-
Notifications
You must be signed in to change notification settings - Fork 8.5k
Closed
Labels
Feature:EndpointElastic Endpoint featureElastic Endpoint featureTeam:Defend Workflows“EDR Workflows” sub-team of Security Solution“EDR Workflows” sub-team of Security SolutionTeam:Endpoint ResponseEndpoint Response TeamEndpoint Response TeamTeam:FleetTeam label for Observability Data Collection Fleet teamTeam label for Observability Data Collection Fleet team
Description
Describe the feature:
The Endpoint security functionality need to be able to intercept and possibly manipulate the Endpoint Datasource at creation and/or editing time.
Describe a specific use case for the feature:
Endpoint requires that some additional custom data be provided along with the Policy configuration that are specific to the Endpoint executable. This data is not user controlled and is generated at runtime in kibana, thus it can not be included in the endpoint package definition. The Datasource is currently used to include and deliver the Endpoint Policy data and we would like to use that same delivery mechanism and include/inject this data into it.
Automated Test Cases on the Ingest Side To Be Documented:
- Validate when create api handler and external callbacks are registered that it should call external callbacks in expected order
- Validate when create api handler and external callbacks are registered that it should feed datasource returned by last callback
- Validate when create api handler and external callbacks are registered that it should create with data from callback
- Validate when create api handler and external callbacks are registered and it throws an exception error that it should skip over callback exceptions and still execute other callbacks
- Validate when create api handler and external callbacks are registered and it throws an exception error that it should log errors
- Validate when create api handler and external callbacks are registered and it throws an exception error that it should create datasource with last successful returned datasource
Test Case:
- Validate when a policy is created the policy information is included in the response from the Package Config API (C15633 - manual)
Metadata
Metadata
Assignees
Labels
Feature:EndpointElastic Endpoint featureElastic Endpoint featureTeam:Defend Workflows“EDR Workflows” sub-team of Security Solution“EDR Workflows” sub-team of Security SolutionTeam:Endpoint ResponseEndpoint Response TeamEndpoint Response TeamTeam:FleetTeam label for Observability Data Collection Fleet teamTeam label for Observability Data Collection Fleet team