[backend] feat(executors): adapt Tanium and improve all executors - chunk 2 (#3515) #4491

damgouj · 2025-12-03T15:22:48Z

Proposed changes

Adapt Tanium code as the other executors
Improve executors code with tests and for better performance

Testing Instructions

Tanium: nothing has changed, just try to enable Tanium and see if the endpoints are registered, if you can launch an attack and if the garbage collector works well
Crowdstrike: same
SentinelOne: same
Review doc here please: Add documentation on SentinelOne executor docs#231

Related issues

Closes [EE] Executor SentinelOne #3515
Closes Adapt Tanium executor like Crowdstrike #3127

Checklist

I consider the submitted work as finished
I tested the code for its functionality
I wrote test cases for the relevant uses case
I added/update the relevant documentation (either on github or on notion)
Where necessary I refactored code to improve the overall quality
For bug fix -> I implemented a test that covers the bug

codecov · 2025-12-03T15:36:13Z

Codecov Report

❌ Patch coverage is 58.22368% with 127 lines in your changes missing coverage. Please review.
✅ Project coverage is 50.84%. Comparing base (04e2e56) to head (87d6eba).

Files with missing lines	Patch %	Lines
.../executors/tanium/client/TaniumExecutorClient.java	0.00%	50 Missing ⚠️
...s/tanium/service/TaniumExecutorContextService.java	75.00%	15 Missing and 1 partial ⚠️
...ke/service/CrowdStrikeGarbageCollectorService.java	62.96%	7 Missing and 3 partials ⚠️
...ne/service/SentinelOneGarbageCollectorService.java	61.53%	7 Missing and 3 partials ⚠️
...io/openaev/execution/ExecutionExecutorService.java	52.63%	8 Missing and 1 partial ⚠️
.../tanium/service/TaniumGarbageCollectorService.java	65.38%	7 Missing and 2 partials ⚠️
.../crowdstrike/client/CrowdStrikeExecutorClient.java	0.00%	5 Missing ⚠️
...openaev/executors/exception/ExecutorException.java	0.00%	4 Missing ⚠️
...xecutors/tanium/service/TaniumExecutorService.java	88.88%	1 Missing and 2 partials ⚠️
...utors/crowdstrike/CrowdStrikeGarbageCollector.java	0.00%	2 Missing ⚠️
... and 6 more

Additional details and impacted files

@@                  Coverage Diff                  @@
##             release/current    #4491      +/-   ##
=====================================================
+ Coverage              50.39%   50.84%   +0.45%     
- Complexity              3721     3752      +31     
=====================================================
  Files                    912      913       +1     
  Lines                  27301    27371      +70     
  Branches                2046     2057      +11     
=====================================================
+ Hits                   13758    13917     +159     
+ Misses                 12707    12606     -101     
- Partials                 836      848      +12

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Dimfacion · 2025-12-04T13:23:51Z

...rc/main/java/io/openaev/executors/crowdstrike/service/CrowdStrikeExecutorContextService.java

              + UUID.randomUUID()
              + "\";md $location -ea 0;[Environment]::CurrentDirectory";
-      Endpoint.PLATFORM_TYPE platform = Endpoint.PLATFORM_TYPE.Windows;
+      Endpoint.PLATFORM_TYPE platform = Windows;


nitpick : Happy to discuss about it as it's clearly a nitpicky nitpick but I feel it's easier to read when you write PLATFORM_TYPE.Windows. It makes it clearer that it's an enum.

Dimfacion · 2025-12-04T13:26:25Z

openaev-api/src/main/java/io/openaev/executors/sentinelone/SentinelOneGarbageCollector.java

-      this.taskScheduler.scheduleAtFixedRate(service, Duration.ofHours(6));
+          new SentinelOneGarbageCollectorService(
+              this.config, this.sentinelOneExecutorContextService, this.agentService);
+      this.taskScheduler.scheduleAtFixedRate(service, Duration.ofHours(8));


Suggestion : Maybe we should make the rate configurable in the properties

Dimfacion · 2025-12-04T13:45:33Z

openaev-api/src/main/java/io/openaev/executors/tanium/TaniumGarbageCollector.java

-      this.taskScheduler.scheduleAtFixedRate(service, Duration.ofHours(6));
+          new TaniumGarbageCollectorService(
+              this.config, this.taniumExecutorContextService, this.agentService);
+      this.taskScheduler.scheduleAtFixedRate(service, Duration.ofHours(8));


Suggestion : Maybe we should make the rate configurable in the properties

Dimfacion · 2025-12-04T13:45:48Z

openaev-api/src/main/java/io/openaev/executors/crowdstrike/CrowdStrikeGarbageCollector.java

-      this.taskScheduler.scheduleAtFixedRate(service, Duration.ofHours(6));
+          new CrowdStrikeGarbageCollectorService(
+              this.config, this.crowdStrikeExecutorContextService, this.agentService);
+      this.taskScheduler.scheduleAtFixedRate(service, Duration.ofHours(8));


Suggestion : Maybe we should make the rate configurable in the properties

Dimfacion · 2025-12-04T13:46:56Z

openaev-api/src/main/java/io/openaev/executors/tanium/client/TaniumExecutorClient.java

+                                  }
+                                }
+                              }
+                              """,


nitpick : Maybe this should be a final class member

Dimfacion · 2025-12-04T13:51:07Z

openaev-api/src/main/java/io/openaev/executors/tanium/client/TaniumExecutorClient.java

+    try {
+      String query =
+          String.format(
+              """


Suggestion : Maybe use a final class member

Dimfacion · 2025-12-04T13:52:56Z

openaev-api/src/main/java/io/openaev/executors/tanium/service/TaniumExecutorContextService.java


    if (!this.taniumExecutorConfig.isEnable()) {
-      throw new AgentException("Fatal error: Tanium executor is not enabled", agent);
+      throw new RuntimeException("Fatal error: Tanium executor is not enabled");


chore : We should move away from using generic RuntimeException and create more specific exceptions. Maybe an ExecutorException ?

Dimfacion · 2025-12-04T13:56:20Z

...i/src/test/java/io/openaev/executors/crowdstrike/service/CrowdstrikeExecutorServiceTest.java

    crowdStrikeExecutorContextService.launchBatchExecutorSubprocess(
        inject, new HashSet<>(agents), injectStatus);
+    // Executor scheduled so we have to wait before the execution
+    Thread.sleep(1000);


Suggestion : Maybe a lib like Awaitibility would be better ? With Thread.sleep, you're blocking the whole thread for no real reasons

Dimfacion · 2025-12-04T13:56:38Z

...i/src/test/java/io/openaev/executors/sentinelone/service/SentinelOneExecutorServiceTest.java

    sentinelOneExecutorContextService.launchBatchExecutorSubprocess(
        inject, new HashSet<>(agents), injectStatus);
+    // Executor scheduled so we have to wait before the execution
+    Thread.sleep(1000);


Suggestion : Maybe a lib like Awaitibility would be better ? With Thread.sleep, you're blocking the whole thread for no real reasons

Dimfacion · 2025-12-04T13:57:13Z

openaev-api/src/test/java/io/openaev/executors/tanium/service/TaniumExecutorServiceTest.java

+    taniumExecutorContextService.launchBatchExecutorSubprocess(
+        inject, new HashSet<>(agents), injectStatus);
+    // Executor scheduled so we have to wait before the execution
+    Thread.sleep(1000);


Suggestion : Maybe a lib like Awaitibility would be better ? With Thread.sleep, you're blocking the whole thread for no real reasons

damgouj self-assigned this Dec 3, 2025

damgouj added the filigran team use to identify PR from the Filigran team label Dec 3, 2025

This was linked to issues Dec 3, 2025

[EE] Executor SentinelOne #3515

Open

Adapt Tanium executor like Crowdstrike #3127

Open

damgouj marked this pull request as ready for review December 3, 2025 16:27

Dimfacion requested changes Dec 4, 2025

View reviewed changes

damgouj added 10 commits December 5, 2025 11:58

[backend] Tanium register endpoints

c1a71bd

[backend] Tanium execute actions

5baef71

[backend] Tanium execute actions batch

5be0af2

[backend] Improve API execute actions for each executor

0e3b203

[backend] Fix tests

c9b9573

[backend] Improve garbage collectors

4aa4161

[backend] Duration

f6e63ee

[backend] Fix tests

f74d6ce

[backend] Refactor

33ac763

[backend] Gael comments

969eb2e

damgouj force-pushed the issue/3515_chunk2 branch from a115640 to 969eb2e Compare December 5, 2025 10:58

damgouj added 5 commits December 5, 2025 12:07

[backend] Gael comments

6dd364a

[backend] Gael comments

340ab91

[backend] Fix tests

133544b

[backend] Fix tests

d2406b7

[backend] Fix tests

87d6eba

damgouj requested a review from Dimfacion December 5, 2025 14:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[backend] feat(executors): adapt Tanium and improve all executors - chunk 2 (#3515) #4491

[backend] feat(executors): adapt Tanium and improve all executors - chunk 2 (#3515) #4491

Uh oh!

damgouj commented Dec 3, 2025

Uh oh!

codecov bot commented Dec 3, 2025 •

edited

Loading

Uh oh!

Dimfacion Dec 4, 2025

Uh oh!

Dimfacion Dec 4, 2025

Uh oh!

Dimfacion Dec 4, 2025

Uh oh!

Dimfacion Dec 4, 2025

Uh oh!

Dimfacion Dec 4, 2025

Uh oh!

Dimfacion Dec 4, 2025

Uh oh!

Dimfacion Dec 4, 2025

Uh oh!

Dimfacion Dec 4, 2025

Uh oh!

Dimfacion Dec 4, 2025

Uh oh!

Dimfacion Dec 4, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

[backend] feat(executors): adapt Tanium and improve all executors - chunk 2 (#3515) #4491

Are you sure you want to change the base?

[backend] feat(executors): adapt Tanium and improve all executors - chunk 2 (#3515) #4491

Uh oh!

Conversation

damgouj commented Dec 3, 2025

Proposed changes

Testing Instructions

Related issues

Checklist

Uh oh!

codecov bot commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov bot commented Dec 3, 2025 •

edited

Loading