search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.73k stars 8.14k forks source link

Kibana allows adding host isolation exception for fleet that contains endpoints that does not support host isolation exceptions #116633

Open bit-envoy opened 2 years ago

bit-envoy commented 2 years ago

Kibana version: v 7.16.0

Original install method (e.g. download page, yum, from source, etc.): I was using Kibana from staging.found.no

Describe the bug: It is not exactly bug but behavior which can confuse user, so at least warning would be welcomed. You can add host isolation exceptions for a fleet which consists of all endpoints that does not support host isolation exceptions (all agents with version below v7.16.0).

Steps to reproduce: Install v7.15.1 (or lower) endpoint, enable Endpoint Security, Elastic Agent policies, add host isolation exception.

Expected behavior: I would expect warning if in fleet there are agents that do not support host isolation exceptions and user tries to add host isolation exception.

kevinlog commented 2 years ago

@caitlinbetz fyi - should we mention somewhere in the UI for Host Isolation Exceptions that it's only supported for 7.16?

The feature is global and we can't stop it from rolling out, but we could give a heads up in the UI apart from the documentation itself.

bit-envoy commented 2 years ago

My proposition is when user clicks to isolate a host that does not support host isolation exceptions, and there are exceptions added - show warning that these exceptions won't be applied.

kevinlog commented 2 years ago

@bit-envoy

My proposition is when user clicks to isolate a host that does not support host isolation exceptions, and there are exceptions added - show warning that these exceptions won't be applied.

That's a good idea. I don't think we could do it for 7.16, we may have to opt for a simpler callout on the main page, but we can consider this style of callouts for later releases.

elasticmachine commented 2 years ago

Pinging @elastic/security-solution (Team: SecuritySolution)