[Serverless][Security Solution] Unfriendly error message when creating an invalid exception

[MadameSheema]

Describe the bug:

• Unfriendly error message when creating an invalid exception

Kibana/Elasticsearch Stack version:

• Serverless production

Steps to reproduce:

1. Navigate to Rules > Shared exceptions lists
2. Create an exception list
3. Add a rule exception to it
4. Fill the Exception name
5. Add the Conditions
6. Add a long comment
7. Click on Add rule exception

Current behavior:

• It is not clear why the creation of the exception failed.

Expected behavior:

• The error message should be more descriptive about what is happening. I.E: The Comments field has exceeded the supported lenthg
  OR
• Before clicking the Add rule exception some sort of validation should be performed letting the user know in advanced if the information entered is correct or not.

Additional information:

• The same behaviour happens when instead of a creation an edition is performed.
• This issue was found during the testing spike, the same behavior it might happen on ESS.

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[e40pud]

After discussion with @yctercero we decided to fix the issue by limiting the length of the comment to 30K characters. We took same approach as used in Cases. User will not be allowed to create/edit exception with the comment longer than 30K and validation error will be shown.

[e40pud]

@MadameSheema this bug was fixed and merged into the main branch. Ready to be tested!

[yctercero]

@MadameSheema @e40pud maybe we should start confirming fixes and such on main and serverless production?

[e40pud]

@yctercero good idea, will make sure that QA we test changes before they go into the main!

[cybersecdiva]

Tested in Serverless Production Enviorment

Serverless Project:

Project: keep_security-solutions-testing

Preconditions:

• Alerts generated in Serverless Project

Describe the bug:

Unfriendly message when creating an exception in Serveless

Steps to reproduce:

1. In Serverless Project Navigate to Security --> Alerts
2. Select an alert and right click for actions and Add rule exception or Add endpoint exception if it is an Endpoint alert
3. Fill in necessary fields (exception rule name, comment field: (enter a long comment) )
4. In the comment section, enter a long comment (this can be accomplished by entering a few words and copy and paste repetitively)
5. Save exception
6. Observe if error message is displayed

Current behavior

Error message is not displayed when creating an exception with a long character length in comments

Expected behavior:

Error message is not displayed when creating an exception with a long character length in comments

Observations:

I have tested in the Serverless Environment in Project and there is no error message that currently displays when creating either a rule or endpoint exception for a comment with a long character length

Screenshots of behavior:

Screenshot of exception with the long character comment:

Conclusion:

• Tested and behavior is fixed QA validated ✅ fixed in Serverless Environment with no errors

• @MadameSheema and @e40pud FYI Updated Observations closing marking as QA Validated ✅ cross reference for Detection Engine Project Board for QA Check ✅

[MadameSheema]

@cybersecdiva thanks for taking a look at the issue, but the validation performed was incorrect, so with the description provided during the testing process, we cannot assure that the bug has been correctly fixed and the fix is already available in the QA environment.

As described, the issue was originally reported because the text of the displayed error was not user-friendly, not because an error was displayed. If you check the expected behavior, we are expecting an error message to be displayed.

I'll reopen the ticket because the fix is still pending to be validated.

[e40pud]

@MadameSheema to fix this issue we prevented user from adding comments longer than 30k characters. This will assure that we do not see the error message like shown in the description. Instead we gonna see the validation error during typing the comment like shown here #168213 (comment)

[cybersecdiva]

@MadameSheema Thank you for the update and for the clarification. I see now that I misread based on the error handling message. I have retested (with over 33k+ characters) this and it aligns with @e40pud 's comment - the number of 30k character limitation validation error that shows up.
As demonstrated here:

[vgomez-el]

I can assess that the bug is fixed as @e40pud has described on his comment:

@MadameSheema to fix this issue we prevented user from adding comments longer than 30k characters. This will assure that we do not see the error message like shown in the description. Instead we gonna see the validation error during typing the comment like shown here #168213 (comment)

@cybersecdiva Is also right on her second validation:

@MadameSheema Thank you for the update and for the clarification. I see now that I misread based on the error handling message. I have retested (with over 33k+ characters) this and it aligns with @e40pud 's comment - the number of 30k character limitation validation error that shows up. As demonstrated here:

User now cannot create more than 30K character length comments, and it prevents the issue to happen:

REC-20240125122044.mp4

I will close this issue and consider it validated on 8.12 version.