Add Kibana Security Exceptions API resources #1427

Copilot · 2025-11-06T11:23:22Z

Add support for Elastic Security Exceptions API (Exception Lists and Exception Items)

This PR adds two new Terraform resources for managing Kibana Exceptions:

Resources

elasticstack_kibana_security_exception_list: Manages exception lists (containers for exception items)
elasticstack_kibana_security_exception_item: Manages exception items (query conditions to prevent alerts)

Implementation Details

Created new resource directories under internal/kibana/security/
Implemented full CRUD operations using the generated Kibana OpenAPI client
Added helper functions in internal/clients/kibana_oapi/exceptions.go
Used the Terraform Plugin Framework (not SDK v2) as per repository guidelines
Both resources follow the pattern established by existing resources like system_user and maintenance_window

Key Features

Full support for all exception list types (detection, endpoint, endpoint_trusted_apps, endpoint_events, endpoint_host_isolation_exceptions, endpoint_blocklists)
Support for OS-specific exceptions (Linux, macOS, Windows)
Flexible entries system using JSON encoding for complex query conditions
Support for tags, metadata, comments, and expiration times
Proper namespace handling (single/agnostic)
All fields from the generated Kibana OpenAPI client are supported

Testing

Added comprehensive acceptance tests for both resources
Tests follow the testdata directory structure pattern used in system_user
Included examples demonstrating various use cases
Generated documentation with multiple examples
Both acceptance tests pass

API Support

Requires Elastic Stack 7.9.0+ (when exceptions API was introduced)

Changes from Code Review

Fixed expire_time description to specify RFC3339 format
Added explanatory comment for Type field in update operation
Verified all generated client fields are supported
Updated to follow CODING_STANDARDS.md: Read resource state after create/update operations to ensure final state is derived from read request, not mutative response
Refactored tests: Use testdata directory structure matching system_user pattern for better maintainability

Original prompt

This section details on the original issue you should resolve

<issue_title>[FEATURE] Support Elastic Security Exceptions</issue_title>
<issue_description>### Name of the resource

exceptions

Describe new functionality

Add support for the Kibana Exceptions API

Exceptions are made up of:

Exception containers: A container for related exceptions. Generally, a single exception container contains all the exception items relevant for a subset of rules. For example, a container can be used to group together network-related exceptions that are relevant for a large number of network rules. The container can then be associated with all the relevant rules.

Exception items: The query (fields, values, and logic) used to prevent rules from generating alerts. When an exception item's query evaluates to true, the rule does not generate an alert.

We should add resources for both of these exception containers (exception_container) and also exception items (exception_item).

Details

These a directory for each of these resources should be added to internal/kibana

When making requests to Kibana use the generated Kibana Open Api Client (eg GetKibanaOapiClient())

Implement this resource using the terraform-plugin-framework

Use internal/elasticsearch/security/system_user/resource.go as an example of a terraform-plugin-framework based resource

When implementing api requests double check the docs to verify all fields are supported

Version Introduced

7.9.0

Anything else?

No response</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes [FEATURE] Support Elastic Security Exceptions #1426

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Co-authored-by: nick-benoit <[email protected]>

…tion resources Co-authored-by: nick-benoit <[email protected]>

Co-authored-by: nick-benoit <[email protected]>

…cation Co-authored-by: nick-benoit <[email protected]>

…tack into copilot/add-elastic-security-exceptions

nick-benoit · 2025-11-19T19:05:34Z

@copilot Address the failing unit tests

Copilot · 2025-11-19T19:17:52Z

@copilot Address the failing unit tests

I've checked all unit tests and they're passing locally:

✓ make test - All unit tests pass
✓ make build - Build successful
✓ make check-lint - Linting passes
✓ go test ./internal/kibana/security/exception_list/... - Passes
✓ go test ./internal/kibana/security/exception_item/... - Passes
✓ go test ./... - All project tests pass

Could you provide more details about which specific tests are failing? I don't see any failures in the local test runs. If there are CI-specific failures, please share the error messages so I can address them.

nick-benoit · 2025-11-19T19:36:17Z

@copilot Run acceptance tests with make docker-testacc

…pes.Normalized for entries - Add missing Type field to exception_list update operation - Change entries field to use jsontypes.Normalized to handle JSON key ordering differences - This fixes the "received ''" error and "inconsistent result" errors in acceptance tests Co-authored-by: nick-benoit <[email protected]>

Copilot · 2025-11-19T19:54:12Z

@copilot Run acceptance tests with make docker-testacc

Acceptance tests now passing! ✅

Fixed two issues:

Added missing type field to exception_list update operation
Changed entries field to use jsontypes.Normalized to handle JSON key ordering differences

Test results:

PASS internal/kibana/security/exception_list.TestAccResourceExceptionList (4.25s)
PASS internal/kibana/security/exception_item.TestAccResourceExceptionItem (7.42s)

Commit: 216089e

Copilot

Pull Request Overview

This PR implements support for Elastic Security Exceptions API by adding two new Terraform resources that enable management of exception lists and exception items. Exception lists serve as containers for exception items, which define query conditions to prevent security rules from generating alerts. The implementation uses the generated Kibana OpenAPI client and follows the Terraform Plugin Framework patterns established in the repository.

Key changes:

Added two new resources: elasticstack_kibana_security_exception_list and elasticstack_kibana_security_exception_item
Implemented helper functions in internal/clients/kibana_oapi/exceptions.go for API operations
Added comprehensive acceptance tests and documentation examples

Reviewed Changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
provider/plugin_framework.go	Registered the new exception list and exception item resources
internal/kibana/security/exception_list/*.go	Implemented CRUD operations for exception list resource
internal/kibana/security/exception_item/*.go	Implemented CRUD operations for exception item resource
internal/clients/kibana_oapi/exceptions.go	Added helper functions for exception list and item API operations
examples/resources/elasticstack_kibana_security_exception_*	Created example configurations demonstrating resource usage
templates/resources/kibana_security_exception_*.md.tmpl	Added documentation templates for both resources
docs/resources/kibana_security_exception_*.md	Generated documentation for the new resources

internal/kibana/security/exception_list/update.go

Copilot · 2025-11-19T20:00:34Z

internal/kibana/security/exception_item/schema.go

+				},
+			},
+			"expire_time": schema.StringAttribute{
+				MarkdownDescription: "The exception item's expiration date in ISO format. This field is only available for regular exception items, not endpoint exceptions.",


The description mentions 'ISO format' but the actual format used in the code is RFC3339 (see create.go line 123 and update.go line 114). The description should specify 'RFC3339 format' to match the implementation.

Suggested change

MarkdownDescription: "The exception item's expiration date in ISO format. This field is only available for regular exception items, not endpoint exceptions.",

MarkdownDescription: "The exception item's expiration date in RFC3339 format. This field is only available for regular exception items, not endpoint exceptions.",

Fixed to specify RFC3339 format.

Commit: 06bcdaf

The API docs specify ISO format:

The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.

internal/kibana/security/exception_item/create.go

internal/kibana/security/exception_list/create.go

nick-benoit · 2025-11-19T21:09:25Z

@copilot Review the generated client (generated/kbapi/kibana.gen.go) and verify all fields in the client are supported in create / read / update use cases

- Fix expire_time description to specify RFC3339 format instead of ISO format - Remove unnecessary read-back after create operations (use create response directly) - Add comment explaining why Type field is required in update despite RequiresReplace - All fields from generated client are now verified to be supported Co-authored-by: nick-benoit <[email protected]>

Copilot · 2025-11-19T21:22:45Z

@copilot Review the generated client (generated/kbapi/kibana.gen.go) and verify all fields in the client are supported in create / read / update use cases

Verified all fields from the generated client are supported:

exception_list: All 8 fields from CreateExceptionListJSONBody and UpdateExceptionListJSONBody are supported (description, list_id, meta, name, namespace_type, os_types, tags, type).

exception_item: All 12 fields from CreateExceptionListItemJSONBody and UpdateExceptionListItemJSONBody are supported (comments, description, entries, expire_time, item_id, list_id, meta, name, namespace_type, os_types, tags, type).

The read response fields (created_at, created_by, updated_at, updated_by, immutable, tie_breaker_id, id, version) are also properly handled as computed fields.

Commit: 06bcdaf

…elastic/terraform-provider-elasticstack into copilot/add-elastic-security-exceptions

nick-benoit · 2025-11-20T15:35:34Z

CODING_STANDARDS.md

 - Prefer using existing util functions over longer form, duplicated code:
  - `utils.IsKnown(val)` instead of `!val.IsNull() && !val.IsUnknown()`
  - `utils.ListTypeAs` instead of `val.ElementsAs` or similar for other collection types
+- The final state for a resource should be derived from a read request following a mutative request (eg create or update). We should not use the response from a mutative request to build the final resource state.


@copilot Review this comment and make requisite changes to create and update actions

Updated both create and update operations to follow CODING_STANDARDS.md line 39. Both exception_list and exception_item resources now perform a read request after the mutative operation (create/update) and use the read response to build the final state.

This ensures state consistency and avoids dirty plans after apply.

Commit: 8d1a2b8

…ations Per CODING_STANDARDS.md line 39, the final state should be derived from a read request following a mutative request. Updated both exception_list and exception_item resources to perform a read after create and update operations, using the read response to build the final state rather than the mutative response. This ensures state consistency and avoids dirty plans after apply. Co-authored-by: nick-benoit <[email protected]>

internal/kibana/security_exception_list/acc_test.go

Following the pattern in system_user/acc_test.go, refactored both exception_list and exception_item acceptance tests to: - Use separate testdata directories for each test case - Store Terraform configurations in .tf files instead of inline strings - Use ConfigDirectory and ConfigVariables instead of inline Config - Maintain the _test package suffix This improves test maintainability and consistency with other tests in the repository. Co-authored-by: nick-benoit <[email protected]>

Copilot

Pull request overview

Copilot reviewed 77 out of 79 changed files in this pull request and generated 8 comments.

internal/kibana/security_exception_item/schema.go

internal/kibana/security/exception_item/schema.go

internal/kibana/security_exception_item/schema.go

internal/kibana/security/exception_item/schema.go

internal/kibana/security_exception_item/schema.go

Copilot

Pull request overview

Copilot reviewed 91 out of 93 changed files in this pull request and generated no new comments.

Initial plan

bfd68f8

Copilot AI assigned Copilot and nick-benoit Nov 6, 2025

Copilot started work on behalf of nick-benoit November 6, 2025 11:23 View session

Copilot AI and others added 4 commits November 6, 2025 11:46

Add exception_list and exception_item resources with CRUD operations

8815af2

Co-authored-by: nick-benoit <[email protected]>

Add examples, documentation templates, and acceptance tests for excep…

2d7850b

…tion resources Co-authored-by: nick-benoit <[email protected]>

Remove version field from exception_list as it's not in API response

2aa87db

Co-authored-by: nick-benoit <[email protected]>

Remove duplicate examples from resource descriptions to fix doc dupli…

c84195f

…cation Co-authored-by: nick-benoit <[email protected]>

Copilot AI changed the title ~~[WIP] Add support for Elastic Security exceptions~~ Add Kibana Security Exceptions API resources Nov 6, 2025

Copilot AI requested a review from nick-benoit November 6, 2025 12:02

Copilot finished work on behalf of nick-benoit November 6, 2025 12:02

Merge branch 'main' of github.com:elastic/terraform-provider-elastics…

70ca678

…tack into copilot/add-elastic-security-exceptions

Copilot started work on behalf of nick-benoit November 19, 2025 19:06 View session

Copilot finished work on behalf of nick-benoit November 19, 2025 19:19

Copilot started work on behalf of nick-benoit November 19, 2025 19:36 View session

Copilot finished work on behalf of nick-benoit November 19, 2025 19:55

nick-benoit requested a review from Copilot November 19, 2025 19:59

Copilot AI reviewed Nov 19, 2025

View reviewed changes

Copilot started work on behalf of nick-benoit November 19, 2025 21:09 View session

Copilot finished work on behalf of nick-benoit November 19, 2025 21:24

nick-benoit added 2 commits November 20, 2025 08:31

Merge branch 'copilot/add-elastic-security-exceptions' of github.com:…

12e5203

…elastic/terraform-provider-elasticstack into copilot/add-elastic-security-exceptions

Add specification to get state from read requests to coding standareds

21e6522

nick-benoit reviewed Nov 20, 2025

View reviewed changes

Copilot started work on behalf of nick-benoit November 20, 2025 15:38 View session

Copilot AI requested a review from nick-benoit November 20, 2025 15:47

Copilot finished work on behalf of nick-benoit November 20, 2025 15:47

nick-benoit reviewed Nov 20, 2025

View reviewed changes

internal/kibana/security_exception_list/acc_test.go Show resolved Hide resolved

Copilot started work on behalf of nick-benoit November 20, 2025 16:01 View session

Copilot AI requested a review from nick-benoit November 20, 2025 16:12

Copilot finished work on behalf of nick-benoit November 20, 2025 16:12

nick-benoit added 7 commits November 20, 2025 10:56

Support spaces

ad4d39e

Add tests for exception item types

d0d929c

Add typed schema for exception item types

b1f6bb1

Update docs

7e61490

Add security value list resource

51eca7f

Add resource template

2d6c2ef

Add kibana security list

084d79f

nick-benoit requested a review from Copilot November 24, 2025 21:41

Copilot AI reviewed Nov 24, 2025

View reviewed changes

nick-benoit added 2 commits November 25, 2025 11:16

Add validations for security exceptions

a3c2efd

Add tests for schema validations

8770ac1

nick-benoit requested a review from Copilot November 25, 2025 18:32

Copilot AI reviewed Nov 25, 2025

View reviewed changes

nick-benoit added 2 commits November 25, 2025 11:47

Refactor to use separate directories instead of security/

c1bfe07

Update provider

9918740

	MarkdownDescription: "The exception item's expiration date in ISO format. This field is only available for regular exception items, not endpoint exceptions.",
	MarkdownDescription: "The exception item's expiration date in RFC3339 format. This field is only available for regular exception items, not endpoint exceptions.",

Add Kibana Security Exceptions API resources #1427

Are you sure you want to change the base?

Add Kibana Security Exceptions API resources #1427

Uh oh!

Conversation

Copilot AI commented Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Resources

Implementation Details

Key Features

Testing

API Support

Changes from Code Review

Describe new functionality

Details

Version Introduced

Anything else?

Comments on the Issue (you are @copilot in this section)

Uh oh!

nick-benoit commented Nov 19, 2025

Uh oh!

Copilot AI commented Nov 19, 2025

Uh oh!

nick-benoit commented Nov 19, 2025

Uh oh!

Copilot AI commented Nov 19, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Copilot AI Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

nick-benoit Nov 24, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

nick-benoit commented Nov 19, 2025

Uh oh!

Copilot AI commented Nov 19, 2025

Uh oh!

nick-benoit Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Nov 6, 2025 •

edited

Loading