[Security Solution][Endpoint] Don't create event filters list from ma…

…nifest manager (#102618) (#102964)

* Check if endpoint event filters list exists before create and create it without specific id

* Removes creation of endpoint event filters list in manifest manager

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Co-authored-by: David Sánchez <davidsansol92@gmail.com>

x-pack/plugins/lists/server/services/exception_lists/exception_list_client.ts

@@ -54,7 +54,6 @@ import {
 } from './find_exception_list_items';
 import { createEndpointList } from './create_endpoint_list';
 import { createEndpointTrustedAppsList } from './create_endpoint_trusted_apps_list';
-import { createEndpointEventFiltersList } from './create_endoint_event_filters_list';
 
 export class ExceptionListClient {
   private readonly user: string;
@@ -120,18 +119,6 @@ export class ExceptionListClient {
     });
   };
 
-  /**
-   * Create the Endpoint Event Filters Agnostic list if it does not yet exist (`null` is returned if it does exist)
-   */
-  public createEndpointEventFiltersList = async (): Promise<ExceptionListSchema | null> => {
-    const { savedObjectsClient, user } = this;
-    return createEndpointEventFiltersList({
-      savedObjectsClient,
-      user,
-      version: 1,
-    });
-  };
-
   /**
    * This is the same as "createListItem" except it applies specifically to the agnostic endpoint list and will
    * auto-call the "createEndpointList" for you so that you have the best chance of the agnostic endpoint

x-pack/plugins/security_solution/server/endpoint/lib/artifacts/lists.ts

@@ -140,8 +140,6 @@ export async function getEndpointEventFiltersList(
     policyId ? ` or exception-list-agnostic.attributes.tags:\"policy:${policyId}\"` : ''
   })`;
 
-  await eClient.createEndpointEventFiltersList();
-
   return getFilteredEndpointExceptionList(
     eClient,
     schemaVersion,