI Components

Feature Flag

Technical Approach

Permission Model

Integration Pattern

Testing

Key Changes

Modified Files:

New Files:

Impact & Limitations

Benefits:

Current Limitations:

Uh oh!

tomsonpl commented Aug 6, 2025

Uh oh!

tomsonpl commented Aug 27, 2025

Uh oh!

tomsonpl commented Aug 27, 2025

Uh oh!

tomsonpl commented Aug 28, 2025

Uh oh!

tomsonpl commented Aug 28, 2025

Uh oh!

tomsonpl commented Sep 17, 2025

Uh oh!

ashokaditya left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ashokaditya Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ashokaditya Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tomsonpl commented Sep 18, 2025

Uh oh!

elasticmachine commented Sep 23, 2025

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

Metrics [docs]

Module Count

Async chunks

tomsonpl commented Aug 4, 2025 •

edited

Loading

ashokaditya Sep 17, 2025 •

edited

Loading

ashokaditya Sep 17, 2025 •

edited

Loading