[EDR Workflows] The host isolation exception tab is available inconsistently on the basic license

[muskangulati-qasource]

Description:
The host isolation exception tab is available inconsistently on the basic license

Build Details:

VERSION: 8.15.1
BUILD: 76516
COMMIT: 1796ec02f5523bff4e449c368a3fea574d44455a

Preconditions:

1. Kibana user should be logged in
2. Downgrade the license to Basic

Steps to Reproduce:

1. Deploy one agent with Defend integration
2. Navigate to the Endpoints tab
3. Observe the host isolation exception is available inside the policy navigation but not available on the main explore navigation

Actual Result:
The host isolation exception tab is available inconsistently on the basic license

Expected Result:
The host isolation exception tab should be removed from the policy navigation when on basic license

Screenshot

Login credentials
https://p.elstc.co/paste/lgCOM6+O#5ytxelNtUrTWIMheFNPPmReoyr5baV0-LU0oDa9PuOg

Logs
N/A

AC

•  Gate HIE tab for license lower than Platinum when no HIE records are present.

[elasticmachine]

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

[muskangulati-qasource]

@sukhwindersingh-qasource please review !

[sukhwindersingh-qasource]

Secondary review for this ticket is done!

[dasansol92]

Hi @muskangulati-qasource , were already any entries present on the system before doing the downgrade?

[muskangulati-qasource]

Hi @dasansol92,

were already any entries present on the system before doing the downgrade?

No David, there were no entries created for host isolation exception.

Just to add, if we add any entry before downgrading, the expected results are correctly shown on UI. 🟢
The entry is shown and the actions are shown to delete the existing entry.

Thank you

[szwarckonrad]

We are able to recreate it locally.
Observations:

1. Left navbar correctly filters out Host Isolation Exceptions on Gold license.
2. http://localhost:5601/app/security/manage doesn't include HIE card
   
3. We do show HIE tab in policy detail view.
   
4. route http://localhost:5601/app/security/manage is properly gated
   

Proposed A.C:

1. Gate HIE tab for license lower than Platinum when no HIE records are present.

Notes:
Same behaviour on ESS and Serverless (Serverless with these changes - #191954, without them HIE is not available on Essentials with neither existing HIE and empty HIE list.)

We can probably use/copy this check https://github.com/elastic/kibana/blob/main/x-pack/plugins/security_solution/public/management/links.ts#L246 and extend this check https://github.com/elastic/kibana/blob/main/x-pack/plugins/security_solution/public/management/pages/policy/view/tabs/policy_tabs.tsx#L301