Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution]ES|QL query tab resetting to discover tab. #168431

Closed
sukhwindersingh-qasource opened this issue Oct 10, 2023 · 12 comments
Closed

[Security Solution]ES|QL query tab resetting to discover tab. #168431

sukhwindersingh-qasource opened this issue Oct 10, 2023 · 12 comments
Assignees
@logeekal @michaelolo24 @MadameSheema
Labels
bug Fixes for quality problems that affect the customer experience fixed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. QA:Validated Issue has been validated by QA Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Investigations Security Solution Investigations Team Team:Threat Hunting Security Solution Threat Hunting Team v8.11.0

Comments

@sukhwindersingh-qasource
Copy link

Describe the bug:
ES|QL tab query reseting to discover.

Kibana/Elasticsearch Stack version
Version:8.11.0-SNAPSHOT
commit:b8dc9b47eabdacfd73dde39196f2311eb83d0240
build:67811

Browser and Browser OS Version:
Firefox for windows OS
Version: 118.0.1

Elastic Endpoint Version:
8.11.0

Original install method:
None

Functional Area:
ES|QL

Initial Setup:

  • Alerts should be present

Steps to reproduce

  • Go to Timeline Page and create one timeline
  • Move to ES|QL tab of timeline
  • Enter the ES|QL query :- " from .alerts-security.alerts-default| limit 100"
  • Select quick date select as 1 year.
  • Save the timeline
  • Now open the timeline and attach it to the Existing case or New case
  • Go to Timeline Page.
  • Open the saved timeline.
  • Observe ES|QL tab query resetting to discover tab

Additional Observation

  • Issue is occuring on chrome browser as well
  • Same behavior can be seen when we save the timeline then duplicate it, and open the saved timeline again.

Current behavior

  • ES|QL query tab resetting to discover tab.

Expected behavior:

  • ES|QL query tab should not reset to discover tab.

Screen-Shot:
image

Create a timeline

Timelines.-.Kibana.Mozilla.Firefox.2023-10-10.12-20-17.mp4

Opened the saved timeline to check it is working correctly

Timelines.-.Kibana.Mozilla.Firefox.2023-10-10.12-18-59.mp4

Opening the timeline After Attaching it to case

Timelines.-.Kibana.Mozilla.Firefox.2023-10-10.13-00-52.mp4

Errors in browser console:

  • None
@sukhwindersingh-qasource sukhwindersingh-qasource added bug Fixes for quality problems that affect the customer experience triage_needed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.11.0 labels Oct 10, 2023
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@sukhwindersingh-qasource
Copy link
Author

@manishgupta-qasource kindly review this

@manishgupta-qasource
Copy link

Reviewed & assigned to @MadameSheema

@michaelolo24
Copy link
Contributor

@sukhwindersingh-qasource - Is this happening after an upgrade with older data or is everything on a fresh instance of 8.11? @jamesspi has seen this behavior as well, but following the steps you outlined, I've been unable to reproduce it

@sukhwindersingh-qasource
Copy link
Author

Hi @michaelolo24
It happened on the fresh 8.11.0 - Snapshot Insatance, we have tried this today on the latest snapshot

VERSION: 8.11.0
BUILD: 67841
COMMIT: 636a8339cfad92998a5a5adb7be81e3546525ebf

We are also not able to reproduce this on the latest snapshot.
But we tried this again on the snapshot build we used yesterday and we are able to reproduce this, Sometimes it get reproduce with these exact steps sometimes not. We are not sure whats causing this behavior we can share the build with you if it is required.

Please find below the testing details

Build Details:
VERSION: 8.11.0
BUILD: 67811
COMMIT: b8dc9b4

Screen Recording:

Elastic.Mozilla.Firefox.2023-10-11.12-41-33.mp4

Please do let us know if anything else is required from our end.
Thanks !

@MadameSheema
Copy link
Member

@sukhwindersingh-qasource may you please share the credentials of the scenario where you can reproduce the issue? Thanks! :)

@MadameSheema MadameSheema added Team:Threat Hunting:Investigations Security Solution Investigations Team Team:Threat Hunting Security Solution Threat Hunting Team labels Oct 11, 2023
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

@logeekal logeekal mentioned this issue Oct 12, 2023
Merged
logeekal added a commit that referenced this issue Oct 13, 2023
@logeekal
[Security Solution] Fixes ES|QL Tab resetting to KQL Bar (#168716)
6fd6966 
## Summary

Handles #168431

This PR fixes a race condition which was causing Discover ES|QL tab to
revert to it KQL query bar. See demo below:

| Before | After |
|---|---|
| <video
src="https://github.com/elastic/kibana/assets/7485038/24ff8ca9-30ce-4581-94d7-52908a2c81fd"
/>|<video
src="https://github.com/elastic/kibana/assets/7485038/746946ad-bd69-412f-bd38-d3d79b570c68"
/>|
@logeekal
Copy link
Contributor

this has been fixed with PR #168716 . Please test it in the next BC

kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Oct 13, 2023
@logeekal
[Security Solution] Fixes ES|QL Tab resetting to KQL Bar (elastic#168716
b3c7807 
)

## Summary

Handles elastic#168431

This PR fixes a race condition which was causing Discover ES|QL tab to
revert to it KQL query bar. See demo below:

| Before | After |
|---|---|
| <video
src="https://github.com/elastic/kibana/assets/7485038/24ff8ca9-30ce-4581-94d7-52908a2c81fd"
/>|<video
src="https://github.com/elastic/kibana/assets/7485038/746946ad-bd69-412f-bd38-d3d79b570c68"
/>|

(cherry picked from commit 6fd6966)
kibanamachine added a commit that referenced this issue Oct 13, 2023
@kibanamachine @logeekal
[8.11] [Security Solution] Fixes ES|QL Tab resetting to KQL Bar (#168716
12a59a2 
) (#168784)

# Backport

This will backport the following commits from `main` to `8.11`:
- [[Security Solution] Fixes ES|QL Tab resetting to KQL Bar
(#168716)](#168716)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Jatin
Kathuria","email":"[email protected]"},"sourceCommit":{"committedDate":"2023-10-13T06:22:06Z","message":"[Security
Solution] Fixes ES|QL Tab resetting to KQL Bar (#168716)\n\n##
Summary\r\n\r\nHandles #168431\r\n\r\nThis PR fixes a race condition
which was causing Discover ES|QL tab to\r\nrevert to it KQL query bar.
See demo below:\r\n\r\n| Before | After |\r\n|---|---|\r\n|
<video\r\nsrc=\"https://github.com/elastic/kibana/assets/7485038/24ff8ca9-30ce-4581-94d7-52908a2c81fd\"\r\n/>|<video\r\nsrc=\"https://github.com/elastic/kibana/assets/7485038/746946ad-bd69-412f-bd38-d3d79b570c68\"\r\n/>|","sha":"6fd6966ed8225935feee247b04b4988424b47c88","branchLabelMapping":{"^v8.12.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Threat
Hunting:Investigations","v8.11.0","v8.12.0"],"number":168716,"url":"https://github.com/elastic/kibana/pull/168716","mergeCommit":{"message":"[Security
Solution] Fixes ES|QL Tab resetting to KQL Bar (#168716)\n\n##
Summary\r\n\r\nHandles #168431\r\n\r\nThis PR fixes a race condition
which was causing Discover ES|QL tab to\r\nrevert to it KQL query bar.
See demo below:\r\n\r\n| Before | After |\r\n|---|---|\r\n|
<video\r\nsrc=\"https://github.com/elastic/kibana/assets/7485038/24ff8ca9-30ce-4581-94d7-52908a2c81fd\"\r\n/>|<video\r\nsrc=\"https://github.com/elastic/kibana/assets/7485038/746946ad-bd69-412f-bd38-d3d79b570c68\"\r\n/>|","sha":"6fd6966ed8225935feee247b04b4988424b47c88"}},"sourceBranch":"main","suggestedTargetBranches":["8.11"],"targetPullRequestStates":[{"branch":"8.11","label":"v8.11.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.12.0","labelRegex":"^v8.12.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/168716","number":168716,"mergeCommit":{"message":"[Security
Solution] Fixes ES|QL Tab resetting to KQL Bar (#168716)\n\n##
Summary\r\n\r\nHandles #168431\r\n\r\nThis PR fixes a race condition
which was causing Discover ES|QL tab to\r\nrevert to it KQL query bar.
See demo below:\r\n\r\n| Before | After |\r\n|---|---|\r\n|
<video\r\nsrc=\"https://github.com/elastic/kibana/assets/7485038/24ff8ca9-30ce-4581-94d7-52908a2c81fd\"\r\n/>|<video\r\nsrc=\"https://github.com/elastic/kibana/assets/7485038/746946ad-bd69-412f-bd38-d3d79b570c68\"\r\n/>|","sha":"6fd6966ed8225935feee247b04b4988424b47c88"}}]}]
BACKPORT-->

Co-authored-by: Jatin Kathuria <[email protected]>
@ghost
Copy link

ghost commented Oct 16, 2023

thanks @logeekal for the update.

we will regress this issue once this issue get fixed as currently we are facing issue saving timeline getting discovery error.

image

@ghost
Copy link

ghost commented Oct 16, 2023

rechecked the issue on creating new 8.11.0 instance and now able to save the timeline but mentioned issue of query tab reset is still persistent.

Build Details:

Version: 8.11.0 BC2
Commit: 636a8339cfad92998a5a5adb7be81e3546525ebf
Build: 67841

Current Result:

Cases.-.Security.-.Elastic.-.Google.Chrome.2023-10-16.15-51-22.mp4

Expected Result:

image

@logeekal
Copy link
Contributor

logeekal commented Oct 16, 2023 •
edited
Loading

Thanks @karanbirsingh-qasource , I forgot that BC3 is not yet build and will be available tomorrow. Since this issue was fixed after BC2 as mentioned here, could you please test it in BC3?

dej611 pushed a commit to dej611/kibana that referenced this issue Oct 17, 2023
@logeekal @dej611
[Security Solution] Fixes ES|QL Tab resetting to KQL Bar (elastic#168716
17288b2 
)

## Summary

Handles elastic#168431

This PR fixes a race condition which was causing Discover ES|QL tab to
revert to it KQL query bar. See demo below:

| Before | After |
|---|---|
| <video
src="https://github.com/elastic/kibana/assets/7485038/24ff8ca9-30ce-4581-94d7-52908a2c81fd"
/>|<video
src="https://github.com/elastic/kibana/assets/7485038/746946ad-bd69-412f-bd38-d3d79b570c68"
/>|
@cybersecdiva cybersecdiva added the QA:Validated Issue has been validated by QA label Nov 9, 2023
@cybersecdiva
Copy link

cybersecdiva commented Nov 9, 2023 •
edited
Loading

Tested in 8.11.0 BC9

Build Details:

VERSION: 8.11.0 BC9
BUILD: 68160
COMMIT: f2ea0c43ec0d854259d63d926b97e5c556b5f6b2

Preconditions:

  • Kibana must be running

Describe the bug:
ES|QL tab query reseting to discover

Steps to reproduce:

  1. Navigate to Security -> Timelines -> Create a Timeline
  2. Click on Create a Timeline
  3. Select ES|QL Tab
  4. Expand the ES|QL Query Window
  5. Delete the default ES|QL query and enter your query
  6. Select a time period, in this case I selected Last 90 days
  7. Click on ▶️ to execute the query
  8. Select a rule and click on the calendar icon next to the date time selector
  9. In my example ES|QL test scenario, I created two ES|QL queries with the following condition:
  • A query I generated to detect and identify threat indicator malware signature file types:

from logs-ti_abusech.malware-default [metadata _id, _index, _version] | where threat.indicator.file.type == "elf" or threat.indicator.file.type == "dll"| sort threat.indicator.type, @timestamp desc

  • The initial query executed to test when this bug was reported:
    from .alerts-security.alerts-default| limit 100
  1. After query is executed, observe page results
  2. Save the Timeline
  3. Go back to Timelines
  4. Open the Saved Timeline
  5. Attach the Saved Timeline to an existing case or create a new case
  6. Click on the Timeline in the case or navigate back to Timelines and click on the saved timeline
  7. In the Saved Timeline, Select ES|QL Tab and observer results

Current behavior:
ES|QL query tab is not resetting to Discover tab and remaining on the timelines page ES|QL query tab

Expected behavior:
ES|QL query tab is not resetting to Discover tab and remaining on the timelines page ES|QL query tab

Observations:

  • ES|QL Query was performed using two queries:

Query 1 (provided when bug was first reported):
from .alerts-security.alerts-default| limit 100

Query 2 (a custom query I created for threat intel and malware investigations purposes):
from logs-ti_abusech.malware-default [metadata _id, _index, _version] | where threat.indicator.file.type == "elf" or threat.indicator.file.type == "dll"| sort threat.indicator.type, @timestamp desc

After execution of both queries and attaching to existing and new cases, the results displayed were that the ES|QL query tab did not reset to Discover tab and remained in the ES|QL Query tab in Timelines

Screenshots of behavior:

Query 1 using query reported in bug (results show after attaching an existing case):

Screenshot 2023-11-08 at 8 38 06 PM

Query 2 generated to query threat indicator files from abuse.ch (results show after attaching a newly created case):

Screenshot 2023-11-08 at 8 44 09 PM

Screen share recording:

esql.bug.test.query.tab.reset.to.discover.extended.version.mp4

Conclusion:

  • Behavior is performing as expected.
  • Validating that this bug is fixed ✅ with QA Validation and closing

@MadameSheema @logeekal @michaelolo24 QA Validation Fixed ✅ per testing in 8.11.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@logeekal logeekal

@michaelolo24 michaelolo24

@MadameSheema MadameSheema

Labels
bug Fixes for quality problems that affect the customer experience fixed impact:high Addressing this issue will have a high level of impact on the quality/strength of our product. QA:Validated Issue has been validated by QA Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Investigations Security Solution Investigations Team Team:Threat Hunting Security Solution Threat Hunting Team v8.11.0
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@logeekal @elasticmachine @michaelolo24 @MadameSheema @cybersecdiva @manishgupta-qasource @sukhwindersingh-qasource