[SECURITY_SOLUTION][ENDPOINT] Create Trusted Apps API changes to process user input

[paul-tavares]

Summary

When creating a new trusted app entry, the API will now process the user input data and perform the following:

• trim values for Trusted App name, as well as condition's (both path and hash) value
• For a hash condition - ensure its value stored in lowercase
• Ensure that when storing the new trusted app entry, an appropriate hash field (md5, sha1 or sha256) is used based on the value entered

As a result of the above changes, the GET Trusted Apps List API was also updated to ensure that entries for hash have their field name adjusted back to process.hash.*

A change was also made to the process.path condition field to use process.path.text as the name, which will cause the Endpoint artifact to be generated with "type:: "exact_caseless"

Example of a generated Window Artifact:

{
  "entries": [
    {
      "type": "simple",
      "entries": [
        {
          "field": "process.path",
          "operator": "included",
          "type": "exact_caseless",
          "value": "c:\\program files\\program1\\something.exe"
        }
      ]
    },
    {
      "type": "simple",
      "entries": [
        {
          "field": "process.hash.sha256",
          "operator": "included",
          "type": "exact_cased",
          "value": "a4370c0cf81686c0b696fa6261c9d3e0d810ae704ab8301839dffd5d5112f476"
        }
      ]
    },
    {
      "type": "simple",
      "entries": [
        {
          "field": "process.hash.sha1",
          "operator": "included",
          "type": "exact_cased",
          "value": "aedb279e378bed6c2db3c9dc9e12ba635e0b391c"
        }
      ]
    },
    {
      "type": "simple",
      "entries": [
        {
          "field": "process.hash.md5",
          "operator": "included",
          "type": "exact_cased",
          "value": "741462ab431a22233c787baab9b653c7"
        }
      ]
    }
  ]
}

Checklist

• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

Pinging @elastic/endpoint-management (Team:Endpoint Management)

[elasticmachine]

Pinging @elastic/endpoint-app-team (Feature:Endpoint)

[kevinlog]

What's the error here?

[paul-tavares]

@kevinlog ,
It has to do with the fact that entries in Trusted Apps is an Array of different types base on the outer value for os and in order to get around it, we would have to do (needless) runtime castings using type guards. In this instance, i think it's ok to ignore it, but open to suggestions.

Error is:

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 1fc7f8e

Build metrics

async chunks size

id	value	diff	baseline
securitySolution	10.1MB	+10.0B	10.1MB

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[parkiino]

what does this syntax mean?

[paul-tavares]

It makes the object "own keys" mutable (you can mutate them). Its short of writing a Mutable<> generic interface (to undo what our Immutable<> generic does :)