[Security Solution]Memory protection configuration card for policies integration.

x-pack/plugins/fleet/server/saved_objects/index.ts

@@ -43,6 +43,7 @@ import {
   migrateOutputToV7130,
 } from './migrations/to_v7_13_0';
 import { migratePackagePolicyToV7140 } from './migrations/to_v7_14_0';
+import { migratePackagePolicyToV7150 } from './migrations/to_v7_15_0';
 
 /*
  * Saved object types and mappings
@@ -272,6 +273,7 @@ const getSavedObjectTypes = (
       '7.12.0': migratePackagePolicyToV7120,
       '7.13.0': migratePackagePolicyToV7130,
       '7.14.0': migratePackagePolicyToV7140,
+      '7.15.0': migratePackagePolicyToV7150,
     },
   },
   [PACKAGES_SAVED_OBJECT_TYPE]: {

x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/index.ts

@@ -9,3 +9,4 @@ export { migratePackagePolicyToV7110 } from './to_v7_11_0';
 export { migratePackagePolicyToV7120 } from './to_v7_12_0';
 export { migrateEndpointPackagePolicyToV7130 } from './to_v7_13_0';
 export { migrateEndpointPackagePolicyToV7140 } from './to_v7_14_0';
+export { migratePackagePolicyToV7150 } from './to_v7_15_0';

x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_15_0.test.ts

@@ -0,0 +1,174 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { SavedObjectMigrationContext, SavedObjectUnsanitizedDoc } from 'kibana/server';
+
+import type { PackagePolicy } from '../../../../common';
+
+import { migratePackagePolicyToV7150 as migration } from './to_v7_15_0';
+
+describe('7.15.0 Endpoint Package Policy migration', () => {
+  const policyDoc = ({
+    windowsMemory = {},
+    windowsPopup = {},
+    windowsMalware = {},
+    windowsRansomware = {},
+  }) => {
+    return {
+      id: 'mock-saved-object-id',
+      attributes: {
+        name: 'Some Policy Name',
+        package: {
+          name: 'endpoint',
+          title: '',
+          version: '',
+        },
+        id: 'endpoint',
+        policy_id: '',
+        enabled: true,
+        namespace: '',
+        output_id: '',
+        revision: 0,
+        updated_at: '',
+        updated_by: '',
+        created_at: '',
+        created_by: '',
+        inputs: [
+          {
+            type: 'endpoint',
+            enabled: true,
+            streams: [],
+            config: {
+              policy: {
+                value: {
+                  windows: {
+                    ...windowsMalware,
+                    ...windowsRansomware,
+                    ...windowsMemory,
+                    ...windowsPopup,
+                  },
+                },
+              },
+            },
+          },
+        ],
+      },
+      type: ' nested',
+    };
+  };
+
+  it('adds windows memory protection alongside malware and ramsomware', () => {
+    const initialDoc = policyDoc({
+      windowsMalware: { malware: { mode: 'off' } },
+      windowsRansomware: { ransomware: { mode: 'off', supported: true } },
+      windowsPopup: {
+        popup: {
+          malware: {
+            message: '',
+            enabled: true,
+          },
+          ransomware: {
+            message: '',
+            enabled: true,
+          },
+        },
+      },
+    });
+
+    const migratedDoc = policyDoc({
+      windowsMalware: { malware: { mode: 'off' } },
+      windowsRansomware: { ransomware: { mode: 'off', supported: true } },
+      // new memory protection
+      windowsMemory: { memory_protection: { mode: 'off', supported: true } },
+      windowsPopup: {
+        popup: {
+          malware: {
+            message: '',
+            enabled: true,
+          },
+          ransomware: {
+            message: '',
+            enabled: true,
+          },
+          // new memory popup setup
+          memory_protection: {
+            message: '',
+            enabled: false,
+          },
+        },
+      },
+    });
+
+    expect(migration(initialDoc, {} as SavedObjectMigrationContext)).toEqual(migratedDoc);
+  });
+
+  it('does not modify non-endpoint package policies', () => {
+    const doc: SavedObjectUnsanitizedDoc<PackagePolicy> = {
+      id: 'mock-saved-object-id',
+      attributes: {
+        name: 'Some Policy Name',
+        package: {
+          name: 'notEndpoint',
+          title: '',
+          version: '',
+        },
+        id: 'notEndpoint',
+        policy_id: '',
+        enabled: true,
+        namespace: '',
+        output_id: '',
+        revision: 0,
+        updated_at: '',
+        updated_by: '',
+        created_at: '',
+        created_by: '',
+        inputs: [
+          {
+            type: 'notEndpoint',
+            enabled: true,
+            streams: [],
+            config: {},
+          },
+        ],
+      },
+      type: ' nested',
+    };
+
+    expect(
+      migration(doc, {} as SavedObjectMigrationContext) as SavedObjectUnsanitizedDoc<PackagePolicy>
+    ).toEqual({
+      attributes: {
+        name: 'Some Policy Name',
+        package: {
+          name: 'notEndpoint',
+          title: '',
+          version: '',
+        },
+        id: 'notEndpoint',
+        policy_id: '',
+        enabled: true,
+        namespace: '',
+        output_id: '',
+        revision: 0,
+        updated_at: '',
+        updated_by: '',
+        created_at: '',
+        created_by: '',
+        inputs: [
+          {
+            type: 'notEndpoint',
+            enabled: true,
+            streams: [],
+            config: {},
+          },
+        ],
+      },
+      type: ' nested',
+      id: 'mock-saved-object-id',
+    });
+  });
+});

x-pack/plugins/fleet/server/saved_objects/migrations/security_solution/to_v7_15_0.ts

@@ -0,0 +1,40 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { SavedObjectMigrationFn, SavedObjectUnsanitizedDoc } from 'kibana/server';
+import { cloneDeep } from 'lodash';
+
+import type { PackagePolicy } from '../../../../common';
+
+export const migratePackagePolicyToV7150: SavedObjectMigrationFn<PackagePolicy, PackagePolicy> = (
+  packagePolicyDoc
+) => {
+  const updatedPackagePolicyDoc: SavedObjectUnsanitizedDoc<PackagePolicy> = cloneDeep(
+    packagePolicyDoc
+  );
+  if (packagePolicyDoc.attributes.package?.name === 'endpoint') {
+    const input = updatedPackagePolicyDoc.attributes.inputs[0];
+    const memory = {
+      mode: 'off',
+      // This value is based on license.
+      // For the migration, we add 'true', our license watcher will correct it, if needed, when the app starts.
+      supported: true,
+    };
+    const memoryPopup = {
+      message: '',
+      enabled: false,
+    };
+    if (input && input.config) {
+      const policy = input.config.policy.value;
+
+      policy.windows.memory_protection = memory;
+      policy.windows.popup.memory_protection = memoryPopup;
+    }
+  }
+
+  return updatedPackagePolicyDoc;
+};

x-pack/plugins/fleet/server/saved_objects/migrations/to_v7_15_0.ts

@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { SavedObjectMigrationFn } from 'kibana/server';
+
+import type { PackagePolicy } from '../../../common';
+
+import { migratePackagePolicyToV7150 as SecSolMigratePackagePolicyToV7150 } from './security_solution';
+
+export const migratePackagePolicyToV7150: SavedObjectMigrationFn<PackagePolicy, PackagePolicy> = (
+  packagePolicyDoc,
+  migrationContext
+) => {
+  let updatedPackagePolicyDoc = packagePolicyDoc;
+
+  // Endpoint specific migrations
+  if (packagePolicyDoc.attributes.package?.name === 'endpoint') {
+    updatedPackagePolicyDoc = SecSolMigratePackagePolicyToV7150(packagePolicyDoc, migrationContext);
+  }
+
+  return updatedPackagePolicyDoc;
+};

x-pack/plugins/security_solution/common/endpoint/models/policy_config.ts

@@ -29,6 +29,10 @@ export const policyFactory = (): PolicyConfig => {
         mode: ProtectionModes.prevent,
         supported: true,
       },
+      memory_protection: {
+        mode: ProtectionModes.prevent,
+        supported: true,
+      },
       popup: {
         malware: {
           message: '',
@@ -38,6 +42,10 @@ export const policyFactory = (): PolicyConfig => {
           message: '',
           enabled: true,
         },
+        memory_protection: {
+          message: '',
+          enabled: true,
+        },
       },
       logging: {
         file: 'info',
@@ -101,6 +109,10 @@ export const policyFactoryWithoutPaidFeatures = (
         mode: ProtectionModes.off,
         supported: false,
       },
+      memory_protection: {
+        mode: ProtectionModes.off,
+        supported: false,
+      },
       popup: {
         ...policy.windows.popup,
         malware: {
@@ -111,6 +123,10 @@ export const policyFactoryWithoutPaidFeatures = (
           message: '',
           enabled: false,
         },
+        memory_protection: {
+          message: '',
+          enabled: false,
+        },
       },
     },
     mac: {
@@ -150,11 +166,15 @@ export const policyFactoryWithSupportedFeatures = (
         ...policy.windows.ransomware,
         supported: true,
       },
+      memory_protection: {
+        ...policy.windows.memory_protection,
+        supported: true,
+      },
     },
   };
 };
 
 /**
  * Reflects what string the Endpoint will use when message field is default/empty
  */
-export const DefaultMalwareMessage = 'Elastic Security {action} {filename}';
+export const DefaultPolicyNotificationMessage = 'Elastic Security {action} {filename}';

x-pack/plugins/security_solution/common/endpoint/types/index.ts

@@ -844,6 +844,7 @@ export interface PolicyConfig {
       security: boolean;
     };
     malware: ProtectionFields;
+    memory_protection: ProtectionFields & SupportedFields;
     ransomware: ProtectionFields & SupportedFields;
     logging: {
       file: string;
@@ -857,6 +858,10 @@ export interface PolicyConfig {
         message: string;
         enabled: boolean;
       };
+      memory_protection: {
+        message: string;
+        enabled: boolean;
+      };
     };
     antivirus_registration: {
       enabled: boolean;
@@ -909,7 +914,13 @@ export interface UIPolicyConfig {
    */
   windows: Pick<
     PolicyConfig['windows'],
-    'events' | 'malware' | 'ransomware' | 'popup' | 'antivirus_registration' | 'advanced'
+    | 'events'
+    | 'malware'
+    | 'ransomware'
+    | 'popup'
+    | 'antivirus_registration'
+    | 'advanced'
+    | 'memory_protection'
   >;
   /**
    * Mac-specific policy configuration that is supported via the UI