Skip to content

[9.1] [Security Solution][Endpoint] Add server configuration setting for disabling the auto install of endpoint rule on policy create (#246418) #246784

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
paul-tavares wants to merge 2 commits into
base: 9.1
Choose a base branch
from
Open

[9.1] [Security Solution][Endpoint] Add server configuration setting for disabling the auto install of endpoint rule on policy create (#246418) #246784

paul-tavares wants to merge 2 commits into from
+296 −204

Conversation

@paul-tavares
Copy link
Contributor

@paul-tavares paul-tavares commented Dec 17, 2025

@paul-tavares
[Security Solution][Endpoint] Add server configuration setting for di…
065f0d4 
…sabling the auto install of endpoint rule on policy create (elastic#246418)

## Summary

- Add a new server configuration setting:
`disableEndpointRuleAutoInstall`
- When set to `true`, the Elastic Defend SIEM rule will NOT be
auto-installed/enabled when the first Elastic Defend Integration policy
is created
- Default value is `false` - thus backwards compatible: we will continue
to auto-install/enable the Elastic Defend SIEM rule when an Elastic
Defend integration policy is created

(cherry picked from commit 1c974a4)

# Conflicts:
#	x-pack/solutions/security/plugins/security_solution/server/config.mock.ts
#	x-pack/solutions/security/plugins/security_solution/server/endpoint/endpoint_app_context_services.ts
#	x-pack/solutions/security/plugins/security_solution/server/fleet_integration/fleet_integration.test.ts
@paul-tavares paul-tavares added the backport This PR is a backport of another PR label Dec 17, 2025
@paul-tavares paul-tavares enabled auto-merge (squash) December 17, 2025 20:33
@paul-tavares paul-tavares mentioned this pull request Dec 17, 2025
Merged
1 task
@elasticmachine
Copy link
Contributor

elasticmachine commented Dec 17, 2025

⏳ Build in-progress, with failures

Failed CI Steps

Test Failures

  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback Artifacts manifest initialisation default manifest is taken when there is none and there are errors building new one
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback Artifacts manifest initialisation default manifest is taken when there is none and there are errors building new one
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback Artifacts manifest initialisation default manifest is taken when there is none and there are errors commiting manifest
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback Artifacts manifest initialisation default manifest is taken when there is none and there are errors commiting manifest
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback Artifacts manifest initialisation default manifest is taken when there is none and there are errors pushing artifacts
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback Artifacts manifest initialisation default manifest is taken when there is none and there are errors pushing artifacts
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback Artifacts manifest initialisation manifest is created successfuly when there is none
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback Artifacts manifest initialisation manifest is created successfuly when there is none
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback Artifacts manifest initialisation policy is updated with only default entries from manifest
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback Artifacts manifest initialisation policy is updated with only default entries from manifest
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback Artifacts manifest initialisation should correctly set global_telemetry_enabled to false
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback Artifacts manifest initialisation should correctly set global_telemetry_enabled to false
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback Artifacts manifest initialisation should correctly set global_telemetry_enabled to true
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback Artifacts manifest initialisation should correctly set global_telemetry_enabled to true
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback Artifacts manifest initialisation should correctly set meta.billable
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback Artifacts manifest initialisation should correctly set meta.billable
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback SIEM rule install should call utility to install SIEM prebuilt rule
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback SIEM rule install should call utility to install SIEM prebuilt rule
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback SIEM rule install should not call utility to install SIEM prebuilt rule when server config setting is enabled
  • [job] [logs] Jest Tests #10 / Fleet integrations package policy create callback SIEM rule install should not call utility to install SIEM prebuilt rule when server config setting is enabled

History

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pzl pzl pzl approved these changes

@kibanamachine kibanamachine Awaiting requested review from kibanamachine kibanamachine is a code owner

Assignees

No one assigned

Labels

backport This PR is a backport of another PR

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@paul-tavares @elasticmachine @pzl