From dbf61ef297817526235672b71a7c65d0e6984747 Mon Sep 17 00:00:00 2001
From: Ashokaditya <1849116+ashokaditya@users.noreply.github.com>
Date: Tue, 16 Nov 2021 12:01:15 +0100
Subject: [PATCH] [Security Solution][Endpoint] Consistent pending actions
 agent status label (#117875)

* pull more than default 10 records!!

refs elastic/kibana/pull/115691

Co-Authored-By: Ashokaditya <1849116+ashokaditya@users.noreply.github.com>

* commit using ashokaditya@elastic.co

* show correct isolation status badge when pending actions data is updated

fixes elastic/security-team/issues/2105

Co-Authored-By: Ashokaditya <1849116+ashokaditya@users.noreply.github.com>

* fix typo

Co-Authored-By: Ashokaditya <1849116+ashokaditya@users.noreply.github.com>

* remove redundant dependencies

review changes

Co-Authored-By: Ashokaditya <1849116+ashokaditya@users.noreply.github.com>

* show `isolated` right after pending state is refreshed

fixes elastic/security-team/issues/2105

Co-Authored-By: Ashokaditya <1849116+ashokaditya@users.noreply.github.com>

* recompute only on prop change

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
---
 .../endpoint_host_isolation_status.tsx        | 48 +++++++++++--------
 .../server/endpoint/services/actions.ts       |  1 +
 2 files changed, 30 insertions(+), 19 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/common/components/endpoint/host_isolation/endpoint_host_isolation_status.tsx b/x-pack/plugins/security_solution/public/common/components/endpoint/host_isolation/endpoint_host_isolation_status.tsx
index 6795557f17f1a3..ad86b0f3622347 100644
--- a/x-pack/plugins/security_solution/public/common/components/endpoint/host_isolation/endpoint_host_isolation_status.tsx
+++ b/x-pack/plugins/security_solution/public/common/components/endpoint/host_isolation/endpoint_host_isolation_status.tsx
@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import React, { memo, useMemo } from 'react';
+import React, { memo, useMemo, useRef, useEffect } from 'react';
 import { EuiBadge, EuiFlexGroup, EuiFlexItem, EuiTextColor, EuiToolTip } from '@elastic/eui';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { useTestIdGenerator } from '../../../../management/components/hooks/use_test_id_generator';
@@ -28,12 +28,20 @@ export interface EndpointHostIsolationStatusProps {
 export const EndpointHostIsolationStatus = memo<EndpointHostIsolationStatusProps>(
   ({ isIsolated, pendingIsolate = 0, pendingUnIsolate = 0, 'data-test-subj': dataTestSubj }) => {
     const getTestId = useTestIdGenerator(dataTestSubj);
-    const isPendingStatuseDisabled = useIsExperimentalFeatureEnabled(
+    const isPendingStatusDisabled = useIsExperimentalFeatureEnabled(
       'disableIsolationUIPendingStatuses'
     );
 
+    const wasReleasing = useRef<boolean>(false);
+    const wasIsolating = useRef<boolean>(false);
+
+    useEffect(() => {
+      wasReleasing.current = pendingIsolate === 0 && pendingUnIsolate > 0;
+      wasIsolating.current = pendingIsolate > 0 && pendingUnIsolate === 0;
+    }, [pendingIsolate, pendingUnIsolate]);
+
     return useMemo(() => {
-      if (isPendingStatuseDisabled) {
+      if (isPendingStatusDisabled) {
         // If nothing is pending and host is not currently isolated, then render nothing
         if (!isIsolated) {
           return null;
@@ -49,21 +57,23 @@ export const EndpointHostIsolationStatus = memo<EndpointHostIsolationStatusProps
         );
       }
 
-      // If nothing is pending and host is not currently isolated, then render nothing
-      if (!isIsolated && !pendingIsolate && !pendingUnIsolate) {
-        return null;
-      }
-
-      // If nothing is pending, but host is isolated, then show isolation badge
-      if (!pendingIsolate && !pendingUnIsolate) {
-        return (
-          <EuiBadge color="hollow" data-test-subj={dataTestSubj}>
-            <FormattedMessage
-              id="xpack.securitySolution.endpoint.hostIsolationStatus.isolated"
-              defaultMessage="Isolated"
-            />
-          </EuiBadge>
-        );
+      // If nothing is pending
+      if (!(pendingIsolate || pendingUnIsolate)) {
+        // and host is either releasing and or currently released, then render nothing
+        if ((!wasIsolating.current && wasReleasing.current) || !isIsolated) {
+          return null;
+        }
+        // else host was isolating or is isolated, then show isolation badge
+        else if ((!isIsolated && wasIsolating.current && !wasReleasing.current) || isIsolated) {
+          return (
+            <EuiBadge color="hollow" data-test-subj={dataTestSubj}>
+              <FormattedMessage
+                id="xpack.securitySolution.endpoint.hostIsolationStatus.isolated"
+                defaultMessage="Isolated"
+              />
+            </EuiBadge>
+          );
+        }
       }
 
       // If there are multiple types of pending isolation actions, then show count of actions with tooltip that displays breakdown
@@ -136,7 +146,7 @@ export const EndpointHostIsolationStatus = memo<EndpointHostIsolationStatusProps
       dataTestSubj,
       getTestId,
       isIsolated,
-      isPendingStatuseDisabled,
+      isPendingStatusDisabled,
       pendingIsolate,
       pendingUnIsolate,
     ]);
diff --git a/x-pack/plugins/security_solution/server/endpoint/services/actions.ts b/x-pack/plugins/security_solution/server/endpoint/services/actions.ts
index 4dbfd700496f5e..fb9348d3f05bcb 100644
--- a/x-pack/plugins/security_solution/server/endpoint/services/actions.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/actions.ts
@@ -294,6 +294,7 @@ const hasEndpointResponseDoc = async ({
     .search<LogsEndpointActionResponse>(
       {
         index: ENDPOINT_ACTION_RESPONSES_INDEX,
+        size: 10000,
         body: {
           query: {
             bool: {