Skip to content

[Ingest Manager] Provide the ability to register a callback for creation and/or editing of Endpoint Datasources #68698

@paul-tavares

Description

@paul-tavares

Describe the feature:
The Endpoint security functionality need to be able to intercept and possibly manipulate the Endpoint Datasource at creation and/or editing time.

Describe a specific use case for the feature:
Endpoint requires that some additional custom data be provided along with the Policy configuration that are specific to the Endpoint executable. This data is not user controlled and is generated at runtime in kibana, thus it can not be included in the endpoint package definition. The Datasource is currently used to include and deliver the Endpoint Policy data and we would like to use that same delivery mechanism and include/inject this data into it.

Automated Test Cases on the Ingest Side To Be Documented:

  • Validate when create api handler and external callbacks are registered that it should call external callbacks in expected order
  • Validate when create api handler and external callbacks are registered that it should feed datasource returned by last callback
  • Validate when create api handler and external callbacks are registered that it should create with data from callback
  • Validate when create api handler and external callbacks are registered and it throws an exception error that it should skip over callback exceptions and still execute other callbacks
  • Validate when create api handler and external callbacks are registered and it throws an exception error that it should log errors
  • Validate when create api handler and external callbacks are registered and it throws an exception error that it should create datasource with last successful returned datasource

Test Case:

  • Validate when a policy is created the policy information is included in the response from the Package Config API (C15633 - manual)

Metadata

Metadata

Labels

Feature:EndpointElastic Endpoint featureTeam:Defend Workflows“EDR Workflows” sub-team of Security SolutionTeam:Endpoint ResponseEndpoint Response TeamTeam:FleetTeam label for Observability Data Collection Fleet team

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions