Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security Solution] Error when exporting a rule that has an action referencing a deleted connector #178221

Open
Tracked by #179907
maximpn opened this issue Mar 7, 2024 · 3 comments
Labels
bug Fixes for quality problems that affect the customer experience Feature:Rule Actions Security Solution Detection Rule Actions area Feature:Rule Import/Export Security Solution Detection Rule Import & Export workflow impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. needs product Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.

Comments

@maximpn
Copy link
Contributor

maximpn commented Mar 7, 2024

Epics: https://github.com/elastic/security-team/issues/1974 (internal), #179907
Related to: #198771, #198845, https://github.com/elastic/security-team/issues/8816 (internal)

Summary

Rule export gets blocked whenever there is a rule with configured action (for example send message to Slack) which references a removed connector (for example Slack connector). Rule export fails with an error Error fetching objects to export instead of exporting a rule and display a warning message.

{
  "name": "Error",
  "body": {
    "message": "Error fetching objects to export",
    "status_code": 500
  },
  "message": "",
  "stack": "{\n  \"message\": \"Error fetching objects to export\",\n  \"status_code\": 500\n}"
}

Steps to reproduce

  1. Create a rule, e.g. a custom query rule
  2. Add an action to the rule (it requires to create a connector if non exists for the action type)
  3. Delete the referenced connector
  4. Export the rule with an action referencing deleted connector

Expected result:
Rule is exported without an action referencing deleted connector and a warning message is shown.

Actual result:
Rule export fails with an error

Needs product input on how to handle it. Should be consistent with #198771.

@maximpn maximpn added bug Fixes for quality problems that affect the customer experience impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team Feature:Rule Import/Export Security Solution Detection Rule Import & Export workflow labels Mar 7, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Fixes for quality problems that affect the customer experience Feature:Rule Actions Security Solution Detection Rule Actions area Feature:Rule Import/Export Security Solution Detection Rule Import & Export workflow impact:medium Addressing this issue will have a medium level of impact on the quality/strength of our product. needs product Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Projects
None yet
Development

No branches or pull requests

4 participants